From fc3a7ea359c392222320e57e6869e9c5fba8f236 Mon Sep 17 00:00:00 2001 From: Josh Creek <8179928+jcreek@users.noreply.github.com> Date: Tue, 1 Sep 2026 22:54:33 +0100 Subject: [PATCH] fix(multiplayer): validate proposal expiry --- Game/scripts/control_plane_client.gd | 15 +++++++++++++-- Game/tests/cases/test_control_plane_client.gd | 9 ++++++++- multiplayer-next.md | 2 ++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/Game/scripts/control_plane_client.gd b/Game/scripts/control_plane_client.gd index 59e8b314..cf08af9b 100644 --- a/Game/scripts/control_plane_client.gd +++ b/Game/scripts/control_plane_client.gd @@ -337,6 +337,17 @@ static func normalize_ticket(payload: Dictionary) -> Dictionary: return result +static func normalize_proposal(payload: Dictionary) -> Dictionary: + var result := payload.duplicate(true) + if not result.has("expires_at"): + return result + if not result["expires_at"] is String or not is_valid_rfc3339_timestamp(String(result["expires_at"])): + result["expires_at_unix"] = -1 + else: + result["expires_at_unix"] = int(Time.get_unix_time_from_datetime_string(String(result["expires_at"]))) + return result + + func _start_request(operation: String, method: HTTPClient.Method, path: String, payload: Dictionary, idempotency_key: String, expected_revision: int = -1) -> Error: if _request == null or not _operation.is_empty() or not is_valid_base_url(base_url): return ERR_BUSY if not _operation.is_empty() else ERR_UNAUTHORIZED @@ -460,7 +471,7 @@ func _on_request_completed(result: HTTPRequest.Result, response_code: int, _head if operation.begins_with("queue_"): state.apply_ticket_update(normalize_ticket(payload)) elif operation.begins_with("proposal_"): - state.apply_proposal_update(payload) + state.apply_proposal_update(normalize_proposal(payload)) elif operation == "ranked_profile": if not ranked_profile.apply(payload): request_failed.emit(operation, response_code, ranked_profile.error_message) @@ -533,7 +544,7 @@ static func _valid_response_opaque_id(payload: Dictionary, key: String) -> bool: static func _valid_proposal_response(payload: Dictionary) -> bool: - if not _valid_response_opaque_id(payload, "proposal_id") or not payload.has("participants") or not payload["participants"] is Array: + if not _valid_response_opaque_id(payload, "proposal_id") or not payload.has("expires_at") or not payload["expires_at"] is String or not is_valid_rfc3339_timestamp(String(payload["expires_at"])) or not payload.has("participants") or not payload["participants"] is Array: return false var participants: Array = payload["participants"] if participants.size() < 2 or participants.size() > 6: diff --git a/Game/tests/cases/test_control_plane_client.gd b/Game/tests/cases/test_control_plane_client.gd index 6d08e699..dd302881 100644 --- a/Game/tests/cases/test_control_plane_client.gd +++ b/Game/tests/cases/test_control_plane_client.gd @@ -175,7 +175,7 @@ func test_rest_responses_reject_malformed_resource_identifiers() -> void: func test_proposal_response_requires_structured_unique_participants() -> void: - var base := {"proposal_id": "proposal_1234567890", "participants": [ + var base := {"proposal_id": "proposal_1234567890", "expires_at": "2099-08-31T12:00:00Z", "participants": [ {"player_id": "player_1234567890", "response": "PENDING", "team": 0, "slot": 0}, {"player_id": "player_1234567891", "response": "PENDING", "team": 1, "slot": 3} ]} @@ -186,6 +186,13 @@ func test_proposal_response_requires_structured_unique_participants() -> void: var fractional_slot := base.duplicate(true) fractional_slot["participants"][0]["slot"] = 0.5 assert_true(not ControlPlaneClient._valid_proposal_response(fractional_slot), "fractional participant slot is rejected") + var malformed_expiry := base.duplicate(true) + malformed_expiry["expires_at"] = "tomorrow" + assert_true(not ControlPlaneClient._valid_proposal_response(malformed_expiry), "malformed proposal expiry is rejected") + var missing_expiry := base.duplicate(true) + missing_expiry.erase("expires_at") + assert_true(not ControlPlaneClient._valid_proposal_response(missing_expiry), "missing proposal expiry is rejected") + assert_true(int(ControlPlaneClient.normalize_proposal(base)["expires_at_unix"]) > 0, "proposal expiry is normalized") func test_assignment_endpoint_split_never_accepts_url_or_bad_port() -> void: diff --git a/multiplayer-next.md b/multiplayer-next.md index 2c7095f9..faf739ad 100644 --- a/multiplayer-next.md +++ b/multiplayer-next.md @@ -1609,6 +1609,8 @@ MatchNet admission configuration now requires exact string opaque match/server I The proposal wire contract now matches the real API participant-object shape (`player_id`, response, team, slot), with JSON tags on the Go model and client validation for count, uniqueness, identities, enums, and integer team/slot assignments. +Proposal responses now require and normalize the contract's RFC3339 `expires_at`; malformed or missing expiry metadata fails closed while already-expired terminal proposals remain representable. + Signed MatchNet claims now also require exact JSON string/integer types for every identity, protocol, expiry, slot, team, and generation field; string-number coercion is rejected before canonical signature verification. Presentation progress: a shared `Game/themes/cosmic_clash_theme.tres` now gives the menu, lobby, matchmaking, and settings surfaces consistent button, input, option, and label styling. The custom-font portion of `TODO.md` remains open until a distributable font asset is selected.