mirror of
https://github.com/openfrontio/OpenFrontIO.git
synced 2026-07-23 18:20:52 +00:00
## Problem
Patches sending the `spawn` intent over the game WebSocket while a match
is underway:
```js
ws.send(JSON.stringify({ type: "intent", intent: { type: "spawn", tile: tileRef } }));
```
The server relays it like any intent, and `SpawnExecution.tick()` then
**relinquishes the player's entire territory and re-conquers it at the
target tile** — instant teleport anywhere on the map.
The root cause is that `SpawnExecution.tick()` had no spawn-phase gate
(only a random-spawn re-roll guard), and the engine ticks the execution
**both during and after** the spawn phase (`activeDuringSpawnPhase()` is
`true`, and after the phase `!inSpawnPhase()` is also `true`).
## Fix
Ignore a spawn intent when the game is no longer in the spawn phase
**and** the player has already spawned:
```js
if (!this.mg.inSpawnPhase() && player.hasSpawned()) {
return;
}
```
Because `inSpawnPhase()` / `hasSpawned()` are deterministic game state,
the intent becomes a no-op identically on every client — no desync.
Unaffected:
- First-time spawns (`hasSpawned()` is false)
- In-phase spawn picks and re-picks (`inSpawnPhase()` is true)
- Existing random-spawn re-roll protection (kept as-is)
## Tests
- Added `Spawn intent after the spawn phase cannot relocate territory
(anti-teleport)` — establishes a player, then asserts a later `spawn`
intent leaves `spawnTile()` and `numTilesOwned()` unchanged.
- Simplified `Spawn on specific tile` to a single first spawn (the
previous version relied on an out-of-phase re-pick, which this fix now
correctly forbids).
- Full `tests/core` suite green (259 tests).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
165 lines
5.3 KiB
TypeScript
165 lines
5.3 KiB
TypeScript
import { SpawnExecution } from "../../../src/core/execution/SpawnExecution";
|
|
import { PlayerInfo, PlayerType } from "../../../src/core/game/Game";
|
|
import { setup } from "../../util/Setup";
|
|
|
|
describe("Spawn execution", () => {
|
|
// Manually calculated based on number of tiles in manifest of each map
|
|
// and minimum distance between players in PlayerSpawner
|
|
test.each([
|
|
["big_plains", 49],
|
|
["half_land_half_ocean", 1],
|
|
["ocean_and_land", 1],
|
|
["plains", 9],
|
|
])(
|
|
"Spawn location is found for all players in %s map with %i players",
|
|
async (mapName, maxPlayers) => {
|
|
const players: PlayerInfo[] = [];
|
|
const spawnExecutions: SpawnExecution[] = [];
|
|
for (let i = 0; i < maxPlayers; i++) {
|
|
const playerInfo = new PlayerInfo(
|
|
`player${i}`,
|
|
PlayerType.Human,
|
|
`client_id${i}`,
|
|
`player_id${i}`,
|
|
);
|
|
players.push(playerInfo);
|
|
|
|
spawnExecutions.push(new SpawnExecution("game_id", playerInfo));
|
|
}
|
|
|
|
const game = await setup(mapName, {}, players);
|
|
|
|
game.addExecution(...spawnExecutions);
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
game.allPlayers().forEach((player) => {
|
|
const spawnTile = player.spawnTile()!;
|
|
expect(spawnTile).toEqual(expect.any(Number));
|
|
expect(game.isLand(spawnTile)).toBe(true);
|
|
expect(game.isBorder(spawnTile)).toBe(false);
|
|
});
|
|
|
|
for (let i = 0; i < game.allPlayers().length; i++) {
|
|
for (let j = i + 1; j < game.allPlayers().length; j++) {
|
|
const distance = game.manhattanDist(
|
|
game.allPlayers()[i].spawnTile()!,
|
|
game.allPlayers()[j].spawnTile()!,
|
|
);
|
|
expect(distance).toBeGreaterThanOrEqual(
|
|
game.config().minDistanceBetweenPlayers(),
|
|
);
|
|
}
|
|
}
|
|
},
|
|
);
|
|
|
|
test("Handles spawn failure when map is too crowded", async () => {
|
|
const players: PlayerInfo[] = [];
|
|
const spawnExecutions: SpawnExecution[] = [];
|
|
|
|
// Try to spawn more players than possible on a small map
|
|
for (let i = 0; i < 5; i++) {
|
|
const playerInfo = new PlayerInfo(
|
|
`player${i}`,
|
|
PlayerType.Human,
|
|
`client_id${i}`,
|
|
`player_id${i}`,
|
|
);
|
|
players.push(playerInfo);
|
|
|
|
spawnExecutions.push(new SpawnExecution("game_id", playerInfo));
|
|
}
|
|
|
|
const game = await setup("half_land_half_ocean", {}, players);
|
|
|
|
game.addExecution(...spawnExecutions);
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
// Should spawn fewer than requested when map is too small
|
|
expect(
|
|
game.allPlayers().filter((player) => player.spawnTile() !== undefined)
|
|
.length,
|
|
).toBe(1);
|
|
});
|
|
|
|
test("Spawn on specific tile", async () => {
|
|
const playerInfo = new PlayerInfo(
|
|
`player`,
|
|
PlayerType.Human,
|
|
`client_id`,
|
|
`player_id`,
|
|
);
|
|
|
|
const game = await setup("half_land_half_ocean", {}, [playerInfo]);
|
|
|
|
game.addExecution(new SpawnExecution("game_id", playerInfo, 20));
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
const player = game.playerByClientID("client_id")!;
|
|
expect(player.spawnTile()).toBe(20);
|
|
expect(player.numTilesOwned()).toBeGreaterThan(0);
|
|
});
|
|
|
|
test("Spawn intent after the spawn phase cannot relocate territory (anti-teleport)", async () => {
|
|
const playerInfo = new PlayerInfo(
|
|
`player`,
|
|
PlayerType.Human,
|
|
`client_id`,
|
|
`player_id`,
|
|
);
|
|
|
|
// setup() ends the spawn phase by default, so the game is already underway.
|
|
const game = await setup("half_land_half_ocean", {}, [playerInfo]);
|
|
|
|
// Establish the player's territory with a legitimate first spawn.
|
|
game.addExecution(new SpawnExecution("game_id", playerInfo, 20));
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
const player = game.playerByClientID("client_id")!;
|
|
expect(player.spawnTile()).toBe(20);
|
|
const tilesBefore = player.numTilesOwned();
|
|
expect(tilesBefore).toBeGreaterThan(0);
|
|
|
|
// Malicious "teleport": a spawn intent to a new tile after the game has
|
|
// started must be a deterministic no-op — the player keeps their original
|
|
// spawn location and territory rather than relinquishing and re-conquering.
|
|
game.addExecution(new SpawnExecution("game_id", playerInfo, 10));
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
expect(player.spawnTile()).toBe(20);
|
|
expect(player.numTilesOwned()).toBe(tilesBefore);
|
|
});
|
|
|
|
test("Random spawn ignores client-specified tile", async () => {
|
|
const playerInfo = new PlayerInfo(
|
|
`player`,
|
|
PlayerType.Human,
|
|
`client_id`,
|
|
`player_id`,
|
|
);
|
|
|
|
const game = await setup("half_land_half_ocean", { randomSpawn: true }, [
|
|
playerInfo,
|
|
]);
|
|
|
|
// Simulate a malicious client sending a spawn intent with a specific tile
|
|
const maliciousTile = 10;
|
|
game.addExecution(new SpawnExecution("game_id", playerInfo, maliciousTile));
|
|
game.executeNextTick();
|
|
game.executeNextTick();
|
|
|
|
const player = game.playerByClientID("client_id")!;
|
|
expect(player.hasSpawned()).toBe(true);
|
|
// The spawn tile should NOT be the client-specified tile —
|
|
// random spawn must bypass the client's choice.
|
|
expect(player.spawnTile()).not.toBe(maliciousTile);
|
|
expect(player.spawnTile()).toEqual(expect.any(Number));
|
|
expect(game.isLand(player.spawnTile()!)).toBe(true);
|
|
});
|
|
});
|