From 3aad68a6e6eac5638e842941e9a07e540bcea4ab Mon Sep 17 00:00:00 2001 From: Josh Creek <8179928+jcreek@users.noreply.github.com> Date: Tue, 1 Sep 2026 08:52:12 +0100 Subject: [PATCH] feat: fence expired allocated reconnects --- Game/scripts/match_net.gd | 32 +++++++++++++++++++++++++++++- Game/tests/cases/test_match_net.gd | 12 ++++++++--- multiplayer-todo.md | 2 +- 3 files changed, 41 insertions(+), 5 deletions(-) diff --git a/Game/scripts/match_net.gd b/Game/scripts/match_net.gd index 4f786ec2..8a11723d 100644 --- a/Game/scripts/match_net.gd +++ b/Game/scripts/match_net.gd @@ -19,6 +19,7 @@ signal rejected(reason: String) # client-side only: the server refused our hel signal welcomed() # client-side only: our hello was accepted const TEAM_COUNT := 2 +const RECONNECT_GRACE_SECONDS := 60.0 # player_name is the one client-supplied value in _hello that gets broadcast # verbatim to every other peer (protocol_version/tick_hz are checked, never @@ -55,6 +56,7 @@ var join_authorisation := "" var require_join_authorisation := false var _allowed_join_authorisations: Dictionary = {} var _active_join_peers: Dictionary = {} # opaque authorisation -> peer_id +var _join_history: Dictionary = {} # token -> {generation, lost_at} var _join_authorisation_context: Dictionary = {} var _join_signing_key := PackedByteArray() @@ -92,6 +94,7 @@ func _on_shutting_down() -> void: roster.clear() _allowed_join_authorisations.clear() _active_join_peers.clear() + _join_history.clear() _join_authorisation_context.clear() _join_signing_key = PackedByteArray() require_join_authorisation = false @@ -119,6 +122,7 @@ func configure_join_authorisations(tokens: Array, context: Dictionary, signing_k func _on_peer_disconnected(peer_id: int) -> void: if not multiplayer.is_server(): return + NetworkManager.invalidate_peer(peer_id) _remove_player(peer_id) @@ -126,6 +130,9 @@ func _remove_player(peer_id: int) -> void: for token in _active_join_peers.keys(): if int(_active_join_peers[token]) == peer_id: _active_join_peers.erase(token) + var history: Dictionary = _join_history.get(token, {}) + history["lost_at"] = Time.get_unix_time_from_system() + _join_history[token] = history break if not roster.has(peer_id): return @@ -197,6 +204,12 @@ func _hello(protocol_version: int, tick_hz: int, player_name: String, supplied_j if require_join_authorisation and _active_join_peers.has(supplied_join_authorisation): await _reject(peer_id, "join authorisation already in use") return + var join_generation := 1 + if require_join_authorisation: + join_generation = _reserve_join_authorisation(supplied_join_authorisation, peer_id) + if join_generation < 0: + await _reject(peer_id, "join authorisation reclaim expired") + return if player_name.length() > MAX_INPUT_LENGTH: await _reject(peer_id, "player name too long") return @@ -212,7 +225,10 @@ func _hello(protocol_version: int, tick_hz: int, player_name: String, supplied_j var team := _pick_balanced_team() roster[peer_id] = PlayerInfo.new(peer_id, clean_name, team, false) if require_join_authorisation: - _active_join_peers[supplied_join_authorisation] = peer_id + # _reserve_join_authorisation already owns the active peer reservation; + # keeping the generation in the history makes fencing auditable without + # exposing it to the client. + _join_history[supplied_join_authorisation]["generation"] = join_generation player_joined.emit(peer_id, clean_name) # local: the broadcast below is call_remote, never loops back to the server itself _welcome.rpc_id(peer_id) _player_joined.rpc(peer_id, clean_name, team, false) # broadcast, includes the new peer itself @@ -268,6 +284,20 @@ func is_join_authorisation_active(token: String) -> bool: return not token.is_empty() and _active_join_peers.has(token) +func _reserve_join_authorisation(token: String, peer_id: int) -> int: + if token.is_empty() or _active_join_peers.has(token): + return -1 + var now := Time.get_unix_time_from_system() + var history: Dictionary = _join_history.get(token, {}) + var lost_at := float(history.get("lost_at", 0.0)) + if lost_at > 0.0 and now - lost_at > RECONNECT_GRACE_SECONDS: + return -1 + var generation := int(history.get("generation", 0)) + 1 + _join_history[token] = {"generation": generation, "lost_at": 0.0} + _active_join_peers[token] = peer_id + return generation + + # Strips control/formatting characters (so a name can't corrupt a log line # or blow out UI layout with e.g. embedded newlines) and clamps to display # length. Input is already bounded to MAX_INPUT_LENGTH by the caller before diff --git a/Game/tests/cases/test_match_net.gd b/Game/tests/cases/test_match_net.gd index e020bc3c..ecd89bf0 100644 --- a/Game/tests/cases/test_match_net.gd +++ b/Game/tests/cases/test_match_net.gd @@ -54,9 +54,15 @@ func test_allocated_join_authorisation_is_allowlisted_and_bound_to_server() -> v wrong_claims["ServerID"] = "other-server" var wrong_token := Marshalls.raw_to_base64(JSON.stringify({"Authorisation": wrong_claims, "Signature": "trusted-signature"}).to_utf8_buffer()) assert_true(not match_net._valid_join_authorisation(wrong_token), "wrong server claim is rejected") - assert_true(not match_net.is_join_authorisation_active(token), "validated token is not active before admission") - match_net._active_join_peers[token] = 42 - assert_true(match_net.is_join_authorisation_active(token), "active token is visible to the duplicate-admission guard") + assert_eq(match_net._reserve_join_authorisation(token, 42), 1, "first admission receives generation one") + assert_true(match_net.is_join_authorisation_active(token), "admitted token is active") + assert_eq(match_net._reserve_join_authorisation(token, 43), -1, "active token cannot be admitted concurrently") + match_net._remove_player(42) + assert_true(not match_net.is_join_authorisation_active(token), "disconnect releases active token") + assert_eq(match_net._reserve_join_authorisation(token, 43), 2, "reclaim receives the next server-owned generation") + match_net._remove_player(43) + match_net._join_history[token]["lost_at"] = Time.get_unix_time_from_system() - MatchNet.RECONNECT_GRACE_SECONDS - 1.0 + assert_eq(match_net._reserve_join_authorisation(token, 44), -1, "reclaim after the grace window is fenced") func test_allocated_join_authorisation_verifies_canonical_hmac() -> void: diff --git a/multiplayer-todo.md b/multiplayer-todo.md index ee27f024..fe8d50fa 100644 --- a/multiplayer-todo.md +++ b/multiplayer-todo.md @@ -1229,7 +1229,7 @@ the local/CI/community transport, not a silent production fallback. |---|---|---| | 8.39 `[D:8.3,8.14,8.17]` | **IN PROGRESS.** `MatchmakingState` now projects queue → proposal → allocation/process-ready/assignment-ready/connect/live plus terminal failure states; autoload `ControlPlaneClient` provides authenticated queue create/recovery/heartbeat/cancel and proposal response requests with idempotency/revision headers; `matchmaking.tscn`/`matchmaking.gd` expose the state and authoritative actions from the main menu; authenticated proposal recovery now reconciles missed proposal events and expires them at read time; the Go API publishes targeted authenticated revisioned queue/proposal/assignment events and the Godot client consumes state/proposal/assignment events, fetching the authoritative assignment after assignment readiness; the API can now use the durable participant-scoped proposal provider for both recovery and accept/decline mutations | `test_matchmaking_state.gd`, `test_control_plane_client.gd`, `test_matchmaking_ui.gd`, `TestProposalRecoveryIsParticipantScopedAndExpiresAtReadBoundary`, `TestAuthenticatedWebSocketDeliversOnlyTargetedRevisionedEvents`, `TestStateChangingAPIActionsPublishTargetedEvents`, `TestProposalRecoveryUsesDurableBackendAndRemainsParticipantScoped` and store proposal SQL tests reject stale/gapped/conflicting updates, validate endpoint/token/payload normalization, preserve idempotent duplicates, and guarantee visible phase/terminal copy; wiring durable allocation events into the outbox, wait/latency explanations and Godot runtime verification remain | | 8.40 `[D:8.3,8.14]` | **IN PROGRESS.** Pure Go revisioned replica reducer rejects gaps for REST resync, makes duplicate/out-of-order events idempotent, and resumes from the authoritative snapshot revision; authenticated queue-ticket recovery now has an owner-checked REST read; Godot client projection persists non-secret ticket/proposal state, forces authoritative recovery after restart, and can replay a lost queue-create response with the original ticket/idempotency key; the Go API now exposes an authenticated `/v1/events` WebSocket with bounded per-player queues, strict upgrade/vocabulary validation and REST-resync-safe slow-client failure; Godot `ControlPlaneClient` can connect to the stream using Godot 4.7's handshake-header API, consume validated events, automatically reconnect with bounded backoff, and trigger REST recovery on projection gaps and stream return; `OutboxDispatcher` now provides ordered at-least-once delivery after durable commit; assignment recovery events carry the durable assignment revision without leaking it into REST JSON; prediction startup now distinguishes the sequence-0 warm-up acknowledgement from genuine missing/evicted history, preventing a false hard-snap during a live match | `server/domain/sync.go`, `server/api/events.go`, `server/api/service.go`, `server/store/outbox.go`, `service_test.go`, `outbox_test.go`, `matchmaking_state.gd`, `control_plane_client.gd`, `local_prediction_history.gd`, `net_ship_predictor.gd` and tests cover gap, snapshot, replay, same-revision conflict, owner-only ticket recovery, expired-ticket terminal handling, malformed restart snapshots, API-level duplicate-create replay/conflict, authenticated handshake/key rejection, targeted event delivery, exactly-once slow-subscriber closure, invalid-event rejection, delivery-before-ack failure ordering, assignment event/response revision separation and prediction warm-up/hard-resync separation; Godot 4.7.1 headless project parse and 143-test unit harness pass with compatibility rendering, and a two-process ENet authoritative match smoke passes spawn, movement, prediction, 0% snapshot loss and 0 hard snaps; wiring the dispatcher to a production WebSocket/Redis worker and live multi-process control-plane/game verification remain | -| 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view including the hosted endpoint; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, validate and retain the endpoint, and `connect_to_assignment()` now starts only the validated ENet/Steam transport after assignment readiness; the opaque join authorisation is carried in the MatchNet hello payload rather than the endpoint URL; allocated Godot servers now fail closed unless an operator-mounted JSON roster of control-plane signed envelopes and an HMAC-SHA256 key are present, and MatchNet verifies the canonical Go claim bytes, checks exact token membership plus match/server/protocol/slot/expiry claims before admitting a peer, rejects concurrent reuse of an active token, and releases it on disconnect; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point; `SaveAssignments` publishes a complete signed roster atomically instead of allowing partial player visibility; `SaveVerifiedAssignmentRoster` rechecks signed claims before deriving player rows | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `control_plane_client.gd`, `match_net.gd`, `server_boot.gd`, `server_config.gd`, `test_assignment_state.gd`, `test_control_plane_client.gd`, `test_match_net.gd`, `server/contracts/v1/openapi.json`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport/endpoint boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling, atomic batch validation, signed-claim binding, strict endpoint splitting, allowlisted claim rejection, canonical HMAC interoperability, forged-signature rejection, duplicate active-token rejection and 146-test Godot compatibility coverage; SDR relay-ticket installation, reconnect generation fencing and live Godot/PostgreSQL verification remain | +| 8.41 `[D:7.8,8.9,8.31,8.40]` | **IN PROGRESS.** Authenticated `GET /v1/assignments/{matchId}` now exposes only a validated, player-scoped assignment view including the hosted endpoint; Godot `AssignmentState`/`ControlPlaneClient.fetch_assignment()` bind the response to the authenticated player, recheck expiry, validate and retain the endpoint, and `connect_to_assignment()` now starts only the validated ENet/Steam transport after assignment readiness; the opaque join authorisation is carried in the MatchNet hello payload rather than the endpoint URL; allocated Godot servers now fail closed unless an operator-mounted JSON roster of control-plane signed envelopes and an HMAC-SHA256 key are present, and MatchNet verifies the canonical Go claim bytes, checks exact token membership plus match/server/protocol/slot/expiry claims before admitting a peer, rejects concurrent reuse of an active token, tracks server-owned reconnect generations across the 60-second reclaim window, fences expired reclaims and invalidates old peers; migration 0002 and the Go store adapter now persist/recover the complete player-scoped assignment projection with conflict-safe identical replay; `AssignmentProviderFromStore` wires that durable projection into the API injection point; `SaveAssignments` publishes a complete signed roster atomically instead of allowing partial player visibility; `SaveVerifiedAssignmentRoster` rechecks signed claims before deriving player rows | `server/api/service.go`, `store_adapters.go`, `service_test.go`, `assignment_state.gd`, `control_plane_client.gd`, `match_net.gd`, `server_boot.gd`, `server_config.gd`, `test_assignment_state.gd`, `test_control_plane_client.gd`, `test_match_net.gd`, `server/contracts/v1/openapi.json`, `server/migrations/0002_assignments.sql` and `server/store/assignment_sql.go` cover participant/identity/expiry/shape/transport/endpoint boundaries, player-scoped schema keys, expiry-filtered reads, assignment upsert conflict handling, atomic batch validation, signed-claim binding, strict endpoint splitting, allowlisted claim rejection, canonical HMAC interoperability, forged-signature rejection, duplicate active-token rejection, reclaim generation/expiry behavior and 146-test Godot compatibility coverage; the three-process disconnect/reclaim smoke passes ship retention, replacement drive and old-peer invalidation; SDR relay-ticket installation, live allocated-token process integration and live Godot/PostgreSQL verification remain | | 8.42 `[D:8.22,8.23,8.24,8.40]` | **IN PROGRESS.** `RankedProfileState` and `ControlPlaneClient.fetch_ranked_profile()` expose the backend-authoritative rating/RD/volatility/games/tier/provisional/season view; matchmaking UI displays provisional/tier status without client-side rating math | `test_control_plane_client.gd` validates profile shape, numeric safety and provisional display; ranked profile fetch/display, committed revision after reconnect, abandon status and season countdown remain dependent on live auth/backend events and Godot runtime verification | | 8.43 `[D:8.39,8.40,8.41]` | **IN PROGRESS.** Matchmaking client now distinguishes expired queue recovery, session expiry, missing records and retryable control-plane outages; a 401 clears the in-memory token, emits `session_expired` and disables retry until a new session is configured; terminal messages remain visible and active searches are not falsely failed on transient errors | `MatchmakingState` and `ControlPlaneClient` tests cover explicit expiry and the existing terminal/retry-safe state paths; decline, version mismatch, regional outage retry UI, failed reconnect, duplicate-action recovery and live Godot verification remain |