1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
# `web/play` — browser frontend
Vanilla TypeScript + esbuild. The browser sends `Command` JSON and renders
`View` JSON; it contains no game rules, no payout math and no wire protocol.
The gateway in `webd/` owns the upstream TLS connection.
## Build
```sh
npm ci
npm run build # writes app.js
npm run typecheck
npm test # headless DOM smoke test (jsdom)
```
Commit the generated `app.js` so the site deploys without Node.
## Local development
From the repository root:
```sh
./scripts/dev-web.sh
```
It builds the server, gateway and app, creates a throwaway identity under
`target/dev-web/`, starts the game server on `127.0.0.1:11525`, the gateway on
`127.0.0.1:8890` and a static server on `127.0.0.1:8899`, and prints the URL
(with a local-only `?ws=` override because the ports differ). Ctrl+C stops all
three. `--reset` starts with a fresh dev database.
The app only honours `?ws=` when the page is on `127.0.0.1`, `localhost` or
`::1`; a real deployment uses the same-origin `/ws` path.
## Screens
- Auth: login/register. The password is hashed with Web Crypto (`SHA-256`)
before it leaves the page; the gateway and browser never store it.
- Lobby: four games, per-game bet, history.
- Slots: five reels, win cells and paylines.
- Roulette: canvas felt with straight, dozen, column and outside chips;
left click adds, right click removes.
- Blackjack: dealer/player cards, hit/stand/double/forfeit.
- Crash: curve, live multiplier, cash-out, commit/seed verification.
- History: settled plays with net result.
## Theme
`style.css` mirrors the palette in `gui/src/theme.rs`: near-black ground,
cyan focus, green for wins, gold for chips, felt green only for roulette.
Do not introduce a second palette or hard-code colours in the render modules.
## Security
- The session cookie is HttpOnly and SameSite=Strict; JavaScript never reads
it and never stores a credential.
- Notices are inserted with `textContent`, not HTML.
- The app is play-money only. Do not add deposits, withdrawals, KYC or
real-money claims without a product decision and an ADR.
|
