# Server

ASP.NET Core 9 (`net9.0`) implementation of the RecNet API surface that archived
2023 Rec Room clients call. Root namespace `RadicadeServer`; one process serves both
the game API and the public web/share endpoints.

## Running

```bash
dotnet run --project Server
```

Development listens on `https://localhost:3030` and `http://127.0.0.1:3031` (see
`appsettings.Development.json`); Production defaults to `http://0.0.0.0:3030` for a
TLS-terminating proxy in front (see the repo-level `Caddyfile`).

`Program.cs` builds the host, loads configuration into `DBConfig`, then:

- fails fast in Production if `AdminApiKey`, `JwtKey` or `SteamApiKey` are blank;
- registers the EF Core `RecDBContext` (SQL Server, retry-on-failure, pending-model
  warnings ignored);
- wires JWT bearer auth (signing key from `Radicade:JwtKey`; the `access_token` query
  parameter is accepted on notify-hub paths for WebSocket clients) plus a token
  version check that revokes sessions;
- configures ImageSharp (with a `cropSquare` command used by avatar images);
- applies migrations and idempotent schema fix-ups at startup;
- maps controllers and the `NotifyHub` SignalR hubs.

## Layout

| Folder | Contents |
| --- | --- |
| `Program.cs` | Host, DI, auth, middleware pipeline and startup schema work. |
| `DB/` | `DBConfig` (all runtime configuration + paths), `RecDBContext`, `Defaults`, factory and bootstrap helpers. |
| `Migrations/` | EF Core migrations. |
| `NameServer/` | `GET /`, `/ns`, `/nameserver` — the document that tells a client where every service lives. |
| `Auth/`, `AccountCreation/` | Login, token issuance, onboarding flows, platform identity proofing. |
| `Players/`, `PlayersBanned/`, `Relationships/`, `Messages/`, `Chat/`, `Notifications/` | Player records, presence, friends, direct messages, chat and notifications. |
| `Rooms/`, `Clubs/`, `Board/`, `PlayerEvents/`, `Inventions/`, `Keepsakes/`, `Studio/`, `Royale/` | User-generated and social content surfaces. |
| `Avatars/`, `CustomAvatarItems/`, `Images/`, `CDN/`, `Storage/`, `LoadingScreens/`, `Launcher/` | Cosmetics, image/video CDN routes, stored blobs, launcher manifest. |
| `Commerce/`, `Storefront/`, `Gift/`, `Promotions/`, `PlayerCheer/`, `ProgressionEvents/` | Economy: storefronts, purchases, gifts, promotions, progression rewards. |
| `Matchmaking/`, `Activities/`, `Leaderboards/`, `Compatibility/`, `Health/` | Session/matchmaking, activity feed, leaderboards, version compatibility checks, health endpoints. |
| `Moderation/`, `PlayerReporting/`, `PlayerWarnings/`, `PlayerReputation/`, `BanAppeal/` | Moderation and safety tooling. |
| `Config/` | Client configuration/split-test endpoints and player settings. |
| `Analytics/`, `BugReporting/` | Game log ingestion and bug reports. |
| `Admin/` | Admin panel API. Endpoints authenticate with `AdminApiKey`/`SupportApiKey` (see `AdminUtils`). |
| `Web/` | Public web/share API (`/web/...`). |
| `Discord/` | Discord webhook config (`webhooks.json` git-ignored, `webhooks.example.json` tracked). |
| `RecNet/`, `Radicade/` | Shared response/enum models and RecNet-shaped DTOs. |
| `RadicadeServer-Config/` | Catalogs served to clients (storefronts, avatars, equipment, keepsakes, level-up rewards, Steam whitelist). |
| `Middleware/`, `Extensions/`, `Utils/` | Cross-cutting plumbing and helpers. |
| `Tooling/` | Debug and test-case management endpoints. |

## Routing and multi-version support

Routes are declared with controller attributes and many endpoints deliberately expose
several paths for the same handler, because different 2023 builds call slightly
different URLs (for example `~/clubs/club/home/me`, `~/club/home/me` and
`~/api/clubs/v1/home/me`). Supported client versions are listed in
`DBConfig.SupportedGameVersions`, with **`20230831`** (September 2023) as the primary
target and `20230301`–`20231207` plus a couple of 2025 builds also accepted.

CORS is wide open (`AllowAllOrigins`), which is appropriate for a self-hosted server
serving the game client and local tooling.

## Data

`DBConfig.PublicData` defaults to `./RadicadeServer-Data/` and is split into:

- `CDN/Images`, `CDN/Videos`, `CDN/Storage`, `CDN/Custom` — served content and uploads;
- `Persistent/Logs` — rotating logs and generated `debugkey.txt`;
- `Persistent/DataProtection-Keys` — Data Protection key ring;
- `Persistent/localhost-rsa-aes-devcert.pfx` — the Development HTTPS certificate.

## Configuration

See the configuration table in the [root README](../README.md#configuration). The
checked-in `appsettings.*.json` files contain `USEYOURS` placeholders; override real
values with user secrets or environment variables (`Radicade__JwtKey`,
`ConnectionStrings__DefaultConnection`, …). Production startup validates the three
required secrets.

## Tests

Covered by [`ServerTests/`](../ServerTests) — see that README for how to run them and
which helpers they use.