Radicade/Server/README.md

Server

ASP.NET Core 9 (net9.0) implementation of the RecNet API surface that archived 2023 Rec Room clients call. Root namespace RadicadeServer; one process serves both the game API and the public web/share endpoints.

Running

dotnet run --project Server

Development listens on https://localhost:3030 and http://127.0.0.1:3031 (see appsettings.Development.json); Production defaults to http://0.0.0.0:3030 for a TLS-terminating proxy in front (see the repo-level Caddyfile).

Program.cs builds the host, loads configuration into DBConfig, then:

• fails fast in Production if AdminApiKey, JwtKey or SteamApiKey are blank;
• registers the EF Core RecDBContext (SQL Server, retry-on-failure, pending-model warnings ignored);
• wires JWT bearer auth (signing key from Radicade:JwtKey; the access_token query parameter is accepted on notify-hub paths for WebSocket clients) plus a token version check that revokes sessions;
• configures ImageSharp (with a cropSquare command used by avatar images);
• applies migrations and idempotent schema fix-ups at startup;
• maps controllers and the NotifyHub SignalR hubs.

Layout

Folder	Contents
Program.cs	Host, DI, auth, middleware pipeline and startup schema work.
DB/	DBConfig (all runtime configuration + paths), RecDBContext, Defaults, factory and bootstrap helpers.
Migrations/	EF Core migrations.
NameServer/	GET /, /ns, /nameserver — the document that tells a client where every service lives.
Auth/, AccountCreation/	Login, token issuance, onboarding flows, platform identity proofing.
Players/, PlayersBanned/, Relationships/, Messages/, Chat/, Notifications/	Player records, presence, friends, direct messages, chat and notifications.
Rooms/, Clubs/, Board/, PlayerEvents/, Inventions/, Keepsakes/, Studio/, Royale/	User-generated and social content surfaces.
Avatars/, CustomAvatarItems/, Images/, CDN/, Storage/, LoadingScreens/, Launcher/	Cosmetics, image/video CDN routes, stored blobs, launcher manifest.
Commerce/, Storefront/, Gift/, Promotions/, PlayerCheer/, ProgressionEvents/	Economy: storefronts, purchases, gifts, promotions, progression rewards.
Matchmaking/, Activities/, Leaderboards/, Compatibility/, Health/	Session/matchmaking, activity feed, leaderboards, version compatibility checks, health endpoints.
Moderation/, PlayerReporting/, PlayerWarnings/, PlayerReputation/, BanAppeal/	Moderation and safety tooling.
Config/	Client configuration/split-test endpoints and player settings.
Analytics/, BugReporting/	Game log ingestion and bug reports.
Admin/	Admin panel API. Endpoints authenticate with AdminApiKey/SupportApiKey (see AdminUtils).
Web/	Public web/share API (/web/...).
Discord/	Discord webhook config (webhooks.json git-ignored, webhooks.example.json tracked).
RecNet/, Radicade/	Shared response/enum models and RecNet-shaped DTOs.
RadicadeServer-Config/	Catalogs served to clients (storefronts, avatars, equipment, keepsakes, level-up rewards, Steam whitelist).
Middleware/, Extensions/, Utils/	Cross-cutting plumbing and helpers.
Tooling/	Debug and test-case management endpoints.

Routing and multi-version support

Routes are declared with controller attributes and many endpoints deliberately expose several paths for the same handler, because different 2023 builds call slightly different URLs (for example ~/clubs/club/home/me, ~/club/home/me and ~/api/clubs/v1/home/me). Supported client versions are listed in DBConfig.SupportedGameVersions, with 20230831 (September 2023) as the primary target and 20230301–20231207 plus a couple of 2025 builds also accepted.

CORS is wide open (AllowAllOrigins), which is appropriate for a self-hosted server serving the game client and local tooling.

Data

DBConfig.PublicData defaults to ./RadicadeServer-Data/ and is split into:

• CDN/Images, CDN/Videos, CDN/Storage, CDN/Custom — served content and uploads;
• Persistent/Logs — rotating logs and generated debugkey.txt;
• Persistent/DataProtection-Keys — Data Protection key ring;
• Persistent/localhost-rsa-aes-devcert.pfx — the Development HTTPS certificate.

Configuration

See the configuration table in the root README. The checked-in appsettings.*.json files contain USEYOURS placeholders; override real values with user secrets or environment variables (Radicade__JwtKey, ConnectionStrings__DefaultConnection, …). Production startup validates the three required secrets.

Tests

Covered by ServerTests/ — see that README for how to run them and which helpers they use.