feat(anon): memorable, collision-proof animal anonymous names (#4611)

## Description:

Makes OpenFront's anonymised names **memorable and collision-proof**.

Anonymised lobbies (e.g. OFM tournaments) previously showed opaque names
— the `Anon420` fallback and hash-derived civ-tribe names in the overlay
— that were hard to remember and could repeat within a viewer's view, so
players couldn't reliably track opponents across a match.

**What changed**
- **`src/core/AnonAnimals.ts`** (new): an 80-word animal bank +
`anonAnimalName(slot, offset)`. Consecutive slots map to **distinct**
handles — the 80 animals fill first (`round 0` → a bare `AnonWolf`),
then a single round digit counts up (`AnonWolf1`, …). At a fixed offset,
two slots can never collide.
- **`GameServer.anonName`**: assigns each player its **join-order slot**
in `allClients` (stable — late-joiners append so existing names never
shift; reconnects reuse their slot) plus a **per-viewer offset**. So
within any one viewer's view no two players can share a name, while
different viewers still see different names for the same player
(**anti-team preserved**). Replaces the old per-pair hash and removes
the now-dead `anonymousUsername` helper.
- **Client fallback** (`genAnonUsername`): draws a random slot through
the same helper (no roster client-side → best-effort); the overlay is
what guarantees uniqueness in-game.
- `createRandomName` (nation/other display names) is untouched.

**Desync safety — audited against #4426**

#4426 fixed a desync where `PlayerExecution` seeded `removeClusters()`
from `player.name()`, a value anonymize-names makes per-client. This
change preserves that invariant:

| Check | Result |
|---|---|
| Deterministic state hash reads `name()`? | **No** — `PlayerImpl.hash =
simpleHash(id)·(troops+numTilesOwned) + Σ unit.hash`; `UnitImpl.hash =
tile + simpleHash(type)·id` |
| `removeClusters` seed | `simpleHash(player.id())` — id-based (#4426
fix), untouched |
| Where `anonName` is called | only `startInfoFor` / `gameInfo` —
per-viewer wire payloads, never the sim |
| Archived record | uses `wireGameStartInfo` (real names) — untouched →
replay/scoring unaffected |
| Net new sim inputs | none — only the display string + server-side
roster order |

The name is display-only and the simulation is name-blind, so this
cannot desync.

**Testing**
- New `tests/AnonAnimals.test.ts`: the no-collision guarantee (250
distinct slots → 250 distinct names), round roll-over, per-viewer
variation, wire-validity/length.
- Existing `tests/server/AnonymizeNames.test.ts` overlay suite still
passes.
- Full suite green locally (`npm test` + `npm run test:coverage`), plus
`build-prod`, `eslint`, and `prettier --check .` clean.

## Please complete the following:

- [x] I have added screenshots for all UI updates — _N/A, no UI changes
(in-game name string only)_
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file — _N/A, generated handles are not
translatable identifiers_
- [x] I have added relevant tests to the test directory —
`tests/AnonAnimals.test.ts`

## Please put your Discord username so you can be contacted if a bug or
regression is found:

<!-- TODO: fill in Discord username -->

src/client/UsernameInput.ts

@@ -1,6 +1,7 @@
 import { LitElement, html } from "lit";
 import { customElement, property, state } from "lit/decorators.js";
-import { generateCryptoRandomUUID, translateText } from "../client/Utils";
+import { translateText } from "../client/Utils";
+import { ANON_ANIMALS, anonAnimalName } from "../core/AnonAnimals";
 import { sanitizeClanTag } from "../core/Util";
 import {
   MAX_CLAN_TAG_LENGTH,
@@ -318,10 +319,24 @@ export class UsernameInput extends LitElement {
   }
 }
 
+// A memorable anonymous username: "Anon" + animal (+ digit), the same handle
+// format the server-side anonymisation overlay uses (anonAnimalName). Client-side
+// fallback for players who never set a name — no roster here, so it draws a
+// random slot (best-effort-unique); the overlay is what guarantees uniqueness
+// in-game.
+//
+// Rejection-sample a uniform slot in [0, bound) from the CSPRNG: drawing a raw
+// uint32 and taking `% bound` would be very slightly biased (the top partial
+// bucket), so we discard the unrepresentable tail first. The bias is cosmetically
+// irrelevant here, but this keeps the draw provably uniform.
 export function genAnonUsername(): string {
-  const uuid = generateCryptoRandomUUID();
-  const cleanUuid = uuid.replace(/-/g, "").toLowerCase();
-  const decimal = BigInt(`0x${cleanUuid}`);
-  const threeDigits = decimal % 1000n;
-  return "Anon" + threeDigits.toString().padStart(3, "0");
+  const bound = ANON_ANIMALS.length * 10;
+  const limit = Math.floor(0x1_0000_0000 / bound) * bound;
+  const buf = new Uint32Array(1);
+  let rand: number;
+  do {
+    crypto.getRandomValues(buf);
+    rand = buf[0] ?? 0;
+  } while (rand >= limit);
+  return anonAnimalName(rand % bound);
 }

src/core/AnonAnimals.ts

@@ -0,0 +1,104 @@
+// Word bank for anonymous usernames (see genAnonUsername). Each entry is a
+// single, memorable animal word that is username-safe on its own (matches
+// UsernameSchema's [a-zA-Z0-9_ üÜ.] and, prefixed with "Anon" plus one digit,
+// stays under MAX_USERNAME_LENGTH). Kept as recognisable animals with a matching
+// emoji so a future cosmetic pass can pair each name with its animal badge.
+// Order is irrelevant — genAnonUsername indexes into this by a random value.
+export const ANON_ANIMALS: readonly string[] = [
+  "Wolf",
+  "Fox",
+  "Bear",
+  "Panda",
+  "Koala",
+  "Tiger",
+  "Lion",
+  "Leopard",
+  "Cheetah",
+  "Jaguar",
+  "Otter",
+  "Seal",
+  "Sloth",
+  "Raccoon",
+  "Badger",
+  "Skunk",
+  "Hedgehog",
+  "Squirrel",
+  "Hamster",
+  "Rabbit",
+  "Boar",
+  "Horse",
+  "Zebra",
+  "Deer",
+  "Moose",
+  "Bison",
+  "Ram",
+  "Goat",
+  "Camel",
+  "Llama",
+  "Giraffe",
+  "Elephant",
+  "Rhino",
+  "Hippo",
+  "Gorilla",
+  "Orangutan",
+  "Monkey",
+  "Kangaroo",
+  "Bat",
+  "Falcon",
+  "Eagle",
+  "Hawk",
+  "Owl",
+  "Raven",
+  "Swan",
+  "Goose",
+  "Duck",
+  "Chicken",
+  "Rooster",
+  "Penguin",
+  "Flamingo",
+  "Peacock",
+  "Parrot",
+  "Turkey",
+  "Dove",
+  "Shark",
+  "Whale",
+  "Dolphin",
+  "Orca",
+  "Octopus",
+  "Squid",
+  "Crab",
+  "Lobster",
+  "Shrimp",
+  "Pufferfish",
+  "Turtle",
+  "Crocodile",
+  "Snake",
+  "Cobra",
+  "Lizard",
+  "Gecko",
+  "Frog",
+  "Bee",
+  "Butterfly",
+  "Beetle",
+  "Ant",
+  "Spider",
+  "Scorpion",
+  "Snail",
+  "Ladybug",
+];
+
+// "Anon" + animal + optional round number, from a slot index and a per-viewer
+// offset (e.g. "AnonWolf", "AnonFox", … then "AnonWolf1" once all 80 are used).
+// Consecutive slots map to DISTINCT handles: the 80 animals fill first (round 0
+// → a bare name), then the round counts up. So for a fixed offset, two different
+// slots can never collide — that is what lets the anonymisation overlay
+// guarantee unique names by feeding it join-order slots. The offset rotates
+// which animal each slot lands on, so different viewers see a different name for
+// the same player. Output is always wire-valid (letters + optional digits).
+export function anonAnimalName(slot: number, offset = 0): string {
+  const s = Math.abs(Math.trunc(slot));
+  const o = Math.abs(Math.trunc(offset));
+  const animal = ANON_ANIMALS[(s + o) % ANON_ANIMALS.length];
+  const round = Math.floor(s / ANON_ANIMALS.length);
+  return round === 0 ? `Anon${animal}` : `Anon${animal}${round}`;
+}

src/core/Util.ts

@@ -377,18 +377,6 @@ export function createRandomName(
   return randomName;
 }
 
-// Deterministic anonymized username. Reuses createRandomName, then strips the
-// emoji and any illegal chars so it passes UsernameSchema and survives the wire
-// (createRandomName's output is a display string, not a valid username).
-export function anonymousUsername(seed: string): string {
-  const base = createRandomName(seed, PlayerType.Human) ?? "";
-  const name = base
-    .replace(/[^a-zA-Z0-9_ üÜ.]/g, "")
-    .trim()
-    .slice(0, 27);
-  return name.length >= 3 ? name : "Player";
-}
-
 export const emojiTable = [
   ["😀", "😊", "🥰", "😇", "😎"],
   ["😞", "🥺", "😭", "😱", "😡"],

src/server/GameServer.ts

@@ -3,6 +3,7 @@ import ipAnonymize from "ip-anonymize";
 import { Logger } from "winston";
 import WebSocket from "ws";
 import { z } from "zod";
+import { anonAnimalName } from "../core/AnonAnimals";
 import { isAdminRole } from "../core/ApiSchemas";
 import { GameEnv } from "../core/configuration/Config";
 import { GameType } from "../core/game/Game";
@@ -32,7 +33,7 @@ import {
   StampedIntent,
   Turn,
 } from "../core/Schemas";
-import { anonymousUsername, createPartialGameRecord } from "../core/Util";
+import { createPartialGameRecord, simpleHash } from "../core/Util";
 import { archive, finalizeGameRecord } from "./Archive";
 import { Client } from "./Client";
 import { ClientMsgRateLimiter } from "./ClientMsgRateLimiter";
@@ -205,8 +206,23 @@ export class GameServer {
   }
 
   // Same (viewer, target) -> same name in the lobby and in-game.
+  //
+  // The target's slot is its join-order position in allClients (an
+  // insertion-ordered Map): stable for the whole game, and late-joiners simply
+  // append, so existing players' names never shift. Distinct targets have
+  // distinct slots, and anonAnimalName maps distinct slots (at a fixed offset) to
+  // distinct handles — so within any one viewer's view no two players ever share
+  // a name. The per-viewer offset rotates the animal assignment, so different
+  // viewers still see different names for the same player (the anti-team point).
+  // Display-only: this feeds per-viewer wire payloads (startInfoFor / gameInfo),
+  // never the simulation or the archived record, so it cannot desync (see #4426).
   private anonName(viewer: ClientID | undefined, target: ClientID): string {
-    return anonymousUsername(target + (viewer ?? ""));
+    let slot = 0;
+    for (const id of this.allClients.keys()) {
+      if (id === target) break;
+      slot++;
+    }
+    return anonAnimalName(slot, viewer ? simpleHash(viewer) : 0);
   }
 
   // Whether `viewer` should see `target`'s real identity: when names aren't

tests/AnonAnimals.test.ts

@@ -0,0 +1,50 @@
+import { ANON_ANIMALS, anonAnimalName } from "../src/core/AnonAnimals";
+import { UsernameSchema } from "../src/core/Schemas";
+import { MAX_USERNAME_LENGTH } from "../src/core/validations/username";
+
+describe("ANON_ANIMALS", () => {
+  it("has 80 unique, single-word entries", () => {
+    expect(ANON_ANIMALS.length).toBe(80);
+    expect(new Set(ANON_ANIMALS).size).toBe(ANON_ANIMALS.length);
+    for (const a of ANON_ANIMALS) expect(a).toMatch(/^[A-Z][a-z]+$/);
+  });
+});
+
+describe("anonAnimalName", () => {
+  it("is deterministic in (slot, offset)", () => {
+    expect(anonAnimalName(5, 3)).toBe(anonAnimalName(5, 3));
+  });
+
+  it("names the first 80 slots bare, then counts the round up", () => {
+    expect(anonAnimalName(0, 0)).toBe(`Anon${ANON_ANIMALS[0]}`);
+    expect(anonAnimalName(79, 0)).toBe(`Anon${ANON_ANIMALS[79]}`);
+    expect(anonAnimalName(80, 0)).toBe(`Anon${ANON_ANIMALS[0]}1`);
+    expect(anonAnimalName(160, 0)).toBe(`Anon${ANON_ANIMALS[0]}2`);
+  });
+
+  it("NEVER collides for distinct slots at a fixed offset (the guarantee)", () => {
+    for (const offset of [0, 7, 12345]) {
+      const names = new Set<string>();
+      for (let slot = 0; slot < 250; slot++)
+        names.add(anonAnimalName(slot, offset));
+      expect(names.size).toBe(250); // 250 distinct players → 250 distinct names
+    }
+  });
+
+  it("varies by offset (per-viewer): same slot, different viewers → different name", () => {
+    const slot = 3;
+    const names = new Set(
+      Array.from({ length: 25 }, (_, v) => anonAnimalName(slot, v * 101)),
+    );
+    expect(names.size).toBeGreaterThan(1);
+  });
+
+  it("always produces a wire-valid handle within length limits", () => {
+    for (let slot = 0; slot < ANON_ANIMALS.length * 3; slot++) {
+      const name = anonAnimalName(slot, 999);
+      expect(name).toMatch(/^Anon[A-Z][a-z]+\d*$/);
+      expect(name.length).toBeLessThanOrEqual(MAX_USERNAME_LENGTH);
+      expect(UsernameSchema.safeParse(name).success).toBe(true);
+    }
+  });
+});

tests/AnonymousUsername.test.ts

@@ -1,25 +0,0 @@
-import { UsernameSchema } from "../src/core/Schemas";
-import { anonymousUsername } from "../src/core/Util";
-
-describe("anonymousUsername", () => {
-  it("always produces a wire-valid username", () => {
-    for (let i = 0; i < 1000; i++) {
-      const name = anonymousUsername(`client${i}` + `viewer${i % 13}`);
-      expect(UsernameSchema.safeParse(name).success).toBe(true);
-    }
-  });
-
-  it("is deterministic per seed", () => {
-    expect(anonymousUsername("abc")).toBe(anonymousUsername("abc"));
-  });
-
-  it("varies by viewer for the same player", () => {
-    const player = "playerA";
-    const names = new Set(
-      Array.from({ length: 25 }, (_, v) =>
-        anonymousUsername(player + "viewer" + v),
-      ),
-    );
-    expect(names.size).toBeGreaterThan(1);
-  });
-});