feat: account system, OIDC, meta-progression research tree, and automated tests

Account & Persistence Layer (server/db.mjs) - SQLite via node:sqlite DatabaseSync with WAL mode, foreign keys, and synchronous=NORMAL for microsecond response times - Users table: UUID primary key, unique lowercase username, scrypt-hashed password, optional OIDC sub/issuer, crystal balance, timestamps - Sessions table: 64-byte random hex token, FK to users, configurable TTL with automatic expiry cleanup every 10 minutes - User upgrades table: composite PK (user_id, upgrade_id), level tracking, ON CONFLICT DO UPDATE for idempotent merges - User stats table: games played/won, total kills/score, highest wave - Password hashing: crypto.scrypt with 16-byte salt and 64-byte derived key, constant-time comparison via crypto.timingSafeEqual - Guest merge: caps crystals at 100,000, caps levels to defined maxLevels, uses MAX(level, new) to preserve higher account levels, ignores unknown upgrade IDs, transactional with BEGIN IMMEDIATE/COMMIT/ROLLBACK - Atomic crystal purchasing: subtracts cost only if balance sufficient, upgrades level within transaction, returns full user object on success Meta-Progression Definitions (shared/meta-upgrades.mjs) - Single source of truth shared between server (authoritative validation) and client (talent tree UI) - 3 branches: Economy (start_gold, wave_bonus, obstacle_discount), Defense (bonus_lives, shockwave, fortress_shield), Towers (tower_range, tower_speed, dot_potency) - 9 upgrades with 1–5 levels each, progressive cost curves - calcCrystalsEarned(wave, score, win): base 2.5 per wave, +40 for victory, +floor(score/250), minimum 1 crystal per game REST API (server/server.mjs) - /api/auth/register: username 3–16 chars a-z0-9_-; password min 8 chars; case-insensitive uniqueness; auto-creates user_stats row; returns session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS) - /api/auth/login: constant-time username lookup via scrypt verify; rate-limited 20 auth attempts/IP/minute - /api/auth/logout: deletes session server-side, clears cookie - /api/auth/me: returns publicUser (id, username, crystals, upgrades, stats, oidc flag) or null - /api/auth/oidc/login: PKCE Authorization Code flow with SHA-256 S256 challenge/verifier; discovers .well-known/openid-configuration; verifies RS256 id_token signature via JWKS public key; validates issuer, audience, and expiry; finds or creates user by OIDC sub/issuer - /api/auth/oidc/callback: exchanges code for tokens, verifies id_token, issues session cookie, redirects to /?auth=ok or /?auth=error - /api/upgrades/buy: validates upgrade ID against META_UPGRADES, checks current level < maxLevel, deducts cost from crystals - /api/game/finish: server-authoritative crystal calculation; bounds-checks inputs (wave ≤ 9999, score ≤ 10M, kills ≤ 1M); updates user_stats (games_played, games_won, total_kills, total_score, highest_wave via MAX) - /api/auth/merge-guest: one-time guest-to-account crystal and upgrade migration with level caps - /api/config: public endpoint exposing OIDC enabled state and button label - Security: CSP header on all responses, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer, cache-control no-store on API responses, path-traversal protection on static serving Multiplayer Fairness - Meta-upgrades (start_gold, bonus_lives, tower_range, tower_speed, dot_potency, wave_bonus, obstacle_discount, shockwave, fortress_shield) applied only in solo campaign mode - Co-op and Duel multiplayer sessions reset all meta buffs to zero, preserving lockstep determinism and competitive balance - Multiplayer results set crystalsEarned: 0 to prevent duplicate rewards Frontend (Vue 3 + TypeScript) - AuthModal.vue: username/password login and registration form with validation, OIDC single sign-on button (shown when configured), guest-to-account upgrade on first login - UserProfileBar.vue: top-bar indicator showing crystal count (💎), user display name, research and login/logout buttons, reactive auth state via auth controller - ResearchTree.vue: interactive talent tree modal with 3 branches, per-upgrade cost/level display, purchase confirmation, disabled state for unaffordable/maxed upgrades, branch icons and descriptions - auth.ts: reactive controller managing login, registration, OIDC redirect detection (?auth=ok/?auth=error), guest profile migration on first login, upgrade purchasing, and game result reporting - meta.ts: frontend helpers for branch definitions, upgrade costs, and guest profile persistence in localStorage - engine.ts: solo meta bonus application (start_gold, bonus_lives, tower_range, tower_speed, dot_potency, wave_bonus, obstacle_discount, shockwave, fortress_shield); crystal rewards in finish() path - mpgame.ts: meta buff reset in multiplayer sessions; crystalsEarned: 0 - sound.ts: shield sound synthesis for fortress_shield absorption - store.ts: auth state, research tree toggle, upgrade snapshot - types.ts: SfxName extended with "shield" sound Docker Configuration - Multi-stage build: node:22-alpine build → node:22-alpine runtime (production deps only: ws) - VOLUME /app/data for persistent SQLite database - HEALTHCHECK on /health endpoint - docker-compose.yml: port 3001, persistent ./data volume, commented OIDC environment variables (OIDC_ENABLED, OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_REDIRECT_URI, OIDC_BUTTON_LABEL) - .gitignore: data/, *.db, *.db-journal, *.db-wal, *.db-shm Automated Tests (npm test) - scripts/test-db.mjs (17 unit tests): isolated SQLite persistence – scrypt hash/verify roundtrip, timing-safe constant-time comparison, user creation with lowercase enforcement, UNIQUE constraint, session create/get/delete lifecycle, expired session invalidation, crystal addition, 5-level upgrade cost progression with max-level guard, guest merge (crystal cap 100k, level cap, MAX() semantics, unknown upgrade rejection), game result stats accumulation, calcCrystalsEarned formula verification - scripts/test-auth.mjs (31 integration tests): spawns real server with isolated DATA_DIR, exercises full REST flow – register validation (username too short, password too short, duplicate, case-insensitive), login (wrong password, correct), session cookie attributes (HttpOnly, SameSite=Lax, Path=/), /me endpoint, upgrade purchase (insufficient crystals, unknown ID, successful purchase), game finish rewards (victory, defeat, negative values clamped to 1 crystal minimum), guest merge (crystals, level caps, unknown upgrades), logout, OIDC-disabled endpoints (400), unauthenticated guards (401), 404 routing, CSP header on static files, rate limiting (429 after 20+ auth attempts per minute), and persistence across server restart (kill + respawn with same DATA_DIR preserves all state)
2026-08-16 16:22:38 +02:00 · 2026-08-16 16:22:38 +02:00 · 1a9ac5bf45
commit 1a9ac5bf45
parent ce2484bb8d
24 changed files with 2216 additions and 12 deletions
--- a/server/server.mjs
+++ b/server/server.mjs
@ -16,8 +16,25 @@
 import http from 'node:http'
 import { promises as fs } from 'node:fs'
 import path from 'node:path'
+import crypto from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { WebSocketServer } from 'ws'
+import {
+  buyUpgrade,
+  cleanExpiredSessions,
+  createSession,
+  createUserLocal,
+  deleteSession,
+  findOrCreateUserOidc,
+  getSession,
+  getUserById,
+  getUserByUsername,
+  hashPassword,
+  mergeGuest,
+  recordGameResult,
+  verifyPassword,
+} from './db.mjs'
+import { META_UPGRADES, calcCrystalsEarned } from '../shared/meta-upgrades.mjs'

 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const DIST_DIR = process.env.DIST_DIR || path.join(__dirname, '..', 'dist')
@ -30,6 +47,31 @@ const MAX_WS_TOTAL = 500 // total concurrent websocket connections
 const MAX_WS_PER_IP = 20 // concurrent websocket connections per client IP
 const MAX_ROOMS = 300 // concurrent rooms

+// ------------------------------------------------------------------ accounts & OIDC config
+
+const SESSION_COOKIE = 'trxtd_session'
+const OIDC = {
+  enabled: String(process.env.OIDC_ENABLED || 'false').toLowerCase() === 'true',
+  issuer: String(process.env.OIDC_ISSUER || '').replace(/\/$/, ''),
+  clientId: String(process.env.OIDC_CLIENT_ID || ''),
+  clientSecret: String(process.env.OIDC_CLIENT_SECRET || ''),
+  redirectUri: String(process.env.OIDC_REDIRECT_URI || ''),
+  buttonLabel: String(process.env.OIDC_BUTTON_LABEL || 'Mit Single Sign-On anmelden'),
+}
+/** pending OIDC authorization attempts (state -> pkce verifier), short-lived */
+const oidcPending = new Map()
+let oidcDiscovery = null
+let oidcDiscoveryAt = 0
+
+// periodic session & oidc-state cleanup
+setInterval(() => {
+  cleanExpiredSessions()
+  const now = Date.now()
+  for (const [state, entry] of oidcPending.entries()) {
+    if (now - entry.createdAt > 10 * 60 * 1000) oidcPending.delete(state)
+  }
+}, 10 * 60 * 1000).unref()
+
 const CSP =
  "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; " +
  "img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; " +
@ -88,6 +130,316 @@ function originAllowed(req) {
  return false
 }

+// ------------------------------------------------------------------ auth helpers
+
+function parseCookies(req) {
+  const out = {}
+  const header = req.headers.cookie
+  if (!header) return out
+  for (const part of header.split(';')) {
+    const idx = part.indexOf('=')
+    if (idx === -1) continue
+    out[part.slice(0, idx).trim()] = decodeURIComponent(part.slice(idx + 1).trim())
+  }
+  return out
+}
+
+function sessionTokenFromReq(req) {
+  return parseCookies(req)[SESSION_COOKIE] || null
+}
+
+function setSessionCookie(res, token, expiresAt, req) {
+  const proto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim()
+  const secure = proto === 'https' || (req.socket?.encrypted ?? false)
+  const sameSite = 'Lax'
+  res.setHeader(
+    'Set-Cookie',
+    `${SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=${sameSite}${secure ? '; Secure' : ''}; Expires=${new Date(expiresAt).toUTCString()}`,
+  )
+}
+
+function clearSessionCookie(res) {
+  res.setHeader('Set-Cookie', `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`)
+}
+
+function json(res, status, obj) {
+  const body = JSON.stringify(obj)
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  })
+  res.end(body)
+}
+
+function readJsonBody(req, maxBytes = 8192) {
+  return new Promise((resolve, reject) => {
+    let size = 0
+    const chunks = []
+    req.on('data', (c) => {
+      size += c.length
+      if (size > maxBytes) {
+        reject(new Error('body too large'))
+        req.destroy()
+        return
+      }
+      chunks.push(c)
+    })
+    req.on('end', () => {
+      try {
+        resolve(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}'))
+      } catch {
+        reject(new Error('invalid json'))
+      }
+    })
+    req.on('error', reject)
+  })
+}
+
+function publicUser(user) {
+  if (!user) return null
+  return {
+    id: user.id,
+    username: user.username,
+    displayName: user.display_name,
+    crystals: user.crystals,
+    upgrades: user.upgrades,
+    stats: user.stats,
+    oidc: Boolean(user.oidc_sub),
+  }
+}
+
+// simple per-IP rate limit for auth endpoints
+const authBuckets = new Map()
+function authRateLimited(ip) {
+  const now = Date.now()
+  const b = authBuckets.get(ip)
+  if (!b || now > b.resetAt) {
+    authBuckets.set(ip, { count: 1, resetAt: now + 60000 })
+    return false
+  }
+  b.count++
+  return b.count > 20 // 20 auth attempts per minute per IP
+}
+
+// ------------------------------------------------------------------ OIDC
+
+function base64urlDecode(s) {
+  return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64')
+}
+
+async function fetchJson(url) {
+  const res = await fetch(url, { headers: { Accept: 'application/json' } })
+  if (!res.ok) throw new Error(`fetch ${url} -> ${res.status}`)
+  return res.json()
+}
+
+async function oidcDiscover() {
+  const now = Date.now()
+  if (oidcDiscovery && now - oidcDiscoveryAt < 10 * 60 * 1000) return oidcDiscovery
+  const d = await fetchJson(`${OIDC.issuer}/.well-known/openid-configuration`)
+  if (!d.authorization_endpoint || !d.token_endpoint) throw new Error('invalid OIDC discovery')
+  oidcDiscovery = d
+  oidcDiscoveryAt = now
+  return d
+}
+
+async function verifyIdToken(idToken, discovery) {
+  const parts = idToken.split('.')
+  if (parts.length !== 3) throw new Error('malformed id_token')
+  const [h, p, sig] = parts
+  const header = JSON.parse(base64urlDecode(h).toString('utf8'))
+  const payload = JSON.parse(base64urlDecode(p).toString('utf8'))
+  if (header.alg !== 'RS256') throw new Error('unsupported id_token alg')
+  const jwks = await fetchJson(discovery.jwks_uri)
+  const jwk = jwks.keys.find((k) => k.kid === header.kid) || jwks.keys[0]
+  if (!jwk) throw new Error('no matching JWKS key')
+  const publicKey = crypto.createPublicKey({ key: jwk, format: 'jwk' })
+  const ok = crypto.verify('RSA-SHA256', Buffer.from(`${h}.${p}`), publicKey, base64urlDecode(sig))
+  if (!ok) throw new Error('id_token signature invalid')
+  if (payload.iss !== OIDC.issuer && payload.iss !== discovery.issuer) throw new Error('issuer mismatch')
+  const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud]
+  if (!aud.includes(OIDC.clientId)) throw new Error('audience mismatch')
+  if (payload.exp && payload.exp * 1000 < Date.now()) throw new Error('id_token expired')
+  return payload
+}
+
+// ------------------------------------------------------------------ REST API
+
+async function handleApi(req, res, url) {
+  const ip = clientIp(req)
+  const p = url.pathname
+
+  // --- public config (does OIDC exist?) ---
+  if (p === '/api/config' && req.method === 'GET') {
+    return json(res, 200, {
+      oidcEnabled: OIDC.enabled,
+      oidcLabel: OIDC.buttonLabel,
+    })
+  }
+
+  // --- current session ---
+  if (p === '/api/auth/me' && req.method === 'GET') {
+    const sess = getSession(sessionTokenFromReq(req))
+    if (!sess) return json(res, 200, { user: null })
+    return json(res, 200, { user: publicUser(getUserById(sess.user_id)) })
+  }
+
+  // --- logout ---
+  if (p === '/api/auth/logout' && req.method === 'POST') {
+    deleteSession(sessionTokenFromReq(req))
+    clearSessionCookie(res)
+    return json(res, 200, { ok: true })
+  }
+
+  // --- register (local) ---
+  if (p === '/api/auth/register' && req.method === 'POST') {
+    if (authRateLimited(ip)) return json(res, 429, { error: 'Zu viele Versuche. Bitte warte kurz.' })
+    const body = await readJsonBody(req).catch(() => null)
+    if (!body) return json(res, 400, { error: 'Ungültige Eingabe.' })
+    const username = String(body.username || '').trim().toLowerCase()
+    const password = String(body.password || '')
+    const displayName = String(body.displayName || username).trim().slice(0, 24) || username
+    if (!/^[a-z0-9_-]{3,16}$/.test(username)) return json(res, 400, { error: 'Benutzername: 3–16 Zeichen (a–z, 0–9, _ -).' })
+    if (password.length < 8) return json(res, 400, { error: 'Passwort: mindestens 8 Zeichen.' })
+    if (getUserByUsername(username)) return json(res, 409, { error: 'Benutzername bereits vergeben.' })
+    const hash = await hashPassword(password)
+    const user = createUserLocal(username, displayName, hash)
+    const sess = createSession(user.id)
+    setSessionCookie(res, sess.token, sess.expiresAt, req)
+    return json(res, 200, { user: publicUser(user) })
+  }
+
+  // --- login (local) ---
+  if (p === '/api/auth/login' && req.method === 'POST') {
+    if (authRateLimited(ip)) return json(res, 429, { error: 'Zu viele Versuche. Bitte warte kurz.' })
+    const body = await readJsonBody(req).catch(() => null)
+    if (!body) return json(res, 400, { error: 'Ungültige Eingabe.' })
+    const username = String(body.username || '').trim().toLowerCase()
+    const password = String(body.password || '')
+    const row = getUserByUsername(username)
+    if (!row || !row.password_hash) return json(res, 401, { error: 'Benutzername oder Passwort falsch.' })
+    const ok = await verifyPassword(password, row.password_hash)
+    if (!ok) return json(res, 401, { error: 'Benutzername oder Passwort falsch.' })
+    const user = getUserById(row.id)
+    const sess = createSession(user.id)
+    setSessionCookie(res, sess.token, sess.expiresAt, req)
+    return json(res, 200, { user: publicUser(user) })
+  }
+
+  // --- OIDC: start login ---
+  if (p === '/api/auth/oidc/login' && req.method === 'GET') {
+    if (!OIDC.enabled) return json(res, 400, { error: 'OIDC ist nicht aktiviert.' })
+    try {
+      const d = await oidcDiscover()
+      const state = crypto.randomBytes(16).toString('hex')
+      const verifier = crypto.randomBytes(32).toString('base64url')
+      const challenge = crypto.createHash('sha256').update(verifier).digest('base64url')
+      oidcPending.set(state, { verifier, createdAt: Date.now() })
+      const q = new URLSearchParams({
+        response_type: 'code',
+        client_id: OIDC.clientId,
+        redirect_uri: OIDC.redirectUri,
+        scope: 'openid profile email',
+        state,
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+      })
+      res.writeHead(302, { Location: `${d.authorization_endpoint}?${q.toString()}` })
+      return res.end()
+    } catch (e) {
+      return json(res, 502, { error: 'OIDC-Provider nicht erreichbar.' })
+    }
+  }
+
+  // --- OIDC: callback ---
+  if (p === '/api/auth/oidc/callback' && req.method === 'GET') {
+    if (!OIDC.enabled) return json(res, 400, { error: 'OIDC ist nicht aktiviert.' })
+    const code = url.searchParams.get('code')
+    const state = url.searchParams.get('state')
+    const pending = state ? oidcPending.get(state) : null
+    if (!code || !pending) {
+      res.writeHead(302, { Location: '/?auth=error' })
+      return res.end()
+    }
+    oidcPending.delete(state)
+    try {
+      const d = await oidcDiscover()
+      const tokenRes = await fetch(d.token_endpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+          grant_type: 'authorization_code',
+          code,
+          redirect_uri: OIDC.redirectUri,
+          client_id: OIDC.clientId,
+          client_secret: OIDC.clientSecret,
+          code_verifier: pending.verifier,
+        }).toString(),
+      })
+      if (!tokenRes.ok) throw new Error('token exchange failed')
+      const tokens = await tokenRes.json()
+      const payload = await verifyIdToken(tokens.id_token, d)
+      const user = findOrCreateUserOidc(
+        String(payload.sub),
+        OIDC.issuer,
+        String(payload.preferred_username || payload.email || ''),
+        String(payload.name || payload.preferred_username || ''),
+      )
+      const sess = createSession(user.id)
+      setSessionCookie(res, sess.token, sess.expiresAt, req)
+      res.writeHead(302, { Location: '/?auth=ok' })
+      return res.end()
+    } catch {
+      res.writeHead(302, { Location: '/?auth=error' })
+      return res.end()
+    }
+  }
+
+  // --- authenticated endpoints below ---
+  const sess = getSession(sessionTokenFromReq(req))
+  if (!sess) return json(res, 401, { error: 'Nicht angemeldet.' })
+  const user = getUserById(sess.user_id)
+  if (!user) return json(res, 401, { error: 'Nicht angemeldet.' })
+
+  // --- buy meta upgrade ---
+  if (p === '/api/upgrades/buy' && req.method === 'POST') {
+    const body = await readJsonBody(req).catch(() => null)
+    const upgradeId = String(body?.upgradeId || '')
+    const def = META_UPGRADES[upgradeId]
+    if (!def) return json(res, 400, { error: 'Unbekanntes Upgrade.' })
+    const current = user.upgrades[upgradeId] || 0
+    if (current >= def.maxLevel) return json(res, 400, { error: 'Bereits auf Maximalstufe.' })
+    const cost = def.costs[current]
+    const result = buyUpgrade(user.id, upgradeId, cost, def.maxLevel)
+    if (!result.ok) return json(res, 400, { error: result.error })
+    return json(res, 200, { user: publicUser(result.user) })
+  }
+
+  // --- merge local guest progress into the account (one-time) ---
+  if (p === '/api/auth/merge-guest' && req.method === 'POST') {
+    const body = await readJsonBody(req).catch(() => null)
+    const maxLevels = {}
+    for (const [id, def] of Object.entries(META_UPGRADES)) maxLevels[id] = def.maxLevel
+    const updated = mergeGuest(user.id, body?.crystals, body?.upgrades, maxLevels)
+    return json(res, 200, { user: publicUser(updated) })
+  }
+
+  // --- record finished game & grant crystals (server-authoritative) ---
+  if (p === '/api/game/finish' && req.method === 'POST') {
+    const body = await readJsonBody(req).catch(() => null)
+    const win = Boolean(body?.win)
+    const wave = Math.max(0, Math.min(9999, Number(body?.wave) || 0))
+    const score = Math.max(0, Math.min(10_000_000, Number(body?.score) || 0))
+    const kills = Math.max(0, Math.min(1_000_000, Number(body?.kills) || 0))
+    const crystals = calcCrystalsEarned(wave, score, win)
+    const updated = recordGameResult(user.id, { win, score, wave, kills, crystalsEarned: crystals })
+    return json(res, 200, { user: publicUser(updated), crystalsEarned: crystals })
+  }
+
+  return json(res, 404, { error: 'Nicht gefunden.' })
+}
+
 // ------------------------------------------------------------------ static files

 const MIME = {
@ -171,6 +523,14 @@ async function serveStatic(req, res) {
 }

 const httpServer = http.createServer((req, res) => {
+  const url = new URL(req.url, 'http://localhost')
+  if (url.pathname.startsWith('/api/')) {
+    handleApi(req, res, url).catch(() => {
+      if (!res.headersSent) res.writeHead(500)
+      res.end('Internal Server Error')
+    })
+    return
+  }
  serveStatic(req, res).catch(() => {
    if (!res.headersSent) res.writeHead(500)
    res.end('Internal Server Error')