Update socket rate limiting (#3447)

## Description:

On replays, there can be a burst of traffic from hashes, so instead just
have a 2MB limit per client for the entire game. Also the winner message
can be 100s of kb on a large game with many players, so now we don't
need to put a special case for that.

## Please complete the following:

- [x] I have added screenshots for all UI updates
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [x] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

evan

src/server/ClientMsgRateLimiter.ts

@@ -3,18 +3,14 @@ import { ClientID } from "../core/Schemas";
 
 const INTENTS_PER_SECOND = 10;
 const INTENTS_PER_MINUTE = 150;
-const MAX_BYTES_PER_MINUTE = 25 * 1024; // 25KB/min per client
-const MAX_INTENT_BYTES = 500; // intents are stored in turns, keep them small
+const MAX_INTENT_SIZE = 500;
+const TOTAL_BYTES = 2 * 1024 * 1024; // 2MB per client
 export type RateLimitResult = "ok" | "limit" | "kick";
 
-// Allow 3 winner messages per client since a player can rejoin and resend.
-const MAX_WINNER_MSGS = 3;
-
 interface ClientBucket {
   perSecond: RateLimiter;
   perMinute: RateLimiter;
-  bytesPerMinute: RateLimiter;
-  winnerMsgCount: number;
+  totalBytes: number;
 }
 
 export class ClientMsgRateLimiter {
@@ -22,27 +18,27 @@ export class ClientMsgRateLimiter {
 
   check(clientID: ClientID, type: string, bytes: number): RateLimitResult {
     const bucket = this.getOrCreate(clientID);
+    bucket.totalBytes += bytes;
 
-    // Winner message contains stats for all players and can be large (100s of KB).
-    // It bypasses the byte rate limit but is strictly limited to one per client.
-    if (type === "winner") {
-      if (bucket.winnerMsgCount >= MAX_WINNER_MSGS) return "kick";
-      bucket.winnerMsgCount++;
-      return "ok";
+    if (bucket.totalBytes >= TOTAL_BYTES) return "kick";
+
+    if (type === "intent") {
+      // Intents are stored in turn history for the duration of the game, so
+      // oversized intents would accumulate and fill up server RAM.
+      // Intents are also sent to all players, so it increase outgoing
+      // data.
+      // Intents should never be larger than MAX_INTENT_SIZE, so we assume the client is malicious.
+      if (bytes > MAX_INTENT_SIZE) {
+        return "kick";
+      }
+      if (
+        !bucket.perSecond.tryRemoveTokens(1) ||
+        !bucket.perMinute.tryRemoveTokens(1)
+      ) {
+        return "limit";
+      }
     }
 
-    // Intents are stored in turn history for the duration of the game, so
-    // oversized intents would accumulate and fill up server RAM.
-    if (type === "intent" && bytes > MAX_INTENT_BYTES) return "kick";
-
-    if (!bucket.bytesPerMinute.tryRemoveTokens(bytes)) return "kick";
-
-    if (
-      !bucket.perSecond.tryRemoveTokens(1) ||
-      !bucket.perMinute.tryRemoveTokens(1)
-    )
-      return "limit";
-
     return "ok";
   }
 
@@ -60,11 +56,7 @@ export class ClientMsgRateLimiter {
         tokensPerInterval: INTENTS_PER_MINUTE,
         interval: "minute",
       }),
-      bytesPerMinute: new RateLimiter({
-        tokensPerInterval: MAX_BYTES_PER_MINUTE,
-        interval: "minute",
-      }),
-      winnerMsgCount: 0,
+      totalBytes: 0,
     };
     this.buckets.set(clientID, bucket);
     return bucket;