jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 00:14:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: verify signed assignment rosters

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 09:53:45 +01:00
parent 55e07648cf
commit 8b5b5333c6
4 changed files with 32 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/store/assignment_sql_test.go
+16 -1
View File
@@ -39,7 +39,22 @@ func TestAssignmentStoreRejectsInvalidBatches(t *testing.T) {
if err := SaveAssignments(nil, nil, []DurableAssignment{{MatchID: "match-1", PlayerID: "player-1"}}); err == nil {
t.Fatal("invalid assignment batch accepted")
}
if err := SaveVerifiedAssignmentRoster(nil, nil, domain.Assignment{}, nil); err == nil {
if err := SaveVerifiedAssignmentRoster(nil, nil, domain.Assignment{}, nil, nil); err == nil {
t.Fatal("empty verified roster accepted")
}
}
func TestSignedRosterRequiresCryptographicVerification(t *testing.T) {
now := time.Unix(1000, 0)
assignment := domain.Assignment{Allocation: domain.Allocation{AllocationID: "allocation-1", MatchID: "match-1", ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", State: domain.ServerAllocated}, Manifest: domain.AllocationManifest{AllocationID: "allocation-1", MatchID: "match-1", ServerID: "server-1", Region: "EU", Build: "build-1", Protocol: 1, Transport: "enet", RosterDigest: "roster-1"}, Endpoint: "127.0.0.1:7777"}
auth := domain.JoinAuthorisation{MatchID: "match-1", ServerID: "server-1", PlayerID: "player-1", SteamID: "steam-1", Slot: 0, Team: 0, Protocol: "1", Generation: 1, ExpiresAt: now.Add(time.Minute)}
signed := domain.SignedJoinAuthorisation{Authorisation: auth, Signature: []byte("signature")}
if err := validateSignedRosterEntry(assignment, signed, func([]byte, []byte) bool { return false }); err == nil {
t.Fatal("forged signature accepted")
}
if err := validateSignedRosterEntry(assignment, signed, func(message, signature []byte) bool {
return string(message) == string(domain.JoinAuthorisationBytes(auth)) && string(signature) == "signature"
}); err != nil {
t.Fatalf("valid signature rejected: %v", err)
}
}