feat: enforce allocated join roster admission

Game/scripts/match_net.gd

@@ -52,6 +52,9 @@ var local_player_name := "Player"
 # this empty for backwards compatibility; allocated matches carry the opaque
 # signed authorisation in hello rather than putting it in the endpoint URL.
 var join_authorisation := ""
+var require_join_authorisation := false
+var _allowed_join_authorisations: Dictionary = {}
+var _join_authorisation_context: Dictionary = {}
 
 # Test hook (tests/match_net_smoke.gd): set false before connecting to
 # suppress the automatic real hello, so a test can send a deliberately
@@ -85,6 +88,23 @@ func _on_disconnected_from_server() -> void:
 # the same process.
 func _on_shutting_down() -> void:
 	roster.clear()
+	_allowed_join_authorisations.clear()
+	_join_authorisation_context.clear()
+	require_join_authorisation = false
+
+
+func configure_join_authorisations(tokens: Array, context: Dictionary) -> bool:
+	var allowed := {}
+	for token in tokens:
+		if not token is String or String(token).is_empty():
+			return false
+		allowed[String(token)] = true
+	if allowed.is_empty() or String(context.get("match_id", "")).is_empty() or String(context.get("server_id", "")).is_empty() or int(context.get("protocol_version", 0)) < 1:
+		return false
+	_allowed_join_authorisations = allowed
+	_join_authorisation_context = context.duplicate(true)
+	require_join_authorisation = true
+	return true
 
 
 # Server only: a raw ENet disconnect (crash, timeout) that never sent a
@@ -162,6 +182,9 @@ func _hello(protocol_version: int, tick_hz: int, player_name: String, supplied_j
 	if tick_hz != SimConstants.TICK_HZ:
 		await _reject(peer_id, "physics tick rate mismatch: server=%d client=%d" % [SimConstants.TICK_HZ, tick_hz])
 		return
+	if require_join_authorisation and not _valid_join_authorisation(supplied_join_authorisation):
+		await _reject(peer_id, "join authorisation rejected")
+		return
 	if player_name.length() > MAX_INPUT_LENGTH:
 		await _reject(peer_id, "player name too long")
 		return
@@ -181,6 +204,31 @@ func _hello(protocol_version: int, tick_hz: int, player_name: String, supplied_j
 	_player_joined.rpc(peer_id, clean_name, team, false)   # broadcast, includes the new peer itself
 
 
+func _valid_join_authorisation(token: String) -> bool:
+	if token.is_empty() or not _allowed_join_authorisations.has(token):
+		return false
+	var standard_token := token.replace("-", "+").replace("_", "/")
+	while standard_token.length() % 4 != 0:
+		standard_token += "="
+	var decoded := Marshalls.base64_to_raw(standard_token)
+	if decoded.is_empty():
+		return false
+	var envelope = JSON.parse_string(decoded.get_string_from_utf8())
+	if not envelope is Dictionary or not envelope.has("Authorisation") or not envelope.has("Signature") or str(envelope["Signature"]).is_empty():
+		return false
+	var claims = envelope["Authorisation"]
+	if not claims is Dictionary:
+		return false
+	var protocol := str(claims.get("Protocol", ""))
+	var expires_at := str(claims.get("ExpiresAt", ""))
+	var expiry := Time.get_unix_time_from_datetime_string(expires_at)
+	return str(claims.get("MatchID", "")) == str(_join_authorisation_context.get("match_id", "")) \
+		and str(claims.get("ServerID", "")) == str(_join_authorisation_context.get("server_id", "")) \
+		and protocol == str(_join_authorisation_context.get("protocol", "")) \
+		and int(claims.get("Slot", -1)) >= 0 and int(claims.get("Slot", -1)) <= 5 \
+		and expiry > Time.get_unix_time_from_system()
+
+
 # Strips control/formatting characters (so a name can't corrupt a log line
 # or blow out UI layout with e.g. embedded newlines) and clamps to display
 # length. Input is already bounded to MAX_INPUT_LENGTH by the caller before