@air-jam/server 0.1.2 → 0.1.4

package/dist/{chunk-KMAEESOE.js → chunk-CGONPUNG.js}

@@ -6,7 +6,9 @@ import {
   controllerStateSchema,
   controllerSystemSchema,
   ErrorCode,
+  hostCreateRoomSchema,
   hostJoinAsChildSchema,
+  hostReconnectSchema,
   hostRegisterSystemSchema,
   hostRegistrationSchema,
   systemLaunchGameSchema
@@ -44,12 +46,12 @@ var db = client ? drizzle(client) : null;
 var AuthService = class {
   masterKey;
   databaseUrl;
-  isDevMode;
+  authMode;
   constructor() {
     this.masterKey = process.env.AIR_JAM_MASTER_KEY;
     this.databaseUrl = process.env.DATABASE_URL;
-    this.isDevMode = !this.masterKey && !this.databaseUrl;
-    if (this.isDevMode) {
+    this.authMode = this.resolveAuthMode();
+    if (this.authMode === "disabled") {
       console.log(
         "[server] Running in development mode - authentication disabled"
       );
@@ -59,15 +61,19 @@ var AuthService = class {
       );
     } else if (this.databaseUrl) {
       console.log("[server] Running with database authentication");
+    } else {
+      console.log(
+        "[server] Authentication required, but no auth backend is configured (set AIR_JAM_MASTER_KEY or DATABASE_URL)"
+      );
     }
   }
   /**
    * Verify an API key
    * Returns verification result with optional error message
-   * In dev mode, always returns success
+   * In local/dev mode, always returns success
    */
   async verifyApiKey(apiKey) {
-    if (this.isDevMode) {
+    if (this.authMode === "disabled") {
       return { isVerified: true };
     }
     if (!apiKey) {
@@ -105,9 +111,66 @@ var AuthService = class {
       };
     }
   }
+  resolveAuthMode() {
+    const configuredMode = process.env.AIR_JAM_AUTH_MODE?.toLowerCase();
+    if (configuredMode === "disabled") {
+      return "disabled";
+    }
+    if (configuredMode === "required") {
+      return "required";
+    }
+    if (this.masterKey || this.databaseUrl) {
+      return "required";
+    }
+    if (process.env.NODE_ENV === "production") {
+      return "required";
+    }
+    return "disabled";
+  }
 };
 var authService = new AuthService();
 
+// src/services/rate-limit-service.ts
+var RateLimitService = class {
+  entries = /* @__PURE__ */ new Map();
+  checks = 0;
+  check(key, limit, windowMs) {
+    if (limit <= 0 || windowMs <= 0) {
+      return { allowed: true, retryAfterMs: 0 };
+    }
+    const now = Date.now();
+    const existing = this.entries.get(key);
+    if (!existing || now >= existing.resetAt) {
+      this.entries.set(key, { count: 1, resetAt: now + windowMs });
+      this.maybeCleanup(now);
+      return { allowed: true, retryAfterMs: 0 };
+    }
+    if (existing.count >= limit) {
+      this.maybeCleanup(now);
+      return {
+        allowed: false,
+        retryAfterMs: Math.max(existing.resetAt - now, 0)
+      };
+    }
+    existing.count += 1;
+    this.entries.set(key, existing);
+    this.maybeCleanup(now);
+    return { allowed: true, retryAfterMs: 0 };
+  }
+  maybeCleanup(now) {
+    this.checks += 1;
+    if (this.checks % 200 !== 0) {
+      return;
+    }
+    for (const [key, entry] of this.entries) {
+      if (now >= entry.resetAt) {
+        this.entries.delete(key);
+      }
+    }
+  }
+};
+var rateLimitService = new RateLimitService();
+
 // src/services/room-manager.ts
 var RoomManager = class {
   rooms = /* @__PURE__ */ new Map();
@@ -198,10 +261,42 @@ var RoomManager = class {
 };
 var roomManager = new RoomManager();
 
+// src/utils/ids.ts
+import { roomCodeSchema } from "@air-jam/sdk/protocol";
+import { randomInt } from "crypto";
+var alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+var generateRoomCode = () => {
+  const code = Array.from(
+    { length: 4 },
+    () => alphabet[randomInt(0, alphabet.length)]
+  ).join("");
+  return roomCodeSchema.parse(code);
+};
+
 // src/index.ts
+var lastServerInputLogTime = 0;
+var lastServerInputFailLogTime = 0;
+var parsePositiveInt = (value, fallback) => {
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+};
 var PORT = Number(process.env.PORT ?? 4e3);
+var RATE_LIMIT_WINDOW_MS = parsePositiveInt(
+  process.env.AIR_JAM_RATE_LIMIT_WINDOW_MS,
+  6e4
+);
+var HOST_REGISTRATION_RATE_LIMIT_MAX = parsePositiveInt(
+  process.env.AIR_JAM_HOST_REGISTRATION_RATE_LIMIT_MAX,
+  30
+);
+var CONTROLLER_JOIN_RATE_LIMIT_MAX = parsePositiveInt(
+  process.env.AIR_JAM_CONTROLLER_JOIN_RATE_LIMIT_MAX,
+  120
+);
+var allowedOrigins = process.env.AIR_JAM_ALLOWED_ORIGINS?.split(",").map((origin) => origin.trim()).filter(Boolean);
+var corsOrigin = allowedOrigins && allowedOrigins.length > 0 ? allowedOrigins : "*";
 var app = express();
-app.use(cors());
+app.use(cors({ origin: corsOrigin }));
 app.use(express.json());
 app.get("/health", (_, res) => {
   res.json({ ok: true });
@@ -209,7 +304,7 @@ app.get("/health", (_, res) => {
 var httpServer = createServer(app);
 var io = new Server(httpServer, {
   cors: {
-    origin: "*"
+    origin: corsOrigin
   },
   pingInterval: 2e3,
   pingTimeout: 5e3
@@ -220,9 +315,40 @@ var emitError = (socketId, payload) => {
 io.on(
   "connection",
   (socket) => {
+    const isHostAuthorizedForRoom = (roomId) => {
+      return roomManager.getRoomByHostId(socket.id) === roomId;
+    };
+    const isControllerAuthorizedForRoom = (roomId, controllerId) => {
+      const controllerInfo = roomManager.getControllerInfo(socket.id);
+      if (!controllerInfo || controllerInfo.roomId !== roomId) {
+        return false;
+      }
+      if (controllerId && controllerInfo.controllerId !== controllerId) {
+        return false;
+      }
+      return true;
+    };
+    const forwardedFor = socket.handshake.headers["x-forwarded-for"];
+    const socketIdentifier = typeof forwardedFor === "string" && forwardedFor.split(",")[0]?.trim() || Array.isArray(forwardedFor) && forwardedFor[0]?.split(",")[0]?.trim() || socket.handshake.address || socket.id;
+    const isRateLimited = (bucket, limit) => {
+      const result = rateLimitService.check(
+        `${bucket}:${socketIdentifier}`,
+        limit,
+        RATE_LIMIT_WINDOW_MS
+      );
+      return !result.allowed;
+    };
     socket.on(
       "host:registerSystem",
       async (payload, callback) => {
+        if (isRateLimited("host-registration", HOST_REGISTRATION_RATE_LIMIT_MAX)) {
+          callback({
+            ok: false,
+            message: "Too many host registration attempts. Please try again.",
+            code: ErrorCode.SERVICE_UNAVAILABLE
+          });
+          return;
+        }
         const parsed = hostRegisterSystemSchema.safeParse(payload);
         if (!parsed.success) {
           callback({
@@ -268,6 +394,139 @@ io.on(
         io.to(roomId).emit("server:roomReady", { roomId });
       }
     );
+    socket.on(
+      "host:createRoom",
+      async (payload, callback) => {
+        if (isRateLimited("host-registration", HOST_REGISTRATION_RATE_LIMIT_MAX)) {
+          callback({
+            ok: false,
+            message: "Too many host registration attempts. Please try again.",
+            code: ErrorCode.SERVICE_UNAVAILABLE
+          });
+          return;
+        }
+        const parsed = hostCreateRoomSchema.safeParse(payload);
+        if (!parsed.success) {
+          callback({
+            ok: false,
+            message: parsed.error.message,
+            code: ErrorCode.INVALID_PAYLOAD
+          });
+          return;
+        }
+        const { maxPlayers, apiKey } = parsed.data;
+        const verification = await authService.verifyApiKey(apiKey);
+        if (!verification.isVerified) {
+          callback({
+            ok: false,
+            message: verification.error,
+            code: ErrorCode.INVALID_API_KEY
+          });
+          return;
+        }
+        const existingRoomId = roomManager.getRoomByHostId(socket.id);
+        if (existingRoomId) {
+          const existingSession = roomManager.getRoom(existingRoomId);
+          if (existingSession && existingSession.masterHostSocketId === socket.id) {
+            console.log(
+              `[server] Host ${socket.id} already has room ${existingRoomId}, returning existing.`
+            );
+            callback({ ok: true, roomId: existingRoomId });
+            return;
+          }
+        }
+        let roomId;
+        let attempts = 0;
+        do {
+          roomId = generateRoomCode();
+          attempts++;
+          if (attempts > 10) {
+            callback({
+              ok: false,
+              message: "Failed to generate unique room ID",
+              code: ErrorCode.CONNECTION_FAILED
+            });
+            return;
+          }
+        } while (roomManager.getRoom(roomId));
+        const session = {
+          roomId,
+          masterHostSocketId: socket.id,
+          focus: "SYSTEM",
+          controllers: /* @__PURE__ */ new Map(),
+          maxPlayers: maxPlayers ?? 8,
+          gameState: "paused"
+        };
+        roomManager.setRoom(roomId, session);
+        roomManager.setHostRoom(socket.id, roomId);
+        socket.join(roomId);
+        console.log(`[server] Created room ${roomId} for host ${socket.id}`);
+        callback({ ok: true, roomId });
+        io.to(roomId).emit("server:roomReady", { roomId });
+      }
+    );
+    socket.on(
+      "host:reconnect",
+      async (payload, callback) => {
+        if (isRateLimited("host-registration", HOST_REGISTRATION_RATE_LIMIT_MAX)) {
+          callback({
+            ok: false,
+            message: "Too many host registration attempts. Please try again.",
+            code: ErrorCode.SERVICE_UNAVAILABLE
+          });
+          return;
+        }
+        const parsed = hostReconnectSchema.safeParse(payload);
+        if (!parsed.success) {
+          callback({
+            ok: false,
+            message: parsed.error.message,
+            code: ErrorCode.INVALID_PAYLOAD
+          });
+          return;
+        }
+        const { roomId, apiKey } = parsed.data;
+        const verification = await authService.verifyApiKey(apiKey);
+        if (!verification.isVerified) {
+          callback({
+            ok: false,
+            message: verification.error,
+            code: ErrorCode.INVALID_API_KEY
+          });
+          return;
+        }
+        const session = roomManager.getRoom(roomId);
+        if (!session) {
+          callback({
+            ok: false,
+            message: "Room not found",
+            code: ErrorCode.ROOM_NOT_FOUND
+          });
+          return;
+        }
+        const previousMasterSocket = io.sockets.sockets.get(
+          session.masterHostSocketId
+        );
+        const isPreviousHostConnected = previousMasterSocket?.connected ?? false;
+        if (!isPreviousHostConnected || session.masterHostSocketId === socket.id) {
+          session.masterHostSocketId = socket.id;
+          roomManager.setRoom(roomId, session);
+          roomManager.setHostRoom(socket.id, roomId);
+          socket.join(roomId);
+          console.log(
+            `[server] Host ${socket.id} reconnected to room ${roomId}`
+          );
+          callback({ ok: true, roomId });
+          io.to(roomId).emit("server:roomReady", { roomId });
+        } else {
+          callback({
+            ok: false,
+            message: "Room already has an active host",
+            code: ErrorCode.ALREADY_CONNECTED
+          });
+        }
+      }
+    );
     socket.on(
       "system:launchGame",
       (payload, callback) => {
@@ -397,10 +656,33 @@ io.on(
       session.joinToken = void 0;
       session.activeControllerUrl = void 0;
       io.to(roomId).emit("client:unloadUi");
+      if (session.masterHostSocketId) {
+        const masterSocket = io.sockets.sockets.get(session.masterHostSocketId);
+        if (masterSocket) {
+          setTimeout(() => {
+            session.controllers.forEach((c) => {
+              const notice = {
+                controllerId: c.controllerId,
+                nickname: c.nickname,
+                player: c.playerProfile
+              };
+              masterSocket.emit("server:controllerJoined", notice);
+            });
+          }, 100);
+        }
+      }
     });
     socket.on(
       "host:register",
       async (payload, callback) => {
+        if (isRateLimited("host-registration", HOST_REGISTRATION_RATE_LIMIT_MAX)) {
+          callback({
+            ok: false,
+            message: "Too many host registration attempts. Please try again.",
+            code: ErrorCode.SERVICE_UNAVAILABLE
+          });
+          return;
+        }
         const parsed = hostRegistrationSchema.safeParse(payload);
         if (!parsed.success) {
           callback({
@@ -410,7 +692,16 @@ io.on(
           });
           return;
         }
-        const { roomId, maxPlayers } = parsed.data;
+        const { roomId, maxPlayers, apiKey } = parsed.data;
+        const verification = await authService.verifyApiKey(apiKey);
+        if (!verification.isVerified) {
+          callback({
+            ok: false,
+            message: verification.error,
+            code: ErrorCode.INVALID_API_KEY
+          });
+          return;
+        }
         let session = roomManager.getRoom(roomId);
         if (session) {
           session.masterHostSocketId = socket.id;
@@ -434,6 +725,14 @@ io.on(
       }
     );
     socket.on("controller:join", (payload, callback) => {
+      if (isRateLimited("controller-join", CONTROLLER_JOIN_RATE_LIMIT_MAX)) {
+        callback({
+          ok: false,
+          message: "Too many join attempts. Please try again.",
+          code: ErrorCode.SERVICE_UNAVAILABLE
+        });
+        return;
+      }
       const parsed = controllerJoinSchema.safeParse(payload);
       if (!parsed.success) {
         callback({
@@ -552,6 +851,9 @@ io.on(
         return;
       }
       const { roomId, controllerId } = parsed.data;
+      if (!isControllerAuthorizedForRoom(roomId, controllerId)) {
+        return;
+      }
       const session = roomManager.getRoom(roomId);
       if (!session) {
         return;
@@ -566,18 +868,40 @@ io.on(
       socket.leave(roomId);
     });
     socket.on("controller:input", (payload) => {
+      const now = Date.now();
+      const input = payload?.input;
+      const hasActiveInput = input && (input.action === true || typeof input.vector === "object" && input.vector !== null && (Math.abs(input.vector.x ?? 0) > 0.01 || Math.abs(input.vector.y ?? 0) > 0.01));
+      if (hasActiveInput && (!lastServerInputLogTime || now - lastServerInputLogTime > 1e3)) {
+        lastServerInputLogTime = now;
+      }
       const result = controllerInputSchema.safeParse(payload);
       if (!result.success) {
+        if (!lastServerInputFailLogTime || now - lastServerInputFailLogTime > 1e3) {
+          lastServerInputFailLogTime = now;
+        }
+        return;
+      }
+      const { roomId, controllerId } = result.data;
+      if (!isControllerAuthorizedForRoom(roomId, controllerId)) {
         return;
       }
-      const { roomId } = result.data;
       const session = roomManager.getRoom(roomId);
       if (!session) {
+        if (!lastServerInputFailLogTime || now - lastServerInputFailLogTime > 1e3) {
+          lastServerInputFailLogTime = now;
+        }
         return;
       }
       const targetHostId = roomManager.getActiveHostId(session);
       if (targetHostId) {
+        if (!lastServerInputLogTime || now - lastServerInputLogTime > 1e3) {
+          lastServerInputLogTime = now;
+        }
         io.to(targetHostId).emit("server:input", result.data);
+      } else {
+        if (!lastServerInputFailLogTime || now - lastServerInputFailLogTime > 1e3) {
+          lastServerInputFailLogTime = now;
+        }
       }
     });
     socket.on("controller:system", (payload) => {
@@ -586,6 +910,9 @@ io.on(
         return;
       }
       const { roomId, command } = parsed.data;
+      if (!isControllerAuthorizedForRoom(roomId)) {
+        return;
+      }
       const session = roomManager.getRoom(roomId);
       if (!session) {
         return;
@@ -624,6 +951,9 @@ io.on(
         return;
       }
       const { roomId, command } = parsed.data;
+      if (!isHostAuthorizedForRoom(roomId)) {
+        return;
+      }
       const session = roomManager.getRoom(roomId);
       if (!session) {
         return;
@@ -643,6 +973,9 @@ io.on(
       const result = controllerStateSchema.safeParse(payload);
       if (!result.success) return;
       const { roomId, state } = result.data;
+      if (!isHostAuthorizedForRoom(roomId)) {
+        return;
+      }
       const session = roomManager.getRoom(roomId);
       if (session) {
         if (state.gameState) {
@@ -689,6 +1022,9 @@ io.on(
     });
     socket.on("controller:play_sound", (payload) => {
       const { roomId, soundId, volume, loop } = payload;
+      if (!isControllerAuthorizedForRoom(roomId)) {
+        return;
+      }
       const session = roomManager.getRoom(roomId);
       if (!session) return;
       io.to(roomManager.getActiveHostId(session)).emit("server:playSound", {
@@ -723,9 +1059,6 @@ io.on(
           return;
         }
         if (controllerSession.socketId !== socket.id) {
-          roomManager.deleteController(controllerSession.socketId);
-          controllerSession.socketId = socket.id;
-          roomManager.setController(socket.id, { roomId, controllerId });
           socket.join(roomId);
         }
         const hostId = roomManager.getActiveHostId(session);
@@ -754,6 +1087,23 @@ io.on(
           session.joinToken = void 0;
           session.activeControllerUrl = void 0;
           io.to(roomId).emit("client:unloadUi");
+          if (session.masterHostSocketId) {
+            const masterSocket = io.sockets.sockets.get(
+              session.masterHostSocketId
+            );
+            if (masterSocket) {
+              setTimeout(() => {
+                session.controllers.forEach((c) => {
+                  const notice = {
+                    controllerId: c.controllerId,
+                    nickname: c.nickname,
+                    player: c.playerProfile
+                  };
+                  masterSocket.emit("server:controllerJoined", notice);
+                });
+              }, 100);
+            }
+          }
         } else if (socket.id === session.masterHostSocketId) {
           console.log(`[server] Host disconnected from room ${roomId}`);
           setTimeout(() => {
@@ -788,4 +1138,4 @@ io.on(
 httpServer.listen(PORT, () => {
   console.log(`[air-jam] server listening on http://localhost:${PORT}`);
 });
-//# sourceMappingURL=chunk-KMAEESOE.js.map
+//# sourceMappingURL=chunk-CGONPUNG.js.map