screeps-connectivity 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.15.1
+
+### Patch Changes
+
+- 4526471: Namespace the pre-login `/api/authmod` session cache by host **and path**, not hostname alone. Behind `screeps-client-proxy` every backend is wrapped under one host (`localhost/(https://server)`), so hostname-only keys collided and one server's auth capabilities could be shown for another. Also disambiguates private servers that share a hostname on different ports. Matches the path-based namespacing already used for the persistent cache in `ScreepsClient`.
+
 ## 0.15.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screeps-connectivity",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "license": "ISC",
   "type": "module",
   "repository": {

package/src/http/fetchServerVersion.ts

@@ -14,7 +14,15 @@ interface CachedEntry<T> {
 
 function sessionKey(suffix: string, url: string): string {
   try {
-    return `screeps:${suffix}:${new URL(url).hostname}`
+    const parsed = new URL(url)
+    // Hostname alone isn't enough: multiple worlds can live under one host via a
+    // path (screeps.com vs screeps.com/season), and behind screeps-client-proxy
+    // every backend is wrapped under the same host (localhost/(https://server)),
+    // so the path must disambiguate them. Same path-based approach as the Cache
+    // namespace in ScreepsClient; host (incl. port) also separates private
+    // servers sharing a hostname on different ports.
+    const path = parsed.pathname.replace(/\/+$/, '')
+    return `screeps:${suffix}:${path ? `${parsed.host}${path}` : parsed.host}`
   } catch {
     return `screeps:${suffix}:${url}`
   }
@@ -60,7 +68,7 @@ export async function fetchServerVersion(url: string): Promise<ServerVersion> {
 /**
  * Fetch screepsmod-auth capabilities from `/api/authmod` without authentication.
  * Returns `null` if the server does not run screepsmod-auth.
- * The result is cached in `sessionStorage` for 5 minutes (per server hostname).
+ * The result is cached in `sessionStorage` for 5 minutes (per server host+path).
  */
 export async function fetchAuthModInfo(url: string): Promise<ApiAuthModInfoResponse | null> {
   const key = sessionKey('authmod', url)

package/tests/http/fetchServerVersion.test.ts

@@ -0,0 +1,52 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { fetchAuthModInfo } from '../../src/http/fetchServerVersion.js'
+
+// Minimal in-memory sessionStorage stub (the node test env has none).
+class MemorySessionStorage {
+  private readonly map = new Map<string, string>()
+  getItem(k: string): string | null { return this.map.get(k) ?? null }
+  setItem(k: string, v: string): void { this.map.set(k, v) }
+  removeItem(k: string): void { this.map.delete(k) }
+  clear(): void { this.map.clear() }
+}
+
+describe('fetchAuthModInfo — session cache namespacing', () => {
+  beforeEach(() => {
+    vi.stubGlobal('sessionStorage', new MemorySessionStorage())
+  })
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  it('does not collide between two backends wrapped under the same proxy host', async () => {
+    // Both URLs share host `localhost:8080`; only the /(backend) path differs —
+    // exactly how screeps-client-proxy addresses distinct servers. The cache key
+    // must include the path, otherwise the second lookup returns the first's data.
+    const worldUrl = 'http://localhost:8080/(https://screeps.com)'
+    const privUrl = 'http://localhost:8080/(http://my-private-server:21025)'
+    // Exact URL → payload map (no substring host matching).
+    const payloads: Record<string, string> = {
+      [`${worldUrl}/api/authmod`]: 'official',
+      [`${privUrl}/api/authmod`]: 'private',
+    }
+    const fetchMock = vi.fn().mockImplementation((input: string) => {
+      return Promise.resolve(
+        new Response(JSON.stringify({ ok: 1, backend: payloads[input] }), {
+          headers: { 'content-type': 'application/json' },
+        }),
+      )
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    const world = await fetchAuthModInfo(worldUrl)
+    const priv = await fetchAuthModInfo(privUrl)
+
+    expect((world as { backend?: string })?.backend).toBe('official')
+    expect((priv as { backend?: string })?.backend).toBe('private')
+    // Both were real network fetches — neither served the other's cached entry.
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+
+    // A repeat of the first URL is served from cache (no third fetch).
+    const worldAgain = await fetchAuthModInfo(worldUrl)
+    expect((worldAgain as { backend?: string })?.backend).toBe('official')
+    expect(fetchMock).toHaveBeenCalledTimes(2)
+  })
+})