Reward server (raw Node, no deps) #14

New issue

Open

opened 2026-10-22 00:45:47 -04:00 by cheech · 0 comments

cheech commented

2026-10-22 00:45:47 -04:00

Owner

Server-verified rewarded ads, same model as Hexosphere. Lives in server/, plain Node http module, no npm dependencies.

Flow

POST /api/reward/start {game, reward} -> one-time token (random 128-bit, stored server-side with issue time, game, reward, client fingerprint).
Client shows the ad (about 60 s for an extra play).
POST /api/reward/claim {token} -> succeeds only if the token is unused, not expired and at least minWatchSeconds have passed since issue.
Game applies the reward.

Acceptance criteria

Tokens are single-use and expire (e.g. 10 min)
Claim rejected before minimum watch time (configurable per reward)
Per-client cooldown between rewards (configurable)
Rate limits per IP on start and claim (429 with Retry-After)
No dependencies: node server/index.js runs on a clean Node LTS
In-memory store with periodic cleanup; interface allows swapping for a file/SQLite store later
Unit tests using node:test
CORS/same-origin and JSON size limits enforced

Server-verified rewarded ads, same model as Hexosphere. Lives in `server/`, plain Node `http` module, no npm dependencies. ## Flow 1. `POST /api/reward/start {game, reward}` -> one-time token (random 128-bit, stored server-side with issue time, game, reward, client fingerprint). 2. Client shows the ad (about 60 s for an extra play). 3. `POST /api/reward/claim {token}` -> succeeds only if the token is unused, not expired and at least `minWatchSeconds` have passed since issue. 4. Game applies the reward. ## Acceptance criteria - [ ] Tokens are single-use and expire (e.g. 10 min) - [ ] Claim rejected before minimum watch time (configurable per reward) - [ ] Per-client cooldown between rewards (configurable) - [ ] Rate limits per IP on start and claim (429 with Retry-After) - [ ] No dependencies: `node server/index.js` runs on a clean Node LTS - [ ] In-memory store with periodic cleanup; interface allows swapping for a file/SQLite store later - [ ] Unit tests using `node:test` - [ ] CORS/same-origin and JSON size limits enforced

cheech added this to the M2 Rewarded ads milestone

2026-10-22 00:45:47 -04:00

cheech added the

labels

2026-10-22 00:45:47 -04:00

cheech added this to the Roadmap project

2026-10-22 20:51:53 -04:00