Better username censoring (#3122)

## Description:

Many inapropriate names bypass the current filter. This PR does the
following:

1. Moves name censoring to server side so inappropriate names are
scrubbed before being sent to the client
2. Requests a list of profane words from the api, this allows us to
quickly add new profane words in the admin panel without having to
redeploy.

## Please complete the following:

- [x] I have added screenshots for all UI updates
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [x] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced

## Please put your Discord username so you can be contacted if a bug or
regression is found:

evan

src/server/Client.ts

@@ -18,6 +18,7 @@ export class Client {
     public readonly flares: string[] | undefined,
     public readonly ip: string,
     public readonly username: string,
+    public readonly uncensoredUsername: string,
     public ws: WebSocket,
     public readonly cosmetics: PlayerCosmetics | undefined,
   ) {}

src/server/Privilege.ts

@@ -1,3 +1,14 @@
+import {
+  DataSet,
+  RegExpMatcher,
+  collapseDuplicatesTransformer,
+  englishDataset,
+  pattern,
+  resolveConfusablesTransformer,
+  resolveLeetSpeakTransformer,
+  skipNonAlphabeticTransformer,
+  toAsciiLowerCaseTransformer,
+} from "obscenity";
 import { Cosmetics } from "../core/CosmeticSchemas";
 import { decodePatternData } from "../core/PatternDecoder";
 import {
@@ -7,6 +18,95 @@ import {
   PlayerCosmetics,
   PlayerPattern,
 } from "../core/Schemas";
+import { getClanTagOriginalCase, simpleHash } from "../core/Util";
+
+export const shadowNames = [
+  "UnhuggedToday",
+  "DaddysLilChamp",
+  "BunnyKisses67",
+  "SnugglePuppy",
+  "CuddleMonster67",
+  "DaddysLilStar",
+  "SnuggleMuffin",
+  "PeesALittle",
+  "PleaseFullSendMe",
+  "NanasLilMan",
+  "NoAlliances",
+  "TryingTooHard67",
+  "MommysLilStinker",
+  "NeedHugs",
+  "MommysLilPeanut",
+  "IWillBetrayU",
+  "DaddysLilTater",
+  "PreciousBubbles",
+  "67 Cringelord",
+  "Peace And Love",
+  "AlmostPottyTrained",
+];
+
+export function createMatcher(bannedWords: string[]): RegExpMatcher {
+  const customDataset = new DataSet<{ originalWord: string }>().addAll(
+    englishDataset,
+  );
+
+  for (const word of bannedWords) {
+    customDataset.addPhrase((phrase) =>
+      phrase.setMetadata({ originalWord: word }).addPattern(pattern`${word}`),
+    );
+  }
+
+  return new RegExpMatcher({
+    ...customDataset.build(),
+    blacklistMatcherTransformers: [
+      toAsciiLowerCaseTransformer(),
+      resolveConfusablesTransformer(),
+      resolveLeetSpeakTransformer(),
+      collapseDuplicatesTransformer(),
+      skipNonAlphabeticTransformer(),
+    ],
+  });
+}
+
+/**
+ * Sanitizes and censors profane usernames and clan tags.
+ * Profane username is overwritten, profane clan tag is removed.
+ *
+ * Removing bad clan tags won't hurt existing clans nor cause desyncs:
+ * - full name including clan tag was overwritten in the past, if any part of name was bad
+ * - only each separate local player name with a profane clan tag will remain, no clan team assignment
+ *
+ * Examples:
+ * - "GoodName" -> "GoodName"
+ * - "BadName" -> "Censored"
+ * - "[CLAN]GoodName" -> "[CLAN]GoodName"
+ * - "[CLaN]BadName" -> "[CLAN] Censored"
+ * - "[BAD]GoodName" -> "GoodName"
+ * - "[BAD]BadName" -> "Censored"
+ */
+function censorUsernameWithMatcher(
+  username: string,
+  matcher: RegExpMatcher,
+): string {
+  const clanTag = getClanTagOriginalCase(username);
+
+  const nameWithoutClan = clanTag
+    ? username.replace(`[${clanTag}]`, "").trim()
+    : username;
+
+  const clanTagIsProfane = clanTag ? matcher.hasMatch(clanTag) : false;
+  const usernameIsProfane = matcher.hasMatch(nameWithoutClan);
+
+  const censoredName = usernameIsProfane
+    ? shadowNames[simpleHash(nameWithoutClan) % shadowNames.length]
+    : nameWithoutClan;
+
+  // Restore clan tag only if it's clean, otherwise remove it entirely
+  if (clanTag && !clanTagIsProfane) {
+    return `[${clanTag.toUpperCase()}] ${censoredName}`;
+  }
+
+  return censoredName;
+}
 
 type CosmeticResult =
   | { type: "allowed"; cosmetics: PlayerCosmetics }
@@ -14,13 +114,19 @@ type CosmeticResult =
 
 export interface PrivilegeChecker {
   isAllowed(flares: string[], refs: PlayerCosmeticRefs): CosmeticResult;
+  censorUsername(username: string): string;
 }
 
 export class PrivilegeCheckerImpl implements PrivilegeChecker {
+  private matcher: RegExpMatcher;
+
   constructor(
     private cosmetics: Cosmetics,
     private b64urlDecode: (base64: string) => Uint8Array,
-  ) {}
+    bannedWords: string[],
+  ) {
+    this.matcher = createMatcher(bannedWords);
+  }
 
   isAllowed(flares: string[], refs: PlayerCosmeticRefs): CosmeticResult {
     const cosmetics: PlayerCosmetics = {};
@@ -106,10 +212,22 @@ export class PrivilegeCheckerImpl implements PrivilegeChecker {
     }
     return { color };
   }
+
+  censorUsername(username: string): string {
+    return censorUsernameWithMatcher(username, this.matcher);
+  }
 }
 
+// Default matcher with no custom banned words (just englishDataset)
+const defaultMatcher = createMatcher([]);
+
 export class FailOpenPrivilegeChecker implements PrivilegeChecker {
   isAllowed(flares: string[], refs: PlayerCosmeticRefs): CosmeticResult {
     return { type: "allowed", cosmetics: {} };
   }
+
+  censorUsername(username: string): string {
+    // Fail open: use matcher with just the built-in English profanity dataset
+    return censorUsernameWithMatcher(username, defaultMatcher);
+  }
 }

src/server/PrivilegeRefresher.ts

@@ -8,7 +8,7 @@ import {
   PrivilegeCheckerImpl,
 } from "./Privilege";
 
-// Refreshes the privilege checker every 5 minutes.
+// Refreshes the privilege checker every 3 minutes.
 // WARNING: This fails open if cosmetics.json is not available.
 export class PrivilegeRefresher {
   private privilegeChecker: PrivilegeChecker | null = null;
@@ -18,7 +18,9 @@ export class PrivilegeRefresher {
   private log: Logger;
 
   constructor(
-    private endpoint: string,
+    private cosmeticsEndpoint: string,
+    private profaneWordsEndpoint: string,
+    private apiKey: string,
     parentLog: Logger,
     private refreshInterval: number = 1000 * 60 * 3,
   ) {
@@ -37,27 +39,62 @@ export class PrivilegeRefresher {
   }
 
   private async loadPrivilegeChecker(): Promise<void> {
-    this.log.info(`Loading privilege checker from ${this.endpoint}`);
+    this.log.info(`Loading privilege checker`);
     try {
-      const response = await fetch(this.endpoint);
-      if (!response.ok) {
-        throw new Error(`HTTP error! status: ${response.status}`);
+      const fetchWithTimeout = async (url: string) => {
+        try {
+          return await fetch(url, {
+            signal: AbortSignal.timeout(5000),
+            headers: { "x-api-key": this.apiKey },
+          });
+        } catch (error) {
+          this.log.warn(`Failed to fetch ${url}: ${error}`);
+          return null;
+        }
+      };
+
+      const [cosmeticsResponse, profaneWordsResponse] = await Promise.all([
+        fetchWithTimeout(this.cosmeticsEndpoint),
+        fetchWithTimeout(this.profaneWordsEndpoint),
+      ]);
+
+      if (!cosmeticsResponse || !cosmeticsResponse.ok) {
+        throw new Error(
+          `Cosmetics HTTP error! status: ${cosmeticsResponse?.status ?? "network error"}`,
+        );
       }
 
-      const cosmeticsData = await response.json();
+      const cosmeticsData = await cosmeticsResponse.json();
       const result = CosmeticsSchema.safeParse(cosmeticsData);
 
       if (!result.success) {
         throw new Error(`Invalid cosmetics data: ${result.error.message}`);
       }
 
+      let bannedWords: string[] = [];
+      if (profaneWordsResponse && profaneWordsResponse.ok) {
+        try {
+          bannedWords = await profaneWordsResponse.json();
+          this.log.info(
+            `Loaded ${bannedWords.length} profane words from ${this.profaneWordsEndpoint}`,
+          );
+        } catch (error) {
+          this.log.warn(`Failed to parse profane words JSON, using empty list`);
+        }
+      } else {
+        this.log.warn(
+          `Failed to fetch profane words (status ${profaneWordsResponse?.status ?? "network error"}), using empty list`,
+        );
+      }
+
       this.privilegeChecker = new PrivilegeCheckerImpl(
         result.data,
         base64url.decode,
+        bannedWords,
       );
       this.log.info(`Privilege checker loaded successfully`);
     } catch (error) {
-      this.log.error(`Failed to fetch cosmetics from ${this.endpoint}:`, error);
+      this.log.error(`Failed to load privilege checker:`, error);
       throw error;
     }
   }

src/server/Worker.ts

@@ -67,6 +67,8 @@ export async function startWorker() {
 
   const privilegeRefresher = new PrivilegeRefresher(
     config.jwtIssuer() + "/cosmetics.json",
+    config.jwtIssuer() + "/profane_words_game_server",
+    config.apiKey(),
     log,
   );
   privilegeRefresher.start();
@@ -436,6 +438,11 @@ export async function startWorker() {
           }
         }
 
+        // Censor profane usernames server-side (don't reject, just rename)
+        const censoredUsername = privilegeRefresher
+          .get()
+          .censorUsername(clientMsg.username);
+
         // Create client and add to game
         const client = new Client(
           generateID(),
@@ -444,6 +451,7 @@ export async function startWorker() {
           roles,
           flares,
           ip,
+          censoredUsername,
           clientMsg.username,
           ws,
           cosmeticResult.cosmetics,