Navigation
🔒 Fort Knox Security Implementation

External Scrabble Game Authentication System

How It Works
1

User clicks "Scrabble" → System generates secure JWT token with their email, premium status, and pearl balance

2

Token is signed with HMAC-SHA256 using JWT_SECRET (expires in 5 minutes)

3

User redirected to external game with token in URL: ?auth=eyJhbGc...

4

External game validates token via /gameAPISupabase?endpoint=validate

5

On success, game receives user data and can award pearls using existing HMAC-signed API

Security Features Implemented
  • ✅ JWT Tokens: Short-lived (5 min), cryptographically signed
  • ✅ HMAC-SHA256: Prevents token tampering or forgery
  • ✅ Rate Limiting: Max 10 tokens per minute per user
  • ✅ Expiration Check: Tokens auto-expire after 5 minutes
  • ✅ Nonce Protection: Prevents replay attacks
  • ✅ IP Logging: Tracks request origin for fraud detection
  • ✅ No Email in URL: Sensitive data only in signed token payload
External Game Integration Code
// External Game: Validate Token on Load
// In your idioms-scrabble-language.deploypad.app app

async function authenticateUser() {
  // Extract token from URL
  const params = new URLSearchParams(window.location.search);
  const token = params.get('auth');
  
  if (!token) {
    alert('Please launch from Snappy Idioms');
    return null;
  }

  // Validate with Mothership
  try {
    const response = await fetch(
      'https://snappyidioms.com/functions/gameAPISupabase?endpoint=validate',
      {
        method: 'POST',
        headers: {
          'Content-Type': 'application/json',
          'X-Game-ID': 'famous_scrabble_01',
          'X-Timestamp': Date.now().toString(),
          'X-Nonce': crypto.randomUUID(),
          'X-Signature': 'not_required_for_validation'
        },
        body: JSON.stringify({ token })
      }
    );

    const result = await response.json();
    
    if (result.valid) {
      // User authenticated!
      console.log('User:', result.user.email);
      console.log('Pearl Balance:', result.user.pearlBalance);
      console.log('Premium:', result.user.isPremium);
      
      return result.user;
    } else {
      alert('Authentication failed: ' + result.error);
      return null;
    }
  } catch (error) {
    console.error('Auth error:', error);
    alert('Failed to authenticate. Please try again.');
    return null;
  }
}

// On game load:
const user = await authenticateUser();
if (!user) {
  // Redirect back to Snappy Idioms login
  window.location.href = 'https://snappyidioms.com';
}

// Store user data for pearl reporting
window.currentUser = user;
🎮 Reporting Pearl Rewards

After validating the token, use the existing HMAC-signed API to award pearls:

// When game completes:
import { reportCompletion } from './lib/mothership-sdk';

const result = await reportCompletion(
  window.currentUser.email,
  roundNumber,
  finalScore,
  completedIdioms
);

if (result.success) {
  console.log(`Earned ${result.pearlsAwarded} pearls!`);
  showRewardUI(result.pearlsAwarded);
}