jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 19:03:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate server event resource ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:25:04 +01:00
parent fd1a4d9577
commit 429fb87c08
4 changed files with 14 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/outbox_test.go
+5 -5
View File
@@ -17,7 +17,7 @@ func TestDeliverProposalOutboxEventPublishesEveryTarget(t *testing.T) {
defer service.getEventHub().unsubscribe(second)
payload, err := json.Marshal(map[string]any{
"event": "proposal_changed", "revision": uint64(0), "resource_id": "proposal-1",
"event": "proposal_changed", "revision": uint64(0), "resource_id": "proposal_1234567890",
"occurred_at": time.Unix(1000, 0).UTC(), "state": "OPEN", "player_ids": []string{"player-a", "player-b"},
})
if err != nil {
@@ -66,8 +66,8 @@ func TestDeliverStateOutboxEventValidatesRevisionAndTargets(t *testing.T) {
service := &Service{}
first := service.getEventHub().subscribe("player-a")
defer service.getEventHub().unsubscribe(first)
payload := []byte(`{"event":"state_changed","revision":4,"resource_id":"match-1","occurred_at":"1970-01-01T00:16:40Z","state":"ASSIGNMENT_READY","match_id":"match-1","player_ids":["player-a"]}`)
if err := deliverStateOutboxEvent(context.Background(), store.OutboxEvent{EventType: "state_changed", AggregateID: "match-1", Revision: 4, Payload: payload}, service); err != nil {
payload := []byte(`{"event":"state_changed","revision":4,"resource_id":"match_1234567890","occurred_at":"1970-01-01T00:16:40Z","state":"ASSIGNMENT_READY","match_id":"match-1","player_ids":["player-a"]}`)
if err := deliverStateOutboxEvent(context.Background(), store.OutboxEvent{EventType: "state_changed", AggregateID: "match_1234567890", Revision: 4, Payload: payload}, service); err != nil {
t.Fatalf("valid state event rejected: %v", err)
}
select {
@@ -75,8 +75,8 @@ func TestDeliverStateOutboxEventValidatesRevisionAndTargets(t *testing.T) {
case <-time.After(time.Second):
t.Fatal("participant did not receive state event")
}
bad := []byte(`{"event":"state_changed","revision":3,"resource_id":"match-1","state":"LIVE","player_ids":["player-a"]}`)
if err := deliverStateOutboxEvent(context.Background(), store.OutboxEvent{EventType: "state_changed", AggregateID: "match-1", Revision: 4, Payload: bad}, service); err == nil {
bad := []byte(`{"event":"state_changed","revision":3,"resource_id":"match_1234567890","state":"LIVE","player_ids":["player-a"]}`)
if err := deliverStateOutboxEvent(context.Background(), store.OutboxEvent{EventType: "state_changed", AggregateID: "match_1234567890", Revision: 4, Payload: bad}, service); err == nil {
t.Fatal("revision-mismatched state event accepted")
}
}