268 lines
12 KiB
TypeScript
268 lines
12 KiB
TypeScript
import { afterEach, beforeEach, expect, it, vi } from 'vitest';
|
|
import { newFixture, type Fixture } from '../helpers/fixture.js';
|
|
import { routePermission } from '../../src/lib/server/auth/access.js';
|
|
|
|
let fixture: Fixture;
|
|
const server = 't5_zombie_theater_1';
|
|
const other = 't6_zm_transit_1';
|
|
const secret = 'ec_bank_' + 'a'.repeat(40);
|
|
const otherSecret = 'ec_bank_' + 'b'.repeat(40);
|
|
let serial = 0;
|
|
|
|
beforeEach(async () => {
|
|
vi.resetModules();
|
|
fixture = await newFixture([server, other]);
|
|
vi.stubEnv('EC_BANK_TOKENS', JSON.stringify({ [server]: secret, [other]: otherSecret }));
|
|
vi.stubEnv('EC_TELEMETRY_TOKEN', 'telemetry_' + 't'.repeat(40));
|
|
vi.stubEnv('EC_BANK_MAX_BALANCE', '250000');
|
|
const { seedServerRegistry } = await import('../../src/lib/server/fleet/servers.js');
|
|
const { saveTelemetry } = await import('../../src/lib/server/fleet/telemetry.js');
|
|
await seedServerRegistry();
|
|
for (const source of [server, other]) {
|
|
saveTelemetry({
|
|
server: source,
|
|
map: source === server ? 'zombie_theater' : 'zm_transit',
|
|
match: 'match-one',
|
|
seq: 1,
|
|
event: 'game_start',
|
|
players: [{ guid: 'ace', name: 'Ace' }],
|
|
receivedAt: new Date().toISOString()
|
|
});
|
|
}
|
|
});
|
|
afterEach(async () => {
|
|
await fixture.cleanup();
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
const transfer = (operation = 'deposit', amount: number | string = 2000, source = server) => ({
|
|
server: source,
|
|
guid: 'ace',
|
|
match: 'match-one',
|
|
request_id: `request-${++serial}`,
|
|
operation,
|
|
amount,
|
|
capacity: 1000000
|
|
});
|
|
async function post(action: string, body: unknown, credential = secret) {
|
|
const { POST } = await import('../../src/routes/api/bank/[action]/+server.js');
|
|
const response = await POST({
|
|
params: { action },
|
|
request: new Request(`https://example.test/api/bank/${action}`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${credential}` },
|
|
body: JSON.stringify(body)
|
|
})
|
|
});
|
|
expect(response.headers.get('cache-control')).toBe('no-store');
|
|
return { status: response.status, ...(await response.json()) };
|
|
}
|
|
async function fund(amount = 2000) {
|
|
const data = transfer('deposit', amount);
|
|
expect(await post('deposit', data)).toMatchObject({ state: 'prepared', amount });
|
|
expect(await post('commit', data)).toMatchObject({ state: 'committed', balance: amount });
|
|
return data;
|
|
}
|
|
|
|
it('routes only bank POSTs as machine requests, authenticating before reading bodies', async () => {
|
|
expect(routePermission('/api/bank/[action]', 'POST')).toBe('machine');
|
|
expect(routePermission('/api/bank/[action]', 'GET')).toBe('viewer');
|
|
const { POST } = await import('../../src/routes/api/bank/[action]/+server.js');
|
|
for (const credential of ['', process.env.EC_TELEMETRY_TOKEN!, otherSecret]) {
|
|
const request = new Request('https://test/api/bank/deposit', {
|
|
method: 'POST',
|
|
headers: { Authorization: `Bearer ${credential}` },
|
|
body: 'invalid JSON'
|
|
});
|
|
if (credential === otherSecret) continue;
|
|
expect((await POST({ request, params: { action: 'deposit' } })).status).toBe(401);
|
|
expect(request.bodyUsed).toBe(false);
|
|
}
|
|
expect(await post('deposit', transfer(), otherSecret)).toMatchObject({
|
|
status: 403,
|
|
code: 'wrong_server'
|
|
});
|
|
});
|
|
|
|
it('fails closed for missing, duplicate, telemetry-reused and invalid credentials', async () => {
|
|
for (const configured of [
|
|
'',
|
|
'{}',
|
|
'[]',
|
|
'{',
|
|
JSON.stringify({ [server]: secret, [other]: secret }),
|
|
JSON.stringify({ [server]: 'short' })
|
|
]) {
|
|
vi.stubEnv('EC_BANK_TOKENS', configured);
|
|
expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ status: 503 });
|
|
}
|
|
vi.stubEnv('EC_BANK_TOKENS', JSON.stringify({ [server]: secret }));
|
|
vi.stubEnv('EC_TELEMETRY_TOKEN', secret);
|
|
expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ status: 503 });
|
|
});
|
|
|
|
it('persists one credit and one ledger row through lost replies, retries and database reopen', async () => {
|
|
const data = transfer();
|
|
const initial = await post('deposit', data);
|
|
expect(await post('deposit', data)).toEqual(initial);
|
|
const first = await post('commit', data);
|
|
const { closeDb, db } = await import('../../src/lib/server/db/index.js');
|
|
closeDb();
|
|
expect(await post('commit', data)).toEqual(first);
|
|
expect(await post('deposit', data)).toEqual(first);
|
|
expect(db().prepare('SELECT amount,balance FROM bank_ledger').all()).toEqual([
|
|
{ amount: 2000, balance: 2000 }
|
|
]);
|
|
expect(await post('deposit', { ...data, amount: 1 })).toMatchObject({
|
|
status: 409,
|
|
code: 'request_conflict'
|
|
});
|
|
});
|
|
|
|
it('shares one GUID balance across games and preserves GUID strings', async () => {
|
|
await fund();
|
|
expect(await post('balance', { server: other, guid: 'ace' }, otherSecret)).toMatchObject({
|
|
balance: 2000
|
|
});
|
|
const data = transfer('withdraw', 'all', other);
|
|
expect(await post('withdraw', data, otherSecret)).toMatchObject({
|
|
state: 'prepared',
|
|
amount: 2000
|
|
});
|
|
expect(await post('commit', data, otherSecret)).toMatchObject({
|
|
balance: 0,
|
|
state: 'committed'
|
|
});
|
|
const big = { ...transfer(), guid: '18446744073709551615' };
|
|
expect(await post('deposit', big)).toMatchObject({ code: 'not_in_match' });
|
|
});
|
|
|
|
it('rejects overdraws, maximum overflow, invalid amounts and point overflow without a ledger change', async () => {
|
|
await fund();
|
|
for (const [operation, amount, code] of [
|
|
['withdraw', 2001, 'insufficient_balance'],
|
|
['deposit', 250000, 'bank_limit']
|
|
] as const) {
|
|
const data = transfer(operation, amount);
|
|
const denied = await post(operation, data);
|
|
expect(denied).toMatchObject({ ok: false, state: 'rejected', code });
|
|
expect(await post(operation, data)).toEqual(denied);
|
|
}
|
|
expect(await post('withdraw', { ...transfer('withdraw', 'all'), capacity: 100 })).toMatchObject(
|
|
{ code: 'points_limit' }
|
|
);
|
|
for (const amount of [0, -1, 1.5, 1000001, '2000', 'all', null]) {
|
|
expect(await post('deposit', { ...transfer(), amount })).toMatchObject({ status: 400 });
|
|
}
|
|
const { bankProfile } = await import('../../src/lib/server/fleet/bank.js');
|
|
expect(bankProfile('ace')).toMatchObject({ balance: 2000, pending: false });
|
|
expect(bankProfile('ace').entries).toHaveLength(1);
|
|
});
|
|
|
|
it('requires a present player in the exact current active match', async () => {
|
|
expect(await post('deposit', { ...transfer(), guid: 'outsider' })).toMatchObject({
|
|
code: 'not_in_match'
|
|
});
|
|
expect(await post('deposit', { ...transfer(), match: 'old-match' })).toMatchObject({
|
|
code: 'not_in_match'
|
|
});
|
|
const { db } = await import('../../src/lib/server/db/index.js');
|
|
db().prepare('UPDATE leaderboard_match_players SET present = 0').run();
|
|
expect(await post('deposit', transfer())).toMatchObject({ code: 'not_in_match' });
|
|
db().prepare('UPDATE leaderboard_match_players SET present = 1').run();
|
|
db().prepare("UPDATE leaderboard_matches SET status = 'completed'").run();
|
|
expect(await post('deposit', transfer())).toMatchObject({ code: 'not_in_match' });
|
|
});
|
|
|
|
it('cancels uncertain prepares, including cancellation arriving before the prepare', async () => {
|
|
await fund();
|
|
for (const cancelFirst of [false, true]) {
|
|
const data = transfer('withdraw', 500);
|
|
if (!cancelFirst) expect(await post('withdraw', data)).toMatchObject({ state: 'prepared' });
|
|
const cancelled = await post('cancel', data);
|
|
expect(cancelled).toMatchObject({ state: 'cancelled' });
|
|
expect(await post('cancel', data)).toEqual(cancelled);
|
|
expect(await post('withdraw', data)).toEqual(cancelled);
|
|
expect(await post('commit', data)).toEqual(cancelled);
|
|
}
|
|
const { bankProfile } = await import('../../src/lib/server/fleet/bank.js');
|
|
expect(bankProfile('ace')).toMatchObject({ balance: 2000, available: 2000, pending: false });
|
|
expect(bankProfile('ace').entries).toHaveLength(1);
|
|
});
|
|
|
|
it('serializes transfers across servers and reserves available funds until settled', async () => {
|
|
await fund();
|
|
const data = transfer('withdraw', 1500);
|
|
await post('withdraw', data);
|
|
expect(await post('balance', { server, guid: 'ace' })).toMatchObject({
|
|
balance: 2000,
|
|
amount: 500,
|
|
code: 'pending'
|
|
});
|
|
expect(await post('withdraw', transfer('withdraw', 1000, other), otherSecret)).toMatchObject({
|
|
code: 'pending'
|
|
});
|
|
await post('commit', data);
|
|
expect(await post('balance', { server, guid: 'ace' })).toMatchObject({
|
|
balance: 500,
|
|
amount: 500
|
|
});
|
|
});
|
|
|
|
it('honors prepared deposits after configuration changes and match/server deletion', async () => {
|
|
const data = transfer();
|
|
await post('deposit', data);
|
|
vi.stubEnv('EC_BANK_MAX_BALANCE', '100');
|
|
const { db } = await import('../../src/lib/server/db/index.js');
|
|
db().prepare('DELETE FROM leaderboard_matches').run();
|
|
db().prepare('DELETE FROM servers').run();
|
|
expect(await post('commit', data)).toMatchObject({ state: 'committed', balance: 2000 });
|
|
const { bankProfile } = await import('../../src/lib/server/fleet/bank.js');
|
|
expect(bankProfile('ace').entries[0]).toMatchObject({
|
|
amount: 2000,
|
|
matchAvailable: 0,
|
|
server
|
|
});
|
|
expect(await post('deposit', transfer())).toMatchObject({ code: 'not_in_match' });
|
|
expect(await post('cancel', data)).toMatchObject({ state: 'committed' });
|
|
});
|
|
|
|
it('rolls back all writes if the ledger cannot be saved', async () => {
|
|
const data = transfer();
|
|
await post('deposit', data);
|
|
const { db } = await import('../../src/lib/server/db/index.js');
|
|
db().exec(
|
|
"CREATE TRIGGER reject_bank BEFORE INSERT ON bank_ledger BEGIN SELECT RAISE(ABORT,'test'); END"
|
|
);
|
|
expect(await post('commit', data)).toMatchObject({ status: 503 });
|
|
const { bankProfile } = await import('../../src/lib/server/fleet/bank.js');
|
|
expect(bankProfile('ace')).toMatchObject({ balance: 0, pending: true, entries: [] });
|
|
db().exec('DROP TRIGGER reject_bank');
|
|
expect(await post('commit', data)).toMatchObject({ balance: 2000 });
|
|
});
|
|
|
|
it('returns the original settled result after later transfers change the account', async () => {
|
|
const deposited = await fund();
|
|
const withdrawal = transfer('withdraw', 500);
|
|
await post('withdraw', withdrawal);
|
|
expect(await post('commit', withdrawal)).toMatchObject({ balance: 1500 });
|
|
expect(await post('commit', deposited)).toMatchObject({ balance: 2000 });
|
|
expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ balance: 1500 });
|
|
});
|
|
|
|
it('concurrent preparations cannot reserve the same funds twice', async () => {
|
|
await fund();
|
|
const first = transfer('withdraw', 2000);
|
|
const second = transfer('withdraw', 2000, other);
|
|
const results = await Promise.all([
|
|
post('withdraw', first),
|
|
post('withdraw', second, otherSecret)
|
|
]);
|
|
expect(results.filter((result) => result.state === 'prepared')).toHaveLength(1);
|
|
expect(results.filter((result) => result.code === 'pending')).toHaveLength(1);
|
|
const index = results.findIndex((result) => result.state === 'prepared');
|
|
expect(
|
|
await post('commit', index === 0 ? first : second, index === 0 ? secret : otherSecret)
|
|
).toMatchObject({ balance: 0 });
|
|
});
|