@zaisma/game-server 1.21.0 → 1.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zaisma/game-server",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "description": "Run your Zaisma game server: the same rooms on Zaisma or on your own server.",
   "license": "MIT",
   "homepage": "https://zaisma.com",

package/sdk/zaisma.d.ts

@@ -198,7 +198,7 @@ declare namespace Zaisma {
   const server: Server;
 
   /**
-   * Invite friends. On Zaisma it opens the page's Share, the same as the game bar's Share button: the
+   * Invite friends. On Zaisma it opens Zaisma's invite sheet, the same as the Zaisma overlay's Share: the
    * room's QR code, link and code, Copy and the share sheet ("opened", or "failed" when the page couldn't
    * open it). On your own site it opens the share sheet on phones, otherwise copies the room's invite link
    * (the game's page without a room). Call it from a button in your game, like on a "waiting for players"
@@ -227,16 +227,6 @@ declare namespace Zaisma {
    */
   function checkChat(text: string): Promise<ChatCheck>;
 
-  /**
-   * The Players panel, where a player can mute, block and report the others and see their friends. On
-   * Zaisma it opens the game bar's own Players, the same as its button (leaving full screen if the
-   * game is in it), so a Players button in your game, in your game's style, does exactly what the bar's
-   * does. On your own site, where there's no bar, it draws Zaisma's ready-made panel.
-   * A game with its own netcode offers them in its own menu. Or build your own panel
-   * with room.mute, room.block and room.report.
-   */
-  function openPlayersPanel(room: Room): void;
-
   /**
    * The signed-in player's Zaisma friends who are playing this game right now, for your own list of
    * them: to join a friend's match, watch it or invite them ({@link Friends.list}). A game never sees
@@ -605,7 +595,7 @@ declare namespace Zaisma {
 
   /**
    * Whether Zaisma's page covers the game right now, so a game can pause or hold the player's input while it does.
-   * coveredBy is "sheet" while one of Zaisma's sheets is open over the game (buying, Players, Report: the player is
+   * coveredBy is "sheet" while one of Zaisma's sheets is open over the game (buying, the Zaisma overlay, Report: the player is
    * busy with it), "card" while one of its cards is over the game's corner (Still there?, Keep your progress; the
    * game stays in view and playable), and null otherwise. Always null outside Zaisma's page (your own site, a
    * local test). Listen for "coveredBy" to hear each change.

package/sdk/zaisma.js

@@ -2574,138 +2574,9 @@
     });
   });
 
-  /** Hand a player report to the Zaisma page. If no Zaisma page answers (the game runs somewhere else), use our own form. */
-  function handOff(room, reported, opened, fallback) {
-    if (!config.site || window.parent === window) return fallback();
-    var isAnswered = false;
-    function listen(event) {
-      if (event.origin === config.site && event.source === window.parent && event.data && event.data.type === "zaisma:report-open") {
-        isAnswered = true;
-        window.removeEventListener("message", listen);
-        opened();
-      }
-    }
-    window.addEventListener("message", listen);
-    window.parent.postMessage({ type: "zaisma:report", code: room.roomCode, player: { id: reported.id, name: reported.name } }, config.site);
-    setTimeout(function () {
-      window.removeEventListener("message", listen);
-      if (!isAnswered) fallback();
-    }, 800);
-  }
-
   // The first four go to Zaisma; the rest to the game's developer.
   var REASONS = [["real_life_threat", "Threatening them in real life"], ["personal_details", "Sharing someone's personal details"], ["following_after_block", "Following me after I blocked them"], ["sexual", "Sexual behavior"], ["harassment", "Harassing or bullying"], ["cheating", "Cheating"], ["other", "Something else"]];
 
-  /** A ready-made Players panel: mute, block and report. Games open it from their own menu. */
-  function openPlayersPanel(room) {
-    // On Zaisma, the page's own Players (the bar's), so a game's Players button opens the same one.
-    if (onZaismaPage()) {
-      window.parent.postMessage({ type: "zaisma:players-open" }, config.site);
-      return;
-    }
-    var old = document.getElementById("zaisma-safety");
-    if (old) old.remove();
-    var wrap = document.createElement("div");
-    wrap.id = "zaisma-safety";
-    wrap.setAttribute("role", "dialog");
-    wrap.setAttribute("aria-label", "Players");
-    // Zaisma's Steel look: gunmetal plates with the cut corner.
-    wrap.style.cssText = "position:fixed;inset:0;z-index:2147483647;background:rgba(4,5,7,.6);display:grid;place-items:center;font:15px/1.4 system-ui,-apple-system,sans-serif;color:#eceef0";
-    var box = document.createElement("div");
-    box.style.cssText = "background:linear-gradient(180deg,#262a31,#1b1e23);box-shadow:inset 1px 1px 0 rgba(255,255,255,.09),inset -1px -1px 0 rgba(0,0,0,.7),0 14px 32px rgba(0,0,0,.42);clip-path:polygon(0 0,calc(100% - 18px) 0,100% 18px,100% 100%,0 100%);padding:18px;width:min(420px,92vw);max-height:80vh;overflow:auto";
-    wrap.appendChild(box);
-    var buttonStyle = "font:inherit;font-size:13px;font-weight:600;min-height:36px;padding:0 12px;border:0;background:linear-gradient(180deg,#30353d,#22262c);box-shadow:inset 1px 1px 0 rgba(255,255,255,.13),inset -1px -1px 0 #000;clip-path:polygon(0 0,calc(100% - 7px) 0,100% 7px,100% 100%,0 100%);color:#eceef0;cursor:pointer";
-    function close() { wrap.remove(); }
-    wrap.addEventListener("click", function (event) { if (event.target === wrap) close(); });
-    wrap.addEventListener("keydown", function (event) { if (event.key === "Escape") close(); });
-
-    function render(note) {
-      box.textContent = "";
-      var head = document.createElement("div");
-      head.style.cssText = "display:flex;justify-content:space-between;align-items:center;margin-bottom:10px";
-      var heading = document.createElement("strong");
-      heading.textContent = "Players";
-      var closeButton = document.createElement("button");
-      closeButton.textContent = "Close";
-      closeButton.style.cssText = buttonStyle;
-      closeButton.onclick = close;
-      head.append(heading, closeButton);
-      box.appendChild(head);
-      if (note) {
-        var noteText = document.createElement("p");
-        noteText.textContent = note;
-        noteText.style.cssText = "margin:0 0 10px;color:#b9e7a6";
-        box.appendChild(noteText);
-      }
-      var others = room.players.filter(function (each) { return !room.me || each.id !== room.me.id; });
-      if (!others.length) {
-        var none = document.createElement("p");
-        none.textContent = "Nobody else is here.";
-        none.style.color = "#969ba4";
-        box.appendChild(none);
-      }
-      others.forEach(function (other) {
-        var row = document.createElement("div");
-        row.style.cssText = "display:flex;gap:6px;align-items:center;padding:10px 0;box-shadow:inset 0 1px 0 #000,inset 0 2px 0 rgba(255,255,255,.05)";
-        // Only what this player did themselves shows: a block someone made of them never does.
-        var isBlocked = hasBlocked(other.id);
-        var isMuted = Boolean(room._muted && room._muted.has(other.id));
-        var name = document.createElement("span");
-        name.textContent = other.name + (isBlocked ? " (blocked)" : isMuted ? " (muted)" : "");
-        name.style.flex = "1";
-        row.appendChild(name);
-        function button(text, onclick) {
-          var each = document.createElement("button");
-          each.textContent = text;
-          each.style.cssText = buttonStyle;
-          each.onclick = onclick;
-          row.appendChild(each);
-        }
-        // A lasting block is undone on zaisma.com/friends; a session one here.
-        if (!lastingBlocked.has(other.id)) button(isBlocked ? "Unblock" : isMuted ? "Unmute" : "Mute", function () { isBlocked || isMuted ? room.unmute(other.id) : room.mute(other.id); render(); });
-        if (!isBlocked) {
-          button("Block", function () {
-            room.block(other.id).then(function (isDone) {
-              render(!isDone ? undefined : lastingBlocked.has(other.id) ? other.name + " is blocked. Unblock them on your Zaisma friends page." : other.name + " is blocked for this session.");
-            }, function () { render(); });
-          });
-        }
-        button("Report", function () { handOff(room, other, close, function () { reportForm(other); }); });
-        box.appendChild(row);
-      });
-    }
-
-    function reportForm(reported) {
-      box.textContent = "";
-      var heading = document.createElement("strong");
-      heading.textContent = "Report " + reported.name;
-      var select = document.createElement("select");
-      select.style.cssText = "display:block;width:100%;margin:12px 0;min-height:40px;padding:0 10px;background:#0d0f12;color:#eceef0;border:1px solid #000;box-shadow:inset 0 2px 5px rgba(0,0,0,.65),0 1px 0 rgba(255,255,255,.06);font:inherit";
-      REASONS.forEach(function (reason) { var option = document.createElement("option"); option.value = reason[0]; option.textContent = reason[1]; select.appendChild(option); });
-      var note = document.createElement("p");
-      note.textContent = "Zaisma reviews reports. Nothing about you is sent. They'll also be muted for you.";
-      note.style.cssText = "margin:0 0 12px;color:#969ba4;font-size:13px";
-      var send = document.createElement("button");
-      send.textContent = "Send report";
-      send.style.cssText = buttonStyle + ";background:linear-gradient(180deg,#eef0f2 0%,#b9bcc1 46%,#7d8086 100%);box-shadow:inset 1px 1px 0 #fff,inset -1px -1px 0 #000;color:#0b0b0c";
-      var back = document.createElement("button");
-      back.textContent = "Back";
-      back.style.cssText = buttonStyle + ";margin-left:6px";
-      back.onclick = function () { render(); };
-      send.onclick = function () {
-        send.disabled = true;
-        room.mute(reported.id);
-        room.report(reported.id, select.value).then(function () { render("Thanks. Your report was sent."); }, function (error) { render(error.message); });
-      };
-      box.append(heading, select, note, send, back);
-    }
-
-    render();
-    document.body.appendChild(wrap);
-    wrap.tabIndex = -1;
-    wrap.focus();
-  }
-
   var rooms = { list: listRooms, quickJoin: quickJoin, linkedRoomCode: roomCodeFromPage(), linkedServerUrl: roomCodeFromPage() ? serverUrlFromPage() : null, isLinkedAsSpectator: watchFromPage() };
   /*
    * Friend requests (zaisma.d.ts: Friends.sendRequest): the Zaisma page asks the player before anything is
@@ -2753,5 +2624,5 @@
   });
 
   var friends = { list: listFriends, setRoom: setOwnRoom, sendRequest: sendFriendRequest };
-  window.Zaisma = { sdkVersionNumber: 1, gameSlug: config.game || null, player: player, setUpOffZaisma: setUpOffZaisma, joinRoom: joinRoom, rooms: rooms, server: server, invite: invite, checkChat: checkChat, openPlayersPanel: openPlayersPanel, links: links, items: items, friends: friends, saves: saves, versions: versions, page: zaismaPage };
+  window.Zaisma = { sdkVersionNumber: 1, gameSlug: config.game || null, player: player, setUpOffZaisma: setUpOffZaisma, joinRoom: joinRoom, rooms: rooms, server: server, invite: invite, checkChat: checkChat, links: links, items: items, friends: friends, saves: saves, versions: versions, page: zaismaPage };
 })();

package/src/doors.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Door contracts (docs/DOORS.md). Every way into Zaisma, of every kind, states who may call it, what it may
+ * reach and what it trusts from other doors, and goes through checkDoor before its own code runs. Here, in the
+ * game server package's internal part, so a room on a developer's own server goes through the same check;
+ * never in the package's published index.
+ */
+/** Callers the door's guard proves itself, from what it read of the request or the room. */
+export type DoorCallerProvenByGuard = 
+/** Guests too. A door that shows a signed-in person more trusts `session` as well. */
+"anyone"
+/** A session that works. */
+ | "signed_in"
+/** A session with a finished account, and no developer ban unless the door keeps it open to them. */
+ | "developer"
+/** Cloudflare Access to /admin. */
+ | "admin"
+/** Anyone in the room, spectators too. */
+ | "room_member"
+/** A player in the room, not a spectator. */
+ | "room_player"
+/** The room's host. */
+ | "room_host";
+/** Callers a named function proves, because the proof takes the door's own data (a body's signature, a token's row). */
+export type DoorCallerProvenByFunction = 
+/** The API router: an API key's access, or a session from Zaisma's own pages. */
+"api_caller"
+/** A tester or preview link's token in the address. */
+ | "link_holder"
+/** A Sign in with Zaisma code or access token. */
+ | "token_holder"
+/** Stripe or GitHub, by the signature on the body. */
+ | "signed_sender"
+/** A game's own page, by the request's Origin. */
+ | "game_page"
+/** A signed player pass. */
+ | "pass_holder";
+export type DoorCaller = DoorCallerProvenByGuard | DoorCallerProvenByFunction;
+/**
+ * What a door may touch. The first seven are the API's own words (ApiRoute's reaches, apps/site/src/developer.ts):
+ * `account`, `player_save`, `game`, `webhook`, `sign_in_app` and `forum_topic` are the caller's own or what the caller may read,
+ * and `nothing_private` is what anyone may see. The `any_` ones and `zaisma_settings` are only ever an admin's.
+ */
+export type DoorReach = "account" | "player_save" | "game" | "webhook" | "sign_in_app" | "forum_topic" | "nothing_private" | "any_game" | "any_account" | "zaisma_settings" | "room" | "purchase";
+/** What a door takes from another door, as the security map names them (scripts/security-map/doors.mjs). */
+export type DoorTrust = "session" | "api_key" | "oauth_code" | "oauth_access" | "tester_link" | "preview_link" | "player_pass" | "admin_access" | "player_id" | "stripe_signature" | "github_signature" | "game_origin" | "purchase_receipt" | "passkey" | "email_code";
+/** The function that proves a caller; a test checks it exists. */
+export interface DoorProof {
+    source_path: string;
+    symbol_name: string;
+}
+export interface DoorContractFields {
+    reaches: DoorReach;
+    trusts: readonly DoorTrust[];
+}
+/** A caller a function proves can't be stated without naming the function, so it doesn't build. */
+export type DoorContract = DoorContractFields & ({
+    whoMayCall: DoorCallerProvenByGuard;
+} | {
+    whoMayCall: DoorCallerProvenByFunction;
+    provenBy: DoorProof;
+});
+/**
+ * The one check every door goes through. `proven` is who the door's guard found the caller to be; a caller a
+ * named function proves passes here, and that function refuses them, before anything else of the door runs.
+ */
+export declare function checkDoor(contract: DoorContract, proven: readonly DoorCaller[]): boolean;
+/** Where a door's path parts come from: `:name` parts, each a [^/]+ unless named here, and a final `*` for the rest. */
+export declare function doorPathPattern(path: string, partPatterns?: Readonly<Record<string, string>>): RegExp;

package/src/doors.js

@@ -0,0 +1,24 @@
+/**
+ * Door contracts (docs/DOORS.md). Every way into Zaisma, of every kind, states who may call it, what it may
+ * reach and what it trusts from other doors, and goes through checkDoor before its own code runs. Here, in the
+ * game server package's internal part, so a room on a developer's own server goes through the same check;
+ * never in the package's published index.
+ */
+/**
+ * The one check every door goes through. `proven` is who the door's guard found the caller to be; a caller a
+ * named function proves passes here, and that function refuses them, before anything else of the door runs.
+ */
+export function checkDoor(contract, proven) {
+    return contract.whoMayCall === "anyone" || "provenBy" in contract || proven.includes(contract.whoMayCall);
+}
+/** Where a door's path parts come from: `:name` parts, each a [^/]+ unless named here, and a final `*` for the rest. */
+export function doorPathPattern(path, partPatterns = {}) {
+    const parts = path.split("/").map((part) => {
+        if (part === "*")
+            return ".*";
+        if (part.startsWith(":"))
+            return `(?<${part.slice(1)}>${partPatterns[part.slice(1)] ?? "[^/]+"})`;
+        return part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    });
+    return new RegExp(`^${parts.join("/")}$`);
+}

package/src/internal.d.ts

@@ -12,3 +12,4 @@ export * from "./pass.ts";
 export * from "./names.ts";
 export * from "./chat.ts";
 export * from "./relay.ts";
+export * from "./doors.ts";

package/src/internal.js

@@ -14,3 +14,4 @@ export * from "./pass.js";
 export * from "./names.js";
 export * from "./chat.js";
 export * from "./relay.js";
+export * from "./doors.js";

package/src/room.d.ts

@@ -1334,6 +1334,70 @@ export interface StateSyncHooks {
 export declare const NO_MESSAGE_TYPE = "(none)";
 export declare const BYTES_MESSAGE_TYPE = "(bytes)";
 export declare const ZAISMA_MESSAGE_TYPE = "(zaisma)";
+/**
+ * Every message a room takes (docs/DOORS.md). receive's switch is over these names, so a new one without a row
+ * doesn't build. A spectator may send only what's for room members. hello comes first and proves the pass; chat is the host's to take before receive (readChatMessage);
+ * bytes is every binary message (receiveBytes). A type with no row, maybe from a newer SDK, is counted and ignored.
+ */
+export declare const ROOM_MESSAGE_DOORS: {
+    readonly hello: {
+        readonly whoMayCall: "pass_holder";
+        readonly reaches: "room";
+        readonly trusts: readonly ["player_pass"];
+        readonly provenBy: {
+            readonly source_path: "packages/game-server/src/pass.ts";
+            readonly symbol_name: "verifyPass";
+        };
+    };
+    readonly probe_answer: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly room: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly kick: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly here: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly idle: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly hidden: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly shown: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly back: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly message: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly bytes: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly chat: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly block: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly unblock: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly friend_request: import("./doors.ts").DoorContractFields & {
+        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    };
+    readonly "zaisma:purchase": {
+        readonly whoMayCall: "room_player";
+        readonly reaches: "purchase";
+        readonly trusts: readonly ["player_pass", "purchase_receipt"];
+    };
+};
+export type RoomMessageType = keyof typeof ROOM_MESSAGE_DOORS;
 export declare const OTHER_MESSAGE_TYPE = "(other)";
 /** State sync's updates (stateSyncEnabled). */
 export declare const STATE_MESSAGE_TYPE = "(state)";

package/src/room.js

@@ -8,6 +8,7 @@
  */
 import { CHAT_CHECK_LIMITS, CHAT_ROOM_LIMITS } from "./chat.js";
 import { DatabaseError } from "./database.js";
+import { checkDoor } from "./doors.js";
 import { isRoomCode, roomCode } from "./names.js";
 import { readSchedules } from "./schedules.js";
 import { roomCallChecks } from "./room-calls.js";
@@ -502,6 +503,35 @@ export const STATE_SYNC = Symbol("stateSync");
 export const NO_MESSAGE_TYPE = "(none)";
 export const BYTES_MESSAGE_TYPE = "(bytes)";
 export const ZAISMA_MESSAGE_TYPE = "(zaisma)";
+const ROOM_MEMBER = { whoMayCall: "room_member", reaches: "room", trusts: ["player_pass"] };
+const ROOM_PLAYER = { whoMayCall: "room_player", reaches: "room", trusts: ["player_pass"] };
+const ROOM_HOST = { whoMayCall: "room_host", reaches: "room", trusts: ["player_pass"] };
+/**
+ * Every message a room takes (docs/DOORS.md). receive's switch is over these names, so a new one without a row
+ * doesn't build. A spectator may send only what's for room members. hello comes first and proves the pass; chat is the host's to take before receive (readChatMessage);
+ * bytes is every binary message (receiveBytes). A type with no row, maybe from a newer SDK, is counted and ignored.
+ */
+export const ROOM_MESSAGE_DOORS = {
+    hello: { whoMayCall: "pass_holder", reaches: "room", trusts: ["player_pass"], provenBy: { source_path: "packages/game-server/src/pass.ts", symbol_name: "verifyPass" } },
+    probe_answer: ROOM_MEMBER,
+    room: ROOM_HOST,
+    kick: ROOM_HOST,
+    here: ROOM_PLAYER,
+    idle: ROOM_PLAYER,
+    hidden: ROOM_PLAYER,
+    shown: ROOM_PLAYER,
+    back: ROOM_PLAYER,
+    message: ROOM_PLAYER,
+    bytes: ROOM_PLAYER,
+    chat: ROOM_PLAYER,
+    block: ROOM_PLAYER,
+    unblock: ROOM_PLAYER,
+    friend_request: ROOM_PLAYER,
+    "zaisma:purchase": { whoMayCall: "room_player", reaches: "purchase", trusts: ["player_pass", "purchase_receipt"] },
+};
+const isRoomMessageType = (type) => typeof type === "string" && Object.hasOwn(ROOM_MESSAGE_DOORS, type);
+const PLAYER_PROVEN = ["room_member", "room_player"];
+const HOST_PROVEN = ["room_member", "room_player", "room_host"];
 export const OTHER_MESSAGE_TYPE = "(other)";
 /** State sync's updates (stateSyncEnabled). */
 export const STATE_MESSAGE_TYPE = "(state)";
@@ -1759,7 +1789,10 @@ export class RoomCore {
         const presence = this.presence.get(playerId);
         if (presence)
             presence.seenAtMs = this.now();
-        switch (message.type) {
+        const type = isRoomMessageType(message.type) ? message.type : null;
+        if (type && !checkDoor(ROOM_MESSAGE_DOORS[type], this.hostPlayerId === playerId ? HOST_PROVEN : PLAYER_PROVEN))
+            return "not_allowed";
+        switch (type) {
             case "room":
                 return this.hostChange(playerId, message);
             case "kick":
@@ -1838,7 +1871,7 @@ export class RoomCore {
         if (text.length <= ROOM_LIMITS.maximumGameMessageSizeBytes) {
             try {
                 const message = JSON.parse(text);
-                if (message?.type === "probe_answer" && this.answer(spectatorId, message.probeNumber))
+                if (isRoomMessageType(message?.type) && ROOM_MESSAGE_DOORS[message.type].whoMayCall === "room_member" && this.answer(spectatorId, message.probeNumber))
                     return null;
             }
             catch {
@@ -1910,8 +1943,6 @@ export class RoomCore {
      * text between strangers), so the kicked player is told the host removed them.
      */
     hostKick(playerId, message) {
-        if (this.hostPlayerId !== playerId)
-            return "not_allowed";
         const kickedId = message.playerId;
         if (typeof kickedId !== "string" || kickedId === playerId || !this.players.has(kickedId))
             return "bad_message";
@@ -1920,8 +1951,6 @@ export class RoomCore {
     }
     /** The host hides, shows, opens, closes, turns friends' Join on or off, names or labels the room, when the game server allows it. */
     hostChange(playerId, message) {
-        if (this.hostPlayerId !== playerId)
-            return "not_allowed";
         const asked = message.room;
         if (!asked || typeof asked !== "object" || Array.isArray(asked))
             return "bad_message";