wtclaude
e4591af906
The site half of §11.3.2, on protocol 14:
- `rust.backpack.size` ("Bigger backpack"): a kit reward with a different
permission (D337) — one rust_perm_run_grants row per website user with
backpacks.size.N, no kit, no credit; the perm mirror pushes it and the run's
revert deletes it. risk change, reversible ledger, a new `rust.backpacks`
budget, rust.kit.entitle's recipient modes including `linked`. Refused with
"Backpacks is not installed on this server" in the dry run too (D199), and a
size the server does not offer is refused by name. Its message is never
silent: empty is the take-back warning (D338).
- `rust.options.backpacksizes`: each server's sizes above its smallest, from
the last hello, grouped by server.
- GET /player/rust/backpacks (own links only, 20 reads a minute) and
GET /admin/users/:id/rust/backpacks (that user's links only). Live, never
stored; a stranger's id is a 404 and never reaches the game.
- Client: a shared Backpack panel (pick server and account, open, read once)
on the account page and the admin user page; the grid draws pages of
pageSize, each slot named by the game (D340, no icons), blueprints by what
they make (D341), overflow marked. Backpacks joins the server's mod line.
Server 548/548 (13 new in test/backpacks.test.js), client 79/79 (5 new),
routes.manifest regenerated against the pinned core (89 routes), swagger
fragment regenerated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
109 lines
4.4 KiB
JavaScript
109 lines
4.4 KiB
JavaScript
// ── The shape of the identity surface ─────────────────────────────────────
|
||
//
|
||
// Three properties that are invisible in review and expensive in production:
|
||
//
|
||
// • **the link route is rate-limited** (R1). Six characters from a 32-glyph
|
||
// alphabet is a good code only while a guesser is made to pay per attempt,
|
||
// and once phase 7 grants permissions against a link, guessing one is a
|
||
// privilege-escalation path rather than a nuisance.
|
||
// • **the extension router merges its parent's params**. Without
|
||
// `mergeParams`, `req.params.id` is `undefined` and every statement in that
|
||
// panel silently scopes to no user — a panel that reads as "this user has no
|
||
// Rust account" for everybody.
|
||
// • **the extension's paths keep the module's own segment.** Core owns
|
||
// `/admin/users/:id`; a bare `/links` would be this module claiming a word on
|
||
// a URL it does not own, and the next module to fill a slot would collide.
|
||
|
||
const test = require('node:test')
|
||
const assert = require('node:assert')
|
||
|
||
const { fakeCtx, fakeApi } = require('./_fakes')
|
||
|
||
function register(ctx = fakeCtx()) {
|
||
require('../core')._reset()
|
||
const api = fakeApi()
|
||
require('../index')(ctx, api)
|
||
return api
|
||
}
|
||
|
||
/** `[{ method, path, handlers }]` for one express router. */
|
||
function routesOf(router) {
|
||
return router.stack
|
||
.filter((layer) => layer.route)
|
||
.map((layer) => ({
|
||
path: layer.route.path,
|
||
method: Object.keys(layer.route.methods)[0].toUpperCase(),
|
||
handlers: layer.route.stack.map((s) => s.handle),
|
||
}))
|
||
}
|
||
|
||
test('the player tier serves the identity routes, the entitlement read, and nothing else', () => {
|
||
const api = register()
|
||
const routes = routesOf(api.record.routes.player['/rust'])
|
||
|
||
assert.deepEqual(
|
||
routes.map((r) => `${r.method} ${r.path}`).sort(),
|
||
[
|
||
'DELETE /links/:steamId',
|
||
// Protocol 14 (§11.3.2): the caller's own backpack, read live. Read-only.
|
||
'GET /backpacks',
|
||
// Protocol 14 (§11.2.2): the caller's own coin balances. Read-only.
|
||
'GET /economics',
|
||
'GET /links',
|
||
// Phase 8: what the site has given the caller in game. Read-only on this
|
||
// tier by construction — the authoring routes are all admin.
|
||
// RunicNPC stage 4 (D252): the caller's own kills of each NPC profile. Read-only.
|
||
'GET /npc-kills',
|
||
'GET /permissions',
|
||
'GET /servers',
|
||
'POST /link',
|
||
],
|
||
)
|
||
})
|
||
|
||
test('redeeming a code is rate-limited, and by a limiter of its own', () => {
|
||
const api = register()
|
||
const post = routesOf(api.record.routes.player['/rust']).find((r) => r.method === 'POST')
|
||
|
||
// The fake's `rateLimit` hands back a pass-through carrying the options it was
|
||
// given, so the policy itself is assertable — a limiter that was quietly
|
||
// removed, or one built with core's `accountChangeLimiter` shared counter,
|
||
// both fail here.
|
||
const limiter = post.handlers.find((h) => h.options && h.options.label === 'rust-link-code')
|
||
|
||
assert.ok(limiter, 'POST /link must carry its own rate limiter (R1)')
|
||
assert.equal(limiter.options.max, 10)
|
||
assert.equal(limiter.options.windowMs, 15 * 60 * 1000)
|
||
|
||
// First in the chain: a limiter behind the validator would let an attacker
|
||
// spend the cheap half of the request unbounded.
|
||
assert.equal(post.handlers[0], limiter)
|
||
})
|
||
|
||
test('the admin.users.detail router merges the parent’s params and keeps its own segment', () => {
|
||
const api = register()
|
||
const slot = api.record.extensions.find((e) => e.slot === 'admin.users.detail')
|
||
|
||
assert.ok(slot, 'the server half of admin.users.detail must be registered')
|
||
assert.equal(slot.router.mergeParams, true)
|
||
|
||
const paths = routesOf(slot.router).map((r) => `${r.method} ${r.path}`).sort()
|
||
assert.deepEqual(paths, [
|
||
'DELETE /rust/links/:steamId',
|
||
// Phase 7 filled the same panel with what this person may do in game.
|
||
'DELETE /rust/permissions/grants/:grantId',
|
||
// Protocol 14 (§11.3.2): what they carry, read live. There is no write.
|
||
'GET /rust/backpacks',
|
||
// Protocol 14 (§11.2.2): their coins, and staff's hand on them.
|
||
'GET /rust/economics',
|
||
'GET /rust/links',
|
||
'GET /rust/permissions',
|
||
'POST /rust/economics',
|
||
'POST /rust/permissions/grants',
|
||
])
|
||
|
||
for (const route of routesOf(slot.router)) {
|
||
assert.ok(route.path.startsWith('/rust/'), `${route.path} must live under this module's own segment`)
|
||
}
|
||
})
|