TheSunIsLeaking/recflare
3
0
Fork 0
mirror of https://github.com/djdevin/recflare.git synced 2026-09-08 14:41:28 -07:00
Code Issues Packages Projects Releases Wiki Activity

enforce steam ticket validation

Browse Source
This commit is contained in:
Devin Zuczek
2026-07-10 17:40:49 -04:00
parent 2a1e9d5d0a
commit aad184181b
15 changed files with 540 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/econ/src/avatar-db.ts
+4 -4
View File
@@ -11,13 +11,13 @@
/** Schema DDL for tests — the accounts table including the avatar column. */
export const SCHEMA_DDL: string[] = [
`CREATE TABLE IF NOT EXISTS accounts (
`CREATE TABLE IF NOT EXISTS account (
data TEXT NOT NULL,
avatar TEXT,
account_id INTEGER GENERATED ALWAYS AS (json_extract(data, '$.accountId')) VIRTUAL,
username_lower TEXT GENERATED ALWAYS AS (lower(json_extract(data, '$.username'))) VIRTUAL
)`,
`CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_account_id ON accounts (account_id)`,
`CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_account_id ON account (account_id)`,
]
/** The stored avatar payload — opaque JSON the client sets and reads back. */
@@ -30,7 +30,7 @@ interface AvatarRow {
/** Read the player's stored avatar, or null when they have none yet. */
export async function getAvatar(db: D1Database, accountId: number): Promise<Avatar | null> {
const row = await db
.prepare('SELECT avatar FROM accounts WHERE account_id = ?1')
.prepare('SELECT avatar FROM account WHERE account_id = ?1')
.bind(accountId)
.first<AvatarRow>()
return row?.avatar ? (JSON.parse(row.avatar) as Avatar) : null
@@ -46,7 +46,7 @@ export async function setAvatar(
avatar: Avatar
): Promise<boolean> {
const { meta } = await db
.prepare('UPDATE accounts SET avatar = ?2 WHERE account_id = ?1')
.prepare('UPDATE account SET avatar = ?2 WHERE account_id = ?1')
.bind(accountId, JSON.stringify(avatar))
.run()
return meta.changes > 0
apps/econ/src/test/integration/api.test.ts
+3 -3
View File
@@ -20,7 +20,7 @@ beforeAll(async () => {
// Seed the shared JWT signing key into the local Secrets Store so .get() resolves.
await adminSecretsStore(env.JWT_SECRET).create('test-signing-key')
for (const stmt of SCHEMA_DDL) await env.DB.prepare(stmt).run()
await env.DB.prepare('INSERT OR IGNORE INTO accounts (data) VALUES (?1)')
await env.DB.prepare('INSERT OR IGNORE INTO account (data) VALUES (?1)')
.bind(JSON.stringify({ accountId: 42, username: 'Tester', displayName: 'Tester' }))
.run()
})
@@ -161,10 +161,10 @@ describe('econ endpoints', () => {
test('GET /api/avatar/v2/:id returns another player’s saved avatar, projected', async () => {
// Seed account 314 with a full avatar blob (superset of the projection).
await env.DB.prepare('INSERT OR IGNORE INTO accounts (data) VALUES (?1)')
await env.DB.prepare('INSERT OR IGNORE INTO account (data) VALUES (?1)')
.bind(JSON.stringify({ accountId: 314, username: 'Pi', displayName: 'Pi' }))
.run()
await env.DB.prepare('UPDATE accounts SET avatar = ?2 WHERE account_id = ?1')
await env.DB.prepare('UPDATE account SET avatar = ?2 WHERE account_id = ?1')
.bind(
314,
JSON.stringify({