most-box 0.2.1 → 0.2.2

package/server/src/core/gameRoom.js

@@ -110,7 +110,7 @@ export function deriveGameRoomLobby(messages = [], options = {}) {
     if (!event) continue
 
     if (event.event === 'room:create') {
-      const player = createPlayerFromPayload(event.payload?.player, message.author)
+      const player = createPlayerFromPayload(event.payload?.player, message)
       if (!player) continue
       if (!hostAddress) hostAddress = player.address
       upsertPlayer(players, playerMap, player)
@@ -118,7 +118,7 @@ export function deriveGameRoomLobby(messages = [], options = {}) {
     }
 
     if (event.event === 'player:join') {
-      const player = createPlayerFromPayload(event.payload?.player, message.author)
+      const player = createPlayerFromPayload(event.payload?.player, message)
       if (player) upsertPlayer(players, playerMap, player)
       continue
     }
@@ -157,18 +157,28 @@ export function getLatestGameState(messages = [], options = {}) {
   return latest
 }
 
-export function createPlayerFromPayload(input, author) {
+export function createPlayerFromPayload(input, messageOrAuthor) {
   if (!input || typeof input !== 'object') return null
+  const message =
+    messageOrAuthor && typeof messageOrAuthor === 'object'
+      ? messageOrAuthor
+      : { author: messageOrAuthor }
+  const author = message.author
   const address = normalizeAddress(input.address || author)
   if (!address || normalizeAddress(author) !== address) return null
-  const name = String(input.name || '').trim().slice(0, 50) || shortAddress(address)
+  const name =
+    String(message.authorName || input.name || '').trim().slice(0, 50) ||
+    shortAddress(address)
+  const avatar = String(message.avatar || input.avatar || '').trim()
   const publicKey = String(input.publicKey || '').trim()
-  return {
+  const player = {
     address,
     name,
     publicKey,
     joinedAt: Number(input.joinedAt || Date.now()),
   }
+  if (avatar) player.avatar = avatar.slice(0, 4096)
+  return player
 }
 
 export function normalizeGamePlayer(input) {

package/server/src/core/mostLink.js

@@ -9,7 +9,6 @@ export const MOST_LINK_ERROR_CODES = {
   INVALID_URL: 'invalid_url',
   INVALID_PROTOCOL: 'invalid_protocol',
   UNSUPPORTED_PATH: 'unsupported_path',
-  FILENAME_REQUIRED: 'filename_required',
   UNSUPPORTED_QUERY_PARAM: 'unsupported_query_param',
 }
 
@@ -79,7 +78,7 @@ export function parseMostLink(link) {
   }
 
   const cidString = url.hostname
-  const fileName = url.searchParams.get('filename')
+  const rawFileName = url.searchParams.get('filename')
   const unsupportedParam = [...url.searchParams.keys()].find(
     key => key !== 'filename'
   )
@@ -89,10 +88,6 @@ export function parseMostLink(link) {
     return invalidLink(validation.errorCode)
   }
 
-  if (!fileName || !fileName.trim()) {
-    return invalidLink(MOST_LINK_ERROR_CODES.FILENAME_REQUIRED)
-  }
-
   if (unsupportedParam) {
     return invalidLink(
       MOST_LINK_ERROR_CODES.UNSUPPORTED_QUERY_PARAM,
@@ -100,9 +95,15 @@ export function parseMostLink(link) {
     )
   }
 
+  const fileName = rawFileName?.trim() || cidString
+
   return { cid: cidString, fileName }
 }
 
 export function buildMostLink(cid, fileName) {
-  return `most://${cid}?filename=${encodeURIComponent(fileName)}`
+  const trimmedFileName = String(fileName || '').trim()
+  if (!trimmedFileName) {
+    return `most://${cid}`
+  }
+  return `most://${cid}?filename=${encodeURIComponent(trimmedFileName)}`
 }

package/server/src/core/zhajinhua.js

@@ -196,6 +196,7 @@ export function startRound({ roomCode, players, hostAddress, previousSeq = 0, pr
     return {
       address: player.address,
       name: player.name,
+      avatar: cleanAvatar(player.avatar),
       publicKey: player.publicKey,
       chips: Number(player.chips) - ZHJ_ANTE,
       status: 'active',
@@ -597,6 +598,7 @@ function normalizeRoundPlayer(input) {
   return {
     address,
     name: String(input.name || shortAddress(address)).slice(0, 50),
+    avatar: cleanAvatar(input.avatar),
     publicKey: String(input.publicKey || ''),
     chips: Math.max(0, Number(input.chips) || 0),
     status: input.status === 'folded' ? 'folded' : 'active',
@@ -614,6 +616,10 @@ function shortAddress(address) {
   return address ? `${address.slice(0, 6)}...${address.slice(-4)}` : ''
 }
 
+function cleanAvatar(value) {
+  return String(value || '').trim().slice(0, 4096)
+}
+
 function clone(value) {
   return JSON.parse(JSON.stringify(value))
 }

package/server/src/games/gandengyan.js

@@ -18,6 +18,7 @@ export function createGanDengYanRoom({
     roomPlayers.unshift({
       address: normalizeAddress(ownerAddress),
       name: cleanName(ownerName),
+      avatar: '',
     })
   }
 
@@ -29,6 +30,7 @@ export function createGanDengYanRoom({
     players: roomPlayers.slice(0, 6).map((player, seat) => ({
       address: player.address,
       name: cleanName(player.name),
+      avatar: cleanAvatar(player.avatar),
       seat,
       hand: [],
       handCount: 0,
@@ -62,6 +64,7 @@ export function syncGanDengYanLobby(room, players = []) {
     .map((player, seat) => ({
       address: player.address,
       name: cleanName(player.name),
+      avatar: cleanAvatar(player.avatar),
       seat,
       hand: [],
       handCount: 0,
@@ -257,6 +260,7 @@ export function publicGanDengYanRoom(room) {
     players: orderedPlayers(room).map(player => ({
       address: player.address,
       name: player.name,
+      avatar: cleanAvatar(player.avatar),
       seat: player.seat,
       handCount: player.hand?.length ?? player.handCount ?? 0,
       score: Number(player.score ?? INITIAL_SCORE),
@@ -431,6 +435,7 @@ function normalizePlayers(players) {
     .map(player => ({
       address: normalizeAddress(player.address),
       name: cleanName(player.name),
+      avatar: cleanAvatar(player.avatar),
       publicKey: String(player.publicKey || ''),
     }))
     .filter(player => {
@@ -446,6 +451,7 @@ function normalizeRoundPlayer(input) {
   return {
     address,
     name: cleanName(input.name),
+    avatar: cleanAvatar(input.avatar),
     seat: Number(input.seat || 0),
     hand: Array.isArray(input.hand) ? input.hand.map(normalizeCard).filter(Boolean) : [],
     handCount: Number(input.handCount || 0),
@@ -679,3 +685,7 @@ function normalizeAddress(value) {
 function cleanName(name) {
   return String(name || '玩家').trim().slice(0, 16) || '玩家'
 }
+
+function cleanAvatar(avatar) {
+  return String(avatar || '').trim().slice(0, 4096)
+}

package/server/src/http/access.js

@@ -37,6 +37,53 @@ function isLocalHostname(hostname) {
   return ['localhost', '127.0.0.1', '::1', '[::1]'].includes(value)
 }
 
+function normalizeNetworkAddress(address) {
+  const value = String(address || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, '')
+
+  if (value.startsWith('::ffff:')) {
+    return value.slice('::ffff:'.length)
+  }
+
+  return value
+}
+
+export function isPrivateNetworkHostname(hostname) {
+  const value = normalizeNetworkAddress(hostname)
+
+  if (value === '::1' || value === 'localhost') {
+    return true
+  }
+
+  if (
+    value.includes(':') &&
+    (value.startsWith('fc') ||
+      value.startsWith('fd') ||
+      value.startsWith('fe80:'))
+  ) {
+    return true
+  }
+
+  const parts = value.split('.').map(part => Number(part))
+  if (
+    parts.length !== 4 ||
+    parts.some(part => !Number.isInteger(part) || part < 0 || part > 255)
+  ) {
+    return false
+  }
+
+  const [first, second] = parts
+  return (
+    first === 10 ||
+    first === 127 ||
+    (first === 169 && second === 254) ||
+    (first === 172 && second >= 16 && second <= 31) ||
+    (first === 192 && second === 168)
+  )
+}
+
 export function isPublicListenHost(listenHost) {
   const hostname = extractHostname(listenHost)
   if (!hostname) return false
@@ -76,23 +123,27 @@ export function isLoopbackRemoteAddress(address) {
   )
 }
 
-export function isLocalRequest(c) {
+export function isLocalRequest(c, options = {}) {
   const host = c.req.header('host')
-  if (host) {
-    return isLocalRequestHost(host)
+  if (host && isLocalRequestHost(host)) {
+    return true
   }
-  const clientIp =
-    c.req.header('x-forwarded-for') ||
-    c.env?.incoming?.socket?.remoteAddress ||
-    ''
-  return isLoopbackRemoteAddress(clientIp)
+  const clientIp = c.env?.incoming?.socket?.remoteAddress || ''
+  return (
+    isLoopbackRemoteAddress(clientIp) ||
+    (options.trustPrivateNetwork && isPrivateNetworkHostname(clientIp))
+  )
 }
 
-export function isLocalUpgradeRequest(req) {
-  if (req.headers.host) {
-    return isLocalRequestHost(req.headers.host)
+export function isLocalUpgradeRequest(req, options = {}) {
+  if (req.headers.host && isLocalRequestHost(req.headers.host)) {
+    return true
   }
-  return isLoopbackRemoteAddress(req.socket?.remoteAddress)
+  const remoteAddress = req.socket?.remoteAddress
+  return (
+    isLoopbackRemoteAddress(remoteAddress) ||
+    (options.trustPrivateNetwork && isPrivateNetworkHostname(remoteAddress))
+  )
 }
 
 export function isRemoteAccessRequest({ invite, origin, listenHost, local }) {