Operator: public boundary and transport checks
Use authenticated test clients and existing harnesses to inspect refusal behavior.
Operator-only prerequisites: an isolated account server and two dedicated test accounts. Use the maintained transport suite for crafted HTTP/Discord requests. Do not publish cookies, CSRF values, signed request material, bot credentials or raw private player projections.
Step by step
Tick a step after observing the expected result. Saved on this device only.
01Check the logged-out boundary
Open the account service in a fresh private browser window without signing in. Try only the known account view endpoint for the test service.
An unauthenticated player view is rejected rather than returning a world or player inventory.
02Use the built-in request tests
Run the transport/HTTP regression suite in the isolated checkout to exercise missing/invalid authentication, Host/Origin/CSRF refusal and signed-interaction validation.
Rejected requests do not execute a player command or alter identity. Preserve suite output with secrets redacted.
03Check static exposure
Using a dedicated test service, verify that only intended browser assets and API routes are served. Have the existing tests check private author files and arbitrary paths.
Private story files, environment files, saves, seeds and other players’ records are not downloadable browser resources.
04Check allowed player actions
Attempt the existing harness cases for administrative clock advancement, identity selection and unknown commands using an ordinary test player session.
The player cannot grant items, choose another player identity or advance the authoritative clock.
05Compare the final test state
Audit the isolated save and compare account ownership and inventory totals with the baseline after refused requests.
Invalid requests leave no gameplay mutation. Publish only a sanitized result summary, not the test request credentials.