Add persistent cross-game player bank (Refs #146)

src/routes/api/bank/[action]/+server.ts

@@ -0,0 +1,39 @@
+import { json, isHttpError } from '@sveltejs/kit';
+import { authenticateBank } from '$lib/server/auth/bank.js';
+import { bankRequest, type BankAction } from '$lib/server/fleet/bank.js';
+import { jsonBody } from '$lib/server/request-body.js';
+
+export async function POST({ request, params }: { request: Request; params: { action: string } }) {
+    const headers = { 'Cache-Control': 'no-store' };
+    const authentication = authenticateBank(request);
+    if (!authentication.ok)
+        return json(
+            { ok: false, code: authentication.code },
+            { status: authentication.status, headers }
+        );
+    if (!['balance', 'deposit', 'withdraw', 'commit', 'cancel'].includes(params.action))
+        return json({ ok: false, code: 'invalid_action' }, { status: 404, headers });
+    if (
+        request.headers.get('content-type')?.split(';')[0].trim().toLowerCase() !==
+        'application/json'
+    )
+        return json({ ok: false, code: 'invalid_content_type' }, { status: 415, headers });
+    let value: unknown;
+    try {
+        value = await jsonBody(request, 4096);
+    } catch (cause) {
+        if (isHttpError(cause, 413)) throw cause;
+        return json({ ok: false, code: 'invalid_request' }, { status: 400, headers });
+    }
+    try {
+        const { body, status } = bankRequest(
+            params.action as BankAction,
+            value,
+            authentication.server
+        );
+        return json(body, { status, headers });
+    } catch {
+        console.error('Bank transaction failed; request may be retried with the same identity.');
+        return json({ ok: false, code: 'unavailable' }, { status: 503, headers });
+    }
+}