Tronax
31cb594cb0
Research tree UI: - The level pips shared the header row with the upgrade name and fought for width; long names like "Festungsmauern" (5 pips) pushed the pips out of the upgrade card. Pips now sit in the bottom row next to the buy button (space-between), where width is plentiful, and carry a "level / max" tooltip - Tighter modal padding on phones (max-width 560px), scrollable at 92vh PWA (installable as app in mobile browsers): - public/manifest.webmanifest: standalone display, any orientation, TRXTD theme colors, German lang, start_url "/" - public/sw.js: network-first service worker with runtime caching. index.html is always fetched fresh so new deploys are picked up immediately; the cache only serves as offline fallback. API calls and cross-origin requests are never intercepted - Icon set generated by scripts/generate-icons.mjs (pure Node PNG encoder, zero image dependencies): gold tower on the game-themed dark gradient in 192px, 512px, maskable 512px (motif inside the safe zone) and 180px apple-touch-icon - index.html: manifest link, favicon, apple-touch-icon, theme-color, mobile-web-app-capable, apple-mobile-web-app meta tags - src/main.ts: service worker registration in production builds only (dev HMR stays untouched) - server.mjs: serve .webmanifest as application/manifest+json (Chrome requires the correct MIME type for installability) Verified against the production server: manifest (application/ manifest+json), icons (image/png) and sw.js (text/javascript) respond with 200, index.html references all PWA tags; npm test 48/48 green.
830 lines
28 KiB
JavaScript
830 lines
28 KiB
JavaScript
/**
|
||
* TRXTD game server: static frontend (dist/) + multiplayer WebSocket relay.
|
||
* Single port for everything – ideal for Docker deployments.
|
||
*
|
||
* Dev: npm run server (ws on :3001 next to vite on :5173)
|
||
* Prod: serves dist/ + ws on PORT (default 3001)
|
||
*
|
||
* Security hardening:
|
||
* - WebSocket maxPayload limit (prevents DoS)
|
||
* - Heartbeat (ping/pong) to clean dead sockets
|
||
* - Rate-limiting per connection (action flood protection)
|
||
* - Strict message schema validation
|
||
* - Static file serving with path-traversal protection
|
||
* - Inactive room cleanup timeout
|
||
*/
|
||
import http from 'node:http'
|
||
import { promises as fs } from 'node:fs'
|
||
import path from 'node:path'
|
||
import crypto from 'node:crypto'
|
||
import { fileURLToPath } from 'node:url'
|
||
import { WebSocketServer } from 'ws'
|
||
import {
|
||
buyUpgrade,
|
||
cleanExpiredSessions,
|
||
createSession,
|
||
createUserLocal,
|
||
deleteSession,
|
||
findOrCreateUserOidc,
|
||
getSession,
|
||
getUserById,
|
||
getUserByUsername,
|
||
hashPassword,
|
||
mergeGuest,
|
||
recordGameResult,
|
||
verifyPassword,
|
||
} from './db.mjs'
|
||
import { META_UPGRADES, calcCrystalsEarned } from '../shared/meta-upgrades.mjs'
|
||
|
||
const __dirname = path.dirname(fileURLToPath(import.meta.url))
|
||
const DIST_DIR = process.env.DIST_DIR || path.join(__dirname, '..', 'dist')
|
||
const PORT = Number(process.env.PORT || 3001)
|
||
const MAX_PAYLOAD_BYTES = 4096
|
||
const MAX_ACTIONS_PER_SEC = 30
|
||
const ROOM_TIMEOUT_MS = 30 * 60 * 1000
|
||
// public hosting hardening
|
||
const MAX_WS_TOTAL = 500 // total concurrent websocket connections
|
||
const MAX_WS_PER_IP = 20 // concurrent websocket connections per client IP
|
||
const MAX_ROOMS = 300 // concurrent rooms
|
||
|
||
// ------------------------------------------------------------------ accounts & OIDC config
|
||
|
||
const SESSION_COOKIE = 'trxtd_session'
|
||
const OIDC = {
|
||
enabled: String(process.env.OIDC_ENABLED || 'false').toLowerCase() === 'true',
|
||
issuer: String(process.env.OIDC_ISSUER || '').replace(/\/$/, ''),
|
||
clientId: String(process.env.OIDC_CLIENT_ID || ''),
|
||
clientSecret: String(process.env.OIDC_CLIENT_SECRET || ''),
|
||
redirectUri: String(process.env.OIDC_REDIRECT_URI || ''),
|
||
buttonLabel: String(process.env.OIDC_BUTTON_LABEL || 'Mit Single Sign-On anmelden'),
|
||
}
|
||
/** pending OIDC authorization attempts (state -> pkce verifier), short-lived */
|
||
const oidcPending = new Map()
|
||
let oidcDiscovery = null
|
||
let oidcDiscoveryAt = 0
|
||
|
||
// periodic session & oidc-state cleanup
|
||
setInterval(() => {
|
||
cleanExpiredSessions()
|
||
const now = Date.now()
|
||
for (const [state, entry] of oidcPending.entries()) {
|
||
if (now - entry.createdAt > 10 * 60 * 1000) oidcPending.delete(state)
|
||
}
|
||
}, 10 * 60 * 1000).unref()
|
||
|
||
const CSP =
|
||
"default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; " +
|
||
"img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; " +
|
||
"base-uri 'self'; frame-ancestors 'none'"
|
||
|
||
// ------------------------------------------------------------------ client ip (proxy aware)
|
||
|
||
function isPrivateIp(ip) {
|
||
if (!ip) return false
|
||
if (ip === '::1' || ip.startsWith('fc') || ip.startsWith('fd') || ip.startsWith('fe80')) return true
|
||
const m = ip.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/)
|
||
if (!m) return false
|
||
const a = Number(m[1])
|
||
const b = Number(m[2])
|
||
return a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254)
|
||
}
|
||
|
||
/**
|
||
* Real client IP. X-Forwarded-For is only trusted when the direct peer is a
|
||
* private address (reverse proxy / docker network), so external clients cannot
|
||
* spoof it. Do not expose the port directly to the internet.
|
||
*/
|
||
function clientIp(req) {
|
||
const socketIp = String(req.socket?.remoteAddress || 'unknown').replace(/^::ffff:/, '')
|
||
const xff = req.headers['x-forwarded-for']
|
||
if (xff && isPrivateIp(socketIp)) {
|
||
const first = String(xff).split(',')[0].trim().replace(/^::ffff:/, '')
|
||
if (first) return first
|
||
}
|
||
return socketIp
|
||
}
|
||
|
||
/**
|
||
* WebSocket origin check: blocks cross-site websocket hijacking (other
|
||
* websites opening connections to this server from a victim's browser).
|
||
* Allowed: same origin, local development, entries in ALLOWED_ORIGINS.
|
||
*/
|
||
function originAllowed(req) {
|
||
const origin = req.headers.origin
|
||
if (!origin) return true // non-browser clients (curl, node, bots without origin)
|
||
const host = String(req.headers.host || '').toLowerCase()
|
||
let originHost = ''
|
||
try {
|
||
originHost = new URL(origin).host.toLowerCase()
|
||
} catch {
|
||
return false
|
||
}
|
||
if (host && originHost === host) return true
|
||
if (/^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(originHost)) return true
|
||
const extra = String(process.env.ALLOWED_ORIGINS || '')
|
||
.toLowerCase()
|
||
.split(',')
|
||
.map((s) => s.trim())
|
||
.filter(Boolean)
|
||
if (extra.some((o) => o === originHost || o === origin.toLowerCase())) return true
|
||
return false
|
||
}
|
||
|
||
// ------------------------------------------------------------------ auth helpers
|
||
|
||
function parseCookies(req) {
|
||
const out = {}
|
||
const header = req.headers.cookie
|
||
if (!header) return out
|
||
for (const part of header.split(';')) {
|
||
const idx = part.indexOf('=')
|
||
if (idx === -1) continue
|
||
out[part.slice(0, idx).trim()] = decodeURIComponent(part.slice(idx + 1).trim())
|
||
}
|
||
return out
|
||
}
|
||
|
||
function sessionTokenFromReq(req) {
|
||
return parseCookies(req)[SESSION_COOKIE] || null
|
||
}
|
||
|
||
function setSessionCookie(res, token, expiresAt, req) {
|
||
const proto = String(req.headers['x-forwarded-proto'] || '').split(',')[0].trim()
|
||
const secure = proto === 'https' || (req.socket?.encrypted ?? false)
|
||
const sameSite = 'Lax'
|
||
res.setHeader(
|
||
'Set-Cookie',
|
||
`${SESSION_COOKIE}=${encodeURIComponent(token)}; Path=/; HttpOnly; SameSite=${sameSite}${secure ? '; Secure' : ''}; Expires=${new Date(expiresAt).toUTCString()}`,
|
||
)
|
||
}
|
||
|
||
function clearSessionCookie(res) {
|
||
res.setHeader('Set-Cookie', `${SESSION_COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`)
|
||
}
|
||
|
||
function json(res, status, obj) {
|
||
const body = JSON.stringify(obj)
|
||
res.writeHead(status, {
|
||
'Content-Type': 'application/json; charset=utf-8',
|
||
'Cache-Control': 'no-store',
|
||
'X-Content-Type-Options': 'nosniff',
|
||
})
|
||
res.end(body)
|
||
}
|
||
|
||
function readJsonBody(req, maxBytes = 8192) {
|
||
return new Promise((resolve, reject) => {
|
||
let size = 0
|
||
const chunks = []
|
||
req.on('data', (c) => {
|
||
size += c.length
|
||
if (size > maxBytes) {
|
||
reject(new Error('body too large'))
|
||
req.destroy()
|
||
return
|
||
}
|
||
chunks.push(c)
|
||
})
|
||
req.on('end', () => {
|
||
try {
|
||
resolve(JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}'))
|
||
} catch {
|
||
reject(new Error('invalid json'))
|
||
}
|
||
})
|
||
req.on('error', reject)
|
||
})
|
||
}
|
||
|
||
function publicUser(user) {
|
||
if (!user) return null
|
||
return {
|
||
id: user.id,
|
||
username: user.username,
|
||
displayName: user.display_name,
|
||
crystals: user.crystals,
|
||
upgrades: user.upgrades,
|
||
stats: user.stats,
|
||
oidc: Boolean(user.oidc_sub),
|
||
}
|
||
}
|
||
|
||
// simple per-IP rate limit for auth endpoints
|
||
const authBuckets = new Map()
|
||
function authRateLimited(ip) {
|
||
const now = Date.now()
|
||
const b = authBuckets.get(ip)
|
||
if (!b || now > b.resetAt) {
|
||
authBuckets.set(ip, { count: 1, resetAt: now + 60000 })
|
||
return false
|
||
}
|
||
b.count++
|
||
return b.count > 20 // 20 auth attempts per minute per IP
|
||
}
|
||
|
||
// ------------------------------------------------------------------ OIDC
|
||
|
||
function base64urlDecode(s) {
|
||
return Buffer.from(s.replace(/-/g, '+').replace(/_/g, '/'), 'base64')
|
||
}
|
||
|
||
async function fetchJson(url) {
|
||
const res = await fetch(url, { headers: { Accept: 'application/json' } })
|
||
if (!res.ok) throw new Error(`fetch ${url} -> ${res.status}`)
|
||
return res.json()
|
||
}
|
||
|
||
async function oidcDiscover() {
|
||
const now = Date.now()
|
||
if (oidcDiscovery && now - oidcDiscoveryAt < 10 * 60 * 1000) return oidcDiscovery
|
||
const d = await fetchJson(`${OIDC.issuer}/.well-known/openid-configuration`)
|
||
if (!d.authorization_endpoint || !d.token_endpoint) throw new Error('invalid OIDC discovery')
|
||
oidcDiscovery = d
|
||
oidcDiscoveryAt = now
|
||
return d
|
||
}
|
||
|
||
async function verifyIdToken(idToken, discovery) {
|
||
const parts = idToken.split('.')
|
||
if (parts.length !== 3) throw new Error('malformed id_token')
|
||
const [h, p, sig] = parts
|
||
const header = JSON.parse(base64urlDecode(h).toString('utf8'))
|
||
const payload = JSON.parse(base64urlDecode(p).toString('utf8'))
|
||
if (header.alg !== 'RS256') throw new Error('unsupported id_token alg')
|
||
const jwks = await fetchJson(discovery.jwks_uri)
|
||
const jwk = jwks.keys.find((k) => k.kid === header.kid) || jwks.keys[0]
|
||
if (!jwk) throw new Error('no matching JWKS key')
|
||
const publicKey = crypto.createPublicKey({ key: jwk, format: 'jwk' })
|
||
const ok = crypto.verify('RSA-SHA256', Buffer.from(`${h}.${p}`), publicKey, base64urlDecode(sig))
|
||
if (!ok) throw new Error('id_token signature invalid')
|
||
if (payload.iss !== OIDC.issuer && payload.iss !== discovery.issuer) throw new Error('issuer mismatch')
|
||
const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud]
|
||
if (!aud.includes(OIDC.clientId)) throw new Error('audience mismatch')
|
||
if (payload.exp && payload.exp * 1000 < Date.now()) throw new Error('id_token expired')
|
||
return payload
|
||
}
|
||
|
||
// ------------------------------------------------------------------ REST API
|
||
|
||
async function handleApi(req, res, url) {
|
||
const ip = clientIp(req)
|
||
const p = url.pathname
|
||
|
||
// --- public config (does OIDC exist?) ---
|
||
if (p === '/api/config' && req.method === 'GET') {
|
||
return json(res, 200, {
|
||
oidcEnabled: OIDC.enabled,
|
||
oidcLabel: OIDC.buttonLabel,
|
||
})
|
||
}
|
||
|
||
// --- current session ---
|
||
if (p === '/api/auth/me' && req.method === 'GET') {
|
||
const sess = getSession(sessionTokenFromReq(req))
|
||
if (!sess) return json(res, 200, { user: null })
|
||
return json(res, 200, { user: publicUser(getUserById(sess.user_id)) })
|
||
}
|
||
|
||
// --- logout ---
|
||
if (p === '/api/auth/logout' && req.method === 'POST') {
|
||
deleteSession(sessionTokenFromReq(req))
|
||
clearSessionCookie(res)
|
||
return json(res, 200, { ok: true })
|
||
}
|
||
|
||
// --- register (local) ---
|
||
if (p === '/api/auth/register' && req.method === 'POST') {
|
||
if (authRateLimited(ip)) return json(res, 429, { error: 'Zu viele Versuche. Bitte warte kurz.' })
|
||
const body = await readJsonBody(req).catch(() => null)
|
||
if (!body) return json(res, 400, { error: 'Ungültige Eingabe.' })
|
||
const username = String(body.username || '').trim().toLowerCase()
|
||
const password = String(body.password || '')
|
||
const displayName = String(body.displayName || username).trim().slice(0, 24) || username
|
||
if (!/^[a-z0-9_-]{3,16}$/.test(username)) return json(res, 400, { error: 'Benutzername: 3–16 Zeichen (a–z, 0–9, _ -).' })
|
||
if (password.length < 8) return json(res, 400, { error: 'Passwort: mindestens 8 Zeichen.' })
|
||
if (getUserByUsername(username)) return json(res, 409, { error: 'Benutzername bereits vergeben.' })
|
||
const hash = await hashPassword(password)
|
||
const user = createUserLocal(username, displayName, hash)
|
||
const sess = createSession(user.id)
|
||
setSessionCookie(res, sess.token, sess.expiresAt, req)
|
||
return json(res, 200, { user: publicUser(user) })
|
||
}
|
||
|
||
// --- login (local) ---
|
||
if (p === '/api/auth/login' && req.method === 'POST') {
|
||
if (authRateLimited(ip)) return json(res, 429, { error: 'Zu viele Versuche. Bitte warte kurz.' })
|
||
const body = await readJsonBody(req).catch(() => null)
|
||
if (!body) return json(res, 400, { error: 'Ungültige Eingabe.' })
|
||
const username = String(body.username || '').trim().toLowerCase()
|
||
const password = String(body.password || '')
|
||
const row = getUserByUsername(username)
|
||
if (!row || !row.password_hash) return json(res, 401, { error: 'Benutzername oder Passwort falsch.' })
|
||
const ok = await verifyPassword(password, row.password_hash)
|
||
if (!ok) return json(res, 401, { error: 'Benutzername oder Passwort falsch.' })
|
||
const user = getUserById(row.id)
|
||
const sess = createSession(user.id)
|
||
setSessionCookie(res, sess.token, sess.expiresAt, req)
|
||
return json(res, 200, { user: publicUser(user) })
|
||
}
|
||
|
||
// --- OIDC: start login ---
|
||
if (p === '/api/auth/oidc/login' && req.method === 'GET') {
|
||
if (!OIDC.enabled) return json(res, 400, { error: 'OIDC ist nicht aktiviert.' })
|
||
try {
|
||
const d = await oidcDiscover()
|
||
const state = crypto.randomBytes(16).toString('hex')
|
||
const verifier = crypto.randomBytes(32).toString('base64url')
|
||
const challenge = crypto.createHash('sha256').update(verifier).digest('base64url')
|
||
oidcPending.set(state, { verifier, createdAt: Date.now() })
|
||
const q = new URLSearchParams({
|
||
response_type: 'code',
|
||
client_id: OIDC.clientId,
|
||
redirect_uri: OIDC.redirectUri,
|
||
scope: 'openid profile email',
|
||
state,
|
||
code_challenge: challenge,
|
||
code_challenge_method: 'S256',
|
||
})
|
||
res.writeHead(302, { Location: `${d.authorization_endpoint}?${q.toString()}` })
|
||
return res.end()
|
||
} catch (e) {
|
||
return json(res, 502, { error: 'OIDC-Provider nicht erreichbar.' })
|
||
}
|
||
}
|
||
|
||
// --- OIDC: callback ---
|
||
if (p === '/api/auth/oidc/callback' && req.method === 'GET') {
|
||
if (!OIDC.enabled) return json(res, 400, { error: 'OIDC ist nicht aktiviert.' })
|
||
const code = url.searchParams.get('code')
|
||
const state = url.searchParams.get('state')
|
||
const pending = state ? oidcPending.get(state) : null
|
||
if (!code || !pending) {
|
||
res.writeHead(302, { Location: '/?auth=error' })
|
||
return res.end()
|
||
}
|
||
oidcPending.delete(state)
|
||
try {
|
||
const d = await oidcDiscover()
|
||
const tokenRes = await fetch(d.token_endpoint, {
|
||
method: 'POST',
|
||
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
||
body: new URLSearchParams({
|
||
grant_type: 'authorization_code',
|
||
code,
|
||
redirect_uri: OIDC.redirectUri,
|
||
client_id: OIDC.clientId,
|
||
client_secret: OIDC.clientSecret,
|
||
code_verifier: pending.verifier,
|
||
}).toString(),
|
||
})
|
||
if (!tokenRes.ok) throw new Error('token exchange failed')
|
||
const tokens = await tokenRes.json()
|
||
const payload = await verifyIdToken(tokens.id_token, d)
|
||
const user = findOrCreateUserOidc(
|
||
String(payload.sub),
|
||
OIDC.issuer,
|
||
String(payload.preferred_username || payload.email || ''),
|
||
String(payload.name || payload.preferred_username || ''),
|
||
)
|
||
const sess = createSession(user.id)
|
||
setSessionCookie(res, sess.token, sess.expiresAt, req)
|
||
res.writeHead(302, { Location: '/?auth=ok' })
|
||
return res.end()
|
||
} catch {
|
||
res.writeHead(302, { Location: '/?auth=error' })
|
||
return res.end()
|
||
}
|
||
}
|
||
|
||
// --- authenticated endpoints below ---
|
||
const sess = getSession(sessionTokenFromReq(req))
|
||
if (!sess) return json(res, 401, { error: 'Nicht angemeldet.' })
|
||
const user = getUserById(sess.user_id)
|
||
if (!user) return json(res, 401, { error: 'Nicht angemeldet.' })
|
||
|
||
// --- buy meta upgrade ---
|
||
if (p === '/api/upgrades/buy' && req.method === 'POST') {
|
||
const body = await readJsonBody(req).catch(() => null)
|
||
const upgradeId = String(body?.upgradeId || '')
|
||
const def = META_UPGRADES[upgradeId]
|
||
if (!def) return json(res, 400, { error: 'Unbekanntes Upgrade.' })
|
||
const current = user.upgrades[upgradeId] || 0
|
||
if (current >= def.maxLevel) return json(res, 400, { error: 'Bereits auf Maximalstufe.' })
|
||
const cost = def.costs[current]
|
||
const result = buyUpgrade(user.id, upgradeId, cost, def.maxLevel)
|
||
if (!result.ok) return json(res, 400, { error: result.error })
|
||
return json(res, 200, { user: publicUser(result.user) })
|
||
}
|
||
|
||
// --- merge local guest progress into the account (one-time) ---
|
||
if (p === '/api/auth/merge-guest' && req.method === 'POST') {
|
||
const body = await readJsonBody(req).catch(() => null)
|
||
const maxLevels = {}
|
||
for (const [id, def] of Object.entries(META_UPGRADES)) maxLevels[id] = def.maxLevel
|
||
const updated = mergeGuest(user.id, body?.crystals, body?.upgrades, maxLevels)
|
||
return json(res, 200, { user: publicUser(updated) })
|
||
}
|
||
|
||
// --- record finished game & grant crystals (server-authoritative) ---
|
||
if (p === '/api/game/finish' && req.method === 'POST') {
|
||
const body = await readJsonBody(req).catch(() => null)
|
||
const win = Boolean(body?.win)
|
||
const wave = Math.max(0, Math.min(9999, Number(body?.wave) || 0))
|
||
const score = Math.max(0, Math.min(10_000_000, Number(body?.score) || 0))
|
||
const kills = Math.max(0, Math.min(1_000_000, Number(body?.kills) || 0))
|
||
const crystals = calcCrystalsEarned(wave, score, win)
|
||
const updated = recordGameResult(user.id, { win, score, wave, kills, crystalsEarned: crystals })
|
||
return json(res, 200, { user: publicUser(updated), crystalsEarned: crystals })
|
||
}
|
||
|
||
return json(res, 404, { error: 'Nicht gefunden.' })
|
||
}
|
||
|
||
// ------------------------------------------------------------------ static files
|
||
|
||
const MIME = {
|
||
'.html': 'text/html; charset=utf-8',
|
||
'.js': 'text/javascript; charset=utf-8',
|
||
'.css': 'text/css; charset=utf-8',
|
||
'.json': 'application/json; charset=utf-8',
|
||
'.webmanifest': 'application/manifest+json; charset=utf-8',
|
||
'.png': 'image/png',
|
||
'.jpg': 'image/jpeg',
|
||
'.jpeg': 'image/jpeg',
|
||
'.svg': 'image/svg+xml',
|
||
'.ico': 'image/x-icon',
|
||
'.woff': 'font/woff',
|
||
'.woff2': 'font/woff2',
|
||
'.txt': 'text/plain; charset=utf-8',
|
||
'.map': 'application/json',
|
||
}
|
||
|
||
const DIST_ROOT = path.normalize(DIST_DIR)
|
||
|
||
async function serveStatic(req, res) {
|
||
const url = new URL(req.url, 'http://localhost')
|
||
if (url.pathname === '/health') {
|
||
res.writeHead(200, { 'Content-Type': 'text/plain' })
|
||
res.end('ok')
|
||
return
|
||
}
|
||
if (req.method !== 'GET' && req.method !== 'HEAD') {
|
||
res.writeHead(405, { 'Content-Type': 'text/plain' })
|
||
res.end('Method Not Allowed')
|
||
return
|
||
}
|
||
|
||
let rel
|
||
try {
|
||
rel = decodeURIComponent(url.pathname)
|
||
} catch {
|
||
res.writeHead(400)
|
||
res.end('Bad Request')
|
||
return
|
||
}
|
||
if (rel.includes('\0')) {
|
||
res.writeHead(400)
|
||
res.end('Bad Request')
|
||
return
|
||
}
|
||
|
||
let filePath = path.normalize(path.join(DIST_ROOT, rel))
|
||
if (filePath !== DIST_ROOT && !filePath.startsWith(DIST_ROOT + path.sep)) {
|
||
res.writeHead(403)
|
||
res.end('Forbidden')
|
||
return
|
||
}
|
||
|
||
let data = await fs.readFile(filePath).catch(() => null)
|
||
if (!data) {
|
||
// SPA fallback: unknown paths without file extension get index.html
|
||
if (!path.extname(rel)) {
|
||
filePath = path.join(DIST_ROOT, 'index.html')
|
||
data = await fs.readFile(filePath).catch(() => null)
|
||
}
|
||
if (!data) {
|
||
res.writeHead(404, { 'Content-Type': 'text/plain' })
|
||
res.end('Not Found')
|
||
return
|
||
}
|
||
}
|
||
|
||
const ext = path.extname(filePath).toLowerCase()
|
||
const type = MIME[ext] || 'application/octet-stream'
|
||
const isHashedAsset = url.pathname.startsWith('/assets/')
|
||
res.writeHead(200, {
|
||
'Content-Type': type,
|
||
'Cache-Control': isHashedAsset ? 'public, max-age=31536000, immutable' : 'no-cache',
|
||
'X-Content-Type-Options': 'nosniff',
|
||
'Content-Security-Policy': CSP,
|
||
'X-Frame-Options': 'DENY',
|
||
'Referrer-Policy': 'no-referrer',
|
||
})
|
||
res.end(req.method === 'HEAD' ? undefined : data)
|
||
}
|
||
|
||
const httpServer = http.createServer((req, res) => {
|
||
const url = new URL(req.url, 'http://localhost')
|
||
if (url.pathname.startsWith('/api/')) {
|
||
handleApi(req, res, url).catch(() => {
|
||
if (!res.headersSent) res.writeHead(500)
|
||
res.end('Internal Server Error')
|
||
})
|
||
return
|
||
}
|
||
serveStatic(req, res).catch(() => {
|
||
if (!res.headersSent) res.writeHead(500)
|
||
res.end('Internal Server Error')
|
||
})
|
||
})
|
||
|
||
// ------------------------------------------------------------------ game rooms
|
||
|
||
const wss = new WebSocketServer({
|
||
noServer: true,
|
||
maxPayload: MAX_PAYLOAD_BYTES,
|
||
})
|
||
|
||
// concurrent websocket connection tracking (per IP + global)
|
||
const wsPerIp = new Map()
|
||
|
||
function rejectUpgrade(socket, status, reason) {
|
||
try {
|
||
socket.write(`HTTP/1.1 ${status} ${reason}\r\nConnection: close\r\n\r\n`)
|
||
} catch {
|
||
/* ignore */
|
||
}
|
||
socket.destroy()
|
||
}
|
||
|
||
httpServer.on('upgrade', (req, socket, head) => {
|
||
if (!originAllowed(req)) {
|
||
console.warn(`[ws] Origin abgelehnt: ${req.headers.origin} von ${clientIp(req)}`)
|
||
return rejectUpgrade(socket, 403, 'Forbidden')
|
||
}
|
||
const ip = clientIp(req)
|
||
const perIp = wsPerIp.get(ip) || 0
|
||
if (wss.clients.size >= MAX_WS_TOTAL || perIp >= MAX_WS_PER_IP) {
|
||
console.warn(`[ws] Verbindungslimit erreicht: ${ip} (${perIp}/${MAX_WS_PER_IP}, total ${wss.clients.size}/${MAX_WS_TOTAL})`)
|
||
return rejectUpgrade(socket, 503, 'Service Unavailable')
|
||
}
|
||
wss.handleUpgrade(req, socket, head, (ws) => {
|
||
ws._ip = ip
|
||
wsPerIp.set(ip, perIp + 1)
|
||
ws.on('close', () => {
|
||
const n = (wsPerIp.get(ip) || 1) - 1
|
||
if (n <= 0) wsPerIp.delete(ip)
|
||
else wsPerIp.set(ip, n)
|
||
})
|
||
wss.emit('connection', ws, req)
|
||
})
|
||
})
|
||
|
||
/** code -> { code, mode, created, seq, players: [{ ws, id, name }] } */
|
||
const rooms = new Map()
|
||
|
||
const CODE_CHARS = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'
|
||
|
||
function makeCode() {
|
||
let code
|
||
let attempts = 0
|
||
do {
|
||
code = Array.from({ length: 4 }, () => CODE_CHARS[Math.floor(Math.random() * CODE_CHARS.length)]).join('')
|
||
attempts++
|
||
if (attempts > 1000) break
|
||
} while (rooms.has(code))
|
||
return code
|
||
}
|
||
|
||
const VALID_MAPS = ['meadow', 'desert', 'frostland', 'volcano']
|
||
|
||
function sanitizeName(raw) {
|
||
if (typeof raw !== 'string') return 'Spieler'
|
||
const clean = raw.trim().replace(/[^\p{L}\p{N}_\- ]/gu, '').slice(0, 12)
|
||
return clean || 'Spieler'
|
||
}
|
||
|
||
function sanitizeMapId(raw) {
|
||
return VALID_MAPS.includes(raw) ? raw : 'meadow'
|
||
}
|
||
|
||
function send(ws, obj) {
|
||
if (ws && ws.readyState === 1) {
|
||
try {
|
||
ws.send(JSON.stringify(obj))
|
||
} catch {
|
||
/* ignore socket send failure */
|
||
}
|
||
}
|
||
}
|
||
|
||
function roomOf(ws) {
|
||
const code = ws._room
|
||
return code ? rooms.get(code) : undefined
|
||
}
|
||
|
||
function broadcast(room, obj, exceptWs) {
|
||
for (const p of room.players) {
|
||
if (p.ws !== exceptWs) send(p.ws, obj)
|
||
}
|
||
}
|
||
|
||
function playerInfo(room) {
|
||
return room.players.map((p) => ({ id: p.id, name: p.name }))
|
||
}
|
||
|
||
function leaveRoom(ws) {
|
||
const room = roomOf(ws)
|
||
if (!room) return
|
||
room.players = room.players.filter((p) => p.ws !== ws)
|
||
ws._room = undefined
|
||
if (room.players.length === 0) {
|
||
rooms.delete(room.code)
|
||
} else {
|
||
broadcast(room, { t: 'peer-left' })
|
||
}
|
||
}
|
||
|
||
function validateAction(a) {
|
||
if (!a || typeof a !== 'object' || Array.isArray(a)) return false
|
||
switch (a.type) {
|
||
case 'build':
|
||
return (
|
||
['arrow', 'cannon', 'frost', 'tesla', 'laser'].includes(a.kind) &&
|
||
Number.isInteger(a.tx) &&
|
||
a.tx >= 0 &&
|
||
a.tx < 20 &&
|
||
Number.isInteger(a.ty) &&
|
||
a.ty >= 0 &&
|
||
a.ty < 11
|
||
)
|
||
case 'upgrade':
|
||
case 'sell':
|
||
return Number.isInteger(a.towerId) && a.towerId > 0
|
||
case 'targeting':
|
||
return (
|
||
Number.isInteger(a.towerId) &&
|
||
a.towerId > 0 &&
|
||
['first', 'last', 'strong', 'close'].includes(a.mode)
|
||
)
|
||
case 'obstacle':
|
||
return Number.isInteger(a.tx) && a.tx >= 0 && a.tx < 20 && Number.isInteger(a.ty) && a.ty >= 0 && a.ty < 11
|
||
case 'wave':
|
||
case 'rush':
|
||
return true
|
||
case 'speed':
|
||
return [1, 2, 3].includes(a.s)
|
||
default:
|
||
return false
|
||
}
|
||
}
|
||
|
||
// heartbeat + room timeout
|
||
const pingInterval = setInterval(() => {
|
||
const now = Date.now()
|
||
for (const [code, room] of rooms.entries()) {
|
||
if (now - room.created > ROOM_TIMEOUT_MS) {
|
||
for (const p of room.players) {
|
||
send(p.ws, { t: 'error', msg: 'Raum-Zeitüberschreitung.' })
|
||
p.ws._room = undefined
|
||
}
|
||
rooms.delete(code)
|
||
}
|
||
}
|
||
|
||
wss.clients.forEach((ws) => {
|
||
if (ws.isAlive === false) {
|
||
leaveRoom(ws)
|
||
ws.terminate()
|
||
return
|
||
}
|
||
ws.isAlive = false
|
||
try {
|
||
ws.ping()
|
||
} catch {
|
||
leaveRoom(ws)
|
||
}
|
||
})
|
||
}, 15000)
|
||
|
||
wss.on('close', () => {
|
||
clearInterval(pingInterval)
|
||
})
|
||
|
||
wss.on('connection', (ws) => {
|
||
ws.isAlive = true
|
||
ws._actBucket = { count: 0, resetAt: Date.now() + 1000 }
|
||
|
||
ws.on('pong', () => {
|
||
ws.isAlive = true
|
||
})
|
||
|
||
ws.on('message', (data, isBinary) => {
|
||
ws.isAlive = true
|
||
if (isBinary) return // only JSON text frames are allowed
|
||
|
||
let m
|
||
try {
|
||
m = JSON.parse(data.toString())
|
||
} catch {
|
||
return
|
||
}
|
||
if (!m || typeof m !== 'object' || typeof m.t !== 'string') return
|
||
|
||
// rate limiting
|
||
const now = Date.now()
|
||
if (now > ws._actBucket.resetAt) {
|
||
ws._actBucket.count = 0
|
||
ws._actBucket.resetAt = now + 1000
|
||
}
|
||
ws._actBucket.count++
|
||
if (ws._actBucket.count > MAX_ACTIONS_PER_SEC) {
|
||
send(ws, { t: 'error', msg: 'Zu viele Anfragen gesendet.' })
|
||
return
|
||
}
|
||
|
||
switch (m.t) {
|
||
case 'create': {
|
||
leaveRoom(ws)
|
||
if (m.mode !== 'coop' && m.mode !== 'duel') return
|
||
if (rooms.size >= MAX_ROOMS) {
|
||
return send(ws, { t: 'error', msg: 'Zu viele aktive Räume. Bitte später erneut versuchen.' })
|
||
}
|
||
const code = makeCode()
|
||
const mapId = sanitizeMapId(m.mapId)
|
||
const room = { code, mode: m.mode, mapId, created: Date.now(), seq: 0, players: [{ ws, id: 0, name: sanitizeName(m.name) }] }
|
||
rooms.set(code, room)
|
||
ws._room = code
|
||
send(ws, { t: 'room', code, mode: room.mode, mapId: room.mapId, players: playerInfo(room), you: 0 })
|
||
break
|
||
}
|
||
case 'set-map': {
|
||
const room = roomOf(ws)
|
||
if (!room || room.players.length === 0) return
|
||
if (room.players[0].ws !== ws) return // only host may change map
|
||
room.mapId = sanitizeMapId(m.mapId)
|
||
for (const p of room.players) {
|
||
send(p.ws, { t: 'room', code: room.code, mode: room.mode, mapId: room.mapId, players: playerInfo(room), you: p.id })
|
||
}
|
||
break
|
||
}
|
||
case 'join': {
|
||
leaveRoom(ws)
|
||
const code = String(m.code || '').toUpperCase().trim()
|
||
const room = rooms.get(code)
|
||
if (!room) return send(ws, { t: 'error', msg: 'Raum nicht gefunden.' })
|
||
if (room.players.length >= 2) return send(ws, { t: 'error', msg: 'Raum ist bereits voll.' })
|
||
room.players.push({ ws, id: 1, name: sanitizeName(m.name) })
|
||
ws._room = code
|
||
for (const p of room.players) {
|
||
send(p.ws, { t: 'room', code: room.code, mode: room.mode, mapId: room.mapId, players: playerInfo(room), you: p.id })
|
||
}
|
||
break
|
||
}
|
||
case 'start': {
|
||
const room = roomOf(ws)
|
||
if (!room || room.players.length !== 2) return
|
||
if (room.players[0].ws !== ws) return // only the host may start
|
||
const seed = (Math.random() * 1e9) | 0
|
||
for (const p of room.players) {
|
||
send(p.ws, { t: 'start', seed, mode: room.mode, mapId: room.mapId, players: playerInfo(room), you: p.id })
|
||
}
|
||
break
|
||
}
|
||
case 'act': {
|
||
const room = roomOf(ws)
|
||
if (!room || room.players.length < 2) return
|
||
const from = room.players.findIndex((p) => p.ws === ws)
|
||
if (from === -1) return
|
||
if (!validateAction(m.a)) return
|
||
if (!Number.isInteger(m.tick) || m.tick < 0) return
|
||
|
||
room.seq = (room.seq || 0) + 1
|
||
for (const p of room.players) {
|
||
send(p.ws, { t: 'act', seq: room.seq, from, tick: m.tick, a: m.a })
|
||
}
|
||
break
|
||
}
|
||
case 'prog': {
|
||
const room = roomOf(ws)
|
||
if (!room) return
|
||
const from = room.players.findIndex((p) => p.ws === ws)
|
||
if (from === -1) return
|
||
if (typeof m.tick !== 'number' || !Number.isFinite(m.tick)) return
|
||
broadcast(room, { t: 'prog', from, tick: m.tick })
|
||
break
|
||
}
|
||
case 'leave': {
|
||
leaveRoom(ws)
|
||
break
|
||
}
|
||
}
|
||
})
|
||
|
||
ws.on('close', () => leaveRoom(ws))
|
||
ws.on('error', () => leaveRoom(ws))
|
||
})
|
||
|
||
httpServer.listen(PORT, () => {
|
||
console.log(`TRXTD-Server läuft auf http://localhost:${PORT} (Static: ${DIST_DIR})`)
|
||
})
|