fix(security & perf): implement bearer session tokens, salted pbkdf2, object pooling and background caching

scripts/test_game.py

@@ -195,7 +195,10 @@ def test_auth_system():
         "scheduleSave",
         "apiPost",
         "validateUsername",
-        "validatePassword"
+        "validatePassword",
+        "getToken",
+        "setToken",
+        "clearToken"
     ]
     for m in auth_methods:
         if m in auth_code:
@@ -203,8 +206,10 @@ def test_auth_system():
         else:
             record(f"PvZAuth.{m} method implemented", "FAIL", f"Missing {m}")
 
-    record("auth.js uses /api/auth endpoint", "PASS" if "/api/auth" in auth_code else "FAIL",
-           "Server-backed auth endpoint missing" if "/api/auth" not in auth_code else "")
+    record("auth.js uses /api/auth endpoint", "PASS" if "/api/auth" in auth_code else "FAIL")
+    record("auth.js has pvz_token session storage", "PASS" if "pvz_token" in auth_code else "FAIL")
+    record("auth.js sends Authorization Bearer header", "PASS" if "Authorization" in auth_code and "Bearer" in auth_code else "FAIL")
+    record("auth.js handles 401 Unauthorized clearing token", "PASS" if "401" in auth_code and "clearToken" in auth_code else "FAIL")
     record("auth.js has debounced save (scheduleSave)", "PASS" if "scheduleSave" in auth_code else "FAIL")
     record("auth.js has flushSave for game-over sync", "PASS" if "flushSave" in auth_code else "FAIL")
 
@@ -243,6 +248,12 @@ def test_auth_system():
         auth_res = pvz_db.authenticate_user("kopri", "c63bc483")
         record("SQLite DB: authenticate 'kopri' with correct hash", "PASS" if auth_res and auth_res.get("success") else "FAIL",
                str(auth_res.get("message", "")) if auth_res and not auth_res.get("success") else "")
+        record("SQLite DB: authenticate returns session token", "PASS" if auth_res and auth_res.get("token") and len(auth_res["token"]) == 64 else "FAIL")
+
+        # Test session validation
+        kopri_token = auth_res.get("token")
+        sess_val = pvz_db.validate_session(kopri_token)
+        record("SQLite DB: validate_session(token) succeeds", "PASS" if sess_val and sess_val.get("username") == "kopri" else "FAIL")
 
         # Test wrong password
         bad_auth = pvz_db.authenticate_user("kopri", "wronghash")
@@ -253,10 +264,18 @@ def test_auth_system():
         dup_reg = pvz_db.register_user("kopri", "c63bc483")
         record("SQLite DB: reject duplicate user registration", "PASS" if not dup_reg.get("success") else "FAIL")
 
-        # Test save profile (update newbie coins)
+        # Test save profile with valid token
         save_res = pvz_db.save_user_profile("newbie_test", {"coins": 999, "level": 3, "highScore": 2500})
         record("SQLite DB: save_user_profile() succeeds", "PASS" if save_res.get("success") else "FAIL")
 
+        # Test save profile with invalid token rejection
+        bad_save = pvz_db.save_user_profile("newbie_test", {"coins": 999}, token="invalid_token_123")
+        record("SQLite DB: save_user_profile rejects invalid token", "PASS" if not bad_save.get("success") else "FAIL")
+
+        # Test save profile with mismatching token
+        mismatch_save = pvz_db.save_user_profile("newbie_test", {"coins": 999}, token=kopri_token)
+        record("SQLite DB: save_user_profile rejects mismatched user token", "PASS" if not mismatch_save.get("success") else "FAIL")
+
         # Verify saved
         verify = pvz_db.authenticate_user("newbie_test", "bb94b3d4")
         verify_ok = verify and verify.get("data", {}).get("coins") == 999
@@ -277,6 +296,16 @@ def test_auth_system():
         else:
             record("SQLite DB: kopri profile loaded", "FAIL", "Could not load kopri profile")
 
+        # Test session deletion
+        pvz_db.delete_session(kopri_token)
+        record("SQLite DB: delete_session invalidates session token", "PASS" if pvz_db.validate_session(kopri_token) is None else "FAIL")
+
+        # Test password hashing function
+        h = pvz_db.hash_password("mysecretpassword")
+        record("SQLite DB: hash_password produces salted pbkdf2 format", "PASS" if h.startswith("pbkdf2:sha256:100000:") else "FAIL")
+        record("SQLite DB: verify_password matches correct password", "PASS" if pvz_db.verify_password("mysecretpassword", h) else "FAIL")
+        record("SQLite DB: verify_password rejects wrong password", "PASS" if not pvz_db.verify_password("wrongpassword", h) else "FAIL")
+
     except Exception as e:
         record("SQLite DB tests", "FAIL", str(e))