wtclaude
47692e8832
All checks were successful
PR Checks / plugin-checks (pull_request) Successful in 14s
R1's identity flow, in the shape the UO bridge already proved: the player asks in game, the plugin mints a one-time code and hands it to them, and the website confirms it back through the sidecar. The site is the author of record; this plugin holds no link at all. **`/link` is chat, not console, and the reply is private** (D21). Both frameworks consume a `/` command rather than broadcasting it and `SendReply` addresses one player, so neither the request nor the code reaches anybody else — a code read off a stream is a code somebody else can spend. **Pending codes live in memory and nowhere else** (D22, matching module-uo): six characters from an alphabet with no O/0/I/1, five-minute TTL, a thirty-second cooldown per player, one outstanding code each, and a purge timer because an unconfirmed code is never looked up. A plugin reload drops them — phase 7b's config editor will do that routinely — and the cost is typing `/link` again, which is cheaper than a credential living in a second process. **The code is deliberately NOT in `account.link.requested`.** That event exists so an operator can see linking being used; the code travels through the player, which is what makes typing it proof they are the one who asked. `/unlink` emits rather than deletes, because there is nothing here to delete. It is the escape hatch that makes the site's refusal to move an already-linked Steam id safe: a player who linked the wrong account walks to a computer they are already sitting at. `link.confirm` consumes a code on the FIRST lookup whether or not it turns out to be expired, so a code cannot be probed twice. `unknown` and `expired` stay separate in the reply — an operator wants to know whether codes are being guessed or going stale — and the website says the same sentence for both. `checkPlugin.js` gains a check for the new surface, because a chat command binds by reflection exactly like a hook and fails the same silent way. It asserts the signature, the void return and the absence of duplicates, and — like the hook parser before it — a test reads the real plugin so a regex that matches nothing cannot pass. Verified by breaking it five ways. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4
50 lines
2.7 KiB
TOML
50 lines
2.7 KiB
TOML
# Release metadata for the deployable overlay.
|
|
#
|
|
# Consumed by the release workflow, which folds these values into the
|
|
# manifest.json shipped inside the overlay tarball. The Runic Gateway installer
|
|
# reads that manifest to decide what it is deploying and whether it is compatible
|
|
# with the sidecar it is about to install.
|
|
#
|
|
# There is deliberately NO version key here. The release version is derived from
|
|
# git tags and conventional commits by the release workflow, so there is no bump
|
|
# commit to keep in sync and no way for this file to disagree with the tag.
|
|
|
|
# ── The loopback wire-protocol version this overlay speaks ───────────────────
|
|
#
|
|
# The plugin half of the compatibility contract. It MUST equal the sidecar's
|
|
# PROTOCOL_VERSION (Rust-Link's sidecar/src/main.rs) for a deployment to work:
|
|
# the sidecar rejects a mismatched WEBSITE with 409, and a mismatched PLUGIN is
|
|
# worse, because the game link has no such check — it would simply mis-parse.
|
|
#
|
|
# That asymmetry is why this file exists. The plugin announces its protocol in
|
|
# `server.hello`, which is only readable after the game server has booted with it
|
|
# loaded — far too late for an installer to refuse a bad pairing. This
|
|
# declaration is what lets the bundle CI check the pair BEFORE an operator
|
|
# installs either half.
|
|
#
|
|
# Keeping it honest is a manual duty: when the protocol changes, bump it here in
|
|
# the same change that alters the emitters, exactly as the sidecar bumps
|
|
# PROTOCOL_VERSION and the module bumps its own constant.
|
|
#
|
|
# Current: 2 — the transport plus the read path (docs/rust-link/PROTOCOL.md §8).
|
|
protocol = 3
|
|
|
|
# ── Oxide compatibility ──────────────────────────────────────────────────────
|
|
#
|
|
# The overlay only ADDS a file — one plugin into `oxide/plugins/` — and patches
|
|
# nothing, so it is expected to work on any reasonably current Oxide. This is the
|
|
# oldest build it is known good on.
|
|
#
|
|
# There is no `patches_verified_against` key, and there is no `patches/` tier:
|
|
# Rust's server is a binary and Oxide's hook API is the supported way in, so
|
|
# there is nothing to diff against. That is the whole reason the Rust payload is
|
|
# simpler than the ServUO one.
|
|
min_oxide_version = "2.0.7585"
|
|
|
|
# The `oxide/plugins/` files this overlay expects to find already installed. They
|
|
# are not shipped here — they are third-party plugins an operator installs from
|
|
# uMod — and the installer's `doctor` reports a missing one rather than
|
|
# installing it. Listing them is what turns "the site shows no clans" into a
|
|
# named prerequisite.
|
|
requires_plugins = ["Clans", "Kits", "PopupNotifications", "ZoneManager"]
|