Add identity-backed server moderation

tests/dedicated_host_session_validation.gd

@@ -1,6 +1,9 @@
 extends SceneTree
 
 const TEST_PORT: int = 35777
+const OPERATOR_FINGERPRINT: String = (
+	"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+)
 
 
 func _init() -> void:
@@ -35,12 +38,18 @@ func _run() -> void:
 		host_bans,
 		true,
 	)
+	assert(session.configure_dedicated_operators(
+		PackedStringArray([OPERATOR_FINGERPRINT])
+	))
 	assert(session.start_dedicated_host(TEST_PORT, 5, "127.0.0.1"))
 	assert(session.is_dedicated_host())
 	assert(session.get_local_peer_id() == 0)
 	assert(session.get_player_count() == 0)
 	assert(session.get_session_max_players() == 5)
 	assert(session.get_host_port() == TEST_PORT)
+	assert(bool(session.call(
+		"_operator_for_fingerprint", OPERATOR_FINGERPRINT
+	)))
 	assert(session.set_host_open(true))
 	assert(session.is_open_host())
 	session.disconnect_session("Dedicated host validation complete.")

tests/dedicated_server_config_validation.gd

@@ -1,6 +1,12 @@
 extends SceneTree
 
 const ConfigType = preload("res://server/dedicated_server_config.gd")
+const OPERATOR_A: String = (
+	"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+)
+const OPERATOR_B: String = (
+	"fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210"
+)
 
 
 func _initialize() -> void:
@@ -25,6 +31,9 @@ func _run() -> void:
 	file.set_value("server", "public", true)
 	file.set_value("server", "data_directory", "/tmp/configured-server")
 	file.set_value("discovery", "url", "https://discovery.netfishing.org/")
+	file.set_value(
+		"moderation", "operators", PackedStringArray([OPERATOR_B, OPERATOR_A])
+	)
 	assert(file.save(path) == OK)
 
 	var configured := ConfigType.new()
@@ -37,8 +46,35 @@ func _run() -> void:
 	assert(int(configured.get("max_players")) == 12)
 	assert(bool(configured.get("public_listing")))
 	assert(str(configured.get("discovery_url")) == "https://discovery.netfishing.org")
+	assert(
+		configured.get("operator_fingerprints")
+		== PackedStringArray([OPERATOR_A, OPERATOR_B])
+	)
 	assert(DirAccess.remove_absolute(path) == OK)
 
+	var parsed := ConfigType.new()
+	parsed.set(
+		"operator_fingerprints",
+		ConfigType._parse_fingerprint_list(
+			"%s, %s;%s" % [OPERATOR_B.to_upper(), OPERATOR_A, OPERATOR_A]
+		),
+	)
+	parsed.set("data_directory", "/tmp/parsed-server")
+	parsed.call("_validate")
+	assert(parsed.is_valid())
+	assert(
+		parsed.get("operator_fingerprints")
+		== PackedStringArray([OPERATOR_A, OPERATOR_B])
+	)
+
+	var invalid_operator := ConfigType.new()
+	invalid_operator.set(
+		"operator_fingerprints", PackedStringArray(["not-a-fingerprint"])
+	)
+	invalid_operator.set("data_directory", "/tmp/invalid-operator-server")
+	invalid_operator.call("_validate")
+	assert(not invalid_operator.is_valid())
+
 	var invalid := ConfigType.new()
 	invalid.set("public_listing", true)
 	invalid.set("data_directory", "/tmp/invalid-server")
@@ -58,6 +94,27 @@ func _run() -> void:
 		DiscoveryClient.UPNP_RETRY_INTERVAL_SECONDS
 		< DiscoveryClient.UPNP_RENEW_INTERVAL_SECONDS
 	)
+	var discovery_settings_path: String = ProjectSettings.globalize_path(
+		DiscoveryClient.SETTINGS_PATH
+	)
+	assert(not FileAccess.file_exists(discovery_settings_path))
+	assert(discovery.set_room_name("Client Room"))
+	var client_settings: PackedByteArray = FileAccess.get_file_as_bytes(
+		discovery_settings_path
+	)
+	assert(not client_settings.is_empty())
+	var dedicated_discovery := DiscoveryClient.new()
+	dedicated_discovery.call("_load_settings")
+	assert(
+		dedicated_discovery.configure_dedicated_runtime("Headless Room")
+	)
+	assert(dedicated_discovery.get_room_name() == "Headless Room")
+	assert(
+		FileAccess.get_file_as_bytes(discovery_settings_path)
+		== client_settings
+	)
+	dedicated_discovery.free()
+	assert(DirAccess.remove_absolute(discovery_settings_path) == OK)
 	assert(
 		discovery.get_host_state()
 		== DiscoveryClient.HostState.CLOSED

tests/operator_multiplayer_validation.gd

@@ -0,0 +1,232 @@
+extends SceneTree
+
+const MainScene = preload("res://main/main.tscn")
+const TEST_PORT: int = 18140
+const FIRST_BANNED_FINGERPRINT: String = (
+	"1111111111111111111111111111111111111111111111111111111111111111"
+)
+const SECOND_BANNED_FINGERPRINT: String = (
+	"2222222222222222222222222222222222222222222222222222222222222222"
+)
+
+var _moderation_results: Array[Dictionary] = []
+
+
+func _initialize() -> void:
+	call_deferred("_run")
+
+
+func _run() -> void:
+	var arguments: PackedStringArray = OS.get_cmdline_user_args()
+	if arguments.has("host"):
+		await _run_host()
+		return
+	if arguments.has("client"):
+		await _run_client()
+		return
+	push_error("Operator multiplayer validation needs host or client mode.")
+	quit(1)
+
+
+func _run_host() -> void:
+	var main: Node = await _create_initialized_main()
+	var session := main.get_node("%NetworkSession") as NetworkSession
+	var service := (
+		main.get_node("%NetworkPlayerListService")
+		as NetworkPlayerListService
+	)
+	var bans := main.get_node("%HostBanStore") as HostBanStore
+	assert(session.start_private_host(TEST_PORT))
+	assert(session.set_host_open(true))
+
+	var remote_peer_id: int = await _wait_for_remote_peer(session)
+	assert(remote_peer_id > 1)
+	var remote_record: PeerRegistry.PeerRecord = session.get_peer_record(
+		remote_peer_id
+	)
+	assert(remote_record != null and remote_record.identity_authenticated)
+	var host_fingerprint: String = session.get_host_identity_fingerprint()
+	assert(bans.ban(
+		host_fingerprint, FIRST_BANNED_FINGERPRINT, "First Banned Player"
+	))
+
+	var entry: PlayerListEntry = _entry_for_peer(service, remote_peer_id)
+	assert(entry != null and entry.can_manage_operator)
+	assert(service.set_operator(
+		remote_peer_id,
+		remote_record.identity_fingerprint,
+		true,
+		entry.revision,
+	))
+	assert(session.is_peer_operator(remote_peer_id))
+	var players_page := main.find_child(
+		"PlayersPage", true, false
+	) as PlayersPage
+	assert(players_page != null)
+	players_page.call("_refresh")
+	assert(_has_button_text(players_page, "deop"))
+
+	var unban_deadline: int = Time.get_ticks_msec() + 12000
+	while (
+		Time.get_ticks_msec() < unban_deadline
+		and bans.is_banned(host_fingerprint, FIRST_BANNED_FINGERPRINT)
+	):
+		await process_frame
+	assert(not bans.is_banned(
+		host_fingerprint, FIRST_BANNED_FINGERPRINT
+	))
+	assert(bans.ban(
+		host_fingerprint, SECOND_BANNED_FINGERPRINT, "Second Banned Player"
+	))
+
+	entry = _entry_for_peer(service, remote_peer_id)
+	assert(entry != null and entry.is_operator)
+	assert(service.set_operator(
+		remote_peer_id,
+		remote_record.identity_fingerprint,
+		false,
+		entry.revision,
+	))
+	assert(not session.is_peer_operator(remote_peer_id))
+
+	var disconnect_deadline: int = Time.get_ticks_msec() + 8000
+	while (
+		Time.get_ticks_msec() < disconnect_deadline
+		and session.is_authenticated_peer(remote_peer_id)
+	):
+		await process_frame
+	assert(not session.is_authenticated_peer(remote_peer_id))
+	assert(bans.is_banned(host_fingerprint, SECOND_BANNED_FINGERPRINT))
+	print("Operator multiplayer host validation: PASS")
+	session.disconnect_session("")
+	main.queue_free()
+	for _frame: int in 4:
+		await process_frame
+	await create_timer(0.1).timeout
+	quit()
+
+
+func _run_client() -> void:
+	var main: Node = await _create_initialized_main()
+	main.call(
+		"_on_title_join_game_requested", "127.0.0.1:%d" % TEST_PORT
+	)
+	var session := main.get_node("%NetworkSession") as NetworkSession
+	var service := (
+		main.get_node("%NetworkPlayerListService")
+		as NetworkPlayerListService
+	)
+	service.moderation_finished.connect(
+		func(success: bool, message: String) -> void:
+			_moderation_results.append({
+				"success": success,
+				"message": message,
+			})
+	)
+	var join_deadline: int = Time.get_ticks_msec() + 20000
+	while Time.get_ticks_msec() < join_deadline:
+		await process_frame
+		if session.state == NetworkSession.State.VERIFYING_SERVER_IDENTITY:
+			main.call("_confirm_server_trust")
+		if session.is_joined_client():
+			break
+	assert(session.is_joined_client())
+
+	var operator_deadline: int = Time.get_ticks_msec() + 10000
+	while Time.get_ticks_msec() < operator_deadline and not session.is_local_operator():
+		await process_frame
+	assert(session.is_local_operator())
+	assert(service.is_local_moderator())
+	var players_page := main.find_child(
+		"PlayersPage", true, false
+	) as PlayersPage
+	assert(players_page != null)
+	players_page.call("_refresh")
+	var tabs := players_page.get("_tabs") as HBoxContainer
+	assert((tabs.get_child(2) as Button).visible)
+	players_page.call("_select_tab", 2)
+	assert(int(players_page.get("_current_tab")) == 2)
+	var local_entry: PlayerListEntry = _entry_for_peer(
+		service, session.get_local_peer_id()
+	)
+	assert(local_entry != null and local_entry.is_operator)
+
+	var ban_deadline: int = Time.get_ticks_msec() + 10000
+	while (
+		Time.get_ticks_msec() < ban_deadline
+		and not _has_ban(service.get_bans(), FIRST_BANNED_FINGERPRINT)
+	):
+		await process_frame
+	assert(_has_ban(service.get_bans(), FIRST_BANNED_FINGERPRINT))
+	assert(service.unban(FIRST_BANNED_FINGERPRINT))
+	var result_deadline: int = Time.get_ticks_msec() + 8000
+	while Time.get_ticks_msec() < result_deadline and _moderation_results.is_empty():
+		await process_frame
+	assert(not _moderation_results.is_empty())
+	assert(bool(_moderation_results.back().get("success", false)))
+
+	var deop_deadline: int = Time.get_ticks_msec() + 10000
+	while Time.get_ticks_msec() < deop_deadline and session.is_local_operator():
+		await process_frame
+	assert(not session.is_local_operator())
+	assert(not service.is_local_moderator())
+	assert(not (tabs.get_child(2) as Button).visible)
+	assert(int(players_page.get("_current_tab")) == 0)
+	service.request_unban.rpc_id(1, SECOND_BANNED_FINGERPRINT)
+	await create_timer(1.0).timeout
+	print("Operator multiplayer client validation: PASS")
+	session.disconnect_session("")
+	main.queue_free()
+	for _frame: int in 4:
+		await process_frame
+	await create_timer(0.1).timeout
+	quit()
+
+
+func _create_initialized_main() -> Node:
+	root.size = Vector2i(1280, 720)
+	var main: Node = MainScene.instantiate()
+	root.add_child(main)
+	for _frame: int in 4:
+		await process_frame
+	if not bool(main.get("_application_initialized")):
+		main.call("_activate_selected_data_path", "", true)
+	for _frame: int in 8:
+		await process_frame
+	assert(bool(main.get("_application_initialized")))
+	return main
+
+
+func _wait_for_remote_peer(session: NetworkSession) -> int:
+	var deadline: int = Time.get_ticks_msec() + 20000
+	while Time.get_ticks_msec() < deadline:
+		await process_frame
+		for peer_id: int in session.get_authenticated_peer_ids():
+			if peer_id != session.get_local_peer_id():
+				return peer_id
+	return 0
+
+
+func _entry_for_peer(
+	service: NetworkPlayerListService,
+	peer_id: int,
+) -> PlayerListEntry:
+	for entry: PlayerListEntry in service.get_entries():
+		if entry.peer_id == peer_id:
+			return entry
+	return null
+
+
+func _has_ban(records: Array[Dictionary], fingerprint: String) -> bool:
+	for record: Dictionary in records:
+		if str(record.get("target_fingerprint", "")) == fingerprint:
+			return true
+	return false
+
+
+func _has_button_text(root_node: Node, text: String) -> bool:
+	for node: Node in root_node.find_children("*", "Button", true, false):
+		var button := node as Button
+		if button != null and button.text == text:
+			return true
+	return false

tests/operator_multiplayer_validation.gd.uid

@@ -0,0 +1 @@
+uid://cv17xsf20ue5t