@zaisma/game-server 1.23.0 → 1.24.0

package/src/room.d.ts

@@ -7,6 +7,7 @@
  * running one copy of the game server. Names follow docs/NAMING.md.
  */
 import { type GameDatabase } from "./database.ts";
+import { type DoorContract, type DoorShape } from "./doors.ts";
 import type { PassClaims, PlayerKind, ReceiptClaims } from "./pass.ts";
 import type { Server } from "./requests.ts";
 import { type Schedule, type ScheduledRun } from "./schedules.ts";
@@ -1117,7 +1118,7 @@ export type ClientMessage = {
  * the game became unavailable, its kept room was deleted, or no players were left for its spectators.
  */
 export type EndReason = "game" | "hosting_paused" | "game_server_stopped" | "game_unavailable" | "kept_room_deleted" | "no_players";
-export type RoomErrorCode = "room_full" | "room_closed" | "ended" | "too_big" | "too_fast" | "bad_message" | "bad_pass" | "bad_player_token" | "no_hello" | "not_allowed" | "game_unavailable" | "busy" | "kept_out" | "refused" | "room_not_running" | "hosting_paused" | "account_needed" | "game_not_open_to_player" | "blocked_player_here" | "other_version" | "spectators_full" | "spectator_cannot_send" | "already_playing" | "bad_origin" | "send_queue_full" | "chat_not_here" | "chat_not_allowed" | "chat_empty" | "chat_too_long" | "chat_too_fast";
+export type RoomErrorCode = "room_full" | "room_closed" | "ended" | "too_big" | "too_fast" | "bad_message" | "bad_pass" | "bad_player_token" | "no_hello" | "not_allowed" | "game_unavailable" | "busy" | "kept_out" | "refused" | "room_not_running" | "hosting_paused" | "rented_share_used" | "account_needed" | "game_not_open_to_player" | "blocked_player_here" | "other_version" | "spectators_full" | "spectator_cannot_send" | "already_playing" | "bad_origin" | "send_queue_full" | "chat_not_here" | "chat_not_allowed" | "chat_empty" | "chat_too_long" | "chat_too_fast";
 export declare const ERROR_TEXT: Record<RoomErrorCode, string>;
 /** What players are told when Zaisma ends a match at room.endsAt. */
 export declare const HOSTING_PAUSED_END_MESSAGE = "This game's hosting is paused, so this match has ended. New rooms open again when the month resets or its developer adds credit.";
@@ -1334,6 +1335,7 @@ export interface StateSyncHooks {
 export declare const NO_MESSAGE_TYPE = "(none)";
 export declare const BYTES_MESSAGE_TYPE = "(bytes)";
 export declare const ZAISMA_MESSAGE_TYPE = "(zaisma)";
+export declare const ROOM_FRAME: Readonly<Record<string, unknown>>;
 /**
  * Every message a room takes (docs/DOORS.md). receive's switch is over these names, so a new one without a row
  * doesn't build. A spectator may send only what's for room members. hello comes first and proves the pass; chat is the host's to take before receive (readChatMessage);
@@ -1348,55 +1350,89 @@ export declare const ROOM_MESSAGE_DOORS: {
             readonly source_path: "packages/game-server/src/pass.ts";
             readonly symbol_name: "verifyPass";
         };
+        readonly takes: {
+            readonly query: {};
+            readonly body: {
+                readonly kind: "json";
+                readonly fields: {
+                    readonly idleTimeoutSec: DoorShape;
+                    readonly idleCheckEnabled: DoorShape;
+                    readonly type: DoorShape;
+                    readonly protocolVersionNumber: DoorShape;
+                    readonly pass: DoorShape;
+                    readonly playerToken: DoorShape;
+                    readonly joinData: DoorShape;
+                    readonly room: DoorShape;
+                    readonly isSpectator: DoorShape;
+                    readonly isQuickJoin: DoorShape;
+                    readonly avoidBlockedPlayers: DoorShape;
+                    readonly versionId: DoorShape;
+                    readonly playShare: DoorShape;
+                    readonly hasGraphicsChip: DoorShape;
+                    readonly isInputSeen: DoorShape;
+                };
+                readonly required: readonly ["type"];
+                readonly maximumSizeBytes: number;
+            };
+        };
+        readonly answers: import("./doors.ts").DoorAnswer;
+        readonly limit: {
+            readonly level: "steady";
+            readonly counts: "player";
+        };
     };
-    readonly probe_answer: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly room: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly kick: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly here: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly idle: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly hidden: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly shown: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly back: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly message: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly bytes: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly chat: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly block: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly unblock: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
-    };
-    readonly friend_request: import("./doors.ts").DoorContractFields & {
-        whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    readonly probe_answer: DoorContract;
+    readonly room: DoorContract;
+    readonly kick: DoorContract;
+    readonly here: DoorContract;
+    readonly idle: DoorContract;
+    readonly hidden: DoorContract;
+    readonly shown: DoorContract;
+    readonly back: DoorContract;
+    readonly message: DoorContract;
+    readonly bytes: {
+        readonly whoMayCall: "room_player";
+        readonly reaches: "room";
+        readonly trusts: readonly ["player_pass"];
+        readonly takes: {
+            readonly query: {};
+            readonly body: {
+                readonly kind: "bytes";
+                readonly maximumSizeBytes: number;
+            };
+        };
+        readonly answers: import("./doors.ts").DoorAnswer;
+        readonly limit: {
+            readonly whyNoLimit: "room_token_bucket";
+        };
     };
+    readonly chat: DoorContract;
+    readonly block: DoorContract;
+    readonly unblock: DoorContract;
+    readonly friend_request: DoorContract;
     readonly "zaisma:purchase": {
-        readonly whoMayCall: "room_player";
         readonly reaches: "purchase";
         readonly trusts: readonly ["player_pass", "purchase_receipt"];
+        readonly takes: import("./doors.ts").DoorTakes;
+        readonly answers: import("./doors.ts").DoorAnswer;
+        readonly limit: import("./doors.ts").DoorLimit;
+        readonly whoMayCall: import("./doors.ts").DoorCallerProvenByGuard;
+    } | {
+        readonly reaches: "purchase";
+        readonly trusts: readonly ["player_pass", "purchase_receipt"];
+        readonly takes: import("./doors.ts").DoorTakes;
+        readonly answers: import("./doors.ts").DoorAnswer;
+        readonly limit: import("./doors.ts").DoorLimit;
+        readonly whoMayCall: import("./doors.ts").DoorCallerProvenByFunction;
+        readonly provenBy: import("./doors.ts").DoorProof;
     };
 };
+/**
+ * Whether a message breaks its door's shape: a field of the wrong type or past its bound, or one it needs missing. A
+ * name the door doesn't know is left alone and never read, unlike at other doors: a game's SDK comes from Zaisma and
+ * its server may be the developer's own, older one, so a newer SDK's field has to keep working there.
+ */
+export declare function roomMessageProblem(type: Exclude<RoomMessageType, "bytes">, message: Record<string, unknown>): string | null;
 export type RoomMessageType = keyof typeof ROOM_MESSAGE_DOORS;
 export declare const OTHER_MESSAGE_TYPE = "(other)";
 /** State sync's updates (stateSyncEnabled). */

package/src/room.js

@@ -8,7 +8,7 @@
  */
 import { CHAT_CHECK_LIMITS, CHAT_ROOM_LIMITS } from "./chat.js";
 import { DatabaseError } from "./database.js";
-import { checkDoor } from "./doors.js";
+import { answersJson, checkDoor, fieldsOf, gameData, listOf, orNothing, realNumber, schemaProblems, text as textUpTo, yesOrNo } from "./doors.js";
 import { isRoomCode, roomCode } from "./names.js";
 import { readSchedules } from "./schedules.js";
 import { roomCallChecks } from "./room-calls.js";
@@ -322,6 +322,7 @@ export const ERROR_TEXT = {
     refused: "The game didn't let you into this room.",
     room_not_running: "That room isn't running.",
     hosting_paused: "This game's hosting is paused. It starts again when the month resets or its developer adds credit.",
+    rented_share_used: "This network looks like a server. Turn off your VPN or sign in with an account that has played before.",
     account_needed: "Playing online needs a Zaisma account. Sign in on the game's page to play.",
     game_not_open_to_player: "This game isn't open to this account.",
     blocked_player_here: "Someone you blocked is in this room.",
@@ -445,6 +446,9 @@ export function readChatMessage(text) {
     }
     if (!parsed || typeof parsed !== "object" || parsed.type !== "chat")
         return null;
+    // One of the wrong shape isn't chat: receive refuses it.
+    if (roomMessageProblem("chat", parsed))
+        return null;
     const chat = parsed;
     return { chatNumber: Number.isSafeInteger(chat.chatNumber) ? chat.chatNumber : 0, text: chat.text, toPlayerIds: chat.toPlayerIds, sizeBytes: utf8ByteCount(text) };
 }
@@ -503,32 +507,150 @@ export const STATE_SYNC = Symbol("stateSync");
 export const NO_MESSAGE_TYPE = "(none)";
 export const BYTES_MESSAGE_TYPE = "(bytes)";
 export const ZAISMA_MESSAGE_TYPE = "(zaisma)";
-const ROOM_MEMBER = { whoMayCall: "room_member", reaches: "room", trusts: ["player_pass"] };
-const ROOM_PLAYER = { whoMayCall: "room_player", reaches: "room", trusts: ["player_pass"] };
-const ROOM_HOST = { whoMayCall: "room_host", reaches: "room", trusts: ["player_pass"] };
+/** A pass or a player token, at most, and a whole hello with the fullest of them. */
+const HELLO_PROOF_MAXIMUM_CHARACTER_COUNT = 96 * 1024;
+const HELLO_MAXIMUM_SIZE_BYTES = HELLO_PROOF_MAXIMUM_CHARACTER_COUNT + 2 * ROOM_LIMITS.maximumJoinDataSizeBytes + 8 * 1024;
+/** What a player is sent, by its type, with each type's fields closed: a game's own data and a room's settings pass as they are. Checked in tests only, since this is the busiest path there is. */
+const looseObject = { type: "object" };
+const frameOf = (messageType, fields = {}, optional = {}) => ({
+    type: "object",
+    properties: { type: { type: "string", enum: [messageType] }, ...fields, ...optional },
+    required: ["type", ...Object.keys(fields)],
+    additionalProperties: false,
+});
+const wireText = { type: "string" };
+const wireNumber = { type: "number" };
+const wireYesOrNo = { type: "boolean" };
+const wireNullable = (type) => ({ type: [type, "null"] });
+const wirePlayers = { type: "array", items: looseObject };
+const WIRE_DATA = {};
+export const ROOM_FRAME = {
+    anyOf: [
+        frameOf("welcome", { me: looseObject, isSpectator: wireYesOrNo, players: wirePlayers, room: looseObject, spectatorCount: wireNumber, hostPlayerId: wireNullable("string"), awayChecks: looseObject, endsAt: wireNullable("string"), probeIntervalSec: wireNullable("number"), protocolVersionNumber: wireNumber, canChat: wireYesOrNo }),
+        frameOf("probe", { probeNumber: wireNumber, serverTimeMs: wireNumber, pingDurationMs: wireNullable("number") }),
+        frameOf("ending", { endsAt: wireText }),
+        frameOf("ending_cancelled"),
+        frameOf("version_update", { step: wireText, versionId: wireText, appliesAt: wireText, isReloading: wireYesOrNo }),
+        frameOf("players", { players: wirePlayers, hostPlayerId: wireNullable("string") }),
+        frameOf("away", { awayReason: wireText, seatHoldDurationSec: wireNumber }),
+        frameOf("kicked", { message: wireText, isKeptOut: wireYesOrNo }),
+        frameOf("room", { room: looseObject, spectatorCount: wireNumber }),
+        frameOf("move", { roomCode: wireText }),
+        frameOf("message", { data: WIRE_DATA, fromPlayerId: wireNullable("string") }),
+        frameOf("room_message", { roomMessage: looseObject }),
+        frameOf("state", { serverTimeMs: wireNumber }, { full: WIRE_DATA, changes: { type: "array" } }),
+        frameOf("blocks", { playerIds: { type: "array", items: wireText } }),
+        frameOf("friend_request"),
+        frameOf("chat", { fromPlayerId: wireText, text: wireText, hasSwearing: wireYesOrNo, hasSlur: wireYesOrNo, sentAt: wireText }),
+        frameOf("chat_sent", { chatNumber: wireNumber, sentAt: wireText }),
+        frameOf("chat_stopped", { chatNumber: wireNumber, reason: wireText, message: wireText }),
+        frameOf("error", { code: wireText, message: wireText }, { versionId: wireText, chatNumber: wireNumber }),
+        frameOf("ended", { message: wireText, endReason: wireText }),
+    ],
+};
+/** The room's settings as a client may ask for them: tidyRoomInfo cuts a name and labels to their limits, and these are only the outer wall. */
+const ASKED_ROOM = fieldsOf({
+    isListed: yesOrNo,
+    isOpen: yesOrNo,
+    friendJoinsEnabled: yesOrNo,
+    name: textUpTo(1000),
+    labels: gameData(4 * 1024),
+});
+const PLAYER_ID_SHAPE = textUpTo(80);
+const IDLE_FIELDS = { idleTimeoutSec: realNumber(0, Number.MAX_SAFE_INTEGER), idleCheckEnabled: yesOrNo };
+/** A connection's limit is a room's message bucket, which takes a token per player before any of these runs. */
+const roomMessage = (whoMayCall, fields = {}, required = []) => ({
+    whoMayCall,
+    reaches: "room",
+    trusts: ["player_pass"],
+    takes: { query: {}, body: { kind: "json", fields: { type: textUpTo(40), ...fields }, required: ["type", ...required], maximumSizeBytes: ROOM_LIMITS.maximumGameMessageSizeBytes } },
+    answers: answersJson(ROOM_FRAME),
+    limit: { whyNoLimit: "room_token_bucket" },
+});
 /**
  * Every message a room takes (docs/DOORS.md). receive's switch is over these names, so a new one without a row
  * doesn't build. A spectator may send only what's for room members. hello comes first and proves the pass; chat is the host's to take before receive (readChatMessage);
  * bytes is every binary message (receiveBytes). A type with no row, maybe from a newer SDK, is counted and ignored.
  */
 export const ROOM_MESSAGE_DOORS = {
-    hello: { whoMayCall: "pass_holder", reaches: "room", trusts: ["player_pass"], provenBy: { source_path: "packages/game-server/src/pass.ts", symbol_name: "verifyPass" } },
-    probe_answer: ROOM_MEMBER,
-    room: ROOM_HOST,
-    kick: ROOM_HOST,
-    here: ROOM_PLAYER,
-    idle: ROOM_PLAYER,
-    hidden: ROOM_PLAYER,
-    shown: ROOM_PLAYER,
-    back: ROOM_PLAYER,
-    message: ROOM_PLAYER,
-    bytes: ROOM_PLAYER,
-    chat: ROOM_PLAYER,
-    block: ROOM_PLAYER,
-    unblock: ROOM_PLAYER,
-    friend_request: ROOM_PLAYER,
-    "zaisma:purchase": { whoMayCall: "room_player", reaches: "purchase", trusts: ["player_pass", "purchase_receipt"] },
+    hello: {
+        whoMayCall: "pass_holder",
+        reaches: "room",
+        trusts: ["player_pass"],
+        provenBy: { source_path: "packages/game-server/src/pass.ts", symbol_name: "verifyPass" },
+        takes: {
+            query: {},
+            body: {
+                kind: "json",
+                fields: {
+                    type: textUpTo(40),
+                    protocolVersionNumber: realNumber(0, Number.MAX_SAFE_INTEGER),
+                    pass: textUpTo(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT),
+                    playerToken: orNothing(textUpTo(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT)),
+                    joinData: gameData(ROOM_LIMITS.maximumJoinDataSizeBytes * 2),
+                    room: ASKED_ROOM,
+                    isSpectator: yesOrNo,
+                    isQuickJoin: yesOrNo,
+                    avoidBlockedPlayers: yesOrNo,
+                    versionId: textUpTo(80),
+                    playShare: textUpTo(400),
+                    hasGraphicsChip: yesOrNo,
+                    isInputSeen: yesOrNo,
+                    ...IDLE_FIELDS,
+                },
+                required: ["type"],
+                maximumSizeBytes: HELLO_MAXIMUM_SIZE_BYTES,
+            },
+        },
+        answers: answersJson(ROOM_FRAME),
+        limit: { level: "steady", counts: "player" },
+    },
+    probe_answer: roomMessage("room_member", { probeNumber: realNumber(0, Number.MAX_SAFE_INTEGER) }),
+    room: roomMessage("room_host", { room: ASKED_ROOM }, ["room"]),
+    kick: roomMessage("room_host", { playerId: PLAYER_ID_SHAPE, keepOut: yesOrNo }, ["playerId"]),
+    here: roomMessage("room_player"),
+    idle: roomMessage("room_player"),
+    hidden: roomMessage("room_player"),
+    shown: roomMessage("room_player"),
+    back: roomMessage("room_player", { joinData: gameData(ROOM_LIMITS.maximumJoinDataSizeBytes * 2), ...IDLE_FIELDS }),
+    message: roomMessage("room_player", { data: gameData(ROOM_LIMITS.maximumGameMessageSizeBytes) }),
+    bytes: {
+        whoMayCall: "room_player",
+        reaches: "room",
+        trusts: ["player_pass"],
+        takes: { query: {}, body: { kind: "bytes", maximumSizeBytes: ROOM_LIMITS.maximumGameMessageSizeBytes } },
+        answers: answersJson(ROOM_FRAME),
+        limit: { whyNoLimit: "room_token_bucket" },
+    },
+    chat: roomMessage("room_player", { chatNumber: realNumber(0, Number.MAX_SAFE_INTEGER), text: textUpTo(ROOM_LIMITS.maximumGameMessageSizeBytes), toPlayerIds: listOf(PLAYER_ID_SHAPE, 200) }, ["text"]),
+    block: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    unblock: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    friend_request: roomMessage("room_player", { playerId: PLAYER_ID_SHAPE }, ["playerId"]),
+    "zaisma:purchase": {
+        ...roomMessage("room_player", { purchaseId: gameData(4096), receipt: gameData(HELLO_PROOF_MAXIMUM_CHARACTER_COUNT) }),
+        reaches: "purchase",
+        trusts: ["player_pass", "purchase_receipt"],
+    },
 };
+/**
+ * Whether a message breaks its door's shape: a field of the wrong type or past its bound, or one it needs missing. A
+ * name the door doesn't know is left alone and never read, unlike at other doors: a game's SDK comes from Zaisma and
+ * its server may be the developer's own, older one, so a newer SDK's field has to keep working there.
+ */
+export function roomMessageProblem(type, message) {
+    const body = ROOM_MESSAGE_DOORS[type].takes.body;
+    for (const name of body.required ?? [])
+        if (!(name in message))
+            return `${name} is missing`;
+    for (const [name, shape] of Object.entries(body.fields)) {
+        if (!(name in message))
+            continue;
+        const [problem] = schemaProblems(shape, message[name], name);
+        if (problem)
+            return problem;
+    }
+    return null;
+}
 const isRoomMessageType = (type) => typeof type === "string" && Object.hasOwn(ROOM_MESSAGE_DOORS, type);
 const PLAYER_PROVEN = ["room_member", "room_player"];
 const HOST_PROVEN = ["room_member", "room_player", "room_host"];
@@ -1792,6 +1914,8 @@ export class RoomCore {
         const type = isRoomMessageType(message.type) ? message.type : null;
         if (type && !checkDoor(ROOM_MESSAGE_DOORS[type], this.hostPlayerId === playerId ? HOST_PROVEN : PLAYER_PROVEN))
             return "not_allowed";
+        if (type && type !== "bytes" && roomMessageProblem(type, message))
+            return "bad_message";
         switch (type) {
             case "room":
                 return this.hostChange(playerId, message);