@moneypot/hub 1.20.6 → 1.22.0

package/dist/dashboard/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>Dashboard</title>
-    <script type="module" crossorigin src="/dashboard/assets/index-0G7cFk_0.js"></script>
+    <script type="module" crossorigin src="/dashboard/assets/index-n_xD3-qc.js"></script>
     <link rel="stylesheet" crossorigin href="/dashboard/assets/index-Bl5lLFHa.css">
   </head>
   <body>

package/dist/src/audit-log.d.ts

@@ -1,7 +1,7 @@
 import { DbPlayerBalance, DbHouseBankroll } from "./db/types.js";
 import { QueryExecutor } from "./db/util.js";
 export type AuditLogType = "player-balance" | "house-bankroll" | "both";
-export type HubAuditAction = "hub:init" | "hub:deposit" | "hub:take_request:pending" | "hub:take_request:refund" | "hub:outcome_bet";
+export type HubAuditAction = "hub:init" | "hub:deposit" | "hub:take_request:pending" | "hub:take_request:refund" | "hub:outcome_bet" | "hub:bankroll:adjust";
 export type HubAuditRefType = "hub.deposit" | "hub.outcome_bet" | "hub.take_request";
 export type AuditAction = HubAuditAction | (string & {});
 export type AuditRefType = HubAuditRefType | (string & {});

package/dist/src/config.js

@@ -5,9 +5,8 @@ function getEnvVariable(key, transform = (value) => value) {
     return transform(process.env[key] || "");
 }
 export const NODE_ENV = getEnvVariable("NODE_ENV", (value) => {
-    if (!value) {
-        console.warn("Missing NODE_ENV env var. Defaulting to 'development'");
-        return "development";
+    if (value !== "development" && value !== "test" && value !== "production") {
+        throw new Error(`NODE_ENV must be "development", "test", or "production" (got ${JSON.stringify(value)})`);
     }
     return value;
 });

package/dist/src/log-serializers.d.ts

@@ -0,0 +1,4 @@
+import { type LoggerOptions } from "pino";
+export declare function errorLogOptions(options: {
+    full: boolean;
+}): Pick<LoggerOptions, "serializers" | "hooks">;

package/dist/src/log-serializers.js

@@ -0,0 +1,118 @@
+import pino from "pino";
+import { ClientError } from "graphql-request";
+const SAFE_CODE = /^[A-Z0-9_]{1,32}$/;
+const OPERATION_NAME = /^\s*(?:query|mutation|subscription)\s+([_A-Za-z][_0-9A-Za-z]{0,99})\b/;
+const MAX_DEPTH = 5;
+const WITHHELD_MESSAGE = "error details withheld: a casino request failed";
+function isClientError(value) {
+    return (value instanceof Error &&
+        typeof value.response === "object" &&
+        value.response !== null &&
+        typeof value.request === "object");
+}
+function nestedErrors(err) {
+    const record = err;
+    const nested = [err.cause, record.originalError];
+    if (Array.isArray(record.errors)) {
+        nested.push(...record.errors);
+    }
+    for (const key in err) {
+        nested.push(record[key]);
+    }
+    return nested.filter((x) => x instanceof Error && x !== err);
+}
+function containsClientError(err, depth = 0) {
+    if (!(err instanceof Error)) {
+        return false;
+    }
+    if (depth > MAX_DEPTH) {
+        return true;
+    }
+    return (isClientError(err) ||
+        nestedErrors(err).some((x) => containsClientError(x, depth + 1)));
+}
+const LOCATION = String.raw `(?:file:\/\/|node:|\/)[^\s()]+:\d+:\d+`;
+const STACK_FRAME = new RegExp(String.raw `^\s+at (?:(?:async |new )?[^\s()]+(?: \[as [^\s\]]+\])? \((?:${LOCATION}|<anonymous>|index \d+)\)|(?:async )?${LOCATION})$`);
+function stackFrames(err) {
+    const header = String(err);
+    if (typeof err.stack !== "string" || !err.stack.startsWith(`${header}\n`)) {
+        return undefined;
+    }
+    const lines = err.stack.slice(header.length + 1).split("\n");
+    return lines.every((line) => STACK_FRAME.test(line))
+        ? lines.map((line) => line.trim())
+        : undefined;
+}
+function operationName(err) {
+    const query = err.request
+        ?.query;
+    return typeof query === "string"
+        ? OPERATION_NAME.exec(query)?.[1]
+        : undefined;
+}
+function describeClientError(err) {
+    const { status, errors } = err.response;
+    const list = Array.isArray(errors) ? errors : [];
+    return {
+        type: "ClientError",
+        operationName: operationName(err),
+        status: typeof status === "number" ? status : undefined,
+        errorCount: list.length,
+        codes: list.flatMap((e) => {
+            const code = e?.extensions
+                ?.code;
+            return typeof code === "string" && SAFE_CODE.test(code) ? [code] : [];
+        }),
+        frames: err instanceof ClientError ? stackFrames(err) : undefined,
+    };
+}
+function describeTaintedError(err, depth) {
+    if (isClientError(err)) {
+        return describeClientError(err);
+    }
+    return {
+        type: err.constructor?.name ?? "Error",
+        withheld: true,
+        ...(depth < MAX_DEPTH
+            ? {
+                nested: nestedErrors(err).map((x) => describeTaintedError(x, depth + 1)),
+            }
+            : {}),
+    };
+}
+function serializeError(err) {
+    if (!(err instanceof Error)) {
+        return err;
+    }
+    return containsClientError(err)
+        ? describeTaintedError(err, 0)
+        : pino.stdSerializers.err(err);
+}
+const withholdingHooks = {
+    logMethod(args, method) {
+        const [first, second] = args;
+        const error = first instanceof Error
+            ? first
+            : (first?.err ??
+                first?.error);
+        if (typeof second !== "string" && containsClientError(error)) {
+            const object = first instanceof Error ? { err: first } : first;
+            return method.apply(this, [object, WITHHELD_MESSAGE]);
+        }
+        return method.apply(this, args);
+    },
+};
+export function errorLogOptions(options) {
+    if (options.full) {
+        return {
+            serializers: {
+                err: pino.stdSerializers.err,
+                error: pino.stdSerializers.err,
+            },
+        };
+    }
+    return {
+        serializers: { err: serializeError, error: serializeError },
+        hooks: withholdingHooks,
+    };
+}

package/dist/src/logger.js

@@ -1,11 +1,13 @@
 import pino from "pino";
 import { LOG_LEVEL, LOG_PRETTY, NODE_ENV } from "./config.js";
+import { errorLogOptions } from "./log-serializers.js";
 function createLogger(options) {
     const prettify = LOG_PRETTY === undefined ? NODE_ENV !== "production" : LOG_PRETTY;
     if (prettify) {
         try {
             return pino({
                 level: options.level,
+                ...errorLogOptions({ full: NODE_ENV === "development" }),
                 transport: {
                     target: "pino-pretty",
                     options: {
@@ -18,12 +20,14 @@ function createLogger(options) {
             console.warn("LOG_PRETTY=true but pino-pretty is not installed, falling back to standard logging");
             return pino({
                 level: options.level,
+                ...errorLogOptions({ full: NODE_ENV === "development" }),
             });
         }
     }
     else {
         return pino({
             level: options.level,
+            ...errorLogOptions({ full: NODE_ENV === "development" }),
         });
     }
 }

package/dist/src/pg-versions/018-scope-chat-owner-reads.sql

@@ -0,0 +1,49 @@
+
+drop policy select_chat_message on hub.chat_message;
+create policy select_chat_message on hub.chat_message for select using (
+  hub_hidden.is_operator()
+
+  or (
+    hidden_at is null
+    and experience_id = hub_hidden.current_experience_id()
+    and casino_id = hub_hidden.current_casino_id()
+  )
+
+  or (
+    hub_hidden.is_experience_owner()
+    and experience_id = hub_hidden.current_experience_id()
+    and casino_id = hub_hidden.current_casino_id()
+  )
+);
+
+drop policy select_chat_mute on hub.chat_mute;
+create policy select_chat_mute on hub.chat_mute for select using (
+  hub_hidden.is_operator()
+
+  or hub_hidden.current_user_id() = hub.chat_mute.user_id
+
+  or (
+    hub_hidden.is_experience_owner()
+    and hub.chat_mute.experience_id = hub_hidden.current_experience_id()
+    and hub.chat_mute.casino_id = hub_hidden.current_casino_id()
+  )
+
+  or exists (
+    select 1
+    from hub.chat_mod
+    where user_id = hub_hidden.current_user_id()
+      and casino_id = hub.chat_mute.casino_id
+      and experience_id = hub.chat_mute.experience_id
+  )
+);
+
+drop policy select_chat_mod on hub.chat_mod;
+create policy select_chat_mod on hub.chat_mod for select using (
+  hub_hidden.is_operator()
+
+  or (
+    hub_hidden.is_experience_owner()
+    and experience_id = hub_hidden.current_experience_id()
+    and casino_id = hub_hidden.current_casino_id()
+  )
+);

package/dist/src/plugins/chat/hub-chat-create-system-message.js

@@ -2,7 +2,7 @@ import { GraphQLError } from "graphql";
 import { context, object, sideEffect } from "postgraphile/grafast";
 import { extendSchema, gql } from "postgraphile/utils";
 import z from "zod/v4";
-import { extractFirstZodErrorMessage } from "../../util.js";
+import { extractFirstZodErrorMessage, uuidEqual } from "../../util.js";
 import { exactlyOneRow, maybeOneRow, withPgPoolTransaction, } from "../../db/index.js";
 const InputSchema = z.object({
     clientId: z.uuid("Invalid client ID"),
@@ -69,6 +69,10 @@ export const HubChatCreateSystemMessagePlugin = extendSchema((build) => {
                             if (!dbExperience) {
                                 throw new GraphQLError("Experience not found");
                             }
+                            if (identity.kind === "user" &&
+                                !uuidEqual(identity.session.experience_id, dbExperience.id)) {
+                                throw new GraphQLError("Your session does not match the experienceId");
+                            }
                             return await withPgPoolTransaction(superuserPool, async (pgClient) => {
                                 const dbChatMessage = await pgClient
                                     .query({

package/dist/src/plugins/chat/hub-chat-mod-management.js

@@ -85,9 +85,9 @@ export const HubChatModManagementPlugin = extendSchema((build) => {
                                 text: `
                     SELECT id
                     FROM hub.user
-                    WHERE id = $1 AND experience_id = $2
+                    WHERE id = $1 AND casino_id = $2
                   `,
-                                values: [input.userId, input.experienceId],
+                                values: [input.userId, dbTargetExperience.casino_id],
                             })
                                 .then(maybeOneRow);
                             if (!dbTargetUser) {
@@ -167,9 +167,9 @@ export const HubChatModManagementPlugin = extendSchema((build) => {
                                 text: `
                     SELECT id
                     FROM hub.user
-                    WHERE id = $1 AND experience_id = $2
+                    WHERE id = $1 AND casino_id = $2
                   `,
-                                values: [input.userId, input.experienceId],
+                                values: [input.userId, dbTargetExperience.casino_id],
                             })
                                 .then(maybeOneRow);
                             if (!dbTargetUser) {

package/dist/src/plugins/graphql-error-log.d.ts

@@ -0,0 +1,28 @@
+type ResponseError = {
+    message?: unknown;
+    path?: unknown;
+    locations?: unknown;
+    extensions?: {
+        code?: unknown;
+    };
+};
+type ResponsePayload = {
+    data?: unknown;
+    errors?: ResponseError[];
+};
+export type GraphQLErrorLogLine = {
+    operationName: string | null;
+    kind: "parse" | "request" | "execution";
+    errorCount: number;
+    codes: string[];
+    locations: (string | null)[];
+    unsafe?: {
+        message: unknown;
+        path: unknown;
+    }[];
+};
+export declare function summarizeGraphQLErrors(payload: ResponsePayload, rawOperationName: unknown, options: {
+    includeUnsafe: boolean;
+}): GraphQLErrorLogLine | null;
+export declare const GraphQLErrorLogPlugin: GraphileConfig.Plugin;
+export {};

package/dist/src/plugins/graphql-error-log.js

@@ -0,0 +1,103 @@
+import { NODE_ENV } from "../config.js";
+import { logger } from "../logger.js";
+const SAFE_CODE = /^[A-Z0-9_]{1,32}$/;
+const MAX_INSPECTED_RESPONSE_BYTES = 256 * 1024;
+const SAFE_OPERATION_NAME = /^[_A-Za-z][_0-9A-Za-z]*$/;
+const MAX_OPERATION_NAME_LENGTH = 100;
+const MAX_ERRORS_INSPECTED = 20;
+export function summarizeGraphQLErrors(payload, rawOperationName, options) {
+    const errors = Array.isArray(payload.errors) ? payload.errors : [];
+    if (errors.length === 0) {
+        return null;
+    }
+    const inspected = errors.slice(0, MAX_ERRORS_INSPECTED);
+    const locations = inspected.map((e) => firstLocation(e?.locations));
+    const codes = [
+        ...new Set(inspected.flatMap((e) => {
+            const code = e?.extensions?.code;
+            return typeof code === "string" && SAFE_CODE.test(code) ? [code] : [];
+        })),
+    ];
+    const isParseError = inspected.some((e) => typeof e?.message === "string" && e.message.startsWith("Syntax Error"));
+    return {
+        operationName: safeOperationName(rawOperationName),
+        kind: isParseError ? "parse" : "data" in payload ? "execution" : "request",
+        errorCount: errors.length,
+        codes,
+        locations,
+        ...(options.includeUnsafe
+            ? {
+                unsafe: inspected.map((e) => ({
+                    message: e?.message,
+                    path: e?.path,
+                })),
+            }
+            : {}),
+    };
+}
+function firstLocation(locations) {
+    const first = Array.isArray(locations) ? locations[0] : undefined;
+    const { line, column } = (first ?? {});
+    return Number.isSafeInteger(line) &&
+        Number.isSafeInteger(column) &&
+        line > 0 &&
+        column > 0
+        ? `${line}:${column}`
+        : null;
+}
+function safeOperationName(name) {
+    if (typeof name !== "string" || name === "") {
+        return null;
+    }
+    return name.length <= MAX_OPERATION_NAME_LENGTH &&
+        SAFE_OPERATION_NAME.test(name)
+        ? name
+        : "invalid";
+}
+function responsePayload(result) {
+    if (result?.type === "json") {
+        return result.json;
+    }
+    if (result?.type === "buffer" &&
+        result.buffer.length <= MAX_INSPECTED_RESPONSE_BYTES &&
+        result.buffer.includes('"errors"')) {
+        try {
+            return JSON.parse(result.buffer.toString("utf8"));
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+const operationNames = new WeakMap();
+export const GraphQLErrorLogPlugin = {
+    name: "HubGraphQLErrorLogPlugin",
+    description: "Logs GraphQL requests that return errors, without secrets",
+    version: "0.0.1",
+    grafserv: {
+        middleware: {
+            processGraphQLRequestBody(next, event) {
+                if (event.request) {
+                    operationNames.set(event.request, event.body.operationName);
+                }
+                return next();
+            },
+            async processRequest(next, event) {
+                const result = await next();
+                try {
+                    const payload = responsePayload(result);
+                    const line = payload &&
+                        summarizeGraphQLErrors(payload, operationNames.get(event.requestDigest), { includeUnsafe: NODE_ENV === "development" });
+                    if (line) {
+                        logger.warn(line, "GraphQL request returned errors");
+                    }
+                }
+                catch (e) {
+                    logger.warn({ errorType: e instanceof Error ? e.constructor.name : typeof e }, "GraphQL error logging failed");
+                }
+                return result;
+            },
+        },
+    },
+};

package/dist/src/plugins/hub-add-casino.js

@@ -56,8 +56,8 @@ export const HubAddCasinoPlugin = makeExtendSchemaPlugin((build) => {
                                     throw new GraphQLError("Unauthorized");
                                 }
                                 assert(is(input));
-                                logger.info(input, "Input");
                                 const { name, baseUrl, graphqlUrl, apiKey } = input;
+                                logger.info({ name, baseUrl, graphqlUrl }, "Input");
                                 const graphqlClient = new GraphQLClient(graphqlUrl, {
                                     headers: {
                                         Authorization: `apikey:${apiKey}`,

package/dist/src/plugins/hub-adjust-bankroll.d.ts

@@ -0,0 +1 @@
+export declare const HubAdjustBankrollPlugin: GraphileConfig.Plugin;

package/dist/src/plugins/hub-adjust-bankroll.js

@@ -0,0 +1,106 @@
+import { GraphQLError } from "graphql";
+import { context, object, sideEffect } from "postgraphile/grafast";
+import { extendSchema, gql } from "postgraphile/utils";
+import z from "zod/v4";
+import { extractFirstZodErrorMessage } from "../util.js";
+import { maybeOneRow, withPgPoolTransaction, } from "../db/index.js";
+import { insertAuditLog } from "../audit-log.js";
+const InputSchema = z.object({
+    bankrollId: z.uuid("Invalid bankroll ID"),
+    delta: z
+        .number()
+        .int("Delta must be a whole number of base units")
+        .refine((delta) => delta !== 0, "Delta must not be zero"),
+    reason: z
+        .string()
+        .trim()
+        .min(1, "Reason is required")
+        .max(200, "Max reason length: 200 chars"),
+});
+export const HubAdjustBankrollPlugin = extendSchema((build) => {
+    const bankrollTable = build.input.pgRegistry.pgResources.hub_bankroll;
+    return {
+        typeDefs: gql `
+      input HubAdjustBankrollInput {
+        bankrollId: UUID!
+        "Amount to add, in base units. Negative takes money out."
+        delta: Float!
+        reason: String!
+      }
+
+      type HubAdjustBankrollPayload {
+        hubBankroll: HubBankroll!
+      }
+
+      extend type Mutation {
+        hubAdjustBankroll(
+          input: HubAdjustBankrollInput!
+        ): HubAdjustBankrollPayload
+      }
+    `,
+        objects: {
+            Mutation: {
+                plans: {
+                    hubAdjustBankroll(_, { $input }) {
+                        const $identity = context().get("identity");
+                        const $superuserPool = context().get("superuserPool");
+                        const $bankrollId = sideEffect([$input, $identity, $superuserPool], async ([rawInput, identity, superuserPool]) => {
+                            if (identity?.kind !== "operator") {
+                                throw new GraphQLError("Unauthorized");
+                            }
+                            let input;
+                            try {
+                                input = InputSchema.parse(rawInput);
+                            }
+                            catch (e) {
+                                if (e instanceof z.ZodError) {
+                                    throw new GraphQLError(extractFirstZodErrorMessage(e));
+                                }
+                                throw e;
+                            }
+                            return withPgPoolTransaction(superuserPool, async (pgClient) => {
+                                const dbBankroll = await pgClient
+                                    .query({
+                                    text: `
+                        SELECT id, amount, liability
+                        FROM hub.bankroll
+                        WHERE id = $1
+                        FOR UPDATE
+                      `,
+                                    values: [input.bankrollId],
+                                })
+                                    .then(maybeOneRow);
+                                if (!dbBankroll) {
+                                    throw new GraphQLError("Bankroll not found");
+                                }
+                                const newAmount = dbBankroll.amount + input.delta;
+                                if (newAmount > Number.MAX_SAFE_INTEGER) {
+                                    throw new GraphQLError("Bankroll would be too large");
+                                }
+                                if (newAmount < dbBankroll.liability) {
+                                    throw new GraphQLError("Bankroll can't go below what open games may pay out");
+                                }
+                                await pgClient.query({
+                                    text: `UPDATE hub.bankroll SET amount = $2 WHERE id = $1`,
+                                    values: [dbBankroll.id, newAmount],
+                                });
+                                await insertAuditLog(pgClient, "house-bankroll", {
+                                    action: "hub:bankroll:adjust",
+                                    bankrollId: dbBankroll.id,
+                                    bankrollOld: dbBankroll.amount,
+                                    bankrollNew: newAmount,
+                                    bankrollDelta: input.delta,
+                                    metadata: { reason: input.reason },
+                                });
+                                return dbBankroll.id;
+                            });
+                        });
+                        return object({
+                            hubBankroll: bankrollTable.get({ id: $bankrollId }),
+                        });
+                    },
+                },
+            },
+        },
+    };
+}, "HubAdjustBankrollPlugin");

package/dist/src/plugins/validate-fields.js

@@ -29,9 +29,6 @@ export const AddCasinoSchema = z.strictObject({
     graphqlUrl: v.graphqlUrl(),
     apiKey: z.uuid(),
 });
-const UpdateBankrollSchema = z.strictObject({
-    amount: z.number().int().min(0),
-});
 export const ValidateCasinoFieldsPlugin = wrapPlans(() => ({
     Mutation: {
         updateHubCasinoById: (plan, $source, fieldArgs) => {
@@ -44,10 +41,5 @@ export const ValidateCasinoFieldsPlugin = wrapPlans(() => ({
             sideEffect($input, (input) => validate(input, AddCasinoSchema));
             return plan();
         },
-        updateHubBankrollById: (plan, $source, fieldArgs) => {
-            const $patch = fieldArgs.getRaw(["input", "hubBankrollPatch"]);
-            sideEffect($patch, (patch) => validate(patch, UpdateBankrollSchema));
-            return plan();
-        },
     },
 }));

package/dist/src/process-transfers/index.js

@@ -5,8 +5,6 @@ import assert from "assert";
 import { logger } from "../logger.js";
 import * as config from "../config.js";
 import * as db from "../db/index.js";
-import * as pg from "pg";
-import { z } from "zod/v4";
 const activeCasinos = new Set();
 export async function startCasinoTransferProcessor({ casinoId, signal, pool, }) {
     if (activeCasinos.has(casinoId)) {
@@ -44,51 +42,9 @@ export function initializeTransferProcessors({ signal, pool, }) {
                 logger.info(`Starting casino processor for "${casino.name}" at "${casino.graphql_url}"`);
                 startCasinoTransferProcessor({ casinoId: casino.id, signal, pool });
             }
-            await listenForNewCasinos({ signal, pool });
         }
         catch (e) {
             logger.error(e, `Error initializing transfer processors`);
         }
     })();
 }
-async function listenForNewCasinos({ signal, pool, }) {
-    const pgClient = new pg.Client(config.SUPERUSER_DATABASE_URL);
-    await pgClient.connect();
-    const NewCasinoPayload = z.object({
-        id: z.string(),
-    });
-    pgClient.on("notification", async (msg) => {
-        logger.debug(msg, `[listenForNewCasinos] received notification`);
-        switch (msg.channel) {
-            case "hub:new_casino": {
-                if (!msg.payload) {
-                    logger.error("hub:new_casino notification has no payload");
-                    return;
-                }
-                let json;
-                try {
-                    json = JSON.parse(msg.payload);
-                }
-                catch (error) {
-                    logger.error(error, "Error parsing new casino notification");
-                }
-                const result = NewCasinoPayload.safeParse(json);
-                if (!result.success) {
-                    logger.error(result.error, "Error parsing new casino notification");
-                    return;
-                }
-                startCasinoTransferProcessor({
-                    casinoId: result.data.id,
-                    signal,
-                    pool,
-                });
-                break;
-            }
-        }
-    });
-    signal.addEventListener("abort", () => {
-        pgClient.removeAllListeners("notification");
-        pgClient.end();
-    });
-    await pgClient.query("LISTEN new_casino");
-}