ttrpg_manager/server/src/index.ts

import path from 'node:path';
import Fastify from 'fastify';
import fastifyWebsocket from '@fastify/websocket';
import fastifyStatic from '@fastify/static';
import type { FastifyRequest } from 'fastify';
import { clientMessageSchema, type ServerMessage } from '@/lib/sync/messages';
import { promises as fs } from 'node:fs';
import { RoomHub, type Sender } from './rooms';
import { AccountStore, DEFAULT_QUOTA_BYTES } from './accounts';
import { CloudStore, MAX_CHARACTER_BYTES } from './campaigns';

const PORT = Number(process.env.PORT ?? 8787);
const STATIC_DIR = path.resolve(process.env.STATIC_DIR ?? path.join(process.cwd(), 'dist'));
const DATA_DIR = path.resolve(process.env.DATA_DIR ?? path.join(process.cwd(), 'data'));
const MAX_PAYLOAD = 12 * 1024 * 1024; // 12 MB (map images over WS)
const BODY_LIMIT = 32 * 1024 * 1024; // 32 MB (cloud backup blobs; > the per-user quota)
const ALLOWED_ORIGINS = (process.env.ALLOWED_ORIGINS ?? '').split(',').map((s) => s.trim()).filter(Boolean);
const ADMIN_USERS = (process.env.ADMIN_USERS ?? '').split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
const MAX_USERS = Number(process.env.MAX_USERS) || Infinity;
// Concurrent WebSocket connections allowed from one client IP — generous for a
// household sharing a NAT, but a hard stop on socket-spam room/image floods.
const MAX_WS_PER_IP = Number(process.env.MAX_WS_PER_IP) || 20;

const bearer = (req: FastifyRequest): string | undefined => {
  const h = req.headers.authorization;
  return h?.startsWith('Bearer ') ? h.slice(7) : undefined;
};

// per-socket token bucket: 80 messages / 10s
const RATE = { capacity: 80, refillMs: 10_000 };
// Protocol-level keepalive: ping each socket on an interval and terminate one
// that misses a pong, so a vanished player (closed laptop, dead network) is
// detected and drops out of the GM's roster within ~one interval.
const HEARTBEAT_MS = 30_000;

export function buildServer() {
  // trustProxy: behind Traefik the socket peer is the proxy, so without this every
  // visitor shares one rate-limit bucket. Trust the proxy's X-Forwarded-For so
  // req.ip is the real client. Only Traefik can reach the container, so this is safe.
  const app = Fastify({ bodyLimit: BODY_LIMIT, trustProxy: true });
  // Tolerate a body-less request that still sets content-type: application/json
  // (browsers/fetch wrappers often do this for DELETE/POST-with-no-body). The
  // default parser 400s on an empty JSON body; every handler treats a missing
  // body as {}, so parse empty → undefined instead.
  app.addContentTypeParser('application/json', { parseAs: 'string' }, (_req, body, done) => {
    const s = (body as string).trim();
    if (!s) return done(null, undefined);
    try { done(null, JSON.parse(s)); }
    catch { const err = new Error('Invalid JSON') as Error & { statusCode?: number }; err.statusCode = 400; done(err, undefined); }
  });
  const hub = new RoomHub();
  const accounts = new AccountStore(DATA_DIR, undefined, ADMIN_USERS, MAX_USERS);
  void accounts.load();
  const cloud = new CloudStore(DATA_DIR);
  void cloud.load();
  const sweeper = setInterval(() => { hub.sweep(); pruneRateBuckets(); }, 5 * 60 * 1000);
  app.addHook('onClose', async () => clearInterval(sweeper));

  // Per-IP throttle for the account/cloud API. Auth endpoints get a tighter bucket
  // since each call does password hashing and is the target of credential-stuffing.
  const ipHits = new Map<string, { n: number; reset: number }>();
  const authHits = new Map<string, { n: number; reset: number }>();
  const AUTH_PATHS = new Set(['/api/register', '/api/login']);
  const bump = (map: Map<string, { n: number; reset: number }>, ip: string, limit: number, windowMs: number): boolean => {
    const now = Date.now();
    const e = map.get(ip);
    if (!e || now > e.reset) { map.set(ip, { n: 1, reset: now + windowMs }); return true; }
    return ++e.n <= limit;
  };
  const pruneRateBuckets = () => {
    const now = Date.now();
    for (const [ip, e] of ipHits) if (now > e.reset) ipHits.delete(ip);
    for (const [ip, e] of authHits) if (now > e.reset) authHits.delete(ip);
  };
  app.addHook('onRequest', async (req, reply) => {
    if (!req.url.startsWith('/api/')) return;
    if (!bump(ipHits, req.ip, 60, 60_000)) return reply.code(429).send({ error: 'rate' });
    // Strip the querystring before matching the auth path.
    const path0 = req.url.split('?')[0]!;
    if (AUTH_PATHS.has(path0) && !bump(authHits, req.ip, 10, 60_000)) {
      return reply.code(429).send({ error: 'rate', message: 'Too many attempts — wait a minute and try again.' });
    }
  });

  // ---- accounts + cloud backup sync ----
  app.post('/api/register', async (req, reply) => {
    const { username, password } = (req.body ?? {}) as { username?: string; password?: string };
    const r = await accounts.register(String(username ?? ''), String(password ?? ''));
    if (!r.ok) return reply.code(r.code === 'closed' ? 503 : 400).send({ error: r.code, message: r.message });
    return { token: r.token, username: r.username };
  });
  app.post('/api/login', async (req, reply) => {
    const { username, password } = (req.body ?? {}) as { username?: string; password?: string };
    const r = await accounts.login(String(username ?? ''), String(password ?? ''));
    if (!r.ok) return reply.code(401).send({ error: r.code, message: r.message });
    return { token: r.token, username: r.username };
  });
  app.post('/api/logout', async (req) => { const t = bearer(req); if (t) await accounts.logout(t); return { ok: true }; });
  app.put('/api/save', async (req, reply) => {
    const u = await accounts.userByToken(bearer(req));
    if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const body = (req.body as { blob?: string; baseSavedAt?: number | null } | undefined) ?? {};
    if (typeof body.blob !== 'string') return reply.code(400).send({ error: 'bad-blob' });
    // Quota: the backup blob plus the user's published characters must fit their limit.
    const projected = Buffer.byteLength(body.blob) + (await cloud.usageBytes(u.id));
    if (projected > accounts.quotaFor(u)) {
      return reply.code(413).send({ error: 'quota', message: 'Cloud storage limit reached. Trim old data or ask the admin to raise your quota.', limit: accounts.quotaFor(u) });
    }
    // Optimistic concurrency: if the caller names the version it last synced and
    // the cloud has since moved on (another device pushed), refuse — no silent
    // overwrite. The client then resolves (pull, or force-push).
    const current = await accounts.blobSavedAt(u.id);
    if (current !== null && body.baseSavedAt !== undefined && body.baseSavedAt !== null && body.baseSavedAt !== current) {
      return reply.code(409).send({ error: 'conflict', savedAt: current });
    }
    const savedAt = await accounts.saveBlob(u.id, body.blob);
    return { ok: true, size: body.blob.length, savedAt };
  });
  app.get('/api/save', async (req, reply) => {
    const u = await accounts.userByToken(bearer(req));
    if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const blob = await accounts.loadBlob(u.id);
    if (blob === null) return reply.code(404).send({ error: 'no-save' });
    const savedAt = await accounts.blobSavedAt(u.id);
    return reply.header('content-type', 'application/json').header('x-saved-at', String(savedAt ?? '')).send(blob);
  });

  // ---- shared cloud campaigns + member-owned characters ----
  const userOf = (req: FastifyRequest) => accounts.userByToken(bearer(req));
  app.post('/api/campaigns', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const { name, system } = (req.body ?? {}) as { name?: string; system?: string };
    const c = await cloud.createCampaign(u.id, String(name ?? ''), String(system ?? '5e'));
    return { id: c.id, name: c.name, system: c.system, inviteCode: c.inviteCode, role: 'owner' };
  });
  app.get('/api/campaigns', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const list = await cloud.listForUser(u.id);
    return list.map((c) => ({ id: c.id, name: c.name, system: c.system, role: c.role, ...(c.role === 'owner' ? { inviteCode: c.inviteCode } : {}) }));
  });
  app.post('/api/campaigns/join', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const { inviteCode } = (req.body ?? {}) as { inviteCode?: string };
    const c = await cloud.joinByInvite(u.id, String(inviteCode ?? ''));
    if (!c) return reply.code(404).send({ error: 'no-campaign', message: 'No campaign with that invite code.' });
    return { id: c.id, name: c.name, system: c.system, role: c.ownerUserId === u.id ? 'owner' : 'member' };
  });
  app.post('/api/campaigns/:id/invite', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const code = await cloud.rotateInvite(u.id, (req.params as { id: string }).id);
    return code ? { inviteCode: code } : reply.code(403).send({ error: 'forbidden', message: 'Only the campaign owner can rotate the invite.' });
  });
  app.delete('/api/campaigns/:id/members/:userId', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const p = req.params as { id: string; userId: string };
    const ok = await cloud.removeMember(u.id, p.id, p.userId);
    return ok ? { ok: true } : reply.code(403).send({ error: 'forbidden' });
  });
  app.put('/api/characters', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const { campaignId, character } = (req.body ?? {}) as { campaignId?: string; character?: { id?: string; name?: string; data?: string } };
    if (!campaignId || !character?.id || typeof character.data !== 'string') return reply.code(400).send({ error: 'bad-request' });
    if (Buffer.byteLength(character.data) > MAX_CHARACTER_BYTES) return reply.code(413).send({ error: 'too-large', message: 'That character is too large to publish.' });
    // Quota: total usage after this upsert (replace the old copy's bytes with the new).
    const delta = Buffer.byteLength(character.data) - (cloud.ownsCharacter(u.id, character.id) ? await cloud.characterBytes(character.id) : 0);
    const projected = (await accounts.blobBytes(u.id)) + (await cloud.usageBytes(u.id)) + delta;
    if (projected > accounts.quotaFor(u)) {
      return reply.code(413).send({ error: 'quota', message: 'Cloud storage limit reached.', limit: accounts.quotaFor(u) });
    }
    const r = await cloud.putCharacter(u.id, campaignId, { id: character.id, name: String(character.name ?? ''), data: character.data });
    if (!r) return reply.code(403).send({ error: 'forbidden', message: 'Not a member, you do not own that character, or it is too large.' });
    return { ok: true, updatedAt: r.updatedAt };
  });
  app.get('/api/campaigns/:id/characters', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const id = (req.params as { id: string }).id;
    await cloud.load();
    if (!cloud.isMember(id, u.id)) return reply.code(403).send({ error: 'forbidden' });
    const chars = await cloud.listCharacters(id);
    return chars.map((c) => ({ id: c.id, name: c.name, ownerUserId: c.ownerUserId, mine: c.ownerUserId === u.id, data: c.data, updatedAt: c.updatedAt }));
  });
  app.delete('/api/characters/:id', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const ok = await cloud.removeCharacter(u.id, (req.params as { id: string }).id);
    return ok ? { ok: true } : reply.code(403).send({ error: 'forbidden' });
  });
  app.get('/api/usage', async (req, reply) => {
    const u = await userOf(req); if (!u) return reply.code(401).send({ error: 'unauthorized' });
    const bytes = (await accounts.blobBytes(u.id)) + (await cloud.usageBytes(u.id));
    return { bytes, quota: accounts.quotaFor(u), admin: accounts.isAdmin(u.username) };
  });

  // ---- admin panel API (accounts in ADMIN_USERS only) ----
  const startedAt = Date.now();
  const adminOf = async (req: FastifyRequest) => {
    const u = await userOf(req);
    return u && accounts.isAdmin(u.username) ? u : null;
  };
  /** Recursive byte total of the data dir (users.json + cloud.json + blobs). */
  const dirBytes = async (dir: string): Promise<number> => {
    let total = 0;
    try {
      for (const e of await fs.readdir(dir, { withFileTypes: true })) {
        const p = path.join(dir, e.name);
        if (e.isDirectory()) total += await dirBytes(p);
        else total += (await fs.stat(p)).size.valueOf();
      }
    } catch { /* missing dir = 0 */ }
    return total;
  };

  app.get('/api/admin/overview', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const mem = process.memoryUsage();
    const roomStats = hub.stats();
    const totals = await cloud.totals();
    return {
      uptimeMs: Date.now() - startedAt,
      memory: { rss: mem.rss, heapUsed: mem.heapUsed },
      dataDirBytes: await dirBytes(DATA_DIR),
      users: { count: accounts.userCount(), max: Number.isFinite(MAX_USERS) ? MAX_USERS : null },
      defaultQuotaBytes: DEFAULT_QUOTA_BYTES,
      campaigns: totals.campaigns,
      characters: totals.characters,
      characterBytes: totals.bytes,
      rooms: {
        count: roomStats.length,
        players: roomStats.reduce((n, r) => n + r.players, 0),
        imageBytes: roomStats.reduce((n, r) => n + r.imageBytes, 0),
      },
    };
  });

  app.get('/api/admin/users', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const users = await accounts.listUsersDetailed();
    const rows = await Promise.all(users.map(async (x) => ({
      username: x.username,
      admin: x.admin,
      createdAt: x.createdAt,
      usageBytes: (await accounts.blobBytes(x.id)) + (await cloud.usageBytes(x.id)),
      quotaBytes: x.quotaBytes,
      effectiveQuota: x.quotaBytes > 0 ? x.quotaBytes : DEFAULT_QUOTA_BYTES,
      tokenCount: x.tokenCount,
    })));
    return { users: rows.sort((a, b) => b.usageBytes - a.usageBytes) };
  });

  app.post('/api/admin/quota', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const { username, quotaBytes } = (req.body ?? {}) as { username?: string; quotaBytes?: number };
    const ok = await accounts.setQuota(String(username ?? ''), Number(quotaBytes) || 0);
    return ok ? { ok: true } : reply.code(404).send({ error: 'no-user' });
  });

  app.post('/api/admin/users/:username/revoke', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const ok = await accounts.revokeTokens((req.params as { username: string }).username);
    return ok ? { ok: true } : reply.code(404).send({ error: 'no-user' });
  });

  app.delete('/api/admin/users/:username', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const name = (req.params as { username: string }).username;
    const id = await accounts.deleteUser(name);
    if (!id) return reply.code(400).send({ error: 'cannot-delete', message: 'No such user, or the account is an admin.' });
    const purged = await cloud.purgeUser(id);
    return { ok: true, purged };
  });

  app.get('/api/admin/campaigns', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const byId = new Map((await accounts.listUsers()).map((x) => [x.id, x.username]));
    const rows = (await cloud.adminList()).map((c) => ({ ...c, owner: byId.get(c.ownerUserId) ?? '(deleted)' }));
    return { campaigns: rows.sort((a, b) => b.updatedAt - a.updatedAt) };
  });

  app.delete('/api/admin/campaigns/:id', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    const ok = await cloud.deleteCampaign((req.params as { id: string }).id);
    return ok ? { ok: true } : reply.code(404).send({ error: 'no-campaign' });
  });

  app.get('/api/admin/rooms', async (req, reply) => {
    if (!await adminOf(req)) return reply.code(403).send({ error: 'forbidden' });
    return { rooms: hub.stats() };
  });

  void app.register(fastifyWebsocket, { options: { maxPayload: MAX_PAYLOAD } });

  // Live WebSocket connections per client IP — a hard cap on socket-spam.
  const wsPerIp = new Map<string, number>();

  void app.register(async (instance) => {
    instance.get('/ws', { websocket: true }, (socket, req) => {
      // Anti-CSWSH: reject cross-origin upgrades when an allowlist is configured.
      const origin = req.headers.origin;
      if (ALLOWED_ORIGINS.length && origin && !ALLOWED_ORIGINS.includes(origin)) {
        socket.close(1008, 'origin');
        return;
      }
      const ip = req.ip;
      const live = wsPerIp.get(ip) ?? 0;
      if (live >= MAX_WS_PER_IP) { socket.close(1013, 'too-many'); return; }
      wsPerIp.set(ip, live + 1);
      const releaseIp = () => { const n = (wsPerIp.get(ip) ?? 1) - 1; if (n <= 0) wsPerIp.delete(ip); else wsPerIp.set(ip, n); };
      const sender: Sender = { send: (msg: ServerMessage) => { try { socket.send(JSON.stringify(msg)); } catch { /* closed */ } } };
      let tokens = RATE.capacity;
      const refill = setInterval(() => { tokens = RATE.capacity; }, RATE.refillMs);

      // Heartbeat: a socket that doesn't answer the previous ping is dead → drop it.
      let alive = true;
      socket.on('pong', () => { alive = true; });
      const heartbeat = setInterval(() => {
        if (!alive) { try { socket.terminate(); } catch { /* already gone */ } return; }
        alive = false;
        try { socket.ping(); } catch { /* closed */ }
      }, HEARTBEAT_MS);

      socket.on('message', (raw: Buffer) => {
        if (tokens-- <= 0) { socket.close(1008, 'rate'); return; }
        let parsed;
        try { parsed = clientMessageSchema.safeParse(JSON.parse(raw.toString())); } catch { return; }
        if (!parsed.success) return;
        const m = parsed.data;
        switch (m.t) {
          case 'host': hub.host(sender, m.password, m.resume); break;
          case 'join': hub.join(sender, m.joinCode, m.password, m.playerId); break;
          case 'state': hub.state(sender, m.gmSecret, m.snapshot); break;
          case 'image': hub.image(sender, m.gmSecret, m.id, m.dataUrl); break;
          case 'requestImage': hub.requestImage(sender, m.id); break;
          case 'claimSeat': hub.claimSeat(sender, m.characterId, m.offlineSnapshot); break;
          case 'seatGrant': hub.seatGrant(sender, m.gmSecret, m.targetPlayerId, m.character); break;
          case 'playerPatch': hub.playerPatch(sender, m.characterId, m.diff); break;
          case 'playerRoll': hub.playerRoll(sender, m.characterId, m.label, m.expression, m.total, m.breakdown); break;
          case 'gmRoll': hub.gmRoll(sender, m.gmSecret, m.label, m.expression, m.total, m.breakdown); break;
          case 'privateState': hub.privateState(sender, m.gmSecret, m.targetPlayerId, m.handout); break;
          case 'chat': hub.chat(sender, m.body, m.to); break;
          case 'setName': hub.setName(sender, m.name); break;
        }
      });
      socket.on('close', () => { clearInterval(refill); clearInterval(heartbeat); releaseIp(); hub.disconnect(sender); });
    });
  });

  app.get('/healthz', async () => ({ ok: true }));

  // Serve the built SPA with history fallback (so /play?room=... deep-links work).
  void app.register(fastifyStatic, { root: STATIC_DIR, wildcard: false });
  app.setNotFoundHandler((req, reply) => {
    if (req.raw.url?.startsWith('/ws')) return reply.code(426).send('Upgrade Required');
    return reply.sendFile('index.html');
  });

  return app;
}

// Start unless imported by a test.
if (process.env.NODE_ENV !== 'test') {
  const app = buildServer();
  app.listen({ port: PORT, host: '0.0.0.0' })
    .then((addr) => console.log(`ttrpg server on ${addr} (static: ${STATIC_DIR})`))
    .catch((e) => { console.error(e); process.exit(1); });
}