@couch-kit/host 1.7.11 → 1.7.12

package/lib/action-authorization.d.ts

@@ -0,0 +1,28 @@
+/** Error codes surfaced when a client ACTION is rejected before dispatch. */
+export type ActionRejectionCode = "FORBIDDEN_ACTION" | "NOT_JOINED";
+/** Outcome of authorizing an inbound client ACTION message. */
+export type ActionAuthorization = {
+    kind: "allow";
+    playerId: string;
+} | {
+    kind: "reject";
+    code: ActionRejectionCode;
+    message: string;
+};
+/**
+ * Decide whether an inbound client ACTION may be dispatched.
+ *
+ * Rejects, in order:
+ * - **Internal action types** — clients must not be able to inject framework
+ *   actions (`__HYDRATE__`, `__PLAYER_JOINED__`, etc.) to forge state.
+ * - **Un-joined sockets** — a socket with no resolved player ID never completed
+ *   a JOIN, so its actions have no owner and must not mutate state.
+ *
+ * The decision is pure so it can be unit-tested without a WebSocket or React.
+ *
+ * @param actionType - The `type` field of the client's action payload.
+ * @param resolvedPlayerId - The player ID cached for the socket at JOIN time, or
+ *   `undefined` if the socket has not joined.
+ */
+export declare function authorizeClientAction(actionType: string, resolvedPlayerId: string | undefined): ActionAuthorization;
+//# sourceMappingURL=action-authorization.d.ts.map

package/lib/action-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-authorization.d.ts","sourceRoot":"","sources":["../src/action-authorization.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,YAAY,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,mBAAmB,CAkBrB"}

package/lib/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAazB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBA2WA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBAqWA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@couch-kit/host",
-  "version": "1.7.11",
+  "version": "1.7.12",
   "publishConfig": {
     "access": "public",
     "provenance": true

package/src/action-authorization.ts

@@ -0,0 +1,55 @@
+import { InternalActionTypes } from "@couch-kit/core";
+
+/** Error codes surfaced when a client ACTION is rejected before dispatch. */
+export type ActionRejectionCode = "FORBIDDEN_ACTION" | "NOT_JOINED";
+
+/** Outcome of authorizing an inbound client ACTION message. */
+export type ActionAuthorization =
+  | { kind: "allow"; playerId: string }
+  | { kind: "reject"; code: ActionRejectionCode; message: string };
+
+const INTERNAL_ACTION_TYPES = new Set<string>([
+  InternalActionTypes.HYDRATE,
+  InternalActionTypes.PLAYER_JOINED,
+  InternalActionTypes.PLAYER_LEFT,
+  InternalActionTypes.PLAYER_RECONNECTED,
+  InternalActionTypes.PLAYER_REMOVED,
+]);
+
+/**
+ * Decide whether an inbound client ACTION may be dispatched.
+ *
+ * Rejects, in order:
+ * - **Internal action types** — clients must not be able to inject framework
+ *   actions (`__HYDRATE__`, `__PLAYER_JOINED__`, etc.) to forge state.
+ * - **Un-joined sockets** — a socket with no resolved player ID never completed
+ *   a JOIN, so its actions have no owner and must not mutate state.
+ *
+ * The decision is pure so it can be unit-tested without a WebSocket or React.
+ *
+ * @param actionType - The `type` field of the client's action payload.
+ * @param resolvedPlayerId - The player ID cached for the socket at JOIN time, or
+ *   `undefined` if the socket has not joined.
+ */
+export function authorizeClientAction(
+  actionType: string,
+  resolvedPlayerId: string | undefined,
+): ActionAuthorization {
+  if (INTERNAL_ACTION_TYPES.has(actionType)) {
+    return {
+      kind: "reject",
+      code: "FORBIDDEN_ACTION",
+      message: "Internal action types cannot be dispatched by clients",
+    };
+  }
+
+  if (!resolvedPlayerId) {
+    return {
+      kind: "reject",
+      code: "NOT_JOINED",
+      message: "You must JOIN before dispatching actions",
+    };
+  }
+
+  return { kind: "allow", playerId: resolvedPlayerId };
+}

package/src/provider.tsx

@@ -27,6 +27,7 @@ import {
   HostSessionManager,
   type JoinSessionPayload,
 } from "./session-manager";
+import { authorizeClientAction } from "./action-authorization";
 import {
   BroadcastScheduler,
   DEFAULT_STATE_THROTTLE_MS,
@@ -283,28 +284,25 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
         }
 
         case MessageTypes.ACTION: {
-          // Only accept actions with a user-defined type string,
-          // reject internal action types to prevent injection.
           const actionPayload = message.payload as A;
-          if (
-            actionPayload.type === InternalActionTypes.HYDRATE ||
-            actionPayload.type === InternalActionTypes.PLAYER_JOINED ||
-            actionPayload.type === InternalActionTypes.PLAYER_LEFT ||
-            actionPayload.type === InternalActionTypes.PLAYER_RECONNECTED ||
-            actionPayload.type === InternalActionTypes.PLAYER_REMOVED
-          ) {
+
+          // Authorize before doing any work: reject client-injected internal
+          // action types and actions from sockets that never completed a JOIN.
+          const resolvedPlayerId =
+            sessionManager.current.getPlayerIdForSocket(socketId);
+          const auth = authorizeClientAction(
+            actionPayload.type,
+            resolvedPlayerId,
+          );
+          if (auth.kind === "reject") {
             if (configRef.current.debug)
               console.warn(
-                `[GameHost] Rejected internal action from ${socketId}:`,
+                `[GameHost] Rejected action from ${socketId} (${auth.code}):`,
                 actionPayload.type,
               );
             server.send(socketId, {
               type: MessageTypes.ERROR,
-              payload: {
-                code: "FORBIDDEN_ACTION",
-                message:
-                  "Internal action types cannot be dispatched by clients",
-              },
+              payload: { code: auth.code, message: auth.message },
             });
             return;
           }
@@ -323,10 +321,7 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
             return;
           }
 
-          // Use cached playerId (populated at JOIN time)
-          const resolvedPlayerId =
-            sessionManager.current.getPlayerIdForSocket(socketId);
-          dispatch({ ...actionPayload, playerId: resolvedPlayerId });
+          dispatch({ ...actionPayload, playerId: auth.playerId });
           actionQueue.current.push(actionPayload);
           break;
         }