jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-16 05:22:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): repair allocated compose verification

Browse Source
This commit is contained in:
Josh Creek
2026-09-04 16:38:10 +01:00
parent e6733bd6cb
commit d64920b0f9
11 changed files with 150 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/domain/result.go
+16 -1
View File
@@ -177,7 +177,22 @@ func RatingEligible(receipt ResultReceipt) bool {
}
func validateBinding(binding WorkloadBinding) error {
if binding.Issuer == "" || binding.Audience == "" || binding.Namespace == "" || binding.ServiceAcct == "" || binding.PodUID == "" || binding.GameServerUID == "" || binding.AllocationID == "" || binding.MatchID == "" || binding.ServerID == "" {
// A Kubernetes JWT supplies the six workload-identity fields below, while
// the signed workload credential is deliberately bound through the durable
// allocation record and therefore supplies only allocation/match/server.
// Accept either complete authority model, but never a partial Kubernetes
// identity that could accidentally look authenticated.
if binding.AllocationID == "" || binding.MatchID == "" || binding.ServerID == "" {
return ErrResultBinding
}
kubernetesIdentity := []string{binding.Issuer, binding.Audience, binding.Namespace, binding.ServiceAcct, binding.PodUID, binding.GameServerUID}
present := 0
for _, value := range kubernetesIdentity {
if value != "" {
present++
}
}
if present != 0 && present != len(kubernetesIdentity) {
return ErrResultBinding
}
return nil