Major refactor: security, performance, and code organization

Security:
- DeepSeek API moved to server-side proxy with rate limiting (20 req/min)
- Whitelist validation for all POST/PUT routes
- Cookie security (secure, sameSite, httpOnly in production)
- Input validation for messages, tokens, temperature
- Sanitized hasOwnProperty to prevent prototype pollution

Performance:
- Lazy loading for chat messages (sliding window of 20)
- Streaming response throttling (50ms batches)
- Scroll optimization (only scroll on new messages)
- AbortController fix for stop button

Code organization:
- GamePage refactored from ~1170 to ~750 lines
- New hooks: useGameSession, useStreamingResponse, useCharacterDetection, useLazyMessages
- New components: MessageList, ChatInput, SessionSelector, CharacterPanel
- Fixed ESLint errors

Features:
- OOC mode button for direct AI instructions
- Message versions (aiResponse) now persist to DB
- playerId saved in sessions

This commit is contained in:

Alexej Wolff

2026-05-05 23:41:52 +02:00

parent bbefa114f8

commit 68c2b129fa

23 changed files with 1817 additions and 553 deletions

									
										.env.example
									
		-3
	
												View File
												
				@@ -1,5 +1,2 @@

				# DeepSeek API ключ для генерации историй

				VITE_DEEPSEEK_API_KEY=your_api_key_here

				# URL бэкенд сервера

				VITE_API_URL=http://localhost:3001