jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-13 21:22:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): validate contract route ids

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 22:58:28 +01:00
parent f7ab77dec5
commit badd0b1b47
3 changed files with 39 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
multiplayer-next.md
+2
View File
@@ -1613,6 +1613,8 @@ Proposal responses now require and normalize the contract's RFC3339 `expires_at`
Queue responses now validate the complete published shape before projection: opaque ticket/player IDs, playlist and lifecycle enums, integral revision, and RFC3339 enqueue/expiry timestamps.
The public `/api/v1` route adapters now reject non-opaque queue, proposal, assignment, and server path identifiers before delegating to the legacy handlers; adversarial route tests cover short and separator-bearing IDs.
Signed MatchNet claims now also require exact JSON string/integer types for every identity, protocol, expiry, slot, team, and generation field; string-number coercion is rejected before canonical signature verification.
Presentation progress: a shared `Game/themes/cosmic_clash_theme.tres` now gives the menu, lobby, matchmaking, and settings surfaces consistent button, input, option, and label styling. The custom-font portion of `TODO.md` remains open until a distributable font asset is selected.