playsocketjs 2.2.0 → 2.2.2

package/README.md

@@ -96,10 +96,10 @@ new PlaySocket(id?: string, options: PlaySocketOptions)
 ### Methods
 
 - `init()`: Initialize the WebSocket connection – Returns Promise (async) which resolves with the client's ID
-- `createRoom(initialStorage?: object, maxSize?: number)`: Create a new room and become host – Returns Promise (async) which resolves with the room ID (matches the creator's ID)
+- `createRoom(initialStorage?: object, maxSize?: number)`: Create a new room and become host – Returns Promise (async) which resolves with the room ID (matches the creator's ID). The absolute client maximum is 100
 - `joinRoom(hostId: string)`: Join an existing room – Returns Promise (async)
 - `destroy()`: Use this to leave a room and close the connection
-- `updateStorage(key: string, type: 'set' | 'array-add' | 'array-add-unique' | 'array-remove-matching' | 'array-update-matching', value: any, updateValue?: any)`: Update the shared storage. Safely update arrays in storage by adding, removing, or updating items. UpdateValue is only required for the 'array-update-matching' operation type
+- `updateStorage(key: string, type: 'set' | 'array-add' | 'array-add-unique' | 'array-remove-matching' | 'array-update-matching', value: any, updateValue?: any)`: Update the shared storage (max. 100 keys). Safely update arrays in storage by adding, removing, or updating items. UpdateValue is only required for the 'array-update-matching' operation type
 - `sendRequest(name: string, data?: any)`: Send requests to the server with optional custom data (handle these in the `requestReceived` server event)
 - `onEvent(event: string, callback: Function)`: Register an event callback
 
@@ -221,7 +221,7 @@ Creates a new PlaySocket Server instance with configuration options.
 - `clientJoinedRoom`: Client joined a room – note that clients can only leave by disconnecting (returns the client's ID `string`, room ID `string`)
 - `roomCreated`: Client created a room (returns room ID `string`)
 - `roomDestroyed`: Room was destroyed, this happens when all participants leave (returns room ID `string`)
-- `roomCreationRequested`: Room creation requested by client (returns `object` containing the client's ID `string`, room ID `string` and the initialStorage `object`) – if you return an `object` in the callback, it will take that as the initial storage instead
+- `roomCreationRequested`: Room creation requested by client (returns `object` containing the client's ID `string`, room ID `string` and the initialStorage `object`) – if you return an `object` in the callback, it will take that as the initial storage instead. If you return `false`, the creation will be denied
 - `storageUpdateRequested`: Room storage property update requested by client (returns `object` containing the client's ID `string`, room ID `string` and the update `object`) – if you return `false` in the callback, the update will be blocked
 - `requestReceived`: Request from client was received by the server (returns `object` containing client's ID `string`, if in room – room ID `string`, request name `string` and optional passed data of type `any`)
 

package/dist/playsocket-client.js

@@ -1758,9 +1758,11 @@ function requireCrdtManager () {
 	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
+	            // Check key limit to afeguard against too many keys
+	            if (this.#keyOperations.size >= 100 && !this.#keyOperations.has(key)) throw new Error('Key limit exceeded!');
+
 	            // Get COPY of current ops (or empty array if none yet)
 	            const currentOps = [...(this.#keyOperations.get(key) || [])];
-
 	            // Merge vector clocks (always take max value)
 	            for (const [id, counter] of vectorClock) {
 	                if (!this.#vectorClock.has(id) || this.#vectorClock.get(id) < counter) {
@@ -1768,7 +1770,7 @@ function requireCrdtManager () {
 	                }
 	            }
 
-	            // Saveguard
+	            // Safeguard against massive vector clocks
 	            if (this.#vectorClock.size > 1000) this.#vectorClock = new Map([...this.#vectorClock].slice(-100));
 
 	            // Add new operation if it's not already added
@@ -2019,11 +2021,15 @@ function requireCrdtManager () {
 	    }
 
 	    /**
-	     * Remove HTML to prevent XSS
-	     * @param {Object} obj 
+	     * Remove HTML to prevent XSS and enforce size limits
+	     * @param {Object} obj
 	     * @returns {Object} - Sanitized object
 	     */
 	    #sanitizeValue(obj) {
+	        // Check total serialized size
+	        const jsonString = JSON.stringify(obj);
+	        if (jsonString?.length > 50000) throw new Error('Value too large!'); // 50KB limit
+
 	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
 	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
 	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));

package/dist/playsocket-server.js

@@ -1884,9 +1884,11 @@ function requireCrdtManager () {
 	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
+	            // Check key limit to afeguard against too many keys
+	            if (this.#keyOperations.size >= 100 && !this.#keyOperations.has(key)) throw new Error('Key limit exceeded!');
+
 	            // Get COPY of current ops (or empty array if none yet)
 	            const currentOps = [...(this.#keyOperations.get(key) || [])];
-
 	            // Merge vector clocks (always take max value)
 	            for (const [id, counter] of vectorClock) {
 	                if (!this.#vectorClock.has(id) || this.#vectorClock.get(id) < counter) {
@@ -1894,7 +1896,7 @@ function requireCrdtManager () {
 	                }
 	            }
 
-	            // Saveguard
+	            // Safeguard against massive vector clocks
 	            if (this.#vectorClock.size > 1000) this.#vectorClock = new Map([...this.#vectorClock].slice(-100));
 
 	            // Add new operation if it's not already added
@@ -2145,11 +2147,15 @@ function requireCrdtManager () {
 	    }
 
 	    /**
-	     * Remove HTML to prevent XSS
-	     * @param {Object} obj 
+	     * Remove HTML to prevent XSS and enforce size limits
+	     * @param {Object} obj
 	     * @returns {Object} - Sanitized object
 	     */
 	    #sanitizeValue(obj) {
+	        // Check total serialized size
+	        const jsonString = JSON.stringify(obj);
+	        if (jsonString?.length > 50000) throw new Error('Value too large!'); // 50KB limit
+
 	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
 	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
 	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));
@@ -2393,6 +2399,13 @@ function requireServer () {
 	                    // Event callback with potential initial storage modifications
 	                    const reviewedStorage = await this.#triggerEvent("roomCreationRequested", { roomId: newRoomId, clientId: ws.clientId, initialStorage: structuredClone({ ...data.initialStorage }) });
 	                    if (typeof reviewedStorage === 'object') data.initialStorage = reviewedStorage;
+	                    if (reviewedStorage === false) {
+	                        ws.send(encode({
+	                            type: 'room_creation_failed',
+	                            reason: 'Room creation denied.'
+	                        }), { binary: true });
+	                        return;
+	                    }
 
 	                    // Check if client/creator is still connected
 	                    if (!this.#clients.has(ws.clientId)) {
@@ -2412,7 +2425,7 @@ function requireServer () {
 	                    this.#rooms[newRoomId] = {
 	                        participants: [ws.clientId],
 	                        host: ws.clientId,
-	                        maxSize: data.size || null,
+	                        maxSize: Math.min(Number(data.size), 100) || 100, // Max. limit is 100 clients / room
 	                        crdtManager: roomCrdtManager
 	                    };
 	                    this.#clientRooms.set(ws.clientId, newRoomId); // Add client to the room
@@ -2428,12 +2441,12 @@ function requireServer () {
 	                    const room = this.#rooms[roomId];
 
 	                    if (!room ||
-	                        (room.maxSize && room.participants.length >= room.maxSize) ||
+	                        (room.participants.length >= room.maxSize) ||
 	                        this.#clientRooms.get(ws.clientId)) {
 	                        ws.send(encode({
 	                            type: 'join_rejected',
 	                            reason: !room ? 'Room not found' :
-	                                room.maxSize && room.participants.length >= room.maxSize ? 'Room full' :
+	                                room.participants.length >= room.maxSize ? 'Room full' :
 	                                    'Already in a room'
 	                        }), { binary: true });
 	                        return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playsocketjs",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "WebSocket wrapper for creating simple multiplayer systems with ease.",
   "module": "dist/playsocket-client.js",
   "exports": {