@open-core/framework 0.1.0-alpha.1 → 0.2.0-beta.1

package/dist/runtime/server/system/processors/netEvent.processor.js

@@ -0,0 +1,240 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetEventProcessor = void 0;
+const tsyringe_1 = require("tsyringe");
+const zod_1 = __importDefault(require("zod"));
+const INetTransport_1 = require("../../../../adapters/contracts/INetTransport");
+const logger_1 = require("../../../../kernel/shared/logger");
+const utils_1 = require("../../../../kernel/utils");
+const security_error_1 = require("../../../../kernel/utils/error/security.error");
+const net_event_security_observer_contract_1 = require("../../contracts/security/net-event-security-observer.contract");
+const security_handler_contract_1 = require("../../contracts/security/security-handler.contract");
+const resolve_method_1 = require("../../helpers/resolve-method");
+const player_directory_port_1 = require("../../services/ports/player-directory.port");
+const metadata_server_keys_1 = require("../metadata-server.keys");
+const schema_generator_1 = require("../schema-generator");
+let NetEventProcessor = class NetEventProcessor {
+    constructor(playerService, securityHandler, netEventObserver, netTransport) {
+        this.playerService = playerService;
+        this.securityHandler = securityHandler;
+        this.netEventObserver = netEventObserver;
+        this.netTransport = netTransport;
+        this.metadataKey = metadata_server_keys_1.METADATA_KEYS.NET_EVENT;
+        this.INVALID_COUNTS_META_KEY = 'netEvent.invalidCounts';
+    }
+    process(instance, methodName, metadata) {
+        const result = (0, resolve_method_1.resolveMethod)(instance, methodName, `[NetEventProcessor] Method "${methodName}" not found`);
+        if (!result)
+            return;
+        const { handler, handlerName, proto } = result;
+        const isPublic = Reflect.getMetadata(metadata_server_keys_1.METADATA_KEYS.PUBLIC, proto, methodName);
+        this.netTransport.onNet(metadata.eventName, async (ctx, ...args) => {
+            var _a;
+            const clientId = ctx.clientId;
+            const player = this.playerService.getByClient(clientId);
+            if (!player) {
+                logger_1.loggers.netEvent.warn(`Event ignored: Player session not found`, {
+                    event: metadata.eventName,
+                    clientId: clientId,
+                });
+                return;
+            }
+            // ═══════════════════════════════════════════════════════════════
+            // SECURE BY DEFAULT: Require authentication unless @Public()
+            // ═══════════════════════════════════════════════════════════════
+            if (!isPublic && !player.accountID) {
+                logger_1.loggers.security.warn(`Unauthenticated request blocked`, {
+                    event: metadata.eventName,
+                    clientId: clientId,
+                });
+                player.emit('core:auth:required', { event: metadata.eventName });
+                return;
+            }
+            let validatedArgs = args;
+            let schema;
+            try {
+                schema = (_a = metadata.schema) !== null && _a !== void 0 ? _a : (0, schema_generator_1.generateSchemaFromTypes)(metadata.paramTypes);
+            }
+            catch (error) {
+                if (error instanceof utils_1.AppError) {
+                    logger_1.loggers.netEvent.fatal(error.message, { playerId: clientId }, error);
+                    return;
+                }
+                throw error;
+            }
+            if (!schema) {
+                logger_1.loggers.netEvent.fatal(`Event '${metadata.eventName}' expects complex args but has no schema. Provide options.schema in @OnNet().`, { event: metadata.eventName, playerId: clientId });
+                return;
+            }
+            try {
+                if (schema instanceof zod_1.default.ZodTuple) {
+                    validatedArgs = schema.parse(args);
+                }
+                else {
+                    if (args.length !== 1) {
+                        throw new security_error_1.SecurityError('LOG', `Invalid argument count in ${metadata.eventName}`, {
+                            expected: 1,
+                            received: args.length,
+                        });
+                    }
+                    validatedArgs = [schema.parse(args[0])];
+                }
+            }
+            catch (error) {
+                if (error instanceof zod_1.default.ZodError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: 'zod',
+                        zodError: error,
+                    });
+                    return;
+                }
+                if (error instanceof security_error_1.SecurityError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: this.reasonFromSecurityError(error),
+                        violation: error,
+                    });
+                    return;
+                }
+                logger_1.loggers.netEvent.error(`Validation error in event`, {
+                    event: metadata.eventName,
+                    playerId: player.clientID,
+                }, error);
+                return;
+            }
+            try {
+                await handler(player, ...validatedArgs);
+            }
+            catch (error) {
+                if (error instanceof security_error_1.SecurityError) {
+                    await this.handleInvalidPayload({
+                        player,
+                        event: metadata.eventName,
+                        schema,
+                        receivedArgsCount: args.length,
+                        reason: this.reasonFromSecurityError(error),
+                        violation: error,
+                    });
+                    return;
+                }
+                logger_1.loggers.netEvent.error(`Handler error in event`, {
+                    event: metadata.eventName,
+                    handler: handlerName,
+                    playerId: player.clientID,
+                }, error);
+            }
+        });
+        logger_1.loggers.netEvent.debug(`Registered: ${metadata.eventName} -> ${handlerName}`);
+    }
+    async safeHandleViolation(player, violation, event) {
+        try {
+            await this.securityHandler.handleViolation(player, violation);
+        }
+        catch (e) {
+            logger_1.loggers.security.fatal(`Failed to handle security violation`, { event, playerId: player.clientID }, e);
+        }
+    }
+    reasonFromSecurityError(error) {
+        return error.message.includes('Invalid argument count') ? 'arg_count' : 'security_error';
+    }
+    async handleInvalidPayload(params) {
+        const invalidCount = this.incrementInvalidCount(params.player, params.event);
+        const zodSummary = params.zodError ? this.summarizeZodError(params.zodError) : undefined;
+        const ctx = {
+            event: params.event,
+            reason: params.reason,
+            playerId: params.player.clientID,
+            accountId: params.player.accountID,
+            invalidCount,
+            zodSummary,
+            receivedArgsCount: params.receivedArgsCount,
+            expectedArgsCount: this.getExpectedArgsCount(params.schema),
+        };
+        logger_1.loggers.netEvent.warn(`Invalid payload`, {
+            event: ctx.event,
+            playerId: ctx.playerId,
+            accountId: ctx.accountId,
+            invalidCount: ctx.invalidCount,
+            reason: ctx.reason,
+            zodSummary: ctx.zodSummary,
+        });
+        await this.safeObserve(params.player, ctx);
+        if (params.violation) {
+            await this.safeHandleViolation(params.player, params.violation, params.event);
+            return;
+        }
+        if (params.zodError) {
+            const violation = new security_error_1.SecurityError('LOG', `Invalid data received in ${params.event}`, {
+                issues: zodSummary !== null && zodSummary !== void 0 ? zodSummary : params.zodError.message,
+            });
+            await this.safeHandleViolation(params.player, violation, params.event);
+        }
+    }
+    incrementInvalidCount(player, event) {
+        var _a, _b;
+        const counts = ((_a = player.getMeta(this.INVALID_COUNTS_META_KEY)) !== null && _a !== void 0 ? _a : {});
+        counts[event] = ((_b = counts[event]) !== null && _b !== void 0 ? _b : 0) + 1;
+        player.setMeta(this.INVALID_COUNTS_META_KEY, counts);
+        return counts[event];
+    }
+    summarizeZodError(error, maxIssues = 3) {
+        return error.issues.slice(0, maxIssues).map((issue) => {
+            const path = issue.path.length ? issue.path.join('.') : '<root>';
+            return `${path}: ${issue.message}`;
+        });
+    }
+    async safeObserve(player, ctx) {
+        try {
+            await this.netEventObserver.onInvalidPayload(player, ctx);
+        }
+        catch (e) {
+            logger_1.coreLogger.error(`NetEvent observer failed`, { event: ctx.event, playerId: player.clientID }, e);
+        }
+    }
+    getExpectedArgsCount(schema) {
+        var _a;
+        if (schema instanceof zod_1.default.ZodTuple) {
+            const defItems = (_a = schema === null || schema === void 0 ? void 0 : schema._def) === null || _a === void 0 ? void 0 : _a.items;
+            if (Array.isArray(defItems))
+                return defItems.length;
+            const items = schema === null || schema === void 0 ? void 0 : schema.items;
+            if (Array.isArray(items))
+                return items.length;
+            return undefined;
+        }
+        return 1;
+    }
+};
+exports.NetEventProcessor = NetEventProcessor;
+exports.NetEventProcessor = NetEventProcessor = __decorate([
+    (0, tsyringe_1.injectable)(),
+    __param(1, (0, tsyringe_1.inject)(security_handler_contract_1.SecurityHandlerContract)),
+    __param(2, (0, tsyringe_1.inject)(net_event_security_observer_contract_1.NetEventSecurityObserverContract)),
+    __param(3, (0, tsyringe_1.inject)(INetTransport_1.INetTransport)),
+    __metadata("design:paramtypes", [player_directory_port_1.PlayerDirectoryPort,
+        security_handler_contract_1.SecurityHandlerContract,
+        net_event_security_observer_contract_1.NetEventSecurityObserverContract,
+        INetTransport_1.INetTransport])
+], NetEventProcessor);

package/dist/runtime/server/system/processors/tick.processor.d.ts

@@ -0,0 +1,8 @@
+import { ITick } from '../../../../adapters/contracts/ITick';
+import { type DecoratorProcessor } from '../../../../kernel/di/index';
+export declare class TickProcessor implements DecoratorProcessor {
+    private tickService;
+    readonly metadataKey: string;
+    constructor(tickService: ITick);
+    process(target: any, methodName: string): void;
+}

package/dist/{server → runtime/server}/system/processors/tick.processor.js

@@ -5,19 +5,27 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TickProcessor = void 0;
 const tsyringe_1 = require("tsyringe");
+const ITick_1 = require("../../../../adapters/contracts/ITick");
+const logger_1 = require("../../../../kernel/shared/logger");
 const metadata_server_keys_1 = require("../metadata-server.keys");
-const logger_1 = require("../../../shared/logger");
 let TickProcessor = class TickProcessor {
-    constructor() {
+    constructor(tickService) {
+        this.tickService = tickService;
         this.metadataKey = metadata_server_keys_1.METADATA_KEYS.TICK;
     }
     process(target, methodName) {
         const handler = target[methodName].bind(target);
         const handlerName = `${target.constructor.name}.${methodName}`;
-        setTick(async () => {
+        this.tickService.setTick(async () => {
             try {
                 await handler();
             }
@@ -32,5 +40,7 @@ let TickProcessor = class TickProcessor {
 };
 exports.TickProcessor = TickProcessor;
 exports.TickProcessor = TickProcessor = __decorate([
-    (0, tsyringe_1.injectable)()
+    (0, tsyringe_1.injectable)(),
+    __param(0, (0, tsyringe_1.inject)(ITick_1.ITick)),
+    __metadata("design:paramtypes", [ITick_1.ITick])
 ], TickProcessor);

package/dist/runtime/server/system/processors.register.d.ts

@@ -0,0 +1,2 @@
+import { RuntimeContext } from '../runtime';
+export declare function registerSystemServer(ctx: RuntimeContext): void;

package/dist/runtime/server/system/processors.register.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSystemServer = registerSystemServer;
+const index_1 = require("../../../kernel/di/index");
+const net_event_security_observer_contract_1 = require("../contracts/security/net-event-security-observer.contract");
+const security_handler_contract_1 = require("../contracts/security/security-handler.contract");
+const default_net_event_security_observer_1 = require("../services/default/default-net-event-security-observer");
+const default_security_handler_1 = require("../services/default/default-security.handler");
+const command_processor_1 = require("./processors/command.processor");
+const coreEvent_processor_1 = require("./processors/coreEvent.processor");
+const export_processor_1 = require("./processors/export.processor");
+const fivemEvent_processor_1 = require("./processors/fivemEvent.processor");
+const netEvent_processor_1 = require("./processors/netEvent.processor");
+const tick_processor_1 = require("./processors/tick.processor");
+function registerSystemServer(ctx) {
+    const { features } = ctx;
+    if (features.netEvents.enabled) {
+        index_1.di.register('DecoratorProcessor', { useClass: netEvent_processor_1.NetEventProcessor });
+        if (!index_1.di.isRegistered(security_handler_contract_1.SecurityHandlerContract)) {
+            index_1.di.registerSingleton(security_handler_contract_1.SecurityHandlerContract, default_security_handler_1.DefaultSecurityHandler);
+        }
+        if (!index_1.di.isRegistered(net_event_security_observer_contract_1.NetEventSecurityObserverContract)) {
+            index_1.di.registerSingleton(net_event_security_observer_contract_1.NetEventSecurityObserverContract, default_net_event_security_observer_1.DefaultNetEventSecurityObserver);
+        }
+    }
+    index_1.di.register('DecoratorProcessor', { useClass: tick_processor_1.TickProcessor });
+    if (features.exports.enabled) {
+        index_1.di.register('DecoratorProcessor', { useClass: export_processor_1.ExportProcessor });
+    }
+    index_1.di.register('DecoratorProcessor', { useClass: coreEvent_processor_1.CoreEventProcessor });
+    if (features.commands.enabled) {
+        index_1.di.register('DecoratorProcessor', { useClass: command_processor_1.CommandProcessor });
+    }
+    if (features.fiveMEvents.enabled) {
+        index_1.di.register('DecoratorProcessor', { useClass: fivemEvent_processor_1.FiveMEventProcessor });
+    }
+}

package/dist/{server → runtime/server}/system/schema-generator.d.ts

@@ -1,2 +1,2 @@
 import z from 'zod';
-export declare function generateSchemaFromTypes(paramTypes: any[]): z.ZodTuple | null;
+export declare function generateSchemaFromTypes(paramTypes: any[]): z.ZodTuple | undefined;

package/dist/{server → runtime/server}/system/schema-generator.js

@@ -5,11 +5,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateSchemaFromTypes = generateSchemaFromTypes;
 const zod_1 = __importDefault(require("zod"));
+const utils_1 = require("../../../kernel/utils");
 const player_1 = require("../entities/player");
 function typeToZodSchema(type) {
     switch (type) {
         case String:
-            return zod_1.default.coerce.string();
+            // Use string().min(1) to reject empty/undefined values
+            // Command args are already strings, no coercion needed
+            return zod_1.default.string().min(1);
         case Number:
             return zod_1.default.coerce.number();
         case Boolean:
@@ -17,18 +20,24 @@ function typeToZodSchema(type) {
         case Array:
             return zod_1.default.array(zod_1.default.any());
         case Object:
-            return zod_1.default.any();
-        default:
-            return zod_1.default.any();
+            return undefined;
     }
 }
 function generateSchemaFromTypes(paramTypes) {
     var _a;
-    if (!paramTypes || paramTypes.length <= 1)
-        return null;
+    if (!paramTypes || paramTypes.length === 0)
+        return zod_1.default.tuple([]);
     if (paramTypes[0] !== player_1.Player) {
-        throw new Error(`@OnNet: First parameter must be Player, got ${(_a = paramTypes[0]) === null || _a === void 0 ? void 0 : _a.name}`);
+        throw new utils_1.AppError('SCHEMA:VALIDATION_ERROR', `First parameter must be Player, got ${(_a = paramTypes[0]) === null || _a === void 0 ? void 0 : _a.name}`, 'core');
+    }
+    if (paramTypes.length === 1)
+        return zod_1.default.tuple([]);
+    const argSchemas = [];
+    for (const t of paramTypes.slice(1)) {
+        const s = typeToZodSchema(t);
+        if (!s)
+            return undefined;
+        argSchemas.push(s);
     }
-    const argSchemas = paramTypes.slice(1).map(typeToZodSchema);
     return zod_1.default.tuple(argSchemas);
 }

package/dist/{server/templates/admin → runtime/server/templates}/admin.controller-template.d.ts

@@ -1,4 +1,4 @@
-import type { Player } from '../../entities';
+import { Player } from '../entities';
 type CommandArgs = string[] | any;
 /**
  * Template for admin controller implementations.

package/dist/runtime/server/templates/index.d.ts

@@ -0,0 +1 @@
+export * from './admin.controller-template';

package/dist/runtime/server/templates/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./admin.controller-template"), exports);