From 14dfc122baf57506e3a09909b56aaf263dfbf378 Mon Sep 17 00:00:00 2001 From: wtclaude Date: Wed, 22 Jul 2026 02:17:29 -0500 Subject: [PATCH] fix(player): open the player self-service surface to staff MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Staff are a superset of players — every player ability plus their staff tools on top — but the /player/* group ran requireRole('player'), so a signed-in admin/editor/moderator got 403 on their own linked game accounts (e.g. GET /player/shard/accounts). On the Android client this hid "My characters" and greyed the personal notification streams for staff accounts, even when they had linked characters. Drop the role gate: the group is now requireAuth-only. Every handler is already self-scoped to the caller by req.user.id (with the pre-existing isAdmin bypass still letting a genuine admin read any character), so this only ever widens access to the caller's OWN data. Staff also reach the identical self-scoped handlers under /admin/shard/* (same controller). - player.routes.js: requireRole('player') -> requireAuth; corrected the five stale "Player role required" 403 descriptions and regenerated swagger-output.json. - New test/playerRouteAccess.test.js mounts the router and asserts player/admin/editor/moderator all reach the handler, anon still 401s, and a disabled account still 403s. Suite: 420 pass. Co-Authored-By: Claude --- server/src/router/v1/player/player.routes.js | 38 +++++---- server/swagger/swagger-output.json | 10 +-- server/test/playerRouteAccess.test.js | 84 ++++++++++++++++++++ 3 files changed, 111 insertions(+), 21 deletions(-) create mode 100644 server/test/playerRouteAccess.test.js diff --git a/server/src/router/v1/player/player.routes.js b/server/src/router/v1/player/player.routes.js index e1e51d8..e63e4f0 100644 --- a/server/src/router/v1/player/player.routes.js +++ b/server/src/router/v1/player/player.routes.js @@ -1,10 +1,15 @@ -// ── Player self-service (role: 'player') ─────────────────────────────────── +// ── Player self-service (any authenticated account) ───────────────────────── // -// The player-gated surface. Every route here requires an authenticated session -// whose fresh DB role is 'player' (staff use /admin/account for the same self- -// service). Handlers are shared with the admin account view (account.controller) -// — the same TOTP / identity logic, plus the net-new self-scoped credential -// changes. Future player-only endpoints (profile, etc.) hang off this group. +// The player self-service surface: linked game accounts, character/vendor/house +// reads, and account-credential changes, all self-scoped to the caller by +// req.user.id. Staff are a *superset* of players — they have every player ability +// plus their staff tools on top — so this group is open to any authenticated +// account, not just role 'player'. Staff also reach the identical self-scoped +// handlers under /admin/shard (they are the same controller); this group lets a +// staff account use the player surface directly. Handlers are shared with the +// admin account view (account.controller) — the same TOTP / identity logic, plus +// the net-new self-scoped credential changes. Future self-service endpoints hang +// off this group. const express = require('express') const { body, param } = require('express-validator') @@ -12,17 +17,18 @@ const { body, param } = require('express-validator') const account = require('../admin/account.controller') const shard = require('./shard.controller') const appeals = require('./appeals.controller') -const { requireAuth, requireRole } = require('../../../auth/session.middleware') +const { requireAuth } = require('../../../auth/session.middleware') const noindex = require('../../../middleware/noindex') const validate = require('../../../middleware/validate') const { accountChangeLimiter } = require('../../../middleware/rateLimit') const playerRouter = express.Router() -// Group gate: authenticated + fresh role must be 'player', and keep it out of -// search indexes. requireAuth also enforces the account status check (a -// disabled/banned player is rejected here with 403 before any handler runs). -playerRouter.use(noindex, requireAuth, requireRole('player')) +// Group gate: authenticated only (no role restriction) — players and staff alike +// use this self-service surface; every read/write is scoped to the caller. Keep it +// out of search indexes. requireAuth also enforces the account status check (a +// disabled/banned account is rejected here with 403 before any handler runs). +playerRouter.use(noindex, requireAuth) playerRouter.get( '/account', @@ -31,7 +37,7 @@ playerRouter.get( // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }] /* #swagger.responses[200] = { description: 'The player account', content: { "application/json": { schema: { $ref: "#/components/schemas/PlayerAccount" } } } } */ /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ - /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ + /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ account.getAccount, ) @@ -43,7 +49,7 @@ playerRouter.patch( /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ChangeUsernameRequest" } } } } */ /* #swagger.responses[200] = { description: 'Updated username (session cookie re-issued)', content: { "application/json": { schema: { type: "object", properties: { username: { type: "string" } } } } } } */ /* #swagger.responses[400] = { description: 'Validation error or unavailable username', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */ - /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ + /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ /* #swagger.responses[409] = { description: 'Username already taken', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ /* #swagger.responses[429] = { description: 'Too many changes (rate limited)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ accountChangeLimiter, @@ -61,7 +67,7 @@ playerRouter.patch( /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ChangePasswordRequest" } } } } */ /* #swagger.responses[200] = { description: 'Password changed', content: { "application/json": { schema: { $ref: "#/components/schemas/OkFlag" } } } } */ /* #swagger.responses[400] = { description: 'Validation error or wrong current password', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ - /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ + /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ /* #swagger.responses[429] = { description: 'Too many changes (rate limited)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ accountChangeLimiter, body('newPassword').isString().isLength({ min: 8, max: 64 }), @@ -242,7 +248,7 @@ playerRouter.get( // #swagger.summary = 'List the caller’s moderation appeals' // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }] /* #swagger.responses[200] = { description: 'The caller’s appeals', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/Appeal" } } } } } */ - /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ + /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ appeals.listMine, ) playerRouter.get( @@ -252,7 +258,7 @@ playerRouter.get( // #swagger.description = 'The caller’s ban/mute mod_actions that have no active appeal. Returns an empty array when the caller has no linked Discord account (the UI shows a “link Discord” hint).' // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }] /* #swagger.responses[200] = { description: 'Appealable actions', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AppealEligibleAction" } } } } } */ - /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ + /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */ appeals.listEligible, ) playerRouter.post( diff --git a/server/swagger/swagger-output.json b/server/swagger/swagger-output.json index cc4f770..842e886 100644 --- a/server/swagger/swagger-output.json +++ b/server/swagger/swagger-output.json @@ -10147,7 +10147,7 @@ } }, "403": { - "description": "Player role required, or account not active", + "description": "Account not active (disabled/banned)", "content": { "application/json": { "schema": { @@ -10207,7 +10207,7 @@ "description": "Unauthorized" }, "403": { - "description": "Player role required, or account not active", + "description": "Account not active (disabled/banned)", "content": { "application/json": { "schema": { @@ -10292,7 +10292,7 @@ "description": "Unauthorized" }, "403": { - "description": "Player role required, or account not active", + "description": "Account not active (disabled/banned)", "content": { "application/json": { "schema": { @@ -11141,7 +11141,7 @@ "description": "Unauthorized" }, "403": { - "description": "Player role required, or account not active", + "description": "Account not active (disabled/banned)", "content": { "application/json": { "schema": { @@ -11272,7 +11272,7 @@ "description": "Unauthorized" }, "403": { - "description": "Player role required, or account not active", + "description": "Account not active (disabled/banned)", "content": { "application/json": { "schema": { diff --git a/server/test/playerRouteAccess.test.js b/server/test/playerRouteAccess.test.js new file mode 100644 index 0000000..5066d9a --- /dev/null +++ b/server/test/playerRouteAccess.test.js @@ -0,0 +1,84 @@ +// Point the DB at a closed port BEFORE requiring anything that builds the pool, +// so any stray query fails fast instead of holding the process open. The session +// service, users model, and shardLinks model are all stubbed, so no query runs. +process.env.DB_HOST = '127.0.0.1' +process.env.DB_PORT = '59999' + +const { test, after, afterEach } = require('node:test') +const assert = require('node:assert/strict') + +const { startApp } = require('./_helper') +const playerRouter = require('../src/router/v1/player/player.routes') +const sessionService = require('../src/auth/session.service') +const users = require('../src/model/users/users.model') +const shardLinks = require('../src/model/shardLinks/shardLinks.model') +const db = require('../src/utils/db') + +after(() => db.close()) + +const originals = { + validateSession: sessionService.validateSession, + isSessionRevoked: sessionService.isSessionRevoked, + sessionMeta: sessionService.sessionMeta, + getById: users.getById, + listForUser: shardLinks.listForUser, +} +afterEach(() => { + sessionService.validateSession = originals.validateSession + sessionService.isSessionRevoked = originals.isSessionRevoked + sessionService.sessionMeta = originals.sessionMeta + users.getById = originals.getById + shardLinks.listForUser = originals.listForUser +}) + +// Sign every request in as the given DB user (role decides the gate outcome). +function signInAs(user) { + sessionService.validateSession = () => ({ userId: user.id, sessionId: 's1', createdAt: Date.now(), authMethod: 'jwt' }) + sessionService.isSessionRevoked = async () => false + sessionService.sessionMeta = () => ({}) + users.getById = async () => user +} + +// The player self-service group is intentionally role-agnostic (staff are a +// superset of players): any authenticated, active account reaches the self-scoped +// handlers. Regression guard for the fix that dropped requireRole('player') so a +// staff/admin account is no longer 403'd out of its own characters. +for (const role of ['player', 'admin', 'editor', 'moderator']) { + test(`GET /player/shard/accounts is reachable by an authenticated ${role}`, async () => { + signInAs({ id: 7, username: 'u', role, status: 'active' }) + shardLinks.listForUser = async (id) => { + assert.equal(id, 7) // self-scoped to the caller regardless of role + return [{ account: 'acctA' }] + } + const app = await startApp((a) => a.use('/api/v1/player', playerRouter)) + try { + const res = await fetch(app.url + '/api/v1/player/shard/accounts') + assert.equal(res.status, 200, `${role} should reach the handler, got ${res.status}`) + assert.deepEqual(await res.json(), [{ account: 'acctA' }]) + } finally { + await app.close() + } + }) +} + +test('GET /player/shard/accounts still rejects an unauthenticated caller with 401', async () => { + sessionService.validateSession = () => null + const app = await startApp((a) => a.use('/api/v1/player', playerRouter)) + try { + const res = await fetch(app.url + '/api/v1/player/shard/accounts') + assert.equal(res.status, 401) + } finally { + await app.close() + } +}) + +test('a disabled account is still rejected with 403 (status gate, not role)', async () => { + signInAs({ id: 8, username: 'banned', role: 'player', status: 'disabled' }) + const app = await startApp((a) => a.use('/api/v1/player', playerRouter)) + try { + const res = await fetch(app.url + '/api/v1/player/shard/accounts') + assert.equal(res.status, 403) + } finally { + await app.close() + } +})