Game Validation Guide

This guide documents repeatable checks for the SHA256 guessing game in game/.

1) SHA256 Known Test Vectors

Use these vectors to verify hashing behavior is correct and stable:

Plaintext Expected SHA256 hex digest
abc ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
`` (empty string) e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Run locally:

cd game
node scripts/hash-vectors.test.js

Expected output:

  • Process exits with code 0.
  • Console prints All SHA256 vector assertions passed.

2) Manual Verification: Plaintext Phrases Are Not in Initial Client Source or Initial Network Payloads

These checks demonstrate that phrase plaintexts are not exposed before a user submits a guess.

2.1 Verify client source

cd game
rg "alpha-lighthouse|banana-circuit|cobalt-aurora|delta-compass|ember-tundra|fable-voyage|glacier-orchid|harbor-zenith|ivory-cascade|jungle-quartz" public/index.html

Expected outcome:

  • No matches.
  • rg exits with status 1.

2.2 Verify initial hashes endpoint payload

Start the server in one terminal:

cd game
npm start

In another terminal, request the initial payload:

curl -s http://localhost:3000/game/hashes

Expected outcome:

  • JSON response contains only a hashes array with 10 SHA256-looking hex strings.
  • No plaintext phrase appears.

Optional strict check:

curl -s http://localhost:3000/game/hashes | rg "alpha-lighthouse|banana-circuit|cobalt-aurora|delta-compass|ember-tundra|fable-voyage|glacier-orchid|harbor-zenith|ivory-cascade|jungle-quartz"

Expected outcome:

  • No matches (rg exit status 1).

3) Manual Functional Test Cases

Before running cases, start the app:

cd game
npm install
npm start

Then open http://localhost:3000/game in your browser.

Case A: Correct guess

Steps:

  1. Enter alpha-lighthouse into the guess field.
  2. Click Submit Guess.

Expected outcome:

  • UI message includes Correct phrase(s): alpha-lighthouse.
  • Attempt counters show Correct attempts incremented by 1.
  • Network response from POST /game/guess includes:
    • correctPhrases: ["alpha-lighthouse"]
    • attempts.correct incremented.

Case B: Incorrect guess

Steps:

  1. Enter not-a-real-phrase.
  2. Click Submit Guess.

Expected outcome:

  • UI message includes No correct phrases revealed.
  • Incorrect attempts increments by 1.
  • Network response from POST /game/guess includes:
    • correctPhrases: []
    • attempts.incorrect incremented.

Case C: Empty input

Steps:

  1. Leave the input blank.
  2. Click Submit Guess.

Expected outcome:

  • Browser-native form validation blocks submit because input is marked required.
  • No POST /game/guess request is sent.

4) Local Run Summary

Minimal commands to run checks end-to-end:

cd game
npm install
node scripts/hash-vectors.test.js
npm start

With the server running:

curl -s http://localhost:3000/game/hashes
curl -s -X POST http://localhost:3000/game/guess \
  -H 'Content-Type: application/json' \
  -d '{"guess":"alpha-lighthouse"}'
curl -s -X POST http://localhost:3000/game/guess \
  -H 'Content-Type: application/json' \
  -d '{"guess":"not-a-real-phrase"}'

Expected outcomes:

  • First curl returns hashes only.
  • Second curl returns one correct phrase.
  • Third curl returns empty correctPhrases and increments incorrect counter.