Merge pull request 'fix(perms): never write a never-seen player into Carbon's shared blank record' (#47) from fix/carbon-blank-user into main

Reviewed-on: #47

overlay/oxide/plugins/RunicGateway.cs

@@ -445,12 +445,20 @@ namespace Oxide.Plugins
             public string ServerId = "main";
 
             /// <summary>
-            ///     Whether the website may borrow values on this server for events (protocol 8,
-            ///     D76). <b>Off until an operator turns it on.</b> Letting staff moderate from a
-            ///     screen they are looking at, and letting a schedule change the world at four in
-            ///     the morning, are different consents, and one switch cannot honestly express
-            ///     both. It gates taking a lease only: listing and giving back always work, so
-            ///     turning it off never strands a value somebody already borrowed.
+            ///     Whether the website may run events on this server at all (protocol 8, D76).
+            ///     <b>Off until an operator turns it on.</b> Letting staff moderate from a screen
+            ///     they are looking at, and letting a schedule change the world at four in the
+            ///     morning, are different consents, and one switch cannot honestly express both.
+            ///     <para>
+            ///     It began as the lease switch and grew with the protocol. It now gates taking a
+            ///     lease (protocol 8), every world write (protocol 9, D94: zones, placed crates and
+            ///     NPCs, and from protocol 14 world calls, Dangerous Treasures, Guarded Crate,
+            ///     raid bases and console commands — <see cref="WorldWritesAllowed"/>), opening a
+            ///     tally and a run's chat line (protocol 10, D107), and paying coins (protocol 14).
+            ///     Listing, giving back, reverting and every read always work, so turning it off
+            ///     never strands anything an event already holds. An admin can set it from the
+            ///     website's config editor, and it takes effect without a reload.
+            ///     </para>
             /// </summary>
             public bool EventsEnabled = false;
 
@@ -4770,6 +4778,15 @@ namespace Oxide.Plugins
                     break;
 
                 case PermOpKind.EnsureMember:
+                    // Before the read, because on Carbon the read is the thing that lies: a
+                    // never-seen player's UserHasGroup reads the shared blank record (see
+                    // HasNoCarbonRecord), so it can say "already a member" of nobody.
+                    if (HasNoCarbonRecord(op.Subject))
+                    {
+                        job.Pending.Add(op.Subject + ":" + op.Object);
+                        break;
+                    }
+
                     if (permission.UserHasGroup(op.Subject, op.Object))
                     {
                         job.AlreadyCorrect++;
@@ -4792,6 +4809,15 @@ namespace Oxide.Plugins
                     if (!Registered(job, op.Object))
                         break;
 
+                    // Never-seen on Carbon: the grant would land in the shared blank record and be
+                    // held by every Steam id Carbon has no record for. It lands at the first sync
+                    // after they join, as PLAN.md §29.8 already says of Carbon.
+                    if (HasNoCarbonRecord(op.Subject))
+                    {
+                        job.NotLanded.Add(op.Subject + ":" + op.Object);
+                        break;
+                    }
+
                     if (HoldsDirectly(op.Subject, op.Object))
                     {
                         job.AlreadyCorrect++;
@@ -4934,6 +4960,24 @@ namespace Oxide.Plugins
             return false;
         }
 
+        /// <summary>
+        ///     Whether this is Carbon and Carbon has no user record for the player.
+        ///
+        ///     <para>
+        ///     Carbon (2.0.262) answers <c>GetUserData</c> for a Steam id it has never seen with ONE
+        ///     shared, static blank record, and <c>AddUserGroup</c> and <c>GrantUserPermission</c>
+        ///     write into whatever it returns. So a membership or grant for one never-seen player
+        ///     goes to that shared record and is then held by every Steam id Carbon has no record
+        ///     for, until the server restarts — and <c>UserHasGroup</c> reads it back as a success.
+        ///     Oxide creates a real record instead, so this is never true there and Oxide's
+        ///     behaviour is unchanged. Found in the account deletion walk (W3).
+        ///     </para>
+        /// </summary>
+        private bool HasNoCarbonRecord(string steamId)
+        {
+            return IsCarbon() && !permission.UserExists(steamId);
+        }
+
         /// <summary>
         ///     Whether a player holds a permission through a grant of their own, as opposed to
         ///     through a group.