Files
OpenFrontIO/tests/core/execution/SpawnExecution.test.ts
T
fabd1bd2d1 fix(core): reject spawn intents after the spawn phase (anti-teleport) (#4657)
## Problem
Patches sending the `spawn` intent over the game WebSocket while a match
is underway:

```js
ws.send(JSON.stringify({ type: "intent", intent: { type: "spawn", tile: tileRef } }));
```

The server relays it like any intent, and `SpawnExecution.tick()` then
**relinquishes the player's entire territory and re-conquers it at the
target tile** — instant teleport anywhere on the map.

The root cause is that `SpawnExecution.tick()` had no spawn-phase gate
(only a random-spawn re-roll guard), and the engine ticks the execution
**both during and after** the spawn phase (`activeDuringSpawnPhase()` is
`true`, and after the phase `!inSpawnPhase()` is also `true`).

## Fix

Ignore a spawn intent when the game is no longer in the spawn phase
**and** the player has already spawned:

```js
if (!this.mg.inSpawnPhase() && player.hasSpawned()) {
  return;
}
```

Because `inSpawnPhase()` / `hasSpawned()` are deterministic game state,
the intent becomes a no-op identically on every client — no desync.

Unaffected:
- First-time spawns (`hasSpawned()` is false)
- In-phase spawn picks and re-picks (`inSpawnPhase()` is true)
- Existing random-spawn re-roll protection (kept as-is)

## Tests

- Added `Spawn intent after the spawn phase cannot relocate territory
(anti-teleport)` — establishes a player, then asserts a later `spawn`
intent leaves `spawnTile()` and `numTilesOwned()` unchanged.
- Simplified `Spawn on specific tile` to a single first spawn (the
previous version relied on an out-of-phase re-pick, which this fix now
correctly forbids).
- Full `tests/core` suite green (259 tests).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-21 09:22:41 -07:00

165 lines
5.3 KiB
TypeScript

import { SpawnExecution } from "../../../src/core/execution/SpawnExecution";
import { PlayerInfo, PlayerType } from "../../../src/core/game/Game";
import { setup } from "../../util/Setup";
describe("Spawn execution", () => {
// Manually calculated based on number of tiles in manifest of each map
// and minimum distance between players in PlayerSpawner
test.each([
["big_plains", 49],
["half_land_half_ocean", 1],
["ocean_and_land", 1],
["plains", 9],
])(
"Spawn location is found for all players in %s map with %i players",
async (mapName, maxPlayers) => {
const players: PlayerInfo[] = [];
const spawnExecutions: SpawnExecution[] = [];
for (let i = 0; i < maxPlayers; i++) {
const playerInfo = new PlayerInfo(
`player${i}`,
PlayerType.Human,
`client_id${i}`,
`player_id${i}`,
);
players.push(playerInfo);
spawnExecutions.push(new SpawnExecution("game_id", playerInfo));
}
const game = await setup(mapName, {}, players);
game.addExecution(...spawnExecutions);
game.executeNextTick();
game.executeNextTick();
game.allPlayers().forEach((player) => {
const spawnTile = player.spawnTile()!;
expect(spawnTile).toEqual(expect.any(Number));
expect(game.isLand(spawnTile)).toBe(true);
expect(game.isBorder(spawnTile)).toBe(false);
});
for (let i = 0; i < game.allPlayers().length; i++) {
for (let j = i + 1; j < game.allPlayers().length; j++) {
const distance = game.manhattanDist(
game.allPlayers()[i].spawnTile()!,
game.allPlayers()[j].spawnTile()!,
);
expect(distance).toBeGreaterThanOrEqual(
game.config().minDistanceBetweenPlayers(),
);
}
}
},
);
test("Handles spawn failure when map is too crowded", async () => {
const players: PlayerInfo[] = [];
const spawnExecutions: SpawnExecution[] = [];
// Try to spawn more players than possible on a small map
for (let i = 0; i < 5; i++) {
const playerInfo = new PlayerInfo(
`player${i}`,
PlayerType.Human,
`client_id${i}`,
`player_id${i}`,
);
players.push(playerInfo);
spawnExecutions.push(new SpawnExecution("game_id", playerInfo));
}
const game = await setup("half_land_half_ocean", {}, players);
game.addExecution(...spawnExecutions);
game.executeNextTick();
game.executeNextTick();
// Should spawn fewer than requested when map is too small
expect(
game.allPlayers().filter((player) => player.spawnTile() !== undefined)
.length,
).toBe(1);
});
test("Spawn on specific tile", async () => {
const playerInfo = new PlayerInfo(
`player`,
PlayerType.Human,
`client_id`,
`player_id`,
);
const game = await setup("half_land_half_ocean", {}, [playerInfo]);
game.addExecution(new SpawnExecution("game_id", playerInfo, 20));
game.executeNextTick();
game.executeNextTick();
const player = game.playerByClientID("client_id")!;
expect(player.spawnTile()).toBe(20);
expect(player.numTilesOwned()).toBeGreaterThan(0);
});
test("Spawn intent after the spawn phase cannot relocate territory (anti-teleport)", async () => {
const playerInfo = new PlayerInfo(
`player`,
PlayerType.Human,
`client_id`,
`player_id`,
);
// setup() ends the spawn phase by default, so the game is already underway.
const game = await setup("half_land_half_ocean", {}, [playerInfo]);
// Establish the player's territory with a legitimate first spawn.
game.addExecution(new SpawnExecution("game_id", playerInfo, 20));
game.executeNextTick();
game.executeNextTick();
const player = game.playerByClientID("client_id")!;
expect(player.spawnTile()).toBe(20);
const tilesBefore = player.numTilesOwned();
expect(tilesBefore).toBeGreaterThan(0);
// Malicious "teleport": a spawn intent to a new tile after the game has
// started must be a deterministic no-op — the player keeps their original
// spawn location and territory rather than relinquishing and re-conquering.
game.addExecution(new SpawnExecution("game_id", playerInfo, 10));
game.executeNextTick();
game.executeNextTick();
expect(player.spawnTile()).toBe(20);
expect(player.numTilesOwned()).toBe(tilesBefore);
});
test("Random spawn ignores client-specified tile", async () => {
const playerInfo = new PlayerInfo(
`player`,
PlayerType.Human,
`client_id`,
`player_id`,
);
const game = await setup("half_land_half_ocean", { randomSpawn: true }, [
playerInfo,
]);
// Simulate a malicious client sending a spawn intent with a specific tile
const maliciousTile = 10;
game.addExecution(new SpawnExecution("game_id", playerInfo, maliciousTile));
game.executeNextTick();
game.executeNextTick();
const player = game.playerByClientID("client_id")!;
expect(player.hasSpawned()).toBe(true);
// The spawn tile should NOT be the client-specified tile —
// random spawn must bypass the client's choice.
expect(player.spawnTile()).not.toBe(maliciousTile);
expect(player.spawnTile()).toEqual(expect.any(Number));
expect(game.isLand(player.spawnTile()!)).toBe(true);
});
});