@crowdedkingdoms/construct 0.3.0-dev.1 → 0.3.2-dev.1

package/README.md

@@ -16,7 +16,7 @@ and the games built on it share.
 
 It ships **TypeScript source** for Vite (it uses `?worker&url` and
 `import.meta.env`). Peer dependencies: `@crowdedkingdoms/crowdyjs` 18 (0.3.0
-and later; the 0.2 line peers on 17) and, for the Studio agent pane,
+and later, 18.0.1 from 0.3.1; the 0.2 line peers on 17) and, for the Studio agent pane,
 `@crowdedkingdoms/crowdy-dsh` 0.4+. On a
 prerelease tier the ranges name each `X.Y.Z` line they admit, because npm
 matches a prerelease only against a comparator on the same `X.Y.Z`. A game can

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/construct",
-  "version": "0.3.0-dev.1",
+  "version": "0.3.2-dev.1",
   "description": "The Construct framework: the Crowded Kingdoms game platform layer (hosted sign-in, World Stores, voice/webcam/chat, Crowdy Studio dock, app and grid mods, grid programs) and engine loop, shared by the-construct starter and the games built on it. Ships TypeScript source for Vite.",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,7 @@
     "./grid/*": "./src/grid/*.ts"
   },
   "peerDependencies": {
-    "@crowdedkingdoms/crowdyjs": ">=18.0.0-dev.0 <19",
+    "@crowdedkingdoms/crowdyjs": ">=18.0.0-dev.0 <19 || >=18.0.1-dev.0 <19",
     "@crowdedkingdoms/crowdy-dsh": ">=0.4.0-dev.0 <1 || >=0.4.1-dev.0 <1 || >=0.4.2-dev.0 <1"
   },
   "peerDependenciesMeta": {

package/src/index.ts

@@ -91,4 +91,5 @@ export {
   type ClientHalvesGrid,
   type GridClientHalvesOptions,
 } from './platform/studio/clientHalves';
+export { gridServerCalls, type GridServerCallsOptions } from './platform/studio/gridServerCalls';
 export { GridProgramRunner, type GridProgramRunnerOptions } from './grid/GridProgramRunner';

package/src/platform/studio/StudioService.ts

@@ -24,7 +24,6 @@
  * is missing, saying so in the HUD, rather than letting a worker fail silently.
  */
 import {
-  createGridHostCalls,
   type ExecClientHalfPrompt,
   type ExecGridClientMod,
   type PlayerCodeHostCall,
@@ -39,6 +38,7 @@ import glueWorkerAssetUrl from '@crowdedkingdoms/crowdyjs/player-glue-worker?wor
 
 import { API_HTTP_URL, API_WS_URL, CLIENT_MODS_ENABLED, GAME_NAME, STUDIO_ORIGIN } from '../config';
 import { GridProgramRunner } from '../../grid/GridProgramRunner';
+import { gridServerCalls } from './gridServerCalls';
 import type { GameSession } from '../GameSession';
 import { messageOf } from '../network/NetworkManager';
 import { isTextEntry } from '../../engine/Input';
@@ -422,15 +422,14 @@ export class StudioService {
     gridId: string,
     bounds: GridBounds,
   ): (call: PlayerCodeHostCall) => Promise<unknown> {
-    const game = this.session.network.game;
-    const scope = game.grid(this.session.appId, gridId, toBrokerBounds(bounds));
-    return createGridHostCalls({
-      scope,
-      client: game,
-      local: {
-        gridPermissionKeys: () =>
-          this.currentGrid?.gridId === gridId ? this.currentGrid.permissions.effectiveKeys : [],
-      },
+    return gridServerCalls({
+      game: this.session.network.game,
+      appId: this.session.appId,
+      gridId,
+      bounds,
+      userId: this.session.network.user?.userId,
+      permissionKeys: () =>
+        this.currentGrid?.gridId === gridId ? this.currentGrid.permissions.effectiveKeys : [],
     });
   }
 

package/src/platform/studio/gridServerCalls.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it, vi } from 'vitest';
+
+// The SDK barrel pulls Monaco, which does not load under happy-dom; the host-call module is
+// plain, so the test drives the real one.
+vi.mock('@crowdedkingdoms/crowdyjs', async () => {
+  const dist = '../../../../../node_modules/@crowdedkingdoms/crowdyjs/dist';
+  const calls = await import(/* @vite-ignore */ `${dist}/grid-mods/grid-host-calls.js`);
+  return { createGridHostCalls: calls.createGridHostCalls };
+});
+
+const { gridServerCalls } = await import('./gridServerCalls');
+
+const BOUNDS = { low: { x: '5', y: '0', z: '5' }, high: { x: '5', y: '0', z: '5' } };
+
+function game() {
+  const grid = vi.fn((appId: string, gridId: string, box: unknown) => ({
+    appId,
+    gridId,
+    bounds: box,
+    assertContains: () => {},
+    channels: { list: async () => [] },
+  }));
+  return { grid } as never;
+}
+
+const check = (userId: string, permissionKey: string) => ({
+  fn: 'grid_permission_check',
+  args: { userId, gridId: '42', permissionKey },
+});
+
+describe('gridServerCalls', () => {
+  it("answers grid_permission_check for the signed-in player from the grid's keys", async () => {
+    const calls = gridServerCalls({
+      game: game(),
+      appId: '1',
+      gridId: '42',
+      bounds: BOUNDS,
+      userId: '9',
+      permissionKeys: () => ['write_client_code', 'run_client_code'],
+    });
+    await expect(calls(check('9', 'run_client_code') as never)).resolves.toBe(true);
+    await expect(calls(check('9', 'write_server_code') as never)).resolves.toBe(false);
+    await expect(calls(check('8', 'run_client_code') as never)).rejects.toThrow(/another player/);
+  });
+
+  it('refuses it when no player is signed in', async () => {
+    const calls = gridServerCalls({
+      game: game(),
+      appId: '1',
+      gridId: '42',
+      bounds: BOUNDS,
+      userId: null,
+      permissionKeys: () => ['run_client_code'],
+    });
+    await expect(calls(check('9', 'run_client_code') as never)).rejects.toThrow();
+  });
+});

package/src/platform/studio/gridServerCalls.ts

@@ -0,0 +1,37 @@
+/**
+ * The CLIENT host calls a game's own router does not answer (DN-10): channels, sessions, user
+ * and avatar state, spatial sends and `grid_permission_check`, through CrowdyJS's
+ * `createGridHostCalls`, confined to one grid and answered as the player running the module.
+ * `grid_permission_check` needs both the player's user id and the keys the game holds for them
+ * on the grid; without either the SDK refuses it.
+ */
+import {
+  createGridHostCalls,
+  type CrowdyClient,
+  type PlayerCodeHostCall,
+} from '@crowdedkingdoms/crowdyjs';
+
+import { toBrokerBounds, type GridBounds } from './permissions';
+
+export interface GridServerCallsOptions {
+  game: CrowdyClient;
+  appId: string;
+  gridId: string;
+  bounds: GridBounds;
+  /** The signed-in player, the only one `grid_permission_check` answers about. */
+  userId: string | null | undefined;
+  /** The permission keys the game holds for that player on this grid. */
+  permissionKeys: () => Iterable<string>;
+}
+
+export function gridServerCalls(
+  options: GridServerCallsOptions,
+): (call: PlayerCodeHostCall) => Promise<unknown> {
+  const { game, appId, gridId, bounds, userId, permissionKeys } = options;
+  return createGridHostCalls({
+    scope: game.grid(appId, gridId, toBrokerBounds(bounds)),
+    client: game,
+    ...(userId ? { userId: String(userId) } : {}),
+    local: { gridPermissionKeys: permissionKeys },
+  });
+}