@zaisma/game-server 1.22.0 → 1.24.0

package/src/room.js

@@ -8,6 +8,7 @@
  */
 import { CHAT_CHECK_LIMITS, CHAT_ROOM_LIMITS } from "./chat.js";
 import { DatabaseError } from "./database.js";
+import { answersJson, checkDoor, fieldsOf, gameData, listOf, orNothing, realNumber, schemaProblems, text as textUpTo, yesOrNo } from "./doors.js";
 import { isRoomCode, roomCode } from "./names.js";
 import { readSchedules } from "./schedules.js";
 import { roomCallChecks } from "./room-calls.js";
@@ -321,6 +322,7 @@ export const ERROR_TEXT = {
     refused: "The game didn't let you into this room.",
     room_not_running: "That room isn't running.",
     hosting_paused: "This game's hosting is paused. It starts again when the month resets or its developer adds credit.",
+    rented_share_used: "This network looks like a server. Turn off your VPN or sign in with an account that has played before.",
     account_needed: "Playing online needs a Zaisma account. Sign in on the game's page to play.",
     game_not_open_to_player: "This game isn't open to this account.",
     blocked_player_here: "Someone you blocked is in this room.",
@@ -444,6 +446,9 @@ export function readChatMessage(text) {
     }
     if (!parsed || typeof parsed !== "object" || parsed.type !== "chat")
         return null;
+    // One of the wrong shape isn't chat: receive refuses it.
+    if (roomMessageProblem("chat", parsed))
+        return null;
     const chat = parsed;
     return { chatNumber: Number.isSafeInteger(chat.chatNumber) ? chat.chatNumber : 0, text: chat.text, toPlayerIds: chat.toPlayerIds, sizeBytes: utf8ByteCount(text) };
 }
@@ -502,6 +507,153 @@ export const STATE_SYNC = Symbol("stateSync");
 export const NO_MESSAGE_TYPE = "(none)";
 export const BYTES_MESSAGE_TYPE = "(bytes)";
 export const ZAISMA_MESSAGE_TYPE = "(zaisma)";
+/** A pass or a player token, at most, and a whole hello with the fullest of them. */
+const HELLO_PROOF_MAXIMUM_CHARACTER_COUNT = 96 * 1024;
+const HELLO_MAXIMUM_SIZE_BYTES = HELLO_PROOF_MAXIMUM_CHARACTER_COUNT + 2 * ROOM_LIMITS.maximumJoinDataSizeBytes + 8 * 1024;
+/** What a player is sent, by its type, with each type's fields closed: a game's own data and a room's settings pass as they are. Checked in tests only, since this is the busiest path there is. */
+const looseObject = { type: "object" };
+const frameOf = (messageType, fields = {}, optional = {}) => ({
+    type: "object",
+    properties: { type: { type: "string", enum: [messageType] }, ...fields, ...optional },
+    required: ["type", ...Object.keys(fields)],
+    additionalProperties: false,
+});
+const wireText = { type: "string" };
+const wireNumber = { type: "number" };
+const wireYesOrNo = { type: "boolean" };
+const wireNullable = (type) => ({ type: [type, "null"] });
+const wirePlayers = { type: "array", items: looseObject };
+const WIRE_DATA = {};
+export const ROOM_FRAME = {
+    anyOf: [
+        frameOf("welcome", { me: looseObject, isSpectator: wireYesOrNo, players: wirePlayers, room: looseObject, spectatorCount: wireNumber, hostPlayerId: wireNullable("string"), awayChecks: looseObject, endsAt: wireNullable("string"), probeIntervalSec: wireNullable("number"), protocolVersionNumber: wireNumber, canChat: wireYesOrNo }),
+        frameOf("probe", { probeNumber: wireNumber, serverTimeMs: wireNumber, pingDurationMs: wireNullable("number") }),
+        frameOf("ending", { endsAt: wireText }),
+        frameOf("ending_cancelled"),
+        frameOf("version_update", { step: wireText, versionId: wireText, appliesAt: wireText, isReloading: wireYesOrNo }),
+        frameOf("players", { players: wirePlayers, hostPlayerId: wireNullable("string") }),
+        frameOf("away", { awayReason: wireText, seatHoldDurationSec: wireNumber }),
+        frameOf("kicked", { message: wireText, isKeptOut: wireYesOrNo }),
+        frameOf("room", { room: looseObject, spectatorCount: wireNumber }),
+        frameOf("move", { roomCode: wireText }),
+        frameOf("message", { data: WIRE_DATA, fromPlayerId: wireNullable("string") }),
+        frameOf("room_message", { roomMessage: looseObject }),
+        frameOf("state", { serverTimeMs: wireNumber }, { full: WIRE_DATA, changes: { type: "array" } }),
+        frameOf("blocks", { playerIds: { type: "array", items: wireText } }),
+        frameOf("friend_request"),
+        frameOf("chat", { fromPlayerId: wireText, text: wireText, hasSwearing: wireYesOrNo, hasSlur: wireYesOrNo, sentAt: wireText }),
+        frameOf("chat_sent", { chatNumber: wireNumber, sentAt: wireText }),
+        frameOf("chat_stopped", { chatNumber: wireNumber, reason: wireText, message: wireText }),
+        frameOf("error", { code: wireText, message: wireText }, { versionId: wireText, chatNumber: wireNumber }),
+        frameOf("ended", { message: wireText, endReason: wireText }),
+    ],
+};
+/** The room's settings as a client may ask for them: tidyRoomInfo cuts a name and labels to their limits, and these are only the outer wall. */
+const ASKED_ROOM = fieldsOf({
+    isListed: yesOrNo,
+    isOpen: yesOrNo,
+    friendJoinsEnabled: yesOrNo,
+    name: textUpTo(1000),
+    labels: gameData(4 * 1024),
+});
+const PLAYER_ID_SHAPE = textUpTo(80);
+const IDLE_FIELDS = { idleTimeoutSec: realNumber(0, Number.MAX_SAFE_INTEGER), idleCheckEnabled: yesOrNo };
+/** A connection's limit is a room's message bucket, which takes a token per player before any of these runs. */
+const roomMessage = (whoMayCall, fields = {}, required = []) => ({
+    whoMayCall,
+    reaches: "room",
+    trusts: ["player_pass"],
+    takes: { query: {}, body: { kind: "json", fields: { type: textUpTo(40), ...fields }, required: ["type", ...required], maximumSizeBytes: ROOM_LIMITS.maximumGameMessageSizeBytes } },
+    answers: answersJson(ROOM_FRAME),
+    limit: { whyNoLimit: "room_token_bucket" },
+});
+/**
+ * Every message a room takes (docs/DOORS.md). receive's switch is over these names, so a new one without a row
+ * doesn't build. A spectator may send only what's for room members. hello comes first and proves the pass; chat is the host's to take before receive (readChatMessage);
+ * bytes is every binary message (receiveBytes). A type with no row, maybe from a newer SDK, is counted and ignored.
+ */
+export const ROOM_MESSAGE_DOORS = {
+    hello: {
+        whoMayCall: "pass_holder",
+        reaches: "room",
+        trusts: ["player_pass"],
+        provenBy: { source_path: "packages/game-server/src/pass.ts", symbol_name: "verifyPass" },
+        takes: {
+            query: {},
+            body: {
+                kind: "json",
+                fields: {
+                    type: textUpTo(40),
+                    protocolVersionNumber: realNumber(0, Number.MAX_SAFE_INTEGER),
+                    pass: textUpTo(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT),
+                    playerToken: orNothing(textUpTo(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT)),
+                    joinData: gameData(ROOM_LIMITS.maximumJoinDataSizeBytes * 2),
+                    room: ASKED_ROOM,
+                    isSpectator: yesOrNo,
+                    isQuickJoin: yesOrNo,
+                    avoidBlockedPlayers: yesOrNo,
+                    versionId: textUpTo(80),
+                    playShare: textUpTo(400),
+                    hasGraphicsChip: yesOrNo,
+                    isInputSeen: yesOrNo,
+                    ...IDLE_FIELDS,
+                },
+                required: ["type"],
+                maximumSizeBytes: HELLO_MAXIMUM_SIZE_BYTES,
+            },
+        },
+        answers: answersJson(ROOM_FRAME),
+        limit: { level: "steady", counts: "player" },
+    },
+    probe_answer: roomMessage("room_member", { probeNumber: realNumber(0, Number.MAX_SAFE_INTEGER) }),
+    room: roomMessage("room_host", { room: ASKED_ROOM }, ["room"]),
+    kick: roomMessage("room_host", { playerId: PLAYER_ID_SHAPE, keepOut: yesOrNo }, ["playerId"]),
+    here: roomMessage("room_player"),
+    idle: roomMessage("room_player"),
+    hidden: roomMessage("room_player"),
+    shown: roomMessage("room_player"),
+    back: roomMessage("room_player", { joinData: gameData(ROOM_LIMITS.maximumJoinDataSizeBytes * 2), ...IDLE_FIELDS }),
+    message: roomMessage("room_player", { data: gameData(ROOM_LIMITS.maximumGameMessageSizeBytes) }),
+    bytes: {
+        whoMayCall: "room_player",
+        reaches: "room",
+        trusts: ["player_pass"],
+        takes: { query: {}, body: { kind: "bytes", maximumSizeBytes: ROOM_LIMITS.maximumGameMessageSizeBytes } },
+        answers: answersJson(ROOM_FRAME),
+        limit: { whyNoLimit: "room_token_bucket" },
+    },
+    chat: roomMessage("room_player", { chatNumber: realNumber(0, Number.MAX_SAFE_INTEGER), text: textUpTo(ROOM_LIMITS.maximumGameMessageSizeBytes), toPlayerIds: listOf(PLAYER_ID_SHAPE, 200) }, ["text"]),
+    block: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    unblock: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    friend_request: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    "zaisma:purchase": {
+        ...roomMessage("room_player", { purchaseId: gameData(4096), receipt: gameData(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT) }),
+        reaches: "purchase",
+        trusts: ["player_pass", "purchase_receipt"],
+    },
+};
+/**
+ * Whether a message breaks its door's shape: a field of the wrong type or past its bound, or one it needs missing. A
+ * name the door doesn't know is left alone and never read, unlike at other doors: a game's SDK comes from Zaisma and
+ * its server may be the developer's own, older one, so a newer SDK's field has to keep working there.
+ */
+export function roomMessageProblem(type, message) {
+    const body = ROOM_MESSAGE_DOORS[type].takes.body;
+    for (const name of body.required ?? [])
+        if (!(name in message))
+            return `${name} is missing`;
+    for (const [name, shape] of Object.entries(body.fields)) {
+        if (!(name in message))
+            continue;
+        const [problem] = schemaProblems(shape, message[name], name);
+        if (problem)
+            return problem;
+    }
+    return null;
+}
+const isRoomMessageType = (type) => typeof type === "string" && Object.hasOwn(ROOM_MESSAGE_DOORS, type);
+const PLAYER_PROVEN = ["room_member", "room_player"];
+const HOST_PROVEN = ["room_member", "room_player", "room_host"];
 export const OTHER_MESSAGE_TYPE = "(other)";
 /** State sync's updates (stateSyncEnabled). */
 export const STATE_MESSAGE_TYPE = "(state)";
@@ -1759,7 +1911,12 @@ export class RoomCore {
         const presence = this.presence.get(playerId);
         if (presence)
             presence.seenAtMs = this.now();
-        switch (message.type) {
+        const type = isRoomMessageType(message.type) ? message.type : null;
+        if (type && !checkDoor(ROOM_MESSAGE_DOORS[type], this.hostPlayerId === playerId ? HOST_PROVEN : PLAYER_PROVEN))
+            return "not_allowed";
+        if (type && type !== "bytes" && roomMessageProblem(type, message))
+            return "bad_message";
+        switch (type) {
             case "room":
                 return this.hostChange(playerId, message);
             case "kick":
@@ -1838,7 +1995,7 @@ export class RoomCore {
         if (text.length <= ROOM_LIMITS.maximumGameMessageSizeBytes) {
             try {
                 const message = JSON.parse(text);
-                if (message?.type === "probe_answer" && this.answer(spectatorId, message.probeNumber))
+                if (isRoomMessageType(message?.type) && ROOM_MESSAGE_DOORS[message.type].whoMayCall === "room_member" && this.answer(spectatorId, message.probeNumber))
                     return null;
             }
             catch {
@@ -1910,8 +2067,6 @@ export class RoomCore {
      * text between strangers), so the kicked player is told the host removed them.
      */
     hostKick(playerId, message) {
-        if (this.hostPlayerId !== playerId)
-            return "not_allowed";
         const kickedId = message.playerId;
         if (typeof kickedId !== "string" || kickedId === playerId || !this.players.has(kickedId))
             return "bad_message";
@@ -1920,8 +2075,6 @@ export class RoomCore {
     }
     /** The host hides, shows, opens, closes, turns friends' Join on or off, names or labels the room, when the game server allows it. */
     hostChange(playerId, message) {
-        if (this.hostPlayerId !== playerId)
-            return "not_allowed";
         const asked = message.room;
         if (!asked || typeof asked !== "object" || Array.isArray(asked))
             return "bad_message";