diff --git a/multiplayer-next.md b/multiplayer-next.md index 05675f65..23d3a843 100644 --- a/multiplayer-next.md +++ b/multiplayer-next.md @@ -140,7 +140,8 @@ product policy are in [`docs/MATCHMAKING.md`](docs/MATCHMAKING.md). adapter now performs proposal insertion, participant insertion, and every queue-ticket promotion in one rollback-safe SERIALIZABLE callback; accepted proposals now atomically promote their exact team/slot map and tickets into an - `ALLOCATING` match; the runnable + `ALLOCATING` match; final unanimous proposal acceptance now invokes this + replay-safe promotion through the API; the runnable casual matcher can optionally use a Redis candidate projection and repairs an empty/lost index from PostgreSQL before claiming durably; live DB/Redis failover testing remains. diff --git a/multiplayer-todo.md b/multiplayer-todo.md index 506896c7..47deead7 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1173,7 +1173,7 @@ the local/CI/community transport, not a silent production fallback. | 8.2 `[D:8.1]` | **DONE.** Encode the launch SLOs from `docs/MATCHMAKING.md`: RTT, allocation/connect latency, 99.9% allocation/result success, API latency and tick health | [`docs/MATCHMAKING-SLOs.md`](docs/MATCHMAKING-SLOs.md) defines each metric, denominator, percentile/window, owner, alert threshold and release evidence | | 8.3 `[D:8.1]` | **DONE.** Publish versioned OpenAPI + WebSocket contracts for Steam login/session, profile/rating, queue create/heartbeat/cancel/resume, proposal accept/decline, assignment/status, server registration/roster/result/shutdown | [`server/contracts/v1/`](server/contracts/v1/) contains machine-readable REST/events contracts and dependency-free structural tests; REST resync is specified by the contract; `server/api/service.go` also exposes the documented `/api/v1` route names (including server-assigned idempotent queue ticket IDs and DELETE cancellation) alongside the existing client `/v1` routes, covered by `TestDocumentedContractRoutesAdaptToServiceAPI` | | 8.4 `[D:8.3]` | **DONE.** Define opaque IDs, legal queue/match state transitions, revisions and idempotency keys | [`server/contracts/v1/state-transitions.json`](server/contracts/v1/state-transitions.json) locks terminal states, legal edges, stale-revision handling and same-key replay/conflict behavior; contract tests cover the invariants | -| 8.5 `[D:8.4]` | **IN PROGRESS.** Initial PostgreSQL migration now defines durable idempotency keys, queue ownership/active-participation fencing, identities, sessions/revocations, ranked seasons, ratings/events, matches/participants, penalties, results, audits and outbox; follow-up migrations persist server-derived queue probe RTT metadata and the allocator GameServer/allocation registry | `server/migrations/0001_initial.sql`, `0003_queue_probe_metadata.sql`, `0004_allocator_registry.sql`, `migrations/runner.go`, `cmd/migrate` and static checks cover the durable tables, uniqueness/check constraints, Redis-as-cache boundary and serialized forward migration recording; opt-in `scripts/run_postgres_integration.sh` now runs the runner and real queue/assignment ownership, idempotency, revision and expiry checks through pgx; rollback/down migration, the remaining serializable adapters and cache-loss repair remain | +| 8.5 `[D:8.4]` | **IN PROGRESS.** Initial PostgreSQL migration now defines durable idempotency keys, queue ownership/active-participation fencing, identities, sessions/revocations, ranked seasons, ratings/events, matches/participants, penalties, results, audits and outbox; follow-up migrations persist server-derived queue probe RTT metadata, the allocator GameServer/allocation registry, and matcher-selected proposal region/protocol/team/slot plans | `server/migrations/0001_initial.sql`, `0003_queue_probe_metadata.sql`, `0004_allocator_registry.sql`, `0005_proposal_match_plans.sql`, `migrations/runner.go`, `cmd/migrate` and static checks cover the durable tables, uniqueness/check constraints, Redis-as-cache boundary and serialized forward migration recording; opt-in `scripts/run_postgres_integration.sh` now runs the runner and real queue/assignment ownership, idempotency, revision and expiry checks through pgx; rollback/down migration, remaining serializable adapters and cache-loss repair remain | | 8.6 `[D:8.3,8.4]` | **IN PROGRESS.** Add allocated-mode `ServerConfig` compatibility fields as opt-in defaults | `ServerConfig` now validates allocation mode, match/server IDs, playlist version, client build, future assignment expiry, image digest, transport and EU/NA region; `server_boot.gd` fails closed for the not-yet-wired Steam SDR transport, constrains allocated processes to one match, and emits allocation identity/transport in `server_started`; signed-authorisation admission, dynamic endpoint wiring and full manifest/runtime tests remain | #### 8B — Authentication and secure control plane @@ -1196,7 +1196,7 @@ the local/CI/community transport, not a silent production fallback. | 8.15 `[D:7.8,8.3]` | **IN PROGRESS.** Pure Go probe validation treats Steam location as opaque, requires nonce/freshness/region and server-computed RTT, and implements discrepancy quarantine/release; authenticated HTTP now accepts only opaque location/nonce input through a server-owned probe provider and records validated RTT into the active player's durable queue ticket; durable queue projections have a server-derived RTT JSON field for matcher reads | `server/domain/probes.go`, `server/migrations/0003_queue_probe_metadata.sql`, adversarial fixtures and `server/api/service.go`/`store/queue_sql.go` cover stale/wrong/forged evidence, the 25 ms/30% threshold, three-sample quarantine, five-clean release, authenticated provider arguments, rejection of client RTT fields, player/ticket/expiry binding, persistence failure, playlist-scoped candidate reads and bounded metadata decoding; Steam coordinator, regional probe adapters and multi-region probe population remain | | 8.16 `[D:8.14,8.15]` | **IN PROGRESS.** Pure Go candidate/team selection implements the <=100 ms ceiling, pairwise widening tolerance, anchor inclusion, deterministic set/region scoring and balanced team partitioning; queue-backed formation now consumes the server-owned projection, fences duplicate player identities and rejects playlist/build/protocol mixing; the matcher worker performs bounded formation and delegates the final claim to the durable proposal transaction; the runnable matcher now supports explicitly enabled ranked six-player polling with durable verified-Steam identity lookup | `server/domain/matcher.go`, `teams.go`, `server/matcher/worker.go`, `server/store/queue_sql.go` and adversarial fixtures cover no-common-region, tolerance boundaries, lexical ties, mean-rating balance, malformed candidates, duplicate identities, compatibility mismatches, incomplete batches, source failure, durable claim failure, queue-backed oldest-anchor formation and incomplete ranked identity metadata; arena selection and long-running worker integration remain | | 8.17 `[D:8.14,8.16]` | **IN PROGRESS.** Pure Go proposal policy sends a 10-second response window to every selected human, requires unanimous acceptance, applies exact decline/timeout cooldowns and ranked escalation; authenticated API exposes revisioned accept/decline mutations; formed matches now pass through a playlist-aware proposal boundary | `server/domain/proposal.go`, `formation.go` and `server/api/service.go` plus adversarial fixtures cover partial/unanimous response, expiry, replay/conflict, stale API revision, casual lineup preparation and ranked metadata validation; queue precedence and allocation integration remain | -| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now inserts proposal/participants and promotes every ticket in one rollback-safe transaction with player- and playlist-bound claim predicates, queue creation has a durable idempotency/owner-read adapter, participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time, and proposal accept/decline now uses participant/proposal locks, revision fencing and durable idempotency; an accepted proposal can now atomically create the exact `ALLOCATING` match/team/slot topology and promote all claimed tickets to `ACCEPTED`; runnable matcher polling supports an optional Redis candidate projection that repairs empty/lost cache state from authoritative PostgreSQL before the durable final claim | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go`, `match_sql.go`, `redis_candidates.go`, `server/matcher/worker.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry at read and mutation boundaries, response replay/conflict, exact match-promotion replay/conflict, fixed team/slot persistence, zero-row claim aborts, atomic statement ordering, incomplete matcher batches, source failures and empty-index Redis repair; opt-in PostgreSQL execution now covers queue create/replay/fencing, assignment persistence, proposal claim/promotion, accepted-proposal match promotion, participant recovery, unanimous response and rollback of partial claims; worker invocation, allocation runtime and concurrent two-matcher integration tests remain | +| 8.18 `[D:8.5,8.14,8.17]` | **IN PROGRESS.** Go store layer defines PostgreSQL SERIALIZABLE whole-transaction retries and queue candidate/proposal claim SQL using `FOR UPDATE SKIP LOCKED` plus durable uniqueness/revision fences; proposal creation now persists its matcher-selected region/protocol/team/slot plan alongside proposal/participant claims, queue creation has a durable idempotency/owner-read adapter, participant-scoped proposal recovery now expires OPEN proposals and pending participants transactionally at read time, and proposal accept/decline now uses participant/proposal locks, revision fencing and durable idempotency; final unanimous API acceptance invokes replay-safe promotion of the exact stored `ALLOCATING` match/team/slot topology and claimed tickets to `ACCEPTED`; runnable matcher polling supports an optional Redis candidate projection that repairs empty/lost cache state from authoritative PostgreSQL before the durable final claim | `server/store/serializable.go`, `queue_sql.go`, `proposal_sql.go`, `proposal_recovery_sql.go`, `match_sql.go`, `redis_candidates.go`, `server/matcher/worker.go`, `server/api/service.go` and tests cover retry classification, claim-boundary invariants, player/ticket/playlist mapping, durable queue replay/conflict, owner-scoped queue/proposal recovery, expiry at read and mutation boundaries, final-response promotion retry, exact match-promotion replay/conflict, fixed team/slot persistence, zero-row claim aborts, atomic statement ordering, incomplete matcher batches, source failures and empty-index Redis repair; opt-in PostgreSQL execution now covers queue create/replay/fencing, assignment persistence, proposal claim/promotion, accepted-proposal match promotion, participant recovery, unanimous response and rollback of partial claims; allocation runtime and concurrent two-matcher integration tests remain | | 8.19 `[D:8.18]` | **IN PROGRESS.** Pure Go casual lineup requires 2–6 humans with at least one per team, fills missing slots with explicit bots, permits kickoff-only bot-slot backfill and assigns no backfill penalty/rating update; proposal preparation now derives the lineup from formed teams | `server/domain/casual.go`, `formation.go` cover both-team minimum, bot shape, live-play rejection, zero-penalty backfill and casual proposal composition; queue candidate selection, opt-in 10 s backfill proposals, reconnect/leave penalties and live integration remain | | 8.20 `[D:8.18]` | **IN PROGRESS.** Pure Go ranked admission requires six unique verified solo humans, rejects bots/backfill/parties, and allows only random-enabled non-elevated arenas; proposal preparation requires matching metadata for every formed player | `server/domain/ranked.go`, `formation.go` cover count, identity, party, bot/backfill, arena eligibility and formed-player metadata rejection; `ArenaRegistry` integration, allocation wiring and innocent-ticket restoration remain | | 8.21 `[D:8.5,8.20]` | **IN PROGRESS.** Pure Go rating core implements canonical Glicko-2, daily inactivity, ranked 1/3 and casual 1/N human-opponent weights, deterministic opponent ordering, and authoritative draw/overtime/abandon scoring; certified result completion now applies per-player updates inside the durable transaction with lexical row locks and revision increments | `server/domain/rating.go`, `server/store/result_sql.go` and tests cover canonical/inactivity/weight/invalid-input, draw/OT/abandon, ordered participant snapshots, lock/value re-read and rating update SQL; live PostgreSQL rating, seasons and concurrent result transaction tests remain | diff --git a/server/api/service.go b/server/api/service.go index d5a037e8..9377db2e 100644 --- a/server/api/service.go +++ b/server/api/service.go @@ -63,6 +63,14 @@ type ProposalBackend interface { type ProposalMutationBackend interface { Respond(context.Context, string, string, string, bool, uint64, time.Time) (domain.Proposal, error) } +type ProposalPromoter interface { + Promote(context.Context, domain.Proposal, time.Time) error +} +type ProposalPromoterFunc func(context.Context, domain.Proposal, time.Time) error + +func (f ProposalPromoterFunc) Promote(ctx context.Context, proposal domain.Proposal, now time.Time) error { + return f(ctx, proposal, now) +} type AssignmentView struct { MatchID string `json:"match_id"` @@ -83,29 +91,30 @@ type AssignmentView struct { type AssignmentProvider func(context.Context, string, string, time.Time) (AssignmentView, error) type Service struct { - Sessions *domain.SessionStore - SessionBackend SessionBackend - SessionIssuer SessionIssuer - SteamLogin SteamLoginProvider - Queue *domain.Queue - Candidate CandidateProvider - CandidateV2 CandidateProviderV2 - QueueBackend QueueBackend - CandidateIndex CandidateIndex - Probe ProbeProvider - ProbeRecorder ProbeRecorder - WorkloadVerify WorkloadVerifier - ResultSubmitter ResultSubmitter - Assignment AssignmentProvider - Now func() time.Time - Proposals map[string]*domain.Proposal - ProposalBackend ProposalBackend - RankedProfiles map[string]domain.RankedProfile - TierPolicy domain.TierPolicy - RateLimiter *RateLimiter - proposalMu sync.Mutex - eventsMu sync.Mutex - events *eventHub + Sessions *domain.SessionStore + SessionBackend SessionBackend + SessionIssuer SessionIssuer + SteamLogin SteamLoginProvider + Queue *domain.Queue + Candidate CandidateProvider + CandidateV2 CandidateProviderV2 + QueueBackend QueueBackend + CandidateIndex CandidateIndex + Probe ProbeProvider + ProbeRecorder ProbeRecorder + WorkloadVerify WorkloadVerifier + ResultSubmitter ResultSubmitter + Assignment AssignmentProvider + Now func() time.Time + Proposals map[string]*domain.Proposal + ProposalBackend ProposalBackend + ProposalPromoter ProposalPromoter + RankedProfiles map[string]domain.RankedProfile + TierPolicy domain.TierPolicy + RateLimiter *RateLimiter + proposalMu sync.Mutex + eventsMu sync.Mutex + events *eventHub } func (s *Service) Handler() http.Handler { @@ -598,6 +607,12 @@ func (s *Service) proposalMutation(w http.ResponseWriter, r *http.Request) { writeDomainError(w, err) return } + if updated.State == domain.Accepted && s.ProposalPromoter != nil { + if err := s.ProposalPromoter.Promote(r.Context(), updated, now); err != nil { + writeError(w, http.StatusServiceUnavailable, "match_promotion_unavailable") + return + } + } s.publishProposalEvent(updated, now) writeJSON(w, http.StatusOK, toProposalResponse(updated)) } diff --git a/server/api/service_test.go b/server/api/service_test.go index 7f5a7894..ec613d61 100644 --- a/server/api/service_test.go +++ b/server/api/service_test.go @@ -41,6 +41,18 @@ type resultSubmitterSpy struct { result domain.MatchResult } +type proposalPromoterSpy struct { + calls int + proposal domain.Proposal + err error +} + +func (p *proposalPromoterSpy) Promote(_ context.Context, proposal domain.Proposal, _ time.Time) error { + p.calls++ + p.proposal = proposal + return p.err +} + func (r *resultSubmitterSpy) SubmitResult(_ context.Context, key string, result domain.MatchResult, _ domain.WorkloadBinding, _ []byte, _ time.Time) error { r.calls++ r.key, r.result = key, result @@ -409,6 +421,49 @@ func TestStateChangingAPIActionsPublishTargetedEvents(t *testing.T) { } } +func TestFinalProposalAcceptancePromotesDurableMatchAndFailsRetryably(t *testing.T) { + now := time.Unix(1000, 0).UTC() + proposal, err := domain.NewProposal("proposal-promote-123456", domain.Casual, []string{"player-1", "player-2"}, now) + if err != nil { + t.Fatal(err) + } + backend := &proposalBackendSpy{proposal: proposal} + promoter := &proposalPromoterSpy{} + sessions := domain.NewSessionStore() + session1, token1, err := sessions.Issue("player-1", time.Hour, now) + if err != nil { + t.Fatal(err) + } + session2, token2, err := sessions.Issue("player-2", time.Hour, now) + if err != nil { + t.Fatal(err) + } + service := &Service{Sessions: sessions, ProposalBackend: backend, ProposalPromoter: promoter, Now: func() time.Time { return now }} + respond := func(credential, key, revision string) int { + req := httptest.NewRequest(http.MethodPost, "/v1/proposals/"+proposal.ProposalID+"/accept", nil) + req.Header.Set("Authorization", "Bearer "+credential) + req.Header.Set("Idempotency-Key", key) + req.Header.Set("If-Match-Revision", revision) + recorder := httptest.NewRecorder() + service.proposalMutation(recorder, req) + return recorder.Code + } + credential1 := session1.SessionID + ":" + token1 + credential2 := session2.SessionID + ":" + token2 + if status := respond(credential1, "proposal-promote-first", "0"); status != http.StatusOK || promoter.calls != 0 { + t.Fatalf("first acceptance status/calls = %d/%d", status, promoter.calls) + } + if status := respond(credential2, "proposal-promote-final", "1"); status != http.StatusOK || promoter.calls != 1 || promoter.proposal.State != domain.Accepted { + t.Fatalf("final acceptance status/promoter = %d/%+v", status, promoter) + } + promoter.err = errors.New("database unavailable") + // A duplicate response is replayed by the durable proposal backend and + // retries promotion instead of asking the player to accept again. + if status := respond(credential2, "proposal-promote-final", "1"); status != http.StatusServiceUnavailable || promoter.calls != 2 { + t.Fatalf("promotion retry status/calls = %d/%d", status, promoter.calls) + } +} + func TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped(t *testing.T) { now := time.Unix(1000, 0).UTC() proposal, err := domain.NewProposal("proposal-1234567890123456", domain.Casual, []string{"player-1", "player-2"}, now) diff --git a/server/api/store_adapters.go b/server/api/store_adapters.go index 65eb3012..e555926d 100644 --- a/server/api/store_adapters.go +++ b/server/api/store_adapters.go @@ -46,3 +46,15 @@ func (p postgresProposalBackend) Respond(ctx context.Context, playerID, proposal func ProposalProviderFromStore(db *sql.DB) ProposalBackend { return postgresProposalBackend{db: db} } + +// ProposalPromoterFromStore turns a durably accepted proposal into its exact +// matcher-selected ALLOCATING match. The store chooses a deterministic match +// ID so an API retry after a transient failure cannot duplicate the match. +func ProposalPromoterFromStore(db *sql.DB) ProposalPromoter { + return ProposalPromoterFunc(func(ctx context.Context, proposal domain.Proposal, now time.Time) error { + if proposal.State != domain.Accepted { + return domain.ErrIllegalTransition + } + return store.PromoteStoredAcceptedProposal(ctx, db, proposal.ProposalID, now) + }) +} diff --git a/server/api/store_adapters_test.go b/server/api/store_adapters_test.go index 8c9971df..c99494a7 100644 --- a/server/api/store_adapters_test.go +++ b/server/api/store_adapters_test.go @@ -4,6 +4,8 @@ import ( "context" "testing" "time" + + "github.com/cosmic-clash/cosmic-clash/server/domain" ) func TestAssignmentProviderFromStorePreservesPlayerScopedRecoveryBoundary(t *testing.T) { @@ -25,3 +27,14 @@ func TestProposalProviderFromStoreFailsClosedWithoutDatabase(t *testing.T) { t.Fatal("nil store was treated as an available proposal source") } } + +func TestProposalPromoterFromStoreFailsClosedWithoutDatabase(t *testing.T) { + promoter := ProposalPromoterFromStore(nil) + if promoter == nil { + t.Fatal("proposal promoter was not created") + } + proposal := domain.Proposal{ProposalID: "proposal-1", State: domain.Accepted} + if err := promoter.Promote(context.Background(), proposal, time.Unix(1000, 0)); err == nil { + t.Fatal("nil store was treated as an available proposal promoter") + } +} diff --git a/server/cmd/control-plane/main.go b/server/cmd/control-plane/main.go index 774182d3..6c65eebf 100644 --- a/server/cmd/control-plane/main.go +++ b/server/cmd/control-plane/main.go @@ -81,13 +81,14 @@ func newAPIHandler(db *sql.DB, indexes ...api.CandidateIndex) http.Handler { candidateIndex = indexes[0] } return (&api.Service{ - SessionBackend: store.PostgresSessions{DB: db}, - QueueBackend: store.PostgresQueue{DB: db}, - ProposalBackend: api.ProposalProviderFromStore(db), - Assignment: api.AssignmentProviderFromStore(db), - CandidateIndex: candidateIndex, - ProbeRecorder: store.PostgresQueue{DB: db}, - Now: func() time.Time { return time.Now().UTC() }, + SessionBackend: store.PostgresSessions{DB: db}, + QueueBackend: store.PostgresQueue{DB: db}, + ProposalBackend: api.ProposalProviderFromStore(db), + ProposalPromoter: api.ProposalPromoterFromStore(db), + Assignment: api.AssignmentProviderFromStore(db), + CandidateIndex: candidateIndex, + ProbeRecorder: store.PostgresQueue{DB: db}, + Now: func() time.Time { return time.Now().UTC() }, }).Handler() } diff --git a/server/domain/formation.go b/server/domain/formation.go index 68d0c081..1148704d 100644 --- a/server/domain/formation.go +++ b/server/domain/formation.go @@ -2,6 +2,7 @@ package domain import ( "fmt" + "sort" "time" ) @@ -68,5 +69,34 @@ func PrepareProposal(id string, playlist Playlist, formation MatchFormation, ran if err != nil { return PreparedProposal{}, err } + if formation.Selection.Region == "" || len(formation.Selection.Players) == 0 || formation.Selection.Players[0].ProtocolVersion < 1 { + return PreparedProposal{}, fmt.Errorf("formed match metadata is incomplete") + } + proposal.Region = formation.Selection.Region + proposal.Protocol = formation.Selection.Players[0].ProtocolVersion + for _, player := range formation.Selection.Players { + if player.ProtocolVersion != proposal.Protocol { + return PreparedProposal{}, fmt.Errorf("formed match has mixed protocols") + } + } + assignProposalSlots(&proposal, formation.Teams) return PreparedProposal{Proposal: proposal, CasualLineup: lineup}, nil } + +func assignProposalSlots(proposal *Proposal, teams Teams) { + assign := func(team int, players []Candidate) { + ordered := append([]Candidate(nil), players...) + sort.Slice(ordered, func(i, j int) bool { return ordered[i].PlayerID < ordered[j].PlayerID }) + for index, player := range ordered { + for participant := range proposal.Participants { + if proposal.Participants[participant].PlayerID == player.PlayerID { + proposal.Participants[participant].Team = team + proposal.Participants[participant].Slot = team*3 + index + break + } + } + } + } + assign(0, teams.Team0) + assign(1, teams.Team1) +} diff --git a/server/domain/formation_test.go b/server/domain/formation_test.go index e427cb2f..5fb0d493 100644 --- a/server/domain/formation_test.go +++ b/server/domain/formation_test.go @@ -10,7 +10,7 @@ func testFormation(t *testing.T, count int) MatchFormation { now := time.Unix(1000, 0) players := make([]Candidate, count) for i := range players { - players[i] = Candidate{TicketID: string(rune('a' + i)), PlayerID: string(rune('p' + i)), Rating: 1500, EnqueuedAt: now, PredictedRTT: map[string]float64{"EU": 40}} + players[i] = Candidate{TicketID: string(rune('a' + i)), PlayerID: string(rune('p' + i)), ProtocolVersion: 1, Rating: 1500, EnqueuedAt: now, PredictedRTT: map[string]float64{"EU": 40}} } selection, err := SelectCandidates(players[0], players[1:], count, now) if err != nil { @@ -31,6 +31,9 @@ func TestPrepareProposalBuildsCasualLineupBeforeCreatingProposal(t *testing.T) { if prepared.Proposal.Playlist != Casual || len(prepared.Proposal.Participants) != 2 || len(prepared.CasualLineup) != 6 { t.Fatalf("prepared casual proposal = %+v", prepared) } + if prepared.Proposal.Region != "EU" || prepared.Proposal.Protocol != 1 || prepared.Proposal.Participants[0].Slot == prepared.Proposal.Participants[1].Slot || prepared.Proposal.Participants[0].Team == prepared.Proposal.Participants[1].Team { + t.Fatalf("prepared proposal did not retain deterministic topology: %+v", prepared.Proposal) + } humans := 0 teams := map[int]bool{} for _, slot := range prepared.CasualLineup { diff --git a/server/domain/proposal.go b/server/domain/proposal.go index 692de4f9..00691eee 100644 --- a/server/domain/proposal.go +++ b/server/domain/proposal.go @@ -34,11 +34,15 @@ const ( type ProposalParticipant struct { PlayerID string Response Response + Team int + Slot int } type Proposal struct { ProposalID string Playlist Playlist + Region string + Protocol int Participants []ProposalParticipant State State Revision uint64 diff --git a/server/matcher/worker_test.go b/server/matcher/worker_test.go index 309cd7c4..ea6a030a 100644 --- a/server/matcher/worker_test.go +++ b/server/matcher/worker_test.go @@ -27,7 +27,7 @@ func candidates() []domain.Candidate { now := time.Unix(1000, 0).UTC() result := make([]domain.Candidate, 4) for i := range result { - result[i] = domain.Candidate{TicketID: "ticket-" + string(rune('1'+i)), PlayerID: "player-" + string(rune('1'+i)), Playlist: domain.Casual, EnqueuedAt: now.Add(time.Duration(i) * time.Second), PredictedRTT: map[string]float64{"EU": 20}} + result[i] = domain.Candidate{TicketID: "ticket-" + string(rune('1'+i)), PlayerID: "player-" + string(rune('1'+i)), Playlist: domain.Casual, ProtocolVersion: 1, EnqueuedAt: now.Add(time.Duration(i) * time.Second), PredictedRTT: map[string]float64{"EU": 20}} } return result } diff --git a/server/migrations/0005_proposal_match_plans.sql b/server/migrations/0005_proposal_match_plans.sql new file mode 100644 index 00000000..c44888be --- /dev/null +++ b/server/migrations/0005_proposal_match_plans.sql @@ -0,0 +1,15 @@ +-- Preserve the matcher-selected topology through the proposal response window. +-- These fields are nullable for already-created proposals during a rolling +-- deployment; new matcher-created proposals always populate them before they +-- can be promoted to an ALLOCATING match. +ALTER TABLE proposals + ADD COLUMN match_region TEXT CHECK (match_region IN ('EU', 'NA')), + ADD COLUMN match_protocol INTEGER CHECK (match_protocol > 0); + +ALTER TABLE proposal_participants + ADD COLUMN team INTEGER CHECK (team IN (0, 1)), + ADD COLUMN slot INTEGER CHECK (slot BETWEEN 0 AND 5); + +CREATE UNIQUE INDEX proposal_participants_unique_slot + ON proposal_participants (proposal_id, slot) + WHERE slot IS NOT NULL; diff --git a/server/store/match_sql.go b/server/store/match_sql.go index 2e91c2f0..a110a16b 100644 --- a/server/store/match_sql.go +++ b/server/store/match_sql.go @@ -63,6 +63,44 @@ const AcceptedMatchParticipantInsertSQL = `INSERT INTO match_participants (match_id, player_id, ticket_id, slot, team) VALUES ($1, $2, $3, $4, $5)` +const StoredProposalMatchPlanSQL = `SELECT match_region, match_protocol +FROM proposals +WHERE proposal_id = $1 AND state = 'ACCEPTED'` + +const StoredProposalMatchPlayersSQL = `SELECT player_id, team, slot +FROM proposal_participants +WHERE proposal_id = $1 AND response = 'ACCEPTED' +ORDER BY player_id` + +// PromoteStoredAcceptedProposal materializes the exact topology persisted by +// the matcher once every player has accepted. The deterministic match ID makes +// a request retry converge after an API/worker interruption. +func PromoteStoredAcceptedProposal(ctx context.Context, db *sql.DB, proposalID string, now time.Time) error { + if db == nil || proposalID == "" || now.IsZero() { + return fmt.Errorf("invalid stored proposal promotion arguments") + } + plan := AcceptedMatchPlan{MatchID: "match-" + proposalID, ProposalID: proposalID} + if err := db.QueryRowContext(ctx, StoredProposalMatchPlanSQL, proposalID).Scan(&plan.Region, &plan.Protocol); err != nil { + return err + } + rows, err := db.QueryContext(ctx, StoredProposalMatchPlayersSQL, proposalID) + if err != nil { + return err + } + defer rows.Close() + for rows.Next() { + var player MatchPlayer + if err := rows.Scan(&player.PlayerID, &player.Team, &player.Slot); err != nil { + return err + } + plan.Players = append(plan.Players, player) + } + if err := rows.Err(); err != nil { + return err + } + return CreateMatchFromAcceptedProposal(ctx, db, plan, now) +} + // CreateMatchFromAcceptedProposal atomically promotes the exact accepted // roster into an ALLOCATING match. An existing match ID is an idempotent retry // only if every durable field and participant assignment matches the request. diff --git a/server/store/proposal_sql.go b/server/store/proposal_sql.go index 6073885b..716f78e9 100644 --- a/server/store/proposal_sql.go +++ b/server/store/proposal_sql.go @@ -10,8 +10,8 @@ import ( ) const ProposalInsertSQL = `INSERT INTO proposals - (proposal_id, playlist, state, expires_at, revision) -VALUES ($1, $2, 'OPEN', $3, 0)` + (proposal_id, playlist, state, expires_at, revision, match_region, match_protocol) +VALUES ($1, $2, 'OPEN', $3, 0, NULLIF($4, ''), NULLIF($5, 0))` // CreateProposal atomically claims the queue tickets and creates the proposal. // Every statement runs inside the same SERIALIZABLE retry callback; callers @@ -20,8 +20,11 @@ func CreateProposal(ctx context.Context, db *sql.DB, proposal domain.Proposal, t if proposal.ProposalID == "" || len(proposal.Participants) == 0 { return fmt.Errorf("invalid proposal transaction") } + if !validProposalMatchPlan(proposal) { + return fmt.Errorf("invalid proposal match plan") + } return RunSerializable(ctx, db, DefaultSerializableAttempts, func(ctx context.Context, tx *sql.Tx) error { - if _, err := tx.ExecContext(ctx, ProposalInsertSQL, proposal.ProposalID, proposal.Playlist, proposal.ExpiresAt); err != nil { + if _, err := tx.ExecContext(ctx, ProposalInsertSQL, proposal.ProposalID, proposal.Playlist, proposal.ExpiresAt, proposal.Region, proposal.Protocol); err != nil { return err } for _, participant := range proposal.Participants { @@ -29,7 +32,7 @@ func CreateProposal(ctx context.Context, db *sql.DB, proposal domain.Proposal, t if participant.PlayerID == "" || ticketID == "" { return fmt.Errorf("missing proposal ticket mapping") } - if _, err := tx.ExecContext(ctx, ProposalParticipantInsertSQL, proposal.ProposalID, participant.PlayerID, ticketID); err != nil { + if _, err := tx.ExecContext(ctx, ProposalParticipantInsertSQL, proposal.ProposalID, participant.PlayerID, ticketID, nullablePlanField(proposal.Region != "", participant.Team), nullablePlanField(proposal.Region != "", participant.Slot)); err != nil { return err } result, err := tx.ExecContext(ctx, QueueTicketProposeSQL, ticketID, participant.PlayerID, string(proposal.Playlist), now) @@ -47,3 +50,32 @@ func CreateProposal(ctx context.Context, db *sql.DB, proposal domain.Proposal, t return nil }) } + +func validProposalMatchPlan(proposal domain.Proposal) bool { + if proposal.Region == "" && proposal.Protocol == 0 { + return true // Legacy/direct callers have no matcher formation to persist. + } + if (proposal.Region != "EU" && proposal.Region != "NA") || proposal.Protocol < 1 { + return false + } + seenSlots := make(map[int]struct{}, len(proposal.Participants)) + teams := [2]int{} + for _, participant := range proposal.Participants { + if participant.Team < 0 || participant.Team > 1 || participant.Slot < 0 || participant.Slot > 5 { + return false + } + if _, exists := seenSlots[participant.Slot]; exists { + return false + } + seenSlots[participant.Slot] = struct{}{} + teams[participant.Team]++ + } + return teams[0] > 0 && teams[1] > 0 +} + +func nullablePlanField(enabled bool, value int) any { + if !enabled { + return nil + } + return value +} diff --git a/server/store/queue_sql_test.go b/server/store/queue_sql_test.go index 7e7dcc17..1016442c 100644 --- a/server/store/queue_sql_test.go +++ b/server/store/queue_sql_test.go @@ -8,14 +8,16 @@ import ( func TestQueueSQLUsesDurableIdempotencyAndOwnerScopedRecovery(t *testing.T) { for query, fragments := range map[string][]string{ - QueueIdempotencyInsertSQL: {"idempotency_keys", "ON CONFLICT (scope, idempotency_key) DO NOTHING", "payload_digest"}, - QueueIdempotencySelectSQL: {"scope = $1", "idempotency_key = $2", "FOR UPDATE"}, - QueueTicketSelectSQL: {"ticket_id = $1", "player_id = $2"}, - QueueTicketInsertSQL: {"player_id", "playlist", "client_build", "protocol_version"}, - QueueTicketHeartbeatSQL: {"player_id = $2", "revision = $3", "expires_at > $4", "RETURNING"}, - QueueTicketCancelSQL: {"player_id = $2", "revision = $3", "state NOT IN", "RETURNING"}, - QueueCandidateProjectionSQL: {"playlist = $1", "predicted_rtt", "expires_at > $2", "LIMIT $3"}, - RankedParticipantSQL: {"steam_id", "player_id = ANY($1)", "ORDER BY player_id"}, + QueueIdempotencyInsertSQL: {"idempotency_keys", "ON CONFLICT (scope, idempotency_key) DO NOTHING", "payload_digest"}, + QueueIdempotencySelectSQL: {"scope = $1", "idempotency_key = $2", "FOR UPDATE"}, + QueueTicketSelectSQL: {"ticket_id = $1", "player_id = $2"}, + QueueTicketInsertSQL: {"player_id", "playlist", "client_build", "protocol_version"}, + QueueTicketHeartbeatSQL: {"player_id = $2", "revision = $3", "expires_at > $4", "RETURNING"}, + QueueTicketCancelSQL: {"player_id = $2", "revision = $3", "state NOT IN", "RETURNING"}, + QueueCandidateProjectionSQL: {"playlist = $1", "predicted_rtt", "expires_at > $2", "LIMIT $3"}, + RankedParticipantSQL: {"steam_id", "player_id = ANY($1)", "ORDER BY player_id"}, + ProposalInsertSQL: {"match_region", "match_protocol", "NULLIF($4, '')"}, + ProposalParticipantInsertSQL: {"team", "slot", "'PENDING'"}, } { for _, fragment := range fragments { if !contains(query, fragment) { diff --git a/server/store/serializable.go b/server/store/serializable.go index b4f7681e..99d1a79c 100644 --- a/server/store/serializable.go +++ b/server/store/serializable.go @@ -75,8 +75,8 @@ ORDER BY enqueued_at, ticket_id LIMIT $2 FOR UPDATE SKIP LOCKED` - ProposalParticipantInsertSQL = `INSERT INTO proposal_participants (proposal_id, player_id, ticket_id, response) -VALUES ($1, $2, $3, 'PENDING')` + ProposalParticipantInsertSQL = `INSERT INTO proposal_participants (proposal_id, player_id, ticket_id, response, team, slot) +VALUES ($1, $2, $3, 'PENDING', $4, $5)` QueueTicketProposeSQL = `UPDATE queue_tickets SET state = 'PROPOSED', revision = revision + 1 WHERE ticket_id = $1 AND player_id = $2 AND playlist = $3 AND state = 'QUEUED' AND expires_at > $4`