fable/val Public Public: anyone can read this; nobody can change it.

import { expect, test } from "bun:test";

import { mkdtempSync } from "node:fs";

import { tmpdir } from "node:os";

import { join } from "node:path";

process.env.FORGE_APP_DATA = mkdtempSync(join(tmpdir(), "app-"));

process.env.PORT = "0";

const { server } = await import("./server.ts");

const { match, snapshot, advance, takeSeat, release, releaseAddress } = await import("./arena.ts");

const { visible } = await import("./match.ts");

const base = `http://${server.hostname}:${server.port}`;

test("serves a live match on the first paint, with no script needed", async () => {

  const response = await fetch(base + "/");

  expect(response.status).toBe(200);

  const body = await response.text();

  expect(body).toContain("<h1>val</h1>");

  // The score, the round and both team sheets are in the HTML itself.

  expect(body).toContain("red " + match().score.red);

  expect(body).toContain("round " + match().round);

  for (const player of match().players) expect(body).toContain(player.name);

});

test("the page hands out a session cookie and the script is named by content", async () => {

  const response = await fetch(base + "/", { redirect: "manual" });

  const cookie = response.headers.get("set-cookie") ?? "";

  expect(cookie).toContain("val_session=");

  expect(cookie).toContain("HttpOnly");

  const body = await response.text();

  const src = /src="(\/static\/val\.[0-9a-f]+\.js)"/.exec(body);

  expect(src).not.toBe(null);

  const script = await fetch(base + src![1]!);

  expect(script.status).toBe(200);

  expect(script.headers.get("cache-control")).toContain("immutable");

  expect(await script.text()).toContain("WebSocket");

});

test("a name is taken from a same-origin form and sanitised", async () => {

  // Every test in this file reaches the server from the same address, and a

  // playing seat is rationed per address on purpose. Earlier tests here take

  // that seat and never open a socket to close, so nothing frees it: without

  // this line the join below is correctly refused and the assertion measures

  // the leftovers of another test rather than this one's behaviour.

  releaseAddress("127.0.0.1");

  releaseAddress("::1");

  releaseAddress("::ffff:127.0.0.1");

  const form = new FormData();

  form.set("name", '  Wren<script>"  ');

  const posted = await fetch(base + "/join", { method: "POST", body: form, redirect: "manual" });

  expect(posted.status).toBe(303);

  const cookie = posted.headers.getSetCookie().join(" ");

  expect(cookie).toContain("val_name=");

  // The angle brackets and the quote never reach the cookie or the match.

  expect(cookie).not.toContain("<");

  expect(cookie).not.toContain("%3C");

  expect(match().players.every((p) => !p.name.includes("<"))).toBe(true);

  // The seat that name took is a real player in the running match.

  expect(match().players.some((p) => !p.bot && p.name.includes("Wren"))).toBe(true);

  // A join never opens a socket to close, so nothing ever frees the address

  // it claimed on its own; every other test in this run shares this same

  // loopback address, so free it explicitly rather than starve them of it.

  const sessionCookie = posted.headers.getSetCookie().find((c) => c.startsWith("val_session="));

  const session = sessionCookie?.split(";")[0]?.split("=")[1];

  if (session) release(session, "");

});

test("refuses a cross-site post", async () => {

  const form = new FormData();

  form.set("name", "Evil");

  const posted = await fetch(base + "/join", {

    method: "POST",

    body: form,

    redirect: "manual",

    headers: { origin: "https://evil.example", "sec-fetch-site": "cross-site" },

  });

  expect(posted.status).toBe(403);

  expect(match().players.some((p) => p.name === "Evil")).toBe(false);

});

test("stands on the security floor", async () => {

  const response = await fetch(base + "/");

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

  expect(response.headers.get("x-content-type-options")).toBe("nosniff");

  const missing = await fetch(base + "/nope");

  expect(missing.status).toBe(404);

  expect(missing.headers.get("content-security-policy")).toContain("default-src 'self'");

});

test("a bug answers with the floor, not the runtime's page", async () => {

  // A percent-escape that is not one: whether the runtime decodes it or

  // throws, the answer carries the floor and never a stack trace.

  const response = await fetch(base + "/join", {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "name=%E0%A4%A",

    redirect: "manual",

  });

  expect([303, 500]).toContain(response.status);

  expect(await response.text()).not.toContain("src/server.ts");

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

});

test("a body is capped by the bytes read, whatever it claims", async () => {

  const response = await fetch(base + "/join", {

    method: "POST",

    headers: { "content-type": "application/x-www-form-urlencoded" },

    body: "name=" + "x".repeat(1024 * 1024),

  });

  expect(response.status).toBe(413);

});

test("HEAD sees the app up", async () => {

  const response = await server.fetch(new Request(base + "/", { method: "HEAD" }));

  expect(response.status).toBe(200);

  expect(await response.text()).toBe("");

});

test("the map is served as data, once, for the client to draw", async () => {

  const response = await fetch(base + "/map.json");

  const body = (await response.json()) as { rows: string[]; tile: number };

  expect(body.tile).toBe(80);

  expect(body.rows.length).toBeGreaterThan(10);

  expect(body.rows.some((r) => r.includes("A"))).toBe(true);

  expect(body.rows.some((r) => r.includes("B"))).toBe(true);

});

test("a websocket is refused to another site", async () => {

  const response = await server.fetch(

    new Request(base + "/ws", { headers: { "sec-fetch-site": "cross-site", origin: "https://evil.example" } }),

  );

  expect(response.status).toBe(403);

});

test("a snapshot only carries the enemies that viewer can see", () => {

  const state = match();

  const viewer = state.players.find((p) => p.side === "atk")!;

  const enemy = state.players.find((p) => p.side === "def")!;

  viewer.x = 1200;

  viewer.y = 1320;

  viewer.blind = 0;

  // Both of them alive on purpose: the arena is one live match that other

  // tests run forward, and a dead enemy is invisible for a different reason

  // than the one this test is about.

  viewer.alive = true;

  enemy.alive = true;

  enemy.x = 1200;

  enemy.y = 1240;

  enemy.revealed = 0;

  const near = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[] };

  expect(near.players.some((p) => p.id === enemy.id)).toBe(true);

  // Behind the wall on the far side of the map, the same enemy is gone.

  enemy.x = 200;

  enemy.y = 200;

  const far = JSON.parse(snapshot(viewer.id)) as { players: { id: string }[]; board: unknown[] };

  expect(far.players.some((p) => p.id === enemy.id)).toBe(false);

  // The scoreboard still lists everyone; it carries no position.

  expect(far.board.length).toBe(10);

  expect(JSON.stringify(far.board)).not.toContain('"x"');

});

test("the whole snapshot carries no id or position of a body the viewer cannot see", () => {

  // Generic on purpose: this scans the whole stringified payload rather

  // than one named field, so it would have caught each of the three leaks

  // of this shape — a hidden body's id or coordinate reaching the wire

  // through some field other than `players` — and would catch a fourth.

  const state = match();

  const viewer = state.players.find((p) => p.side === "atk")!;

  viewer.x = 1200;

  viewer.y = 1320;

  viewer.blind = 0;

  viewer.alive = true;

  const enemy = state.players.find((p) => p.side === "def")!;

  enemy.alive = true;

  enemy.revealed = 0;

  // A distinctive decimal, not a round number, so it cannot be mistaken for

  // an unrelated field (hp, credits, damage) that legitimately holds 200.

  enemy.x = 217.3;

  enemy.y = 233.9;

  expect(visible(state, viewer, enemy)).toBe(false);

  // A molly lands at the thrower's own feet — the shape any thrown ability

  // takes — planted on the enemy this viewer cannot see.

  const zoneId = state.nextZone++;

  state.zones.push({

    id: zoneId,

    kind: "molly",

    owner: enemy.id,

    side: enemy.side,

    x: enemy.x,

    y: enemy.y,

    r: 40,

    life: 5,

    fuse: 0,

    beat: 0,

    pulses: 0,

    damage: 0,

    blocks: false,

    solid: false,

  });

  const text = snapshot(viewer.id);

  const round2 = (n: number) => Math.round(n * 10) / 10;

  // A number counts only bare, not as a substring of a larger one — "217.3"

  // inside "1217.3" would be a false alarm, "217.3" on its own is the leak.

  const bare = (n: number) => new RegExp(String.raw`(?<![\d.-])${n}(?![\d.])`);

  // The scoreboard is a named, reviewed exception: it lists every id on

  // purpose (kills, deaths, credits for the whole match), never a position.

  // The id check walks everything else; the position check still walks the

  // scoreboard too, so a coordinate added there would still be caught.

  const { board: _board, ...rest } = JSON.parse(text) as Record<string, unknown>;

  expect(JSON.stringify(rest)).not.toContain(JSON.stringify(enemy.id));

  expect(bare(round2(enemy.x)).test(text)).toBe(false);

  expect(bare(round2(enemy.y)).test(text)).toBe(false);

  state.zones = state.zones.filter((z) => z.id !== zoneId);

});

test("a command from a seat plants the spike, and nonsense from anyone else does nothing", async () => {

  const { command } = await import("./arena.ts");

  const { siteCentre } = await import("./map.ts");

  const state = match();

  state.phase = "live";

  state.clock = 100;

  const spot = siteCentre("B");

  const carrier = state.players.find((p) => p.side === "atk")!;

  // Nobody is a bot for these five seconds: no fight can end the round

  // underneath the plant and make this depend on who shot whom. And nobody

  // else is mid-plant: this arena is live and shared, and once in a dozen

  // runs a bot was standing on A with the spike and F held when this test

  // began. Left with `spike` set and `use` held, it planted on A first, and

  // every seat test after this one failed because the bots were never

  // restored — the deploy gate's coin flip.

  for (const player of state.players) {

    player.bot = false;

    player.alive = true;

    player.hp = 100;

    player.spike = false;

    player.planting = 0;

    player.input.fire = false;

    player.input.use = false;

    player.input.mx = 0;

    player.input.my = 0;

  }

  try {

    carrier.x = spot.x;

    carrier.y = spot.y;

    carrier.spike = true;

    state.spike = { carried: carrier.id, x: spot.x, y: spot.y, planted: false, fuse: 0, site: null, defuse: 0, checkpoint: 0 };

    // Garbage is ignored, and a seat nobody holds cannot be driven.

    command(carrier.id, { t: "i", mx: "left" as unknown as number, a: Number.NaN, u: "yes" });

    command("nobody", { t: "i", u: true });

    expect(carrier.input.use).toBe(false);

    command(carrier.id, { t: "i", u: true, mx: 0, my: 0 });

    advance(5);

    expect(state.spike.planted).toBe(true);

    expect(state.spike.site).toBe("B");

  } finally {

    for (const player of state.players) player.bot = true;

  }

});

test("the scoreboard is sent when it changes and left out when it has not", async () => {

  // Ten names, agents and tallies were almost half of every snapshot, thirty

  // times a second, for a table that changes a few times a round. A seat is

  // sent it the first time and again only when it differs.

  const { snapshotForSeat } = await import("./arena.ts");

  const state = match();

  const player = state.players[0]!;

  const seat = { playerId: player.id, token: "t", address: "198.51.100.200", send: () => {}, stickyCache: "" };

  const first = JSON.parse(snapshotForSeat(seat)) as { board?: unknown[]; last?: unknown };

  expect(first.board?.length).toBe(10);

  const second = JSON.parse(snapshotForSeat(seat)) as { board?: unknown[] };

  expect(second.board).toBeUndefined();

  // Something on the board moves — a kill — and it comes back with the next tick.

  player.kills += 1;

  const third = JSON.parse(snapshotForSeat(seat)) as { board?: { kills: number }[] };

  expect(third.board?.length).toBe(10);

  expect(third.board?.find((p) => (p as { id?: string }).id === player.id)?.kills).toBe(player.kills);

  // The full snapshot a socket is handed on open, and every test reads, is untouched.

  expect((JSON.parse(snapshot(player.id)) as { board: unknown[] }).board.length).toBe(10);

  // The bytes: the board is the bulk of what was going out.

  const withBoard = Buffer.byteLength(snapshot(player.id));

  const without = Buffer.byteLength(snapshotForSeat(seat));

  expect(without).toBeLessThan(withBoard * 0.7);

});

test("the match keeps running and is never parked", () => {

  const state = match();

  const before = state.now;

  advance(30);

  expect(state.now).toBeGreaterThan(before);

  expect(["buy", "live", "end", "over"]).toContain(state.phase);

});

test("the kit is public: every ability, its price and what it does", async () => {

  const response = await fetch(base + "/agents.json");

  expect(response.status).toBe(200);

  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");

  const body = (await response.json()) as { agents: { id: string; abilities: Record<string, { name: string; cost: number; text: string }> }[] };

  expect(body.agents.length).toBe(5);

  const veil = body.agents.find((a) => a.id === "veil")!;

  expect(veil.abilities.c.name).toBe("Cloudburst");

  expect(veil.abilities.c.cost).toBe(100);

  expect(veil.abilities.e.text).toContain("smoke");

  // The ultimate is never for sale, and no server-only state leaks out.

  expect(veil.abilities.x.cost).toBe(0);

  expect(JSON.stringify(body)).not.toContain("kind");

});

test("the page carries the first-run card and the prompt line", async () => {

  const body = await (await fetch(base + "/")).text();

  expect(body).toContain('id="help"');

  expect(body).toContain("How to play");

  expect(body).toContain('id="prompt"');

  // Every buy button says what it costs, so the panel is readable at a glance,

  // and the rows are labelled for somebody meeting the panel for the first

  // time: which of these is a gun, which is armour, which is an ability.

  expect(body).toContain('data-buy="vandal" data-cost="2900"');

  for (const label of ["agent", "gun", "armour", "abilities"]) expect(body).toContain(`<span class="lbl">${label}</span>`);

  expect(body).not.toContain("refused server-side");

  expect(body).toContain('id="viewtoggle"');

});

test("the first paint says who took the round while it is over", async () => {

  // Somebody arriving between rounds used to read "round over" and nothing

  // else; the outcome was in the log three lines down at eighty percent.

  const state = match();

  const was = { phase: state.phase, clock: state.clock, last: state.last };

  state.phase = "end";

  state.clock = 4;

  state.last = { round: state.round, winner: "blue", why: "Spike defused" };

  try {

    const body = await (await fetch(base + "/")).text();

    expect(body).toContain("round over — blue took it, spike defused");

  } finally {

    Object.assign(state, was);

  }

});

test("a stale socket closing does not evict a live reconnect's seat", async () => {

  // A reload opens the new socket before the old one's close event lands.

  // The old close must not turn a player who is still connected into a bot.

  const { attach, release } = await import("./arena.ts");

  const player = takeSeat("203.0.113.1", "reload-session", "Reload")!;

  attach("reload-session", player.id, "203.0.113.1", "first", () => {});

  attach("reload-session", player.id, "203.0.113.1", "second", () => {});

  release("reload-session", "first");

  expect(player.bot).toBe(false);

});

test("one session cannot claim two seats on opposite teams", () => {

  // A websocket upgrade finishes on a later tick than the request that asked

  // for it, so two requests for the same session used to both read the seat

  // map before either had written to it — one client, two seats, opposite

  // sides, the vision of both. Nothing here waits for a socket to open:

  // the claim has to land the moment a seat is handed out.

  const first = takeSeat("203.0.113.2", "cheat-session", "Cheat")!;

  const second = takeSeat("203.0.113.2", "cheat-session", "Cheat")!;

  expect(second.id).toBe(first.id);

  expect(match().players.filter((p) => !p.bot && p.name === "Cheat").length).toBe(1);

});

test("one address cannot hold seats on both sides through a second session", async () => {

  // Three GETs of "/" mint three different, equally legitimate-looking

  // cookies. A session names a browser tab, not a person, so capping by

  // session alone still lets one machine sit on both teams and read both

  // snapshots — every position on the map, no forged traffic required.

  const { addressCapped } = await import("./arena.ts");

  const first = takeSeat("198.51.100.9", "session-a", "OneMachine")!;

  expect(addressCapped("198.51.100.9", "session-b")).toBe(true);

  const second = takeSeat("198.51.100.9", "session-b", "OneMachine");

  expect(second).toBe(null);

  // The same session reconnecting is not a second claim, and is let through.

  expect(addressCapped("198.51.100.9", "session-a")).toBe(false);

  expect(takeSeat("198.51.100.9", "session-a", "OneMachine")!.id).toBe(first.id);

});

test("a real second connection from one address gets a spectator view, positions and all excluded", async () => {

  // The end-to-end path: two sockets from this test's own loopback address,

  // one cookie each. The second must come back with no seat and nothing in

  // its snapshot that carries a coordinate — score and clock, not a map.

  // This loopback address is shared with every other test that runs a real

  // request; start from a clean slate rather than trust none of them left it

  // holding a seat.

  releaseAddress("127.0.0.1");

  const first = await fetch(base + "/");

  const cookieOne = (first.headers.get("set-cookie") ?? "").split(";")[0] ?? "";

  const second = await fetch(base + "/");

  const cookieTwo = (second.headers.get("set-cookie") ?? "").split(";")[0] ?? "";

  expect(cookieOne).not.toBe(cookieTwo);

  const wsUrl = base.replace(/^http/, "ws") + "/ws";

  const wsOne = new WebSocket(wsUrl, { headers: { cookie: cookieOne } } as unknown as string[]);

  const snapOne = await new Promise<{ spectator?: boolean; me?: unknown }>((resolve, reject) => {

    wsOne.onmessage = (event) => resolve(JSON.parse(String(event.data)));

    wsOne.onerror = reject;

  });

  // The first connection from this address is the one that actually plays.

  expect(snapOne.spectator).toBeUndefined();

  expect(snapOne.me).toBeDefined();

  const wsTwo = new WebSocket(wsUrl, { headers: { cookie: cookieTwo } } as unknown as string[]);

  const snapTwo = await new Promise<unknown>((resolve, reject) => {

    wsTwo.onmessage = (event) => resolve(JSON.parse(String(event.data)));

    wsTwo.onerror = reject;

  });

  // It says why it has no seat, because the two reasons have different

  // answers, and it carries the kill feed — names and a gun, never a place.

  expect(snapTwo).toMatchObject({ t: "s", spectator: true, why: "address" });

  expect(Array.isArray((snapTwo as { feed?: unknown[] }).feed)).toBe(true);

  // No coordinate anywhere, not under "me", not under a different key either.

  expect(JSON.stringify(snapTwo)).not.toMatch(/"x"|"y"/);

  // And a connection carrying no session at all is told the other reason.

  const wsThree = new WebSocket(wsUrl);

  const snapThree = await new Promise<unknown>((resolve, reject) => {

    wsThree.onmessage = (event) => resolve(JSON.parse(String(event.data)));

    wsThree.onerror = reject;

  });

  expect(snapThree).toMatchObject({ spectator: true, why: "cookie" });

  wsOne.close();

  wsTwo.close();

  wsThree.close();

  await Bun.sleep(50);

});

test("two people who pick the same name do not end up with the same name", () => {

  // Everything that addresses a player — the kill feed, the round log, the

  // scoreboard — does it by name, so the match may never hold two of one.

  const first = takeSeat("198.51.100.10", "clash-a", "Twin")!;

  const second = takeSeat("198.51.100.11", "clash-b", "Twin")!;

  expect(first.name).toBe("Twin");

  expect(second.name).not.toBe("Twin");

  expect(second.name.startsWith("Twin")).toBe(true);

  expect(second.name.length).toBeLessThanOrEqual(16);

  const names = match().players.map((p) => p.name);

  expect(new Set(names).size).toBe(names.length);

});

test("an empty room freezes the world instead of playing on", async () => {

  const { match, beat, takeSeat, attach, release } = await import("./arena.ts");

  // Whatever else this file left attached, the rule is about the gate itself:

  // with nobody there a beat of real time changes nothing.

  const { attendance } = await import("./arena.ts");

  const start = attendance();

  const quiet = { now: match().now, round: match().round };

  if (start === 0) {

    for (let i = 0; i < 450; i += 1) beat();

    expect({ now: match().now, round: match().round }).toEqual(quiet);

  }

  // Somebody arrives and time starts again from where it stopped.

  const seat = takeSeat("198.51.100.77", "empty-room-session", "Guest");

  expect(seat).not.toBeNull();

  attach("empty-room-session", seat!.id, "198.51.100.77", "tok", () => {});

  const before = match().now;

  for (let i = 0; i < 30; i += 1) beat();

  expect(match().now).toBeGreaterThan(before);

  release("empty-room-session", "tok");

});

test("attendance counts seats and watchers, and nothing else", async () => {

  const { attendance, takeSeat, attach, release, watch, unwatch } = await import("./arena.ts");

  const base = attendance();

  const seat = takeSeat("198.51.100.78", "counted-session", "Guest");

  attach("counted-session", seat!.id, "198.51.100.78", "tok2", () => {});

  expect(attendance()).toBe(base + 1);

  watch("watcher-token", () => {});

  expect(attendance()).toBe(base + 2);

  unwatch("watcher-token");

  release("counted-session", "tok2");

  expect(attendance()).toBe(base);

});