SCOPEDD
a1f19e86c6
Add Fabric/Forge version builds and Paper integration, preserve permanent player identities across renames, harden session authorization, and surface privacy-conscious launcher/server activity in the panel.
268 lines
13 KiB
Rust
268 lines
13 KiB
Rust
//! Game server integration API: tokens, login checks, stats sync.
|
|
|
|
mod common;
|
|
use common::*;
|
|
|
|
async fn admin_and_player(t: &TestApp) -> (String, i64) {
|
|
let admin = t.login("admin", "supersecret").await;
|
|
let (s, v) = t.call("POST", "/api/admin/users", Some(&admin), Some(json!({"username": "Steve", "password": "password123"}))).await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
(admin, v["id"].as_i64().unwrap())
|
|
}
|
|
|
|
async fn create_server(t: &TestApp, admin: &str, body: Value) -> (i64, String) {
|
|
let (s, v) = t.call("POST", "/api/admin/servers", Some(admin), Some(body)).await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
let token = v["token"].as_str().unwrap().to_string();
|
|
assert!(token.starts_with("sn_"));
|
|
assert_eq!(v["server"]["token_hint"], token[token.len() - 4..]);
|
|
assert!(v["server"].get("token_hash").is_none());
|
|
(v["server"]["id"].as_i64().unwrap(), token)
|
|
}
|
|
|
|
async fn steve(t: &TestApp) -> String {
|
|
t.uuid("Steve").await
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn tokens_authenticate_servers() {
|
|
let t = setup().await;
|
|
let (admin, _) = admin_and_player(&t).await;
|
|
let (id, token) = create_server(&t, &admin, json!({"name": "Survival"})).await;
|
|
|
|
let (s, _) = t.call("POST", "/api/server/v1/hello", None, Some(json!({}))).await;
|
|
assert_eq!(s, StatusCode::UNAUTHORIZED);
|
|
let (s, _) = t.call("POST", "/api/server/v1/hello", Some("sn_nope"), Some(json!({}))).await;
|
|
assert_eq!(s, StatusCode::UNAUTHORIZED);
|
|
|
|
let (s, v) = t
|
|
.call(
|
|
"POST",
|
|
"/api/server/v1/hello",
|
|
Some(&token),
|
|
Some(json!({"software": "Paper", "mc_version": "1.21.1", "plugin_version": "0.1.0", "online_mode": true, "max_players": 50})),
|
|
)
|
|
.await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
assert_eq!(v["server_id"], id);
|
|
assert_eq!(v["yggdrasil_url"], "https://panel.test/api/yggdrasil");
|
|
|
|
let (_, list) = t.call("GET", "/api/admin/servers", Some(&admin), None).await;
|
|
assert_eq!(list[0]["software"], "Paper");
|
|
assert_eq!(list[0]["online"], true);
|
|
assert_eq!(list[0]["max_players"], 50);
|
|
|
|
// Regenerating invalidates the old token.
|
|
let (s, v) = t.call("POST", &format!("/api/admin/servers/{id}/token"), Some(&admin), None).await;
|
|
assert_eq!(s, StatusCode::OK);
|
|
let fresh = v["token"].as_str().unwrap();
|
|
let (s, _) = t.call("POST", "/api/server/v1/hello", Some(&token), Some(json!({}))).await;
|
|
assert_eq!(s, StatusCode::UNAUTHORIZED);
|
|
let (s, _) = t.call("POST", "/api/server/v1/hello", Some(fresh), Some(json!({}))).await;
|
|
assert_eq!(s, StatusCode::OK);
|
|
|
|
// Players can't manage servers.
|
|
let player = t.login("Steve", "password123").await;
|
|
let (s, _) = t.call("GET", "/api/admin/servers", Some(&player), None).await;
|
|
assert_eq!(s, StatusCode::FORBIDDEN);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn login_rules() {
|
|
let t = setup().await;
|
|
let (admin, steve_id) = admin_and_player(&t).await;
|
|
let login = |token: String, uuid: String, name: &'static str, ip: Option<&'static str>| {
|
|
let t = &t;
|
|
async move { t.call("POST", "/api/server/v1/login", Some(&token), Some(json!({"uuid": uuid, "name": name, "ip": ip}))).await.1 }
|
|
};
|
|
|
|
// "all": unknown players are fine, accounts are identified.
|
|
let (_, open) = create_server(&t, &admin, json!({"name": "Open"})).await;
|
|
let v = login(open.clone(), "00000000-0000-0000-0000-000000000001".into(), "Stranger", None).await;
|
|
assert_eq!(v["allowed"], true, "{v}");
|
|
let v = login(open.clone(), steve(&t).await.replace('-', ""), "Steve", None).await;
|
|
assert_eq!(v["allowed"], true);
|
|
assert_eq!(v["account"]["username"], "Steve");
|
|
|
|
// "members": unknown players are refused.
|
|
let (_, members) = create_server(&t, &admin, json!({"name": "Members", "access": "members"})).await;
|
|
let v = login(members.clone(), "00000000-0000-0000-0000-000000000001".into(), "Stranger", None).await;
|
|
assert_eq!(v["allowed"], false);
|
|
assert!(v["message"].as_str().unwrap().contains("account"));
|
|
|
|
// "groups": only listed groups (admins always pass).
|
|
let (s, v) = t.call("POST", "/api/admin/servers", Some(&admin), Some(json!({"name": "Staff", "access": "groups"}))).await;
|
|
assert_eq!(s, StatusCode::BAD_REQUEST, "{v}");
|
|
let (_, staff) = create_server(&t, &admin, json!({"name": "Staff", "access": "groups", "allowed_groups": ["builders"]})).await;
|
|
let v = login(staff.clone(), steve(&t).await, "Steve", None).await;
|
|
assert_eq!(v["allowed"], false);
|
|
let admin_uuid = t.uuid("admin").await;
|
|
let v = login(staff.clone(), admin_uuid, "admin", None).await;
|
|
assert_eq!(v["allowed"], true, "{v}");
|
|
t.call("POST", "/api/admin/groups", Some(&admin), Some(json!({"name": "builders"}))).await;
|
|
let (s, v) = t.call("PATCH", &format!("/api/admin/users/{steve_id}"), Some(&admin), Some(json!({"groups": ["builders"]}))).await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
let v = login(staff.clone(), steve(&t).await, "Steve", None).await;
|
|
assert_eq!(v["allowed"], true, "{v}");
|
|
|
|
// Require launcher: a launch from the same IP is needed.
|
|
let (_, strict) = create_server(&t, &admin, json!({"name": "Strict", "require_launcher": true})).await;
|
|
let v = login(strict.clone(), steve(&t).await, "Steve", Some("203.0.113.9")).await;
|
|
assert_eq!(v["allowed"], false);
|
|
assert!(v["message"].as_str().unwrap().contains("launcher"));
|
|
let player = t.login("Steve", "password123").await;
|
|
let req = Request::builder()
|
|
.method("POST")
|
|
.uri("/api/v1/launcher/events")
|
|
.header("authorization", format!("Bearer {player}"))
|
|
.header("content-type", "application/json")
|
|
.header("x-forwarded-for", "203.0.113.9")
|
|
.body(Body::from(json!({"kind": "launch", "instance_id": "survival"}).to_string()))
|
|
.unwrap();
|
|
let (s, v) = t.send(req).await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
let v = login(strict.clone(), steve(&t).await, "Steve", Some("203.0.113.9")).await;
|
|
assert_eq!(v["allowed"], true, "{v}");
|
|
let v = login(strict.clone(), steve(&t).await, "Steve", Some("198.51.100.1")).await;
|
|
assert_eq!(v["allowed"], false);
|
|
|
|
// Disabled accounts see the reason.
|
|
t.call(
|
|
"PATCH",
|
|
&format!("/api/admin/users/{steve_id}"),
|
|
Some(&admin),
|
|
Some(json!({"status": "disabled", "status_reason": "Griefing"})),
|
|
)
|
|
.await;
|
|
let v = login(open, steve(&t).await, "Steve", None).await;
|
|
assert_eq!(v["allowed"], false);
|
|
assert!(v["message"].as_str().unwrap().contains("Griefing"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn sync_tracks_players_stats_and_kicks() {
|
|
let t = setup().await;
|
|
let (admin, steve_id) = admin_and_player(&t).await;
|
|
let (id, token) = create_server(&t, &admin, json!({"name": "Survival"})).await;
|
|
t.call("POST", "/api/server/v1/hello", Some(&token), Some(json!({"max_players": 20}))).await;
|
|
|
|
let sync = json!({
|
|
"tps": 19.8,
|
|
"online": [{"uuid": steve(&t).await.replace('-', ""), "name": "Steve"}],
|
|
"stats": [{"uuid": steve(&t).await, "name": "Steve", "playtime_secs": 30, "joins": 1, "blocks_broken": 12, "deaths": 1}],
|
|
"events": [
|
|
{"uuid": steve(&t).await, "name": "Steve", "kind": "join"},
|
|
{"uuid": steve(&t).await, "name": "Steve", "kind": "death", "detail": "Steve fell from a high place"}
|
|
]
|
|
});
|
|
let (s, v) = t.call("POST", "/api/server/v1/sync", Some(&token), Some(sync)).await;
|
|
assert_eq!(s, StatusCode::OK, "{v}");
|
|
assert_eq!(v["kick"], json!([]));
|
|
// Deltas add up.
|
|
let (s, _) = t
|
|
.call(
|
|
"POST",
|
|
"/api/server/v1/sync",
|
|
Some(&token),
|
|
Some(json!({"tps": 20.0, "online": [{"uuid": steve(&t).await, "name": "Steve"}], "stats": [{"uuid": steve(&t).await, "name": "Steve", "playtime_secs": 30, "blocks_broken": 3}]})),
|
|
)
|
|
.await;
|
|
assert_eq!(s, StatusCode::OK);
|
|
|
|
let (s, d) = t.call("GET", &format!("/api/admin/servers/{id}"), Some(&admin), None).await;
|
|
assert_eq!(s, StatusCode::OK, "{d}");
|
|
assert_eq!(d["server"]["players"], 1);
|
|
assert_eq!(d["server"]["tps"], 20.0);
|
|
assert_eq!(d["online_players"][0]["name"], "Steve");
|
|
let row = &d["leaderboard"][0];
|
|
assert_eq!(row["playtime_secs"], 60);
|
|
assert_eq!(row["blocks_broken"], 15);
|
|
assert_eq!(row["joins"], 1);
|
|
assert_eq!(d["events"][0]["kind"], "death");
|
|
assert_eq!(d["events"][1]["kind"], "join");
|
|
assert_eq!(d["totals"]["players"], 1);
|
|
|
|
let (_, dash) = t.call("GET", "/api/admin/stats", Some(&admin), None).await;
|
|
assert_eq!(dash["live"]["online_now"], 1);
|
|
|
|
let (_, users) = t.call("GET", "/api/admin/users", Some(&admin), None).await;
|
|
let s_view = users.as_array().unwrap().iter().find(|u| u["username"] == "Steve").unwrap();
|
|
assert_eq!(s_view["playtime_secs"], 60);
|
|
let (s, act) = t.call("GET", &format!("/api/admin/users/{steve_id}/activity"), Some(&admin), None).await;
|
|
assert_eq!(s, StatusCode::OK, "{act}");
|
|
assert_eq!(act["servers"][0]["server_name"], "Survival");
|
|
assert_eq!(act["online_on"][0]["name"], "Survival");
|
|
|
|
// Disabling an online player asks the server to kick them.
|
|
t.call(
|
|
"PATCH",
|
|
&format!("/api/admin/users/{steve_id}"),
|
|
Some(&admin),
|
|
Some(json!({"status": "disabled", "status_reason": "Cheating"})),
|
|
)
|
|
.await;
|
|
let (_, v) =
|
|
t.call("POST", "/api/server/v1/sync", Some(&token), Some(json!({"online": [{"uuid": steve(&t).await, "name": "Steve"}]}))).await;
|
|
assert_eq!(v["kick"][0]["uuid"], steve(&t).await);
|
|
assert!(v["kick"][0]["message"].as_str().unwrap().contains("Cheating"));
|
|
|
|
// Leaving empties the online list; deleting the server removes its data.
|
|
t.call("POST", "/api/server/v1/sync", Some(&token), Some(json!({"online": []}))).await;
|
|
let (_, d) = t.call("GET", &format!("/api/admin/servers/{id}"), Some(&admin), None).await;
|
|
assert_eq!(d["online_players"], json!([]));
|
|
let (s, _) = t.call("DELETE", &format!("/api/admin/servers/{id}"), Some(&admin), None).await;
|
|
assert_eq!(s, StatusCode::OK);
|
|
let (s, _) = t.call("POST", "/api/server/v1/sync", Some(&token), Some(json!({}))).await;
|
|
assert_eq!(s, StatusCode::UNAUTHORIZED);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn unknown_uuid_cannot_claim_a_members_name_or_skip_launcher_check() {
|
|
let t = setup().await;
|
|
let (admin, _) = admin_and_player(&t).await;
|
|
let (_, token) = create_server(&t, &admin, json!({"name":"Private", "access":"members"})).await;
|
|
let (_, verdict) =
|
|
t.call("POST", "/api/server/v1/login", Some(&token), Some(json!({"uuid":uuid::Uuid::new_v4(),"name":"Steve"}))).await;
|
|
assert_eq!(verdict["allowed"], false);
|
|
let (_, strict) = create_server(&t, &admin, json!({"name":"Launcher", "require_launcher":true})).await;
|
|
for body in [json!({"uuid":steve(&t).await,"name":"Steve"}), json!({"uuid":uuid::Uuid::new_v4(),"name":"Stranger","ip":"203.0.113.9"})]
|
|
{
|
|
let (_, verdict) = t.call("POST", "/api/server/v1/login", Some(&strict), Some(body)).await;
|
|
assert_eq!(verdict["allowed"], false);
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn retry_does_not_duplicate_stats_or_events() {
|
|
let t = setup().await;
|
|
let (admin, _) = admin_and_player(&t).await;
|
|
let (id, token) = create_server(&t, &admin, json!({"name":"Retry"})).await;
|
|
let body = json!({"batch_id":uuid::Uuid::new_v4(), "stats":[{"uuid":steve(&t).await,"name":"Steve","playtime_secs":30}],"events":[{"kind":"join","name":"Steve","uuid":steve(&t).await}]});
|
|
for _ in 0..2 {
|
|
assert_eq!(t.call("POST", "/api/server/v1/sync", Some(&token), Some(body.clone())).await.0, StatusCode::OK);
|
|
}
|
|
let (_, detail) = t.call("GET", &format!("/api/admin/servers/{id}"), Some(&admin), None).await;
|
|
assert_eq!(detail["leaderboard"][0]["playtime_secs"], 30);
|
|
assert_eq!(detail["events"].as_array().unwrap().len(), 1);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn untrusted_forwarded_header_cannot_forge_a_launcher_ip() {
|
|
let t = setup().await;
|
|
let (admin, _) = admin_and_player(&t).await;
|
|
let token = t.login("Steve", "password123").await;
|
|
let mut request = Request::post("/api/v1/launcher/events")
|
|
.header("authorization", format!("Bearer {token}"))
|
|
.header("content-type", "application/json")
|
|
.header("x-forwarded-for", "203.0.113.9")
|
|
.body(Body::from(json!({"kind":"launch","instance_id":"survival"}).to_string()))
|
|
.unwrap();
|
|
request.extensions_mut().insert(axum::extract::ConnectInfo("198.51.100.1:12345".parse::<std::net::SocketAddr>().unwrap()));
|
|
assert_eq!(t.send(request).await.0, StatusCode::OK);
|
|
let (_, strict) = create_server(&t, &admin, json!({"name":"Strict", "require_launcher":true})).await;
|
|
let (_, verdict) = t
|
|
.call("POST", "/api/server/v1/login", Some(&strict), Some(json!({"uuid":steve(&t).await,"name":"Steve","ip":"203.0.113.9"})))
|
|
.await;
|
|
assert_eq!(verdict["allowed"], false);
|
|
}
|