@couch-kit/host 1.7.11 → 1.7.13

package/lib/action-authorization.d.ts

@@ -0,0 +1,28 @@
+/** Error codes surfaced when a client ACTION is rejected before dispatch. */
+export type ActionRejectionCode = "FORBIDDEN_ACTION" | "NOT_JOINED";
+/** Outcome of authorizing an inbound client ACTION message. */
+export type ActionAuthorization = {
+    kind: "allow";
+    playerId: string;
+} | {
+    kind: "reject";
+    code: ActionRejectionCode;
+    message: string;
+};
+/**
+ * Decide whether an inbound client ACTION may be dispatched.
+ *
+ * Rejects, in order:
+ * - **Internal action types** — clients must not be able to inject framework
+ *   actions (`__HYDRATE__`, `__PLAYER_JOINED__`, etc.) to forge state.
+ * - **Un-joined sockets** — a socket with no resolved player ID never completed
+ *   a JOIN, so its actions have no owner and must not mutate state.
+ *
+ * The decision is pure so it can be unit-tested without a WebSocket or React.
+ *
+ * @param actionType - The `type` field of the client's action payload.
+ * @param resolvedPlayerId - The player ID cached for the socket at JOIN time, or
+ *   `undefined` if the socket has not joined.
+ */
+export declare function authorizeClientAction(actionType: string, resolvedPlayerId: string | undefined): ActionAuthorization;
+//# sourceMappingURL=action-authorization.d.ts.map

package/lib/action-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-authorization.d.ts","sourceRoot":"","sources":["../src/action-authorization.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,MAAM,mBAAmB,GAAG,kBAAkB,GAAG,YAAY,CAAC;AAEpE,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAUnE;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,gBAAgB,EAAE,MAAM,GAAG,SAAS,GACnC,mBAAmB,CAkBrB"}

package/lib/message-validation.d.ts

@@ -1,4 +1,19 @@
 import { MessageTypes, type ClientMessage } from "@couch-kit/core";
+/**
+ * Default maximum size (in bytes) of an inbound client message. Frames larger
+ * than this are discarded before `JSON.parse`, bounding the memory a single
+ * malicious LAN client can force the host to allocate. Generous enough for
+ * data-URI avatars in JOIN payloads while blocking multi-megabyte abuse.
+ */
+export declare const DEFAULT_MAX_MESSAGE_BYTES: number;
+/**
+ * Compute the UTF-8 byte length of a raw WebSocket frame payload.
+ *
+ * For binary frames the `ArrayBuffer.byteLength` is exact. For text frames the
+ * UTF-8 size is counted directly from the JS string without allocating an
+ * encoder buffer, so an oversized frame can be rejected cheaply.
+ */
+export declare function frameByteLength(data: string | ArrayBuffer): number;
 type ClientMessageOf<TType extends ClientMessage["type"]> = Extract<ClientMessage, {
     type: TType;
 }>;

package/lib/message-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"message-validation.d.ts","sourceRoot":"","sources":["../src/message-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnE,KAAK,eAAe,CAAC,KAAK,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CACjE,aAAa,EACb;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,GACD,eAAe,CAAC,QAAQ,CAAC,GACzB,eAAe,CAAC,MAAM,CAAC,GACvB,eAAe,CAAC,eAAe,CAAC,CAAC;AAErC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,sBAAsB,CA8B/B"}
+{"version":3,"file":"message-validation.d.ts","sourceRoot":"","sources":["../src/message-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAmBlE;AAED,KAAK,eAAe,CAAC,KAAK,SAAS,aAAa,CAAC,MAAM,CAAC,IAAI,OAAO,CACjE,aAAa,EACb;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAChB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH,GACD,eAAe,CAAC,QAAQ,CAAC,GACzB,eAAe,CAAC,MAAM,CAAC,GACvB,eAAe,CAAC,eAAe,CAAC,CAAC;AAErC;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,GACX,GAAG,IAAI,sBAAsB,CA8B/B"}

package/lib/provider.d.ts

@@ -13,6 +13,11 @@ export interface GameHostConfig<S extends IGameState, A extends IAction> {
     disconnectTimeout?: number;
     /** State broadcast throttle interval in milliseconds (default: 33ms, ~30fps). */
     stateThrottleMs?: number;
+    /**
+     * Maximum size (in bytes) of an inbound client message. Frames larger than
+     * this are discarded before parsing (default: 256 KiB).
+     */
+    maxMessageBytes?: number;
     /** Called when a player successfully joins. */
     onPlayerJoined?: (playerId: string, name: string) => void;
     /** Called when a player disconnects. */

package/lib/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAazB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBA2WA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAQN,MAAM,OAAO,CAAC;AAGf,OAAO,EAQL,KAAK,UAAU,EACf,KAAK,OAAO,EAEb,MAAM,iBAAiB,CAAC;AAczB,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACrE,YAAY,EAAE,CAAC,CAAC;IAChB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6FAA6F;IAC7F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,wCAAwC;IACxC,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC;AAED,UAAU,oBAAoB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO;IACpE,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,KAAK,GAAG,IAAI,CAAC;CAC3B;AAQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,EAAE,EACxE,QAAQ,EACR,MAAM,GACP,EAAE;IACD,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC9B,qBAyWA;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,OAAO,KAK/C,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAC7C"}

package/lib/websocket.d.ts

@@ -8,6 +8,13 @@ import { EventEmitter } from "./event-emitter";
 export interface WebSocketConfig {
     port: number;
     debug?: boolean;
+    /**
+     * Maximum size (in bytes) of an inbound client message. Frames larger than
+     * this are discarded before parsing, bounding the memory a single client can
+     * force the host to allocate. Defaults to {@link DEFAULT_MAX_MESSAGE_BYTES}
+     * (256 KiB).
+     */
+    maxMessageBytes?: number;
     /**
      * @deprecated No effect. The underlying nitro-http WebSocket transport
      * manages frame sizing internally and this value is never read. This field
@@ -41,6 +48,7 @@ export declare class GameWebSocketServer extends EventEmitter<WebSocketServerEve
     private clients;
     private port;
     private debug;
+    private maxMessageBytes;
     constructor(config: WebSocketConfig);
     private log;
     start(): Promise<void>;

package/lib/websocket.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;CACvB,CAAC;AAOF,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAA2C;IAC1D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAU;gBAEX,MAAM,EAAE,eAAe;IAUnC,OAAO,CAAC,GAAG;IAME,KAAK;IA6FL,IAAI;IAoBjB;;;OAGG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAsB3C;;;OAGG;IACI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;IAoBlD,yDAAyD;IACzD,IAAW,WAAW,IAAI,MAAM,CAE/B;CACF"}
+{"version":3,"file":"websocket.d.ts","sourceRoot":"","sources":["../src/websocket.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAO/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,8CAA8C;AAC9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;CACvB,CAAC;AAOF,qBAAa,mBAAoB,SAAQ,YAAY,CAAC,qBAAqB,CAAC;IAC1E,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,OAAO,CAA2C;IAC1D,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,KAAK,CAAU;IACvB,OAAO,CAAC,eAAe,CAAS;gBAEpB,MAAM,EAAE,eAAe;IAYnC,OAAO,CAAC,GAAG;IAME,KAAK;IAuGL,IAAI;IAoBjB;;;OAGG;IACI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO;IAsB3C;;;OAGG;IACI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM;IAoBlD,yDAAyD;IACzD,IAAW,WAAW,IAAI,MAAM,CAE/B;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@couch-kit/host",
-  "version": "1.7.11",
+  "version": "1.7.13",
   "publishConfig": {
     "access": "public",
     "provenance": true

package/src/action-authorization.ts

@@ -0,0 +1,55 @@
+import { InternalActionTypes } from "@couch-kit/core";
+
+/** Error codes surfaced when a client ACTION is rejected before dispatch. */
+export type ActionRejectionCode = "FORBIDDEN_ACTION" | "NOT_JOINED";
+
+/** Outcome of authorizing an inbound client ACTION message. */
+export type ActionAuthorization =
+  | { kind: "allow"; playerId: string }
+  | { kind: "reject"; code: ActionRejectionCode; message: string };
+
+const INTERNAL_ACTION_TYPES = new Set<string>([
+  InternalActionTypes.HYDRATE,
+  InternalActionTypes.PLAYER_JOINED,
+  InternalActionTypes.PLAYER_LEFT,
+  InternalActionTypes.PLAYER_RECONNECTED,
+  InternalActionTypes.PLAYER_REMOVED,
+]);
+
+/**
+ * Decide whether an inbound client ACTION may be dispatched.
+ *
+ * Rejects, in order:
+ * - **Internal action types** — clients must not be able to inject framework
+ *   actions (`__HYDRATE__`, `__PLAYER_JOINED__`, etc.) to forge state.
+ * - **Un-joined sockets** — a socket with no resolved player ID never completed
+ *   a JOIN, so its actions have no owner and must not mutate state.
+ *
+ * The decision is pure so it can be unit-tested without a WebSocket or React.
+ *
+ * @param actionType - The `type` field of the client's action payload.
+ * @param resolvedPlayerId - The player ID cached for the socket at JOIN time, or
+ *   `undefined` if the socket has not joined.
+ */
+export function authorizeClientAction(
+  actionType: string,
+  resolvedPlayerId: string | undefined,
+): ActionAuthorization {
+  if (INTERNAL_ACTION_TYPES.has(actionType)) {
+    return {
+      kind: "reject",
+      code: "FORBIDDEN_ACTION",
+      message: "Internal action types cannot be dispatched by clients",
+    };
+  }
+
+  if (!resolvedPlayerId) {
+    return {
+      kind: "reject",
+      code: "NOT_JOINED",
+      message: "You must JOIN before dispatching actions",
+    };
+  }
+
+  return { kind: "allow", playerId: resolvedPlayerId };
+}

package/src/message-validation.ts

@@ -1,5 +1,41 @@
 import { MessageTypes, type ClientMessage } from "@couch-kit/core";
 
+/**
+ * Default maximum size (in bytes) of an inbound client message. Frames larger
+ * than this are discarded before `JSON.parse`, bounding the memory a single
+ * malicious LAN client can force the host to allocate. Generous enough for
+ * data-URI avatars in JOIN payloads while blocking multi-megabyte abuse.
+ */
+export const DEFAULT_MAX_MESSAGE_BYTES = 256 * 1024;
+
+/**
+ * Compute the UTF-8 byte length of a raw WebSocket frame payload.
+ *
+ * For binary frames the `ArrayBuffer.byteLength` is exact. For text frames the
+ * UTF-8 size is counted directly from the JS string without allocating an
+ * encoder buffer, so an oversized frame can be rejected cheaply.
+ */
+export function frameByteLength(data: string | ArrayBuffer): number {
+  if (typeof data !== "string") return data.byteLength;
+
+  let bytes = 0;
+  for (let i = 0; i < data.length; i++) {
+    const code = data.charCodeAt(i);
+    if (code < 0x80) {
+      bytes += 1;
+    } else if (code < 0x800) {
+      bytes += 2;
+    } else if (code >= 0xd800 && code <= 0xdbff) {
+      // High surrogate: a full pair encodes to 4 UTF-8 bytes.
+      bytes += 4;
+      i++; // Skip the paired low surrogate.
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+
 type ClientMessageOf<TType extends ClientMessage["type"]> = Extract<
   ClientMessage,
   { type: TType }

package/src/provider.tsx

@@ -27,6 +27,7 @@ import {
   HostSessionManager,
   type JoinSessionPayload,
 } from "./session-manager";
+import { authorizeClientAction } from "./action-authorization";
 import {
   BroadcastScheduler,
   DEFAULT_STATE_THROTTLE_MS,
@@ -46,6 +47,11 @@ export interface GameHostConfig<S extends IGameState, A extends IAction> {
   disconnectTimeout?: number;
   /** State broadcast throttle interval in milliseconds (default: 33ms, ~30fps). */
   stateThrottleMs?: number;
+  /**
+   * Maximum size (in bytes) of an inbound client message. Frames larger than
+   * this are discarded before parsing (default: 256 KiB).
+   */
+  maxMessageBytes?: number;
   /** Called when a player successfully joins. */
   onPlayerJoined?: (playerId: string, name: string) => void;
   /** Called when a player disconnects. */
@@ -186,7 +192,11 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
 
   useEffect(() => {
     const port = config.wsPort || httpPort + DEFAULT_WS_PORT_OFFSET;
-    const server = new GameWebSocketServer({ port, debug: config.debug });
+    const server = new GameWebSocketServer({
+      port,
+      debug: config.debug,
+      maxMessageBytes: config.maxMessageBytes,
+    });
 
     // Start the WebSocket server asynchronously
     server.start().catch((error) => {
@@ -283,28 +293,25 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
         }
 
         case MessageTypes.ACTION: {
-          // Only accept actions with a user-defined type string,
-          // reject internal action types to prevent injection.
           const actionPayload = message.payload as A;
-          if (
-            actionPayload.type === InternalActionTypes.HYDRATE ||
-            actionPayload.type === InternalActionTypes.PLAYER_JOINED ||
-            actionPayload.type === InternalActionTypes.PLAYER_LEFT ||
-            actionPayload.type === InternalActionTypes.PLAYER_RECONNECTED ||
-            actionPayload.type === InternalActionTypes.PLAYER_REMOVED
-          ) {
+
+          // Authorize before doing any work: reject client-injected internal
+          // action types and actions from sockets that never completed a JOIN.
+          const resolvedPlayerId =
+            sessionManager.current.getPlayerIdForSocket(socketId);
+          const auth = authorizeClientAction(
+            actionPayload.type,
+            resolvedPlayerId,
+          );
+          if (auth.kind === "reject") {
             if (configRef.current.debug)
               console.warn(
-                `[GameHost] Rejected internal action from ${socketId}:`,
+                `[GameHost] Rejected action from ${socketId} (${auth.code}):`,
                 actionPayload.type,
               );
             server.send(socketId, {
               type: MessageTypes.ERROR,
-              payload: {
-                code: "FORBIDDEN_ACTION",
-                message:
-                  "Internal action types cannot be dispatched by clients",
-              },
+              payload: { code: auth.code, message: auth.message },
             });
             return;
           }
@@ -323,10 +330,7 @@ export function GameHostProvider<S extends IGameState, A extends IAction>({
             return;
           }
 
-          // Use cached playerId (populated at JOIN time)
-          const resolvedPlayerId =
-            sessionManager.current.getPlayerIdForSocket(socketId);
-          dispatch({ ...actionPayload, playerId: resolvedPlayerId });
+          dispatch({ ...actionPayload, playerId: auth.playerId });
           actionQueue.current.push(actionPayload);
           break;
         }

package/src/websocket.ts

@@ -12,10 +12,21 @@ import type {
 } from "react-native-nitro-http-server";
 import { EventEmitter } from "./event-emitter";
 import { generateId, DEFAULT_WS_PATH } from "@couch-kit/core";
+import {
+  DEFAULT_MAX_MESSAGE_BYTES,
+  frameByteLength,
+} from "./message-validation";
 
 export interface WebSocketConfig {
   port: number;
   debug?: boolean;
+  /**
+   * Maximum size (in bytes) of an inbound client message. Frames larger than
+   * this are discarded before parsing, bounding the memory a single client can
+   * force the host to allocate. Defaults to {@link DEFAULT_MAX_MESSAGE_BYTES}
+   * (256 KiB).
+   */
+  maxMessageBytes?: number;
   /**
    * @deprecated No effect. The underlying nitro-http WebSocket transport
    * manages frame sizing internally and this value is never read. This field
@@ -56,15 +67,18 @@ export class GameWebSocketServer extends EventEmitter<WebSocketServerEvents> {
   private clients: Map<string, WebSocketClient> = new Map();
   private port: number;
   private debug: boolean;
+  private maxMessageBytes: number;
 
   constructor(config: WebSocketConfig) {
     super();
     this.port = config.port;
     this.debug = !!config.debug;
-    // Only `port` and `debug` are honored. `maxFrameSize`, `keepaliveInterval`,
-    // and `keepaliveTimeout` are deprecated no-ops: the nitro-http WebSocket
-    // transport does not expose these knobs, so they are intentionally ignored
-    // (see the @deprecated tags on WebSocketConfig).
+    this.maxMessageBytes =
+      config.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES;
+    // Only `port`, `debug`, and `maxMessageBytes` are honored. `maxFrameSize`,
+    // `keepaliveInterval`, and `keepaliveTimeout` are deprecated no-ops: the
+    // nitro-http WebSocket transport does not expose these knobs, so they are
+    // intentionally ignored (see the @deprecated tags on WebSocketConfig).
   }
 
   private log(...args: unknown[]) {
@@ -93,6 +107,16 @@ export class GameWebSocketServer extends EventEmitter<WebSocketServerEvents> {
 
         // Handle incoming messages
         ws.onmessage = (event: { data: string | ArrayBuffer }) => {
+          // Reject oversized frames before parsing to bound memory usage.
+          const size = frameByteLength(event.data);
+          if (size > this.maxMessageBytes) {
+            this.log(
+              `[WebSocket] Message from ${socketId} exceeds limit ` +
+                `(${size} > ${this.maxMessageBytes} bytes), discarding`,
+            );
+            return;
+          }
+
           try {
             const data =
               typeof event.data === "string"