fuck it we ball

server.cjs

@@ -1794,6 +1794,37 @@ function allowedApiTarget(req) {
     return url
   }
 
+  if (pathname === '/api/tss/players/resolve') {
+    const keys = [...params.keys()]
+    const name = params.get('name') || ''
+    if (keys.some((key) => key !== 'name') || name.length < 2 || name.length > MAX_TEAM_NAME_LENGTH) {
+      return null
+    }
+    return url
+  }
+
+  if (pathname === '/api/tss/players/search') {
+    const keys = [...params.keys()]
+    const query = params.get('q') || params.get('name') || ''
+    const limit = Number(params.get('limit') || 25)
+    if (
+      keys.some((key) => !['q', 'name', 'limit'].includes(key)) ||
+      query.length < 2 ||
+      query.length > MAX_TEAM_NAME_LENGTH ||
+      !Number.isInteger(limit) ||
+      limit < 1 ||
+      limit > 25
+    ) {
+      return null
+    }
+    return url
+  }
+
+  if (/^\/api\/tss\/player\/[0-9]{1,32}$/.test(pathname)) {
+    if ([...params.keys()].length) return null
+    return url
+  }
+
   const teamMatch = pathname.match(/^\/api\/tss\/teams\/([^/]+)(?:\/(history|games))?$/)
   if (!teamMatch || [...params.keys()].length) return null
 
@@ -1931,6 +1962,18 @@ function routeSeo(pathname) {
     }
   }
 
+  if (cleanPath.startsWith('/players/')) {
+    const uid = decodeRouteSegment(cleanPath.slice('/players/'.length))
+    if (uid) {
+      return {
+        title: `Player ${uid} | Toothless' TSS Bot`,
+        description: `TSS career stats for player ${uid} — battles, win rate, kills, and teams seen with.`,
+        robots: 'noindex, follow',
+        path: `/players/${encodeURIComponent(uid)}`,
+      }
+    }
+  }
+
   const byPath = {
     '/': {
       title: "Toothless' TSS Bot | Live TSS Leaderboards and Battle Logs",