masoi-perf-security

name	masoi-perf-security
description	Audit Ma Sói server and client for performance bottlenecks, memory leaks, security vulnerabilities, rate limiting, input validation, CORS policy, timer cleanup, and room zombie detection. Use when changing socket handlers, setTimeout/setInterval patterns, Redis/PostgreSQL queries, authentication, or deploying to production.

Ma Sói Performance & Security Auditor

Workflow

1. Read server/index.js for socket handlers, timer patterns, and room lifecycle.
2. Read server/db/redis.js and server/db/postgres.js for data access patterns.
3. Read server/gameEngine.js for input validation in role assignment.
4. Check the change against references/security-checklist.md.
5. After edits, verify:
   • node --check server/index.js
   • node --check server/gameEngine.js
   • cd client && npm run build if client changed.

Security Rules

• Never trust client-sent userId without server-side validation against socket session.
• All socket event handlers must validate room existence, player membership, and phase before acting.
• Rate limit socket events to prevent spam and DDoS (especially send_message, night_action, cast_vote).
• Production must NOT use cors: { origin: '*' } — restrict to known domains.
• Bcrypt salt rounds should be at least 10 (currently OK).
• Never expose full room state including all player roles to non-admin clients.

Performance Rules

• Every setTimeout must be cancellable and tracked — stale timers from old rounds must not fire.
• Room zombie detection: rooms with all players disconnected should be cleaned up within a bounded time.
• Redis saveRoom calls should be batched or debounced where possible to reduce write pressure.
• roomLocks Map must not grow unbounded — ensure cleanup after lock release.
• Client setInterval for timer countdown must be cleared on component unmount and phase change.
• Wolf chat and public chat arrays are capped at 200 — verify no unbounded growth paths.

Common Vulnerability Patterns

• Forged userId in socket events bypassing auth.
• Concurrent resolveNight / resolveVote causing double kills or double state transitions.
• Timer stacking: multiple scheduleNight or scheduleVote calls for the same round.
• Room state corruption from race conditions in withRoomLock edge cases.
• Stale user:{id}:room mappings blocking room creation/joining.

References

Load references/security-checklist.md when auditing security or performance.