support for 202507 endpoints (#37)

* [auth][api] accept the 20250424.01 client Version check now answers "current" for a set of builds rather than one: SUPPORTED_GAME_VERSIONS carries 20230414 and 20250424.01. GAME_VERSION is unchanged and still what the server reports for itself (presence, rn.ver). Adds GET /api/versioncheck/islandedversions, always [] — we never island a build off into its own matchmaking pool. The 2025 build POSTs /cachedlogin/forplatformid/:platform/:id with a deviceId/platformAuth/time form body where the 2023 build GETs it, so that route now takes both methods. The body is accepted and ignored for now. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * [2025] unstable * 20250718.0 * correct one this time * stubs * more stubs * more stubs * [lists] add worker * [ai] route stubs * [api] player photo setting * [econ] add roomEconConfig route * [infra] update worker generators * [worker] add cards/moderation/platformnotification workers * [lists] updates to some endpoints * [clubs] stub out announcement endpoint, for now * [econ] stub out season endpoints for now * [chat] apps/chat stub out party endpoint not sure the shape yet * [api] stub out statsig and lockeditems * [doc] new services * [lists] stub the bulk endpoint * [datacollection] add placeholder service until we can kill it * [api] set gifting to lvl5 * update lock * [cdn] enable cache * [match] matchmake v2 * [lists] stub some lists * [ai] stubs * [rooms] new subroom save endpoint * [econ] add bulk purchase endpoint * [discovery] update featured creator to 1 for fun * [api] add photo settings flag * [chat] fixup chat permissions (sorta) * [auth] restrictions endpoint * [rooms] contributed endpoint * [api] fix outfit endpoint * [discovery] attempt to fix store * [chat] privacy endpoints * [api] cheered images * [rooms] add xp endpoint (disbaled) * [rooms] add xp endpoint (disabled) * update images-db for cheers * [rooms] add autocomplete endpoint * [cdn/img] increase cache ttl for statics * [api] bulk route for images * [accounts] add banner image * [api] add misc missing endpoints * [discovery] remove AI tab * [platformnotifications] stub some endpoints * [lists] add some more lists * [rooms] additional endpoints * [chat] stub a few privacy endpoints * [econ] stub some endpoints * misc db fixes * [api] tweak shape for images v6 * [rooms] dont show trending RROs --------- Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-09-09 23:21:30 -07:00 · 2026-08-18 23:07:24 -04:00
parent 66c09806f9
commit 34171417e3
162 changed files with 114930 additions and 469 deletions
@@ -0,0 +1,319 @@
+import { adminSecretsStore, env, SELF } from 'cloudflare:test'
+import { beforeAll, describe, expect, it } from 'vitest'
+
+import '../../ai.app'
+
+import type { Env } from '../../context'
+
+declare module 'cloudflare:test' {
+	interface ProvidedEnv extends Env {}
+}
+
+const ORIGIN = 'https://example.com'
+
+beforeAll(async () => {
+	// Seed the shared JWT signing key into the local Secrets Store so .get() resolves.
+	await adminSecretsStore(env.JWT_SECRET).create('test-signing-key')
+})
+
+// Mint a token the way the `auth` worker does, signing with the shared test key seeded
+// into the JWT_SECRET store.
+const TEST_SECRET = 'test-signing-key'
+
+function b64url(input: ArrayBuffer | string): string {
+	const bytes = typeof input === 'string' ? new TextEncoder().encode(input) : new Uint8Array(input)
+	let binary = ''
+	for (const byte of bytes) binary += String.fromCharCode(byte)
+	return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+async function bearer(sub = '42'): Promise<Record<string, string>> {
+	const now = Math.floor(Date.now() / 1000)
+	const signingInput = `${b64url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }))}.${b64url(
+		JSON.stringify({ sub, exp: now + 3600 })
+	)}`
+	const key = await crypto.subtle.importKey(
+		'raw',
+		new TextEncoder().encode(TEST_SECRET),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		['sign']
+	)
+	const sig = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput))
+	return { Authorization: `Bearer ${signingInput}.${b64url(sig)}` }
+}
+
+const REFUSAL = {
+	success: false,
+	error_id: 'AI.RoomDoesNotSupportGameAI',
+	error: 'This room does not support Rec Room Game AI',
+}
+
+describe('ai endpoints', () => {
+	it('GET / reports service status', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/`)
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ service: 'ai', status: 'ok' })
+	})
+})
+
+describe('GET /gameai/user/access', () => {
+	// A refusal, not an HTTP error: the client branches on the body, so a 4xx here would
+	// read as a failed request rather than "Game AI isn't available in this room".
+	it('refuses with a 200 body', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/user/access?roomId=1234`, {
+			headers: await bearer(),
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual(REFUSAL)
+	})
+
+	// `roomId` is optional in the reference signature and ignored here, so both forms and
+	// any room answer identically.
+	it.each(['', '?roomId=1', '?roomId=18446744073709551615'])(
+		'answers the same for %s',
+		async (query) => {
+			const res = await SELF.fetch(`${ORIGIN}/gameai/user/access${query}`, {
+				headers: await bearer(),
+			})
+			expect(res.status).toBe(200)
+			expect(await res.json()).toEqual(REFUSAL)
+		}
+	)
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/user/access?roomId=1234`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+
+	it('401s with a garbage token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/user/access`, {
+			headers: { Authorization: 'Bearer not-a-real-token' },
+		})
+		expect(res.status).toBe(401)
+	})
+})
+
+describe('GET /roomieai/user/access', () => {
+	// Granted, unlike the Game AI check: Roomie runs on the client and only asks for its
+	// energy budget, which nothing here meters.
+	it('grants an int32-max energy budget', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/roomieai/user/access`, { headers: await bearer() })
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({
+			success: true,
+			error_id: null,
+			error: null,
+			value: {
+				// int.MaxValue — the client's field is a signed 32-bit int, so a larger number
+				// overflows on the way in and reads as negative, i.e. no energy at all.
+				MaxEnergyFromSubscriptions: 2147483647,
+				EnergyLeft: 2147483647,
+				NextSubscriptionEnergyRechargeAt: null,
+				OutputAudioEnabled: true,
+			},
+		})
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/roomieai/user/access`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+
+	it('401s with a garbage token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/roomieai/user/access`, {
+			headers: { Authorization: 'Bearer not-a-real-token' },
+		})
+		expect(res.status).toBe(401)
+	})
+})
+
+describe('GET /gameai/room/:roomId/spendsummary', () => {
+	// Same refusal as the access check but with an explicit `value: null` — the access
+	// check omits the key. toEqual pins that difference: don't unify the two shapes.
+	it('refuses with a 200 body carrying a null value', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/room/1234/spendsummary`, {
+			headers: await bearer(),
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ ...REFUSAL, value: null })
+	})
+
+	// Room ids are ulong on the wire, so the largest one has 20 digits and exceeds what a
+	// JS number holds exactly. It's never parsed here, only matched by the route pattern.
+	it.each(['1', '18446744073709551615'])('answers the same for room %s', async (roomId) => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/room/${roomId}/spendsummary`, {
+			headers: await bearer(),
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ ...REFUSAL, value: null })
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/gameai/room/1234/spendsummary`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+})
+
+describe('GET /roomieai/user/facts', () => {
+	// Nothing observes players here, so Roomie's memory of the caller is empty — and empty
+	// in both halves: no prose profile, no facts behind one.
+	it('reports an empty profile', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/roomieai/user/facts`, { headers: await bearer() })
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({ UserContext: '', UserFacts: [] })
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/roomieai/user/facts`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+})
+
+describe('GET /makerai/user/access', () => {
+	// Always false — nothing here runs a model. The body is the boolean itself, not an
+	// envelope, matching econ's `/api/makerai/checkfreetrialeligibility`.
+	it('refuses access with a bare false', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/makerai/user/access?roomInstanceSpecificCheck=False`, {
+			headers: await bearer(),
+		})
+		expect(res.status).toBe(200)
+		expect(res.headers.get('content-type')).toContain('application/json')
+		expect(await res.text()).toBe('false')
+	})
+
+	it('answers the same without the query param', async () => {
+		// `roomInstanceSpecificCheck` is ignored, so its presence, absence and value change
+		// nothing.
+		const res = await SELF.fetch(`${ORIGIN}/makerai/user/access`, { headers: await bearer() })
+		expect(await res.text()).toBe('false')
+		const trueCheck = await SELF.fetch(
+			`${ORIGIN}/makerai/user/access?roomInstanceSpecificCheck=True`,
+			{
+				headers: await bearer(),
+			}
+		)
+		expect(await trueCheck.text()).toBe('false')
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/makerai/user/access`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+})
+
+describe('GET /makerai/user/balances', () => {
+	// Zeroed rather than refused: the client renders a usage meter from these, and a server
+	// that bills nothing has spent nothing. A flat body — no envelope.
+	it('reports zeroed balances', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/makerai/user/balances`, { headers: await bearer() })
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({
+			UsageDollars: 0,
+			UsersMaxUsageDollars: 0,
+			RRPlusUsageDollars: 0,
+			UsersMaxRRPlusUsageDollars: 0,
+			// An untouched allowance reports `Good`; the time bucket is `Empty` at
+			// DateTime.MinValue, this server selling no timed access to hold there.
+			TimeBalanceStatus: 'Empty',
+			TimeExpiresAt: '0001-01-01T00:00:00',
+			UsageBalanceStatus: 'Good',
+			UsagePercent: 0,
+			RRPlusUsageBalanceStatus: 'Good',
+			RRPlusUsagePercent: 0,
+		})
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/makerai/user/balances`)
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+})
+
+describe('POST /realtime-session/create', () => {
+	// The one call whose real answer is a working credential, so the one that can't be
+	// served statically. Note `error_id` is an empty string, not a code, and `value` null.
+	it('refuses to open a session', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/realtime-session/create`, {
+			method: 'POST',
+			headers: { ...(await bearer()), 'Content-Type': 'application/json' },
+			body: JSON.stringify({ AIType: 'Roomie' }),
+		})
+		expect(res.status).toBe(200)
+		expect(await res.json()).toEqual({
+			success: false,
+			error: 'Realtime AI sessions are not available on this server',
+			error_id: '',
+			value: null,
+		})
+	})
+
+	// The body is never read, so a missing or malformed one must not 500 — the answer is
+	// the same refusal either way.
+	it.each([
+		['no body', undefined],
+		['an empty body', '{}'],
+		['a malformed body', 'not json'],
+	])('refuses with %s', async (_label, body) => {
+		const res = await SELF.fetch(`${ORIGIN}/realtime-session/create`, {
+			method: 'POST',
+			headers: { ...(await bearer()), 'Content-Type': 'application/json' },
+			body,
+		})
+		expect(res.status).toBe(200)
+		expect((await res.json()) as { success: boolean }).toMatchObject({ success: false })
+	})
+
+	it('401s without a bearer token', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/realtime-session/create`, {
+			method: 'POST',
+			headers: { 'Content-Type': 'application/json' },
+			body: JSON.stringify({ AIType: 'Roomie' }),
+		})
+		expect(res.status).toBe(401)
+		expect(await res.text()).toBe('')
+	})
+})
+
+describe('GET /openapi.json', () => {
+	it('documents every route, with no dangling $refs', async () => {
+		const res = await SELF.fetch(`${ORIGIN}/openapi.json`)
+		expect(res.status).toBe(200)
+		const spec = (await res.json()) as {
+			openapi: string
+			paths: Record<string, Record<string, { summary?: string }>>
+		}
+		expect(spec.openapi).toMatch(/^3\.1/)
+
+		// The spec route hides itself; everything else is described. Adding a route without
+		// a describeRoute() block fails here rather than shipping an incomplete spec.
+		const documented = new Set(
+			Object.entries(spec.paths).flatMap(([path, ops]) =>
+				Object.keys(ops).map((method) => `${method.toUpperCase()} ${path}`)
+			)
+		)
+		expect([...documented].sort()).toEqual([
+			'GET /',
+			'GET /gameai/room/{roomId}/spendsummary',
+			'GET /gameai/user/access',
+			'GET /makerai/user/access',
+			'GET /makerai/user/balances',
+			'GET /roomieai/user/access',
+			'GET /roomieai/user/facts',
+			'POST /realtime-session/create',
+		])
+
+		for (const ops of Object.values(spec.paths)) {
+			for (const op of Object.values(ops)) expect(op.summary).toBeTruthy()
+		}
+
+		// Schemas must inline: a `$ref` here is a dangling reference (see openapi.ts).
+		expect(JSON.stringify(spec).includes('"$ref"')).toBe(false)
+	})
+})