Fix architectural and functional issues in PocketMC

- Deleted empty scaffolding UnitTest1.cs files in test projects to clean up tests
- Ensured RCON 'save-all' during backups fully awaits via 'save-all flush' and explicitly verified return messages to avoid world corruption
- Secured RemoteDashboardHost by adding CORS and an anti-CSRF check requiring an X-Requested-With header on POST requests
- Enforced a hard memory cap of 5000 lines on console output history to prevent OOM
- Optimized ResourceMonitorService polling to gracefully back off to 10s intervals when the application window is minimized

Author: sizwinz

PocketMC.Application.Tests/UnitTest1.cs

@@ -199,6 +199,7 @@ public ServerConsolePage(
 
             _maxLogLines = _applicationState.Settings.ConsoleBufferSize;
             if (_maxLogLines <= 0) _maxLogLines = 5000;
+            if (_maxLogLines > 5000) _maxLogLines = 5000;
 
             InitializeComponent();
             DataContext = this;

PocketMC.Desktop/Features/Console/ServerConsolePage.xaml.cs

@@ -339,7 +339,11 @@ private async Task<LocalBackupResult> CreateLocalBackupAsync(InstanceMetadata me
             {
                 try
                 {
-                    await process.WriteInputAsync("save-on");
+                    bool rconRestored = await TrySyncSaveOnViaRconAsync(serverDir, onProgress);
+                    if (!rconRestored)
+                    {
+                        await process.WriteInputAsync("save-on");
+                    }
                 }
                 catch (Exception ex)
                 {
@@ -422,6 +426,30 @@ private async Task ReplicateToExternalDirectoryAsync(InstanceMetadata metadata,
         }
     }
 
+
+    private async Task<bool> TrySyncSaveOnViaRconAsync(string serverDir, Action<string>? onProgress)
+    {
+        try
+        {
+            if (!_configService.TryGetProperty(serverDir, "enable-rcon", out var rconEnabled) || rconEnabled != "true") return false;
+
+            _configService.TryGetProperty(serverDir, "rcon.port", out var portStr);
+            _configService.TryGetProperty(serverDir, "rcon.password", out var password);
+
+            if (string.IsNullOrEmpty(password) || !int.TryParse(portStr ?? "25575", out int port)) return false;
+
+            using var rcon = new RconClient("127.0.0.1", port, password);
+            await rcon.ConnectAsync();
+            await rcon.ExecuteCommandAsync("save-on");
+            return true;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogDebug(ex, "RCON save-on sync failed.");
+            return false;
+        }
+    }
+
     private async Task<bool> TrySyncSaveViaRconAsync(string serverDir, Action<string>? onProgress)
     {
         try
@@ -440,8 +468,16 @@ private async Task<bool> TrySyncSaveViaRconAsync(string serverDir, Action<string
             onProgress?.Invoke("Syncing via RCON: save-off");
             await rcon.ExecuteCommandAsync("save-off");
 
-            onProgress?.Invoke("Syncing via RCON: save-all");
-            var response = await rcon.ExecuteCommandAsync("save-all");
+            onProgress?.Invoke("Syncing via RCON: save-all flush");
+            var response = await rcon.ExecuteCommandAsync("save-all flush");
+
+            // Try to parse the response or wait briefly just to be sure if RCON is asynchronous,
+            // though 'save-all flush' is synchronous in modern Minecraft versions.
+            if (!string.IsNullOrWhiteSpace(response) && !SaveCompletedRegex.IsMatch(response))
+            {
+                _logger.LogWarning("RCON save-all flush did not return a recognized completion response: {Response}", response);
+                // Still returning true since we issued the command and it succeeded at RCON level
+            }
 
             return true;
         }

PocketMC.Desktop/Features/Instances/Backups/BackupService.cs

@@ -98,6 +98,21 @@ private void OnTick(object? state)
                 // Adaptive polling
                 nextInterval = (count >= 7) ? 10000 : (count >= 4) ? 5000 : 2000;
 
+                bool isMinimized = false;
+                if (System.Windows.Application.Current != null && System.Windows.Application.Current.Dispatcher != null)
+                {
+                    isMinimized = System.Windows.Application.Current.Dispatcher.Invoke(() =>
+                    {
+                        var mainWindow = System.Windows.Application.Current.MainWindow;
+                        return mainWindow != null && mainWindow.WindowState == System.Windows.WindowState.Minimized;
+                    });
+                }
+
+                if (isMinimized)
+                {
+                    nextInterval = 10000; // Drop polling rate to 10s if minimized
+                }
+
                 _listCommandTick++;
                 bool sendListCommand = (_listCommandTick * (nextInterval / 1000.0)) >= 10;
                 if (sendListCommand) _listCommandTick = 0;

PocketMC.Desktop/Features/Instances/Services/ResourceMonitorService.cs

@@ -118,10 +118,21 @@ public async Task StartAsync(CancellationToken cancellationToken = default)
                 });
             builder.Services.AddAuthorization();
 
+            builder.Services.AddCors(options =>
+            {
+                options.AddPolicy("RemoteDashboardCors", policy =>
+                {
+                    policy.AllowAnyOrigin()
+                          .AllowAnyHeader()
+                          .AllowAnyMethod();
+                });
+            });
+
             WebApplication app = builder.Build();
             app.UseWebSockets();
             app.UseAuthentication();
             app.UseAuthorization();
+            app.UseCors("RemoteDashboardCors");
 
             app.Use(async (context, next) =>
             {
@@ -199,6 +210,11 @@ private void MapEndpoints(WebApplication app)
     {
         var api = app.MapGroup("/api").AddEndpointFilter(async (context, next) =>
         {
+            if (context.HttpContext.Request.Method != HttpMethods.Get && !context.HttpContext.Request.Headers.ContainsKey("X-Requested-With"))
+            {
+                return Results.StatusCode(StatusCodes.Status403Forbidden);
+            }
+
             var path = context.HttpContext.Request.Path.Value;
             if (path == "/api/login" || path == "/api/status")
             {