fix(auth): document SES env vars and add diagnostic logging for password reset (#1)

[angelTomo9]

Closes #1

Summary of Changes

Documents Amazon SES v2 configuration variables in api/.env.example and adds detailed server-side error diagnostic logs when dispatching password reset emails while preserving safe, generic messages for clients.

Problem & Root Cause

Password recovery failed in production whenever SES environment variables were missing or in sandbox mode. The required SES variables (SES_REGION, SES_ACCESS_KEY_ID, SES_SECRET_ACCESS_KEY, SES_FROM_EMAIL, SES_FROM_NAME) were previously undocumented in .env.example, leading deployments to lack mail credentials.

Solution

• Environment Documentation: Added SES_REGION, SES_ACCESS_KEY_ID, SES_SECRET_ACCESS_KEY, SES_FROM_EMAIL, and SES_FROM_NAME to api/.env.example.
• Diagnostic Logging: In api/src/lib/email.ts, distinct diagnostic logs are captured in console/stdout to differentiate configuration absence from AWS sandbox/unverified recipient errors.
• Client Privacy: User responses remain generic, preventing email enumeration or internal AWS error leaking.

---

Summary by Gitar

• Game data admin & world builder:
  • Added granular map editing permissions and protected map restrictions for capital cities in api/src/repositories/worldBuilder.ts
  • Implemented palette override endpoints and graphic resolution metadata routes in api/src/server.ts
• Server stability & graceful shutdown:
  • Implemented graceful shutdown handling for SIGTERM and SIGINT signals with character reset in server/src/server.ts
  • Grouped dual-session idle penalties by account identity rather than IP address to support CGNAT mobile players

_{This will update automatically on new commits.}

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Adds authentication to the palette endpoint, secures palette entry increments, documents SES environment variables, and introduces diagnostic logging for password resets. All identified issues were resolved successfully.

✅ 2 resolved

✅ Security: GET /admin/.../palette endpoint has no authentication

📄 api/src/server.ts:962-976
The new GET /admin/game-data/maps/:mapNum/palette route performs no auth check, unlike its PUT sibling (requireMapEditSession) and every other admin route such as GET /admin/game-data/maps/:mapNum/status (requireAdminEmailSession). The only global middlewares are request-timing and CORS, so this endpoint lets any unauthenticated caller enumerate a map's palette configuration. Add an auth guard (e.g. requireAdminEmailSession or requireMapEditSession) before calling listMapPalette.

✅ Bug: Palette next-id computed via MAX+1 can overwrite entries

📄 api/src/repositories/worldBuilder.ts:619-633
When entry.paletteId is omitted, the next id is derived from SELECT MAX(palette_id)+1. Two concurrent inserts on the same map compute the same id, and because the INSERT uses ON CONFLICT (map_num, palette_id) DO UPDATE, the second request silently overwrites the first request's just-created palette entry instead of creating a distinct one. Use a DB sequence/serial for palette_id, or wrap the read-then-insert in a transaction with appropriate locking to make id allocation atomic.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

---

Important

Your trial ends in 7 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}