support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client * [2025] unstable * 20250718.0 * correct one this time * stubs * more stubs * more stubs * [lists] add worker * [ai] route stubs * [api] player photo setting * [econ] add roomEconConfig route * [infra] update worker generators * [worker] add cards/moderation/platformnotification workers * [lists] updates to some endpoints * [clubs] stub out announcement endpoint, for now * [econ] stub out season endpoints for now * [chat] apps/chat stub out party endpoint not sure the shape yet * [api] stub out statsig and lockeditems * [doc] new services * [lists] stub the bulk endpoint * [datacollection] add placeholder service until we can kill it * [api] set gifting to lvl5 * update lock * [cdn] enable cache * [match] matchmake v2 * [lists] stub some lists * [ai] stubs * [rooms] new subroom save endpoint * [econ] add bulk purchase endpoint * [discovery] update featured creator to 1 for fun * [api] add photo settings flag * [chat] fixup chat permissions (sorta) * [auth] restrictions endpoint * [rooms] contributed endpoint * [api] fix outfit endpoint * [discovery] attempt to fix store * [chat] privacy endpoints * [api] cheered images * [rooms] add xp endpoint (disbaled) * [rooms] add xp endpoint (disabled) * update images-db for cheers * [rooms] add autocomplete endpoint * [cdn/img] increase cache ttl for statics * [api] bulk route for images * [accounts] add banner image * [api] add misc missing endpoints * [discovery] remove AI tab * [platformnotifications] stub some endpoints * [lists] add some more lists * [rooms] additional endpoints * [chat] stub a few privacy endpoints * [econ] stub some endpoints * misc db fixes * [api] tweak shape for images v6 * [rooms] dont show trending RROs
2026-09-08 14:41:28 -07:00 · 2026-08-18 23:07:24 -04:00
parent 66c09806f9
commit 178d3b5b0e
162 changed files with 114930 additions and 469 deletions
@@ -21,7 +21,14 @@ import {
 	updateAccount,
 	verifyPassword,
 } from '@repo/domain'
-import { intVar, logger, withCleanSpec, withDefaultCors, withNotFound, withOnError } from '@repo/hono-helpers'
+import {
+	intVar,
+	logger,
+	withCleanSpec,
+	withDefaultCors,
+	withNotFound,
+	withOnError,
+} from '@repo/hono-helpers'
 import { generateToken, TOKEN_TTL_SECONDS, validateAndGetAccountId } from '@repo/jwt'

 // The account-wide ban lives on a `report` row, whose table the api worker owns; its db
@@ -38,6 +45,7 @@ import {
 	OAuthError,
 	PlatformIdsRequest,
 	PlatformType,
+	RestrictionDto,
 	roleLookup,
 	TokenRequest,
 	TokenResponse,
@@ -434,7 +442,14 @@ const app = new Hono<App>()
 	// id, so the client can offer them on the login screen (and post one back as a
 	// cached_login grant). No linked account → [], and the client falls back to a
 	// fresh login / create_account.
-	.get(
+	//
+	// GET or POST: the 2023 build asks with a GET, the 2025 build (20250424.01) POSTs
+	// the same path with a form body — `deviceId`, `platformAuth` (a JSON blob holding
+	// the platform's session ticket and app id) and `time`. The body is READ BY NOTHING
+	// here; both methods answer the same list off the path params, so a newer client
+	// gets its picker. Verifying that ticket is the eventual point of the POST.
+	.on(
+		['GET', 'POST'],
 		'/cachedlogin/forplatformid/:platform/:id',
 		describeRoute({
 			tags: ['Cached login'],
@@ -449,6 +464,10 @@ const app = new Hono<App>()
 				'APKs: with no Meta SDK they have no real identity to ask about and stall on an',
 				'empty picker. It consults nothing and returns one canned, non-redeemable entry',
 				'with `requirePassword: true`, sending the build to username/password login.',
+				'Older clients GET this; the 20250424.01 build POSTs it with a',
+				'`deviceId` / `platformAuth` / `time` form body attesting the platform session.',
+				'That body is accepted and ignored — both methods answer identically from the',
+				'path params.',
 			].join(' '),
 			parameters: [
 				{
@@ -651,6 +670,19 @@ const app = new Hono<App>()
 				typeof body.device_class === 'string' ? Number.parseInt(body.device_class, 10) : NaN
 			const deviceClass = Number.isNaN(deviceClassInt) ? 0 : deviceClassInt

+			// The client's own build (`ver`, e.g. `20250718.01`), stamped into the token's
+			// `rn.ver` claim so everything downstream reports the build the player is ACTUALLY
+			// running rather than this server's GAME_VERSION — `match` reads it back off the
+			// token when it writes presence. Unverified like the device fields, and only ever
+			// echoed, never trusted for a decision (the version CHECK is `api`'s
+			// `/api/versioncheck/v4`, against its own list).
+			//
+			// A grant that posts none — a refresh, or a caller that isn't the game — leaves it
+			// undefined and generateToken falls back to GAME_VERSION. An empty string is
+			// treated as absent for the same reason: presence must never carry an empty
+			// version, which breaks the client's handling of it.
+			const version = typeof body.ver === 'string' && body.ver !== '' ? body.ver : undefined
+
 			// The client's real IP, per Cloudflare (the client can't spoof CF-Connecting-IP —
 			// the edge sets it — unlike X-Forwarded-For, which is why we don't read that).
 			// Recorded as the immutable `signupIp` at creation and as `lastLoginIp` on every
@@ -1022,7 +1054,8 @@ const app = new Hono<App>()
 				platform,
 				jwtSecret,
 				accountRoles(roleAccount),
-				accountPrivileges(roleAccount)
+				accountPrivileges(roleAccount),
+				version
 			)
 			// Issue a fresh, persisted refresh token (single-use; the client redeems it via
 			// grant_type=refresh_token). A refresh grant thus rotates its token.
@@ -1085,6 +1118,40 @@ const app = new Hono<App>()
 		}
 	)

+	// The moderation restrictions on the caller's account — chat mutes and the like. STUB:
+	// nothing here issues restrictions, so every caller is unrestricted and the list is
+	// empty. An EMPTY ARRAY is the normal unrestricted answer, not null and not a 404: the
+	// client clears and refills its list from this, and acts on a record simply being
+	// present (plus its `EndDate`), so `[]` is a complete answer rather than a placeholder.
+	//
+	// When this is wired up, the display strings are free text — the client matches none of
+	// them — so only `EndDate` and the record's presence need to be right. See
+	// `RestrictionDto`.
+	.get(
+		'/privileges/me/restrictions',
+		describeRoute({
+			tags: ['Account'],
+			summary: 'The caller’s moderation restrictions',
+			description: [
+				'The restrictions in force on the caller’s account (a chat mute, say), as a bare array.',
+				'Always EMPTY here — nothing on this server issues restrictions — and an empty array is',
+				'the normal unrestricted answer, not null. The client refills its list from this and',
+				'acts on a record being present and its `EndDate`; the `Name`/`Description`/',
+				'`DisplayReason` strings are display text it matches nothing against.',
+			].join(' '),
+			security: [{ bearerAuth: [] }],
+			responses: {
+				200: json(RestrictionDto.array(), 'The caller’s restrictions — always empty'),
+				401: { description: 'Missing or invalid bearer token (empty body)' },
+			},
+		}),
+		async (c) => {
+			const id = await authedId(c)
+			if (id === null) return c.body(null, 401)
+			return c.json([])
+		}
+	)
+
 	// Developer role lookup. Returns a bare JSON boolean (the client reads the body as
 	// a bool), and 404s for an unknown player — mirroring the reference API. The role
 	// is off by default and only an operator grants it (via `runx admin grant-developer`,
@@ -170,6 +170,14 @@ export const TokenRequest = z.object({
 		.optional()
 		.describe('Client-chosen, unverified. Recorded on the account, never trusted'),
 	device_class: z.string().optional().describe('Integer string; defaults to 0'),
+	ver: z
+		.string()
+		.optional()
+		.describe(
+			'The client’s build, e.g. `20250718.01`. Stamped into the token’s `rn.ver` claim and ' +
+				'read back by `match` when it writes presence, so a player reports the build they ' +
+				'are running. Absent (or empty) falls back to the server’s GAME_VERSION'
+		),
 })

 /** `POST /account/me/changepassword` form body. */
@@ -192,6 +200,47 @@ export const ChangePasswordResponse = z.object({
 * Both return a BARE JSON boolean rather than an object — the client reads the whole
 * body as a bool — and 404 an unknown player, mirroring the reference API.
 */
+/**
+ * The report category a moderation restriction was issued under, by value. Recorded in
+ * full from the client's enum so a restriction this server starts issuing can name the
+ * right one; nothing here reads it back.
+ *
+ * -1 Moderator · 0 Unknown · 1 DEPRECATED_MicrophoneAbuse · 2 Harassment · 3 Cheating ·
+ * 4 DEPRECATED_ImmatureBehavior · 5 AFK · 6 Misc · 7 Underage · 10 VoteKick ·
+ * 11 MisleadingPurchases · 100 CoC_Underage · 101 CoC_Sexual · 102 CoC_Discrimination ·
+ * 103 CoC_Trolling · 104 CoC_NameOrProfile · 200 InappropriateClothing ·
+ * 1000 IssuingInaccurateReports · 1100 RoomInventoryItems · 1101 InappropriateRooms ·
+ * 1102 InappropriateInventions · 1103 RoomOffers · 1200 Spam
+ */
+export const ReportCategory = z
+	.int()
+	.describe(
+		'ReportCategory: -1 Moderator · 0 Unknown · 1 DEPRECATED_MicrophoneAbuse · 2 Harassment · 3 Cheating · 4 DEPRECATED_ImmatureBehavior · 5 AFK · 6 Misc · 7 Underage · 10 VoteKick · 11 MisleadingPurchases · 100 CoC_Underage · 101 CoC_Sexual · 102 CoC_Discrimination · 103 CoC_Trolling · 104 CoC_NameOrProfile · 200 InappropriateClothing · 1000 IssuingInaccurateReports · 1100 RoomInventoryItems · 1101 InappropriateRooms · 1102 InappropriateInventions · 1103 RoomOffers · 1200 Spam'
+	)
+
+/**
+ * One moderation restriction on an account — a chat mute, say — as
+ * `GET /privileges/me/restrictions` lists them.
+ *
+ * `Name`, `Description` and `DisplayReason` are free display text: the client clears and
+ * refills its list from these and matches none of them against anything, so the wording is
+ * this server's to choose. What the client acts on is a record being PRESENT, and its
+ * `EndDate` — null for a restriction that never lifts.
+ */
+export const RestrictionDto = z.object({
+	AccountId: z.int().describe('The restricted account'),
+	Name: z.string().describe('Display name of the restriction, e.g. `Chat Mute`. Free text'),
+	Description: z.string().describe('What the player may no longer do. Free text'),
+	EndDate: z
+		.string()
+		.nullable()
+		.describe('When it lifts (ISO 8601 UTC); null for one that never does'),
+	AssociatedAccountId: z.int().nullable().describe('The other account involved, when there is one'),
+	AssociatedAccountUsername: z.string().nullable(),
+	ReportCategory: ReportCategory.nullable().describe('The category it was issued under'),
+	DisplayReason: z.string().nullable().describe('Reason shown to the player. Free text'),
+})
+
 export function roleLookup(role: 'developer' | 'moderator') {
 	return {
 		tags: ['Roles'],
@@ -5,6 +5,7 @@ import { beforeAll, describe, expect, test } from 'vitest'
 import '../../auth.app'

 import {
+	GAME_VERSION,
 	getAccountsByDeviceId,
 	hashPassword,
 	PRESENCE_SCHEMA_DDL,
@@ -420,6 +421,59 @@ describe('auth worker routes', () => {
 		])
 	})

+	// The 20250424.01 build POSTs the picker lookup with a platform-attestation form body
+	// instead of GETting it. Nothing reads that body yet, so both methods must answer the
+	// same list — otherwise the newer client's login screen comes up empty.
+	test('POST /cachedlogin/forplatformid answers exactly what the GET answers', async () => {
+		const steamId = '76561197962463211'
+		await env.DB.prepare('INSERT OR IGNORE INTO account (data) VALUES (?1)')
+			.bind(
+				JSON.stringify({
+					accountId: 31381,
+					username: 'SteamPlayer2025',
+					platform: 0,
+					platformId: steamId,
+					lastLoginTime: '2026-08-13T04:21:34.768Z',
+				})
+			)
+			.run()
+		await linkPlatformIdentity(env.DB, 31381, 0, steamId)
+
+		// The body as the live client sends it: device id, the platform session ticket, a
+		// timestamp. All ignored for now.
+		const body = new URLSearchParams({
+			deviceId: '69640e6ae1b54ae5b0ca8eeb4a8872ec6cf8fd88',
+			platformAuth: JSON.stringify({ Ticket: '140000009C5F501B447424FF', AppId: '471710' }),
+			time: '2026-08-13T04:21:34.7684754Z',
+		}).toString()
+		const posted = await exports.default.fetch(`${ORIGIN}/cachedlogin/forplatformid/0/${steamId}`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+			body,
+		})
+		expect(posted.status).toBe(200)
+		const expected = [
+			{
+				platform: 0,
+				platformId: steamId,
+				accountId: 31381,
+				lastLoginTime: '2026-08-13T04:21:34.768Z',
+				requirePassword: false,
+			},
+		]
+		expect(await posted.json()).toEqual(expected)
+		expect(await cachedLogins(0, steamId)).toEqual(expected)
+	})
+
+	// A POST with no body at all still resolves — the client's body is never consulted.
+	test('POST /cachedlogin/forplatformid/1/1 still returns the canned Oculus entry', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/cachedlogin/forplatformid/1/1`, {
+			method: 'POST',
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toMatchObject([{ accountId: 1, requirePassword: true }])
+	})
+
 	test('one account, a Steam and a Meta identity: both pickers offer it', async () => {
 		// The point of the link table. The same account is reachable from the PC and from
 		// the headset, and each picker reports the identity IT was asked about — that's
@@ -526,6 +580,25 @@ describe('auth worker routes', () => {
 		expect(payload.scope).toContain('rn.api')
 	})

+	// `rn.ver` is the CLIENT's build, from the `ver` it posts here — presence in `match`
+	// reads it back off the token, so this is what a player is reported as running.
+	test('POST /connect/token stamps the posted ver into rn.ver', async () => {
+		const payload = await tokenFor(`account_id=42&password=${LOGIN_PASSWORD}&ver=20250718.01`)
+		expect(payload['rn.ver']).toBe('20250718.01')
+	})
+
+	// A grant that names no build — a refresh, or a caller that isn't the game — falls
+	// back to the server's GAME_VERSION rather than stamping an empty claim, which would
+	// leave presence carrying an empty version.
+	test('POST /connect/token falls back to GAME_VERSION with no ver', async () => {
+		expect((await tokenFor(`account_id=42&password=${LOGIN_PASSWORD}`))['rn.ver']).toBe(
+			GAME_VERSION
+		)
+		expect((await tokenFor(`account_id=42&password=${LOGIN_PASSWORD}&ver=`))['rn.ver']).toBe(
+			GAME_VERSION
+		)
+	})
+
 	test('POST /connect/token stamps developer/moderator roles into the token', async () => {
 		await env.DB.prepare('INSERT OR IGNORE INTO account (data) VALUES (?1)')
 			.bind(
@@ -1058,6 +1131,23 @@ describe('auth worker routes', () => {
 		expect(await rotate.json()).toEqual({ success: true })
 	})

+	test('GET /privileges/me/restrictions is an empty array for an unrestricted caller', async () => {
+		const token = await accessTokenFor('grant_type=create_account&platform_id=steam-restrict1')
+		const res = await exports.default.fetch(`${ORIGIN}/privileges/me/restrictions`, {
+			headers: { Authorization: `Bearer ${token}` },
+		})
+		expect(res.status).toBe(200)
+		// [] is the normal unrestricted answer — not null, not a 404: the client refills its
+		// list from this and acts on a record being present.
+		expect(await res.text()).toBe('[]')
+	})
+
+	test('GET /privileges/me/restrictions 401s without a token', async () => {
+		const res = await exports.default.fetch(`${ORIGIN}/privileges/me/restrictions`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+
 	test('GET /role/developer/:id returns a bare false for an un-flagged account', async () => {
 		const res = await exports.default.fetch(`${ORIGIN}/role/developer/42`)
 		expect(res.status).toBe(200)
@@ -1119,9 +1209,11 @@ describe('auth worker routes', () => {
 		expect([...documented].sort()).toEqual([
 			'GET /cachedlogin/forplatformid/{platform}/{id}',
 			'GET /eac/challenge',
+			'GET /privileges/me/restrictions',
 			'GET /role/developer/{id}',
 			'GET /role/moderator/{id}',
 			'POST /account/me/changepassword',
+			'POST /cachedlogin/forplatformid/{platform}/{id}',
 			'POST /cachedlogin/forplatformids',
 			'POST /connect/token',
 		])