@crowdedkingdoms/construct 0.3.8 → 0.3.10-dev.1

package/README.md

@@ -30,7 +30,7 @@ Releases are on npm under one dist-tag per tier, and a game pins the exact
 version of its own tier, as it pins CrowdyJS:
 
 ```bash
-npm install --save-exact @crowdedkingdoms/construct   # X.Y.Z on latest
+npm install --save-exact @crowdedkingdoms/construct@dev   # an X.Y.Z-dev.N build
 ```
 
 `dev` is `X.Y.Z-dev.N`, `test` is `X.Y.Z-test.N`, and `prod` is `X.Y.Z` on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/construct",
-  "version": "0.3.8",
+  "version": "0.3.10-dev.1",
   "description": "The Construct framework: the Crowded Kingdoms game platform layer (hosted sign-in, World Stores, voice/webcam/chat, Crowdy Studio dock, app and grid mods, grid programs) and engine loop, shared by the-construct starter and the games built on it. Ships TypeScript source for Vite.",
   "license": "MIT",
   "type": "module",

package/src/platform/envScope.test.ts

@@ -5,8 +5,16 @@ vi.mock('@crowdedkingdoms/crowdyjs', () => ({
   CROWDY_DEFAULT_TIER: 'test',
 }));
 
-const { ENV_HANDLE, envHandleFor, envScopedKey, ensureEnvScope, readScoped, writeScoped } =
-  await import('./envScope');
+const {
+  ENV_HANDLE,
+  appTokenStorageKey,
+  envHandleFor,
+  envScopedKey,
+  ensureEnvScope,
+  perGameBase,
+  readScoped,
+  writeScoped,
+} = await import('./envScope');
 
 describe('envScope', () => {
   beforeEach(() => localStorage.clear());
@@ -23,6 +31,19 @@ describe('envScope', () => {
     expect(envScopedKey('x', 'other')).toBe('x:other');
   });
 
+  it('keys a saved app token by game path and API host', () => {
+    expect(appTokenStorageKey('/matchstick/')).toBe('crowdyjs:app:/matchstick/:ck.test.example');
+    expect(appTokenStorageKey('/blocks-with-friends/', 'ck.dev.example')).toBe(
+      'crowdyjs:app:/blocks-with-friends/:ck.dev.example',
+    );
+    expect(appTokenStorageKey('/matchstick/', 'ck.dev.example')).not.toBe(
+      appTokenStorageKey('/other-game/', 'ck.dev.example'),
+    );
+    expect(perGameBase('construct:app-route', '/matchstick/')).toBe(
+      'construct:app-route:/matchstick/',
+    );
+  });
+
   it('drops per-environment values when the environment changes', () => {
     localStorage.setItem('construct:env-handle', 'ck.old.example');
     localStorage.setItem('construct:app-id:ck.old.example', '111');

package/src/platform/envScope.ts

@@ -30,6 +30,29 @@ export function envScopedKey(base: string, handle: string = ENV_HANDLE): string
   return `${base}:${handle}`;
 }
 
+/**
+ * `<base>:<game-path>`, for `readScoped` / `writeScoped`, which append the host.
+ *
+ * The host alone is one key for every Construct game on a games host. Blocks
+ * with Friends keys its app token by `import.meta.env.BASE_URL` so two games
+ * do not share a session. Pass that base here.
+ */
+export function perGameBase(base: string, gamePath: string): string {
+  return `${base}:${gamePath}`;
+}
+
+/**
+ * localStorage key for the saved app token.
+ *
+ * Shape is `BrowserLocalStorageTokenStore.appKey(gamePath)` plus the API-host
+ * handle: `crowdyjs:app:/matchstick/:ck.dev.crowdedkingdoms.com`. The path
+ * keeps a second Construct game from restoring Matchstick's token. The handle
+ * keeps a localhost build pointed at another tier from restoring the first.
+ */
+export function appTokenStorageKey(gamePath: string, handle: string = ENV_HANDLE): string {
+  return envScopedKey(`crowdyjs:app:${gamePath}`, handle);
+}
+
 /** Keys that describe the previous environment and must not survive a switch. */
 const SCOPED_LOCAL_PREFIXES = ['construct:app-id', 'construct:last-program'];
 

package/src/platform/network/NetworkManager.ts

@@ -40,7 +40,13 @@ import {
   APP_TOKEN_REFRESH_RETRY_MS,
   AUTHORIZE_URL,
 } from '../config';
-import { envScopedKey, readScoped, writeScoped } from '../envScope';
+import {
+  appTokenStorageKey,
+  envScopedKey,
+  perGameBase,
+  readScoped,
+  writeScoped,
+} from '../envScope';
 import { WorldHub } from '../exec/worldHub';
 import { Emitter } from '../util/Emitter';
 
@@ -58,11 +64,13 @@ export interface AppRoute {
   expiresAt: string;
 }
 
-/** Where the entered app's route is remembered across a reload (env-scoped). */
+/** Where the entered app's route is remembered across a reload (per game path, per API host). */
 export const APP_ROUTE_STORAGE_KEY = 'construct:app-route';
 
-/** The token store key for the app token (env-scoped). One app at a time. */
-const APP_TOKEN_STORE_KEY = 'construct:app-token';
+/** Route key for this game's Vite base, before the API-host suffix `readScoped` adds. */
+function savedRouteBase(): string {
+  return perGameBase(APP_ROUTE_STORAGE_KEY, import.meta.env.BASE_URL);
+}
 
 export interface BootstrapInfo {
   minimumClientVersion?: string;
@@ -125,7 +133,7 @@ export class NetworkManager {
     this.platform = createCrowdyClient({
       httpUrl: API_HTTP_URL,
       wsUrl: API_WS_URL,
-      tokenStore: new BrowserLocalStorageTokenStore(envScopedKey(APP_TOKEN_STORE_KEY)),
+      tokenStore: new BrowserLocalStorageTokenStore(appTokenStorageKey(import.meta.env.BASE_URL)),
     });
   }
 
@@ -183,7 +191,7 @@ export class NetworkManager {
       const minted = await this.platform.portal.handleSignInCallback();
       if (!minted) return null;
       const route = this.routeFrom(minted, minted.appId);
-      writeScoped(APP_ROUTE_STORAGE_KEY, JSON.stringify(route));
+      writeScoped(savedRouteBase(), JSON.stringify(route));
       await this.hydrateUser();
       this.log(`Hosted sign-in complete for app ${route.appId}`);
       return route;
@@ -200,7 +208,7 @@ export class NetworkManager {
   async restore(): Promise<AppRoute | null> {
     await this.platform.session.restore();
     if (!this.platform.session.getToken()) return null;
-    const raw = readScoped(APP_ROUTE_STORAGE_KEY);
+    const raw = readScoped(savedRouteBase());
     let route: AppRoute | null;
     try {
       route = raw ? (JSON.parse(raw) as AppRoute) : null;
@@ -231,7 +239,7 @@ export class NetworkManager {
 
   private forgetCredentials(): void {
     this.platform.session.setToken(null);
-    writeScoped(APP_ROUTE_STORAGE_KEY, null);
+    writeScoped(savedRouteBase(), null);
   }
 
   private async hydrateUser(): Promise<SessionUser | null> {
@@ -346,7 +354,7 @@ export class NetworkManager {
     }
     this.gameClient.setToken(token);
     this.route = route;
-    writeScoped(APP_ROUTE_STORAGE_KEY, JSON.stringify(route));
+    writeScoped(savedRouteBase(), JSON.stringify(route));
     this.refreshFailures = 0;
     this.scheduleRefresh(APP_TOKEN_REFRESH_MS);
     this.log(`Entered app ${route.appId} via ${httpUrl}`);
@@ -417,7 +425,7 @@ export class NetworkManager {
       const refreshed = await this.gameClient.refreshGameplayToken();
       this.platform.session.setToken(refreshed.token);
       this.route = { ...this.route, expiresAt: refreshed.expiresAt };
-      writeScoped(APP_ROUTE_STORAGE_KEY, JSON.stringify(this.route));
+      writeScoped(savedRouteBase(), JSON.stringify(this.route));
       this.refreshFailures = 0;
       this.log('App token rotated');
       this.scheduleRefresh(APP_TOKEN_REFRESH_MS);

package/src/platform/studio/clientModHost.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 
 const {
   DEFAULT_VOXEL_STATE,
@@ -7,6 +7,7 @@ const {
   bytesToBase64,
   parseVoxelSetArgs,
   routeClientHostCall,
+  routeWithFallback,
   voxelStateToWire,
   voxelsFromBase64,
   voxelsListRows,
@@ -144,6 +145,23 @@ describe('routeClientHostCall', () => {
     }
   });
 
+  it("hands an SDK call to the host's server calls while no session is bound", async () => {
+    const { bindModSession } = await import('./modChunkRuntime');
+    bindModSession(null);
+    const r = reads();
+    for (const fn of ['emit_channel', 'channel_join', 'sessions_list']) {
+      const call = { fn, args: { channelId: '5' } } as never;
+      await expect(routeClientHostCall(call, r.reads, grid)).rejects.toBeInstanceOf(
+        HostCallRefusedError,
+      );
+      const serverCalls = vi.fn(async () => ({ answered: fn }));
+      await expect(
+        routeWithFallback(call, () => routeClientHostCall(call, r.reads, grid), serverCalls),
+      ).resolves.toEqual({ answered: fn });
+      expect(serverCalls).toHaveBeenCalledWith(call);
+    }
+  });
+
   it('drains pointer_clicks when the game supplies an input sink', async () => {
     const r = reads();
     await expect(

package/src/platform/studio/clientModHost.ts

@@ -13,7 +13,7 @@
  * the same route Paint uses. Never hand a mod the raw client.
  */
 import type { PlayerCodeGridBounds, PlayerCodeHostCall } from '@crowdedkingdoms/crowdyjs';
-import { routeModGameplay } from './modChunkRuntime';
+import { NO_SESSION, routeModGameplay } from './modChunkRuntime';
 import type { ModSceneStore } from './modScene';
 
 export interface ClientVoxelState {
@@ -188,13 +188,14 @@ export async function routeClientHostCall(
       return scene.store.setInstances(scene.source, args);
     default: {
       const answered = await routeModGameplay(call);
-      if (
-        answered &&
-        typeof answered === 'object' &&
-        'error' in answered &&
-        String((answered as { error: unknown }).error).startsWith('unrouted')
-      ) {
-        throw new HostCallRefusedError(fn);
+      if (answered && typeof answered === 'object' && 'error' in answered) {
+        // A call the mod runtime does not route, or an SDK call in a game that never binds a
+        // session (one without StudioService), is the host's to answer: `routeWithFallback`
+        // hands a refusal to its server calls.
+        const error = String((answered as { error: unknown }).error);
+        if (error.startsWith('unrouted') || error === NO_SESSION) {
+          throw new HostCallRefusedError(fn);
+        }
       }
       return answered;
     }

package/src/platform/studio/modChunkRuntime.ts

@@ -429,6 +429,9 @@ async function restoreAvatar(): Promise<void> {
     .catch(() => undefined);
 }
 
+/** The answer to an SDK call while no session is bound; the host's router hands such a call on. */
+export const NO_SESSION = 'no session';
+
 const PASS_SDK = new Set([
   'actors_create',
   'actors_update',
@@ -494,7 +497,7 @@ const PASS_SDK = new Set([
 
 async function passSdk(fn: string, args: Record<string, unknown>): Promise<unknown> {
   if (!PASS_SDK.has(fn)) return { ok: false, error: `unrouted host call ${fn}` };
-  if (!port) return { ok: false, error: 'no session' };
+  if (!port) return { ok: false, error: NO_SESSION };
   const client = port.client;
   switch (fn) {
     case 'actors_create':