@bounded-sh/core 0.0.34 → 0.0.36

package/dist/index.mjs

@@ -6555,7 +6555,30 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
     if (!connection || !connection.ws || connection.ws.readyState !== WS_READY_STATE_OPEN || connection.isAuthenticating) {
         return false;
     }
-    if (!(await canSendAuthenticatedLiveIntent(connection, isServer))) {
+    // Identity-aware send gate. The server attributes intents to the
+    // CONNECTION's authenticated principal, so the only correct reasons to
+    // refuse the socket are identity ones:
+    //   - the socket is anonymous while the user is now authenticated, or
+    //   - the current principal DIFFERS from the socket principal.
+    // A mere token rotation for the SAME principal, or a transiently-null
+    // token mid-refresh, must NOT reroute a 30Hz command stream to
+    // per-command HTTP — that collapses delivery rate and unbounds the game's
+    // ack lag (field-debugged: server 500+ commands behind).
+    const currentToken = await getIdToken(isServer).catch(() => null);
+    if (!currentToken) {
+        // Mid-refresh: the socket principal still governs server-side.
+        if (!connection.authTokenFingerprint && !connection.authPrincipal)
+            return false;
+    }
+    else if (!connection.authTokenFingerprint && !connection.authPrincipal) {
+        // Anonymous socket + authenticated user: do not attribute this user's
+        // input to the anon principal. Reauth the socket; caller may fall back.
+        void maybeReauthRoomConnection(connection);
+        return false;
+    }
+    else if (!connectionMatchesAuthToken(connection, currentToken)) {
+        // Different principal (identity switch): never send as the old user.
+        void maybeReauthRoomConnection(connection);
         return false;
     }
     try {
@@ -6566,6 +6589,26 @@ async function wsIntent(appId, roomRoutePath, intent, isServer) {
         return false;
     }
 }
+// Debounced background reauth: when the client's current token no longer
+// matches the connection's auth fingerprint (token rotation), refresh the
+// socket auth ONCE rather than degrading every subsequent send.
+const reauthInFlight = new WeakSet();
+async function maybeReauthRoomConnection(connection, isServer) {
+    try {
+        if (reauthInFlight.has(connection))
+            return;
+        reauthInFlight.add(connection);
+        try {
+            await reconnectWithNewAuthV2();
+        }
+        finally {
+            reauthInFlight.delete(connection);
+        }
+    }
+    catch (_a) {
+        // Best-effort: the next send retries; the server still enforces auth.
+    }
+}
 /**
  * Send a live-room intent over the EXISTING per-room socket and AWAIT the server
  * ack — so a policy/auth denial (401/403/404/503) REJECTS instead of being