@mnbroatch/boardgame.io 0.0.1

package/src/server/auth.test.ts

@@ -0,0 +1,275 @@
+import {
+  extractPlayerMetadata,
+  doesMatchRequireAuthentication,
+  areCredentialsAuthentic,
+  Auth,
+} from './auth';
+
+import type { Server } from '../types';
+
+describe('extractPlayerMetadata', () => {
+  describe('when metadata is not found', () => {
+    test('then playerMetadata is undefined', () => {
+      expect(extractPlayerMetadata(undefined, '0')).toBeUndefined();
+    });
+  });
+
+  describe('when metadata does not contain players field', () => {
+    test('then playerMetadata is undefined', () => {
+      expect(
+        extractPlayerMetadata({} as Server.MatchData, '0')
+      ).toBeUndefined();
+    });
+  });
+
+  describe('when metadata does not contain playerID', () => {
+    test('then playerMetadata is undefined', () => {
+      expect(
+        extractPlayerMetadata(
+          {
+            gameName: '',
+            setupData: {},
+            players: { '1': { id: 1 } },
+            createdAt: 0,
+            updatedAt: 0,
+          },
+          '0'
+        )
+      ).toBeUndefined();
+    });
+  });
+
+  describe('when metadata contains playerID', () => {
+    test('then playerMetadata is returned', () => {
+      const playerMetadata = { id: 0, credentials: 'SECRET' };
+      const result = extractPlayerMetadata(
+        {
+          gameName: '',
+          setupData: {},
+          players: { '0': playerMetadata },
+          createdAt: 0,
+          updatedAt: 0,
+        },
+        '0'
+      );
+      expect(result).toBe(playerMetadata);
+    });
+  });
+});
+
+describe('doesMatchRequireAuthentication', () => {
+  describe('when game metadata is not found', () => {
+    test('then authentication is not required', () => {
+      const result = doesMatchRequireAuthentication();
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('when match has no credentials', () => {
+    test('then authentication is not required', () => {
+      const matchData = {
+        gameName: '',
+        setupData: {},
+        players: {
+          '0': { id: 1 },
+        },
+        createdAt: 0,
+        updatedAt: 0,
+      };
+      const result = doesMatchRequireAuthentication(matchData);
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('when match has credentials', () => {
+    test('then authentication is required', () => {
+      const matchData = {
+        gameName: '',
+        setupData: {},
+        players: {
+          '0': {
+            id: 0,
+            credentials: 'SECRET',
+          },
+        },
+        createdAt: 0,
+        updatedAt: 0,
+      };
+      const result = doesMatchRequireAuthentication(matchData);
+      expect(result).toBe(true);
+    });
+  });
+});
+
+describe('areCredentialsAuthentic', () => {
+  let action;
+  let playerID;
+  let matchData;
+  let credentials;
+  let playerMetadata;
+
+  beforeEach(() => {
+    playerID = '0';
+
+    action = {
+      payload: { credentials: 'SECRET' },
+    };
+
+    matchData = {
+      players: {
+        '0': { credentials: 'SECRET' },
+      },
+    };
+
+    playerMetadata = matchData.players[playerID];
+    ({ credentials } = action.payload || {});
+  });
+
+  describe('when game has credentials', () => {
+    describe('when action contains no payload', () => {
+      beforeEach(() => {
+        action = {};
+        ({ credentials } = action.payload || {});
+      });
+
+      test('the action is not authentic', async () => {
+        const result = areCredentialsAuthentic(credentials, playerMetadata);
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('when action contains no credentials', () => {
+      beforeEach(() => {
+        action = {
+          payload: { someStuff: 'foo' },
+        };
+        ({ credentials } = action.payload || {});
+      });
+
+      test('then action is not authentic', async () => {
+        const result = areCredentialsAuthentic(credentials, playerMetadata);
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('when action credentials do not match game credentials', () => {
+      beforeEach(() => {
+        action = {
+          payload: { credentials: 'WRONG' },
+        };
+        ({ credentials } = action.payload || {});
+      });
+      test('then action is not authentic', async () => {
+        const result = areCredentialsAuthentic(credentials, playerMetadata);
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('when playerMetadata is not found', () => {
+      test('then action is not authentic', () => {
+        const result = areCredentialsAuthentic(credentials, undefined);
+        expect(result).toBe(false);
+      });
+    });
+
+    describe('when action credentials do match game credentials', () => {
+      test('then action is authentic', async () => {
+        const result = areCredentialsAuthentic(credentials, playerMetadata);
+        expect(result).toBe(true);
+      });
+    });
+  });
+});
+
+describe('Auth', () => {
+  const credentials = 'credentials';
+  const playerData = { id: 0, credentials };
+  const metadata = {
+    gameName: '',
+    players: { '0': playerData },
+    createdAt: 0,
+    updatedAt: 0,
+  };
+
+  describe('defaults', () => {
+    const auth = new Auth();
+
+    test('generateCredentials', () => {
+      expect(typeof auth.generateCredentials({})).toBe('string');
+    });
+
+    test('authenticateCredentials', () => {
+      expect(
+        auth.authenticateCredentials({ playerID: '0', metadata, credentials })
+      ).toBe(true);
+    });
+  });
+
+  describe('ignores bad options', () => {
+    const auth = new Auth({
+      generateCredentials: 'foo',
+      authenticateCredentials: 'bar',
+    } as any);
+
+    test('generateCredentials', () => {
+      expect(typeof auth.generateCredentials({})).toBe('string');
+    });
+
+    test('authenticateCredentials', () => {
+      expect(
+        auth.authenticateCredentials({ playerID: '0', metadata, credentials })
+      ).toBe(true);
+    });
+  });
+
+  describe('custom methods', () => {
+    const generateCredentials = jest.fn(() => credentials);
+    const authenticateCredentials = jest.fn(() => true);
+    const auth = new Auth({ generateCredentials, authenticateCredentials });
+
+    test('generateCredentials', () => {
+      const ctx = {};
+      expect(auth.generateCredentials(ctx)).toBe(credentials);
+      expect(generateCredentials).toHaveBeenCalledWith(ctx);
+    });
+
+    test('authenticateCredentials', () => {
+      expect(
+        auth.authenticateCredentials({ playerID: '0', metadata, credentials })
+      ).toBe(true);
+      expect(authenticateCredentials).toHaveBeenCalledWith(
+        credentials,
+        playerData
+      );
+    });
+  });
+
+  describe('async', () => {
+    const generateCredentials = jest.fn(async () => credentials);
+    const authenticateCredentials = jest.fn(async () => true);
+    const auth = new Auth({ generateCredentials, authenticateCredentials });
+
+    test('generateCredentials', async () => {
+      const ctx = {};
+      const promise = auth.generateCredentials(ctx);
+      expect(promise).toBeInstanceOf(Promise);
+      expect(generateCredentials).toHaveBeenCalledWith(ctx);
+      expect(await promise).toBe(credentials);
+    });
+
+    test('authenticateCredentials', async () => {
+      const promise = auth.authenticateCredentials({
+        playerID: '0',
+        metadata,
+        credentials,
+      });
+
+      expect(promise).toBeInstanceOf(Promise);
+      expect(authenticateCredentials).toHaveBeenCalledWith(
+        credentials,
+        playerData
+      );
+      expect(await promise).toBe(true);
+    });
+  });
+});

package/src/server/auth.ts

@@ -0,0 +1,89 @@
+import { nanoid } from 'nanoid';
+import type { Server, PlayerID } from '../types';
+
+/**
+ * Verifies that a match has metadata and is using credentials.
+ */
+export const doesMatchRequireAuthentication = (
+  matchData?: Server.MatchData
+) => {
+  if (!matchData) return false;
+  const { players } = matchData;
+  const hasCredentials = Object.values(players).some(
+    (player) => !!(player && player.credentials)
+  );
+  return hasCredentials;
+};
+
+/**
+ * The default `authenticateCredentials` method.
+ * Verifies that the provided credentials match the player’s metadata.
+ */
+export const areCredentialsAuthentic: Server.AuthenticateCredentials = (
+  actionCredentials: string,
+  playerMetadata?: Server.PlayerMetadata
+) => {
+  if (!actionCredentials) return false;
+  if (!playerMetadata) return false;
+  return actionCredentials === playerMetadata.credentials;
+};
+
+/**
+ * Extracts a player’s metadata from the match data object.
+ */
+export const extractPlayerMetadata = (
+  matchData: Server.MatchData,
+  playerID: PlayerID
+): Server.PlayerMetadata => {
+  if (matchData && matchData.players) {
+    return matchData.players[playerID];
+  }
+};
+
+/**
+ * Class that provides authentication methods to the lobby server & transport.
+ */
+export class Auth {
+  private readonly shouldAuthenticate = doesMatchRequireAuthentication;
+  private readonly authenticate = areCredentialsAuthentic;
+
+  /**
+   * Generate credentials string from the Koa context.
+   */
+  public readonly generateCredentials: Server.GenerateCredentials = () =>
+    nanoid();
+
+  constructor(
+    opts: {
+      authenticateCredentials?: Server.AuthenticateCredentials;
+      generateCredentials?: Server.GenerateCredentials;
+    } = {}
+  ) {
+    if (typeof opts.authenticateCredentials === 'function') {
+      this.authenticate = opts.authenticateCredentials;
+      this.shouldAuthenticate = () => true;
+    }
+    if (typeof opts.generateCredentials === 'function') {
+      this.generateCredentials = opts.generateCredentials;
+    }
+  }
+
+  /**
+   * Resolves to true if the provided credentials are valid for the given
+   * metadata and player IDs, or if the match does not require authentication.
+   */
+  public authenticateCredentials({
+    playerID,
+    credentials,
+    metadata,
+  }: {
+    playerID: string;
+    credentials: string | undefined;
+    metadata: Server.MatchData;
+  }) {
+    const playerMetadata = extractPlayerMetadata(metadata, playerID);
+    return this.shouldAuthenticate(metadata)
+      ? this.authenticate(credentials, playerMetadata)
+      : true;
+  }
+}

package/src/server/cors.test.ts

@@ -0,0 +1,121 @@
+import { EventEmitter } from 'events';
+import cors from 'cors';
+import type { Origins as OriginsTS } from './cors';
+let { Origins } = require('./cors') as { Origins: typeof OriginsTS };
+
+describe('localhost origin', () => {
+  const middleware = cors({ origin: [Origins.LOCALHOST] });
+
+  test('allows localhost', () => {
+    const origin = 'http://localhost:8000/';
+    const req = createMockRequest(origin);
+    const res = new MockResponse();
+    middleware(req, res, () => {});
+    expect(res._headers['access-control-allow-origin']).toBe(origin);
+  });
+
+  test('disallows other origins', () => {
+    const req = createMockRequest('http://example.com/');
+    const res = new MockResponse();
+    middleware(req, res, () => {});
+    expect('access-control-allow-origin' in res._headers).toBe(false);
+  });
+});
+
+describe('development-only localhost origin', () => {
+  const reloadOriginsModule = () => {
+    jest.resetModules();
+    ({ Origins } = require('./cors'));
+  };
+
+  const oldNodeEnv = process.env.NODE_ENV;
+
+  afterEach(() => {
+    process.env.NODE_ENV = oldNodeEnv;
+    reloadOriginsModule();
+  });
+
+  const origin = 'http://localhost:8000/';
+
+  describe('development environment', () => {
+    test('allows localhost', () => {
+      const middleware = cors({ origin: [Origins.LOCALHOST_IN_DEVELOPMENT] });
+      const req = createMockRequest(origin);
+      const res = new MockResponse();
+      middleware(req, res, () => {});
+      expect(res._headers['access-control-allow-origin']).toBe(origin);
+    });
+  });
+
+  describe('production environment', () => {
+    beforeEach(() => {
+      process.env.NODE_ENV = 'production';
+      reloadOriginsModule();
+    });
+
+    test('disallows localhost', () => {
+      const middleware = cors({ origin: [Origins.LOCALHOST_IN_DEVELOPMENT] });
+      const req = createMockRequest(origin);
+      const res = new MockResponse();
+      middleware(req, res, () => {});
+      expect('access-control-allow-origin' in res._headers).toBe(false);
+    });
+
+    test('disallows random URL', () => {
+      const middleware = cors({ origin: [Origins.LOCALHOST_IN_DEVELOPMENT] });
+      const req = createMockRequest('http://example.com/');
+      const res = new MockResponse();
+      middleware(req, res, () => {});
+      expect('access-control-allow-origin' in res._headers).toBe(false);
+    });
+
+    test('allows URL when set alongside localhost', () => {
+      const origin = 'http://example.com/';
+      const middleware = cors({
+        origin: [Origins.LOCALHOST_IN_DEVELOPMENT, origin],
+      });
+      const req = createMockRequest(origin);
+      const res = new MockResponse();
+      middleware(req, res, () => {});
+      expect(res._headers['access-control-allow-origin']).toBe(origin);
+    });
+  });
+});
+
+/**
+ * Create a fake request object from the given origin.
+ */
+function createMockRequest(origin: string): cors.CorsRequest {
+  return { headers: { origin } };
+}
+
+/**
+ * Class mocking the interface of the request object expected by the
+ * CORS middleware package.
+ */
+class MockResponse extends EventEmitter {
+  _headers: Record<string, string>;
+  statusCode: number;
+
+  constructor() {
+    super();
+    this._headers = {};
+    this.statusCode = 200;
+  }
+
+  end() {
+    process.nextTick(
+      function () {
+        this.emit('finish');
+      }.bind(this)
+    );
+  }
+
+  getHeader(name: string) {
+    return this._headers[name.toLowerCase()];
+  }
+
+  setHeader(name: string, value: string) {
+    this._headers[name.toLowerCase()] = value;
+  }
+}

package/src/server/cors.ts

@@ -0,0 +1,7 @@
+const LOCALHOST = /localhost:\d+/;
+
+export const Origins = {
+  LOCALHOST,
+  LOCALHOST_IN_DEVELOPMENT:
+    process.env.NODE_ENV === 'production' ? false : LOCALHOST,
+};