SSE 헤더 인증과 연결 수명 검증 및 HTTP 오류 정보 보호

app/game-api/src/realtime/authenticatedConnection.ts

@@ -0,0 +1,86 @@
+import type { ServerResponse } from 'node:http';
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+
+const MAX_PENDING_FRAMES = 32;
+const MAX_BUFFER_BYTES = 64 * 1024;
+
+/** Revalidate before work and before writing its result; never retain unbounded frames. */
+export class AuthenticatedRealtimeConnection {
+    private queue = Promise.resolve();
+    private pending = 0;
+    private ended = false;
+    private readonly expiryTimer: ReturnType<typeof setTimeout>;
+    private cleanup = new Set<() => void>();
+
+    constructor(
+        readonly auth: GameSessionTokenPayload,
+        private readonly response: ServerResponse,
+        private readonly resolveAuth: () => Promise<GameSessionTokenPayload | null>
+    ) {
+        // AccessTokenStore requires a full remaining TTL second on every lookup.
+        this.expiryTimer = setTimeout(() => this.close(), Math.max(0, Date.parse(auth.expiresAt) - Date.now() - 999));
+        this.expiryTimer.unref();
+        response.once('close', this.close);
+        response.once('error', this.close);
+    }
+
+    get closed(): boolean {
+        return this.ended;
+    }
+
+    onClose(cleanup: () => void): void {
+        if (this.ended) cleanup();
+        else this.cleanup.add(cleanup);
+    }
+
+    private async currentAuth(): Promise<GameSessionTokenPayload | null> {
+        if (this.ended) return null;
+        const current = await this.resolveAuth();
+        if (
+            !current ||
+            this.ended ||
+            current.sessionId !== this.auth.sessionId ||
+            current.user.id !== this.auth.user.id ||
+            current.profile !== this.auth.profile
+        ) {
+            this.close();
+            return null;
+        }
+        return current;
+    }
+
+    enqueue(work: (auth: GameSessionTokenPayload) => Promise<string | null>): void {
+        if (this.ended) return;
+        if (this.pending >= MAX_PENDING_FRAMES || this.response.writableLength > MAX_BUFFER_BYTES) {
+            this.close();
+            return;
+        }
+        this.pending += 1;
+        this.queue = this.queue
+            .then(async () => {
+                const current = await this.currentAuth();
+                if (!current) return;
+                const frame = await work(current);
+                if (!frame || !(await this.currentAuth())) return;
+                if (Buffer.byteLength(frame) > MAX_BUFFER_BYTES || !this.response.write(frame)) this.close();
+            })
+            .catch(() => {
+                // Redis/auth failure is fail closed. Reconnect must authenticate again.
+                this.close();
+            })
+            .finally(() => {
+                this.pending -= 1;
+            });
+    }
+
+    close = (): void => {
+        if (this.ended) return;
+        this.ended = true;
+        clearTimeout(this.expiryTimer);
+        this.response.off('close', this.close);
+        this.response.off('error', this.close);
+        for (const cleanup of this.cleanup) cleanup();
+        this.cleanup.clear();
+        if (!this.response.destroyed && !this.response.writableEnded) this.response.end();
+    };
+}

app/game-api/src/server.ts

@@ -1,3 +1,4 @@
+import { safeHttpLoggerOptions, safeHttpErrorHandler } from '@sammo-ts/common';
 import fastify, { type FastifyRequest } from 'fastify';
 import cors from '@fastify/cors';
 import fastifyStatic from '@fastify/static';
@@ -32,6 +33,8 @@ import { appRouter } from './router.js';
 import { buildBattleSimQueueKeys } from './battleSim/keys.js';
 import { RedisBattleSimTransport } from './battleSim/redisTransport.js';
 import { RedisRealtimeEventHub } from './realtime/eventHub.js';
+import { isGameAccessBlocked } from '@sammo-ts/common/auth/sanctions';
+import { AuthenticatedRealtimeConnection } from './realtime/authenticatedConnection.js';
 import { formatSseFrame } from './realtime/sse.js';
 import {
     shouldForwardRealtimeEvent,
@@ -99,11 +102,16 @@ export const createGameApiServer = async () => {
         imageUploadSecret
     );
     const app = fastify({
-        logger: true,
+        logger: safeHttpLoggerOptions,
         routerOptions: {
             maxParamLength: 2048,
         },
     });
+    app.setErrorHandler(safeHttpErrorHandler);
+    const realtimeConnections = new Set<AuthenticatedRealtimeConnection>();
+    app.addHook('preClose', async () => {
+        for (const connection of realtimeConnections) connection.close();
+    });
     const postgres = createGamePostgresConnector(resolvePostgresConfigFromEnv({ schema: config.profile }));
     const redis = createRedisConnector(resolveRedisConfigFromEnv());
 
@@ -150,6 +158,12 @@ export const createGameApiServer = async () => {
         config.flushChannel,
         flushStore,
         async (event) => {
+            const flushedAt = Date.parse(event.flushedAt);
+            for (const connection of realtimeConnections) {
+                if (connection.auth.user.id === event.userId && Date.parse(connection.auth.issuedAt) <= flushedAt) {
+                    connection.close();
+                }
+            }
             await Promise.all([iconFlushHandler(event), identityFlushHandler(event)]);
         },
         (error, event) => {
@@ -299,14 +313,24 @@ export const createGameApiServer = async () => {
         },
     });
 
+    const resolveRealtimeAuth = async (token: string | null): Promise<GameSessionTokenPayload | null> => {
+        const auth = await resolveAuthFromToken(token, accessTokenStore, flushStore);
+        if (
+            !auth ||
+            auth.profile !== config.profileName ||
+            isGameAccessBlocked(auth.sanctions, [config.profileName, config.profile])
+        )
+            return null;
+        return auth;
+    };
+
     app.get(config.eventsPath, async (request, reply) => {
         const query = request.query as { token?: string; scope?: string };
         const subscriptionScope = query.scope === 'tournament' ? 'tournament' : 'dashboard';
         const tokenFromHeader = extractBearerToken(request.headers.authorization);
-        const tokenFromQuery = typeof query.token === 'string' ? query.token : null;
-        const auth = await resolveAuthFromToken(tokenFromHeader ?? tokenFromQuery, accessTokenStore, flushStore);
+        const auth = query.token === undefined ? await resolveRealtimeAuth(tokenFromHeader) : null;
 
-        if (!auth) {
+        if (!auth || auth.profile !== config.profileName) {
             await reply.status(401).send({ ok: false, error: 'unauthorized' });
             return;
         }
@@ -351,88 +375,62 @@ export const createGameApiServer = async () => {
         reply.raw.setTimeout?.(0);
         reply.raw.flushHeaders?.();
 
-        const sendFrame = (payload: string) => {
-            try {
-                reply.raw.write(payload);
-            } catch {
-                return;
-            }
-        };
-
-        sendFrame(
-            formatSseFrame({
-                event: 'ready',
-                data: '{}',
-            })
+        const connection = new AuthenticatedRealtimeConnection(auth, reply.raw, () =>
+            resolveRealtimeAuth(tokenFromHeader)
         );
-
-        let closed = false;
-        let eventQueue = Promise.resolve();
+        realtimeConnections.add(connection);
+        connection.onClose(() => {
+            realtimeConnections.delete(connection);
+        });
+        connection.enqueue(async () => formatSseFrame({ event: 'ready', data: '{}' }));
         const unsubscribe = realtimeHub.subscribe((event) => {
             if (!shouldForwardRealtimeEvent(event, subscriptionScope)) return;
-            eventQueue = eventQueue
-                .then(async () => {
-                    if (closed) return;
-                    const identities = [viewerIdentity];
-                    if (shouldReloadRealtimeViewerIdentity(event, viewerIdentity)) {
-                        const nextIdentity = await loadViewerIdentity();
-                        identities.push(nextIdentity);
-                        viewerIdentity = nextIdentity;
-                    }
-                    let refreshGrant: string | undefined;
-                    const publicEvent = toPublicRealtimeEvent(event, identities, () => {
-                        refreshGrant ??= createRealtimeAccessGrant(auth, config.profileName, config.gameTokenSecret);
-                        return refreshGrant;
-                    });
-                    if (!publicEvent || closed) return;
-                    if (refreshGrant) {
-                        try {
-                            await registerRealtimeAccessGrant(redis.client, refreshGrant, config.profileName);
-                        } catch {
-                            // Preserve the invalidation. An unregistered grant safely falls back
-                            // to the normal scored refresh path.
-                        }
-                    }
-                    sendFrame(
-                        formatSseFrame({
-                            event: publicEvent.type,
-                            data: JSON.stringify(publicEvent),
-                        })
-                    );
-                })
-                .catch(() => {
-                    // A best-effort notification must not affect committed game state.
+            connection.enqueue(async (currentAuth) => {
+                const identities = [viewerIdentity];
+                if (shouldReloadRealtimeViewerIdentity(event, viewerIdentity)) {
+                    const nextIdentity = await loadViewerIdentity();
+                    identities.push(nextIdentity);
+                    viewerIdentity = nextIdentity;
+                }
+                let refreshGrant: string | undefined;
+                const publicEvent = toPublicRealtimeEvent(event, identities, () => {
+                    refreshGrant ??= createRealtimeAccessGrant(currentAuth, config.profileName, config.gameTokenSecret);
+                    return refreshGrant;
                 });
+                if (!publicEvent || connection.closed) return null;
+                if (refreshGrant) {
+                    try {
+                        await registerRealtimeAccessGrant(redis.client, refreshGrant, config.profileName);
+                    } catch {
+                        // An unregistered grant falls back to the scored refresh path.
+                    }
+                }
+                return formatSseFrame({ event: publicEvent.type, data: JSON.stringify(publicEvent) });
+            });
         });
-
+        connection.onClose(unsubscribe);
         let heartbeatPending = false;
         const heartbeat = setInterval(() => {
-            if (heartbeatPending) return;
+            if (heartbeatPending || connection.closed) return;
             heartbeatPending = true;
-            void turnEngineStatus
-                .get()
-                .then((turnEngineRunning) => {
-                    if (closed) return;
-                    sendFrame(
-                        formatSseFrame({
-                            event: 'ping',
-                            data: JSON.stringify({ turnEngineRunning }),
-                        })
-                    );
-                })
-                .finally(() => {
+            connection.enqueue(async () => {
+                try {
+                    return formatSseFrame({
+                        event: 'ping',
+                        data: JSON.stringify({ turnEngineRunning: await turnEngineStatus.get() }),
+                    });
+                } finally {
                     heartbeatPending = false;
-                });
-        }, 15000);
-
-        const close = () => {
-            closed = true;
+                }
+            });
+        }, 15_000);
+        connection.onClose(() => {
             clearInterval(heartbeat);
-            unsubscribe();
-        };
-
-        request.raw.on('close', close);
-        request.raw.on('aborted', close);
+        });
+        request.raw.once('aborted', connection.close);
+        connection.onClose(() => {
+            request.raw.off('aborted', connection.close);
+        });
     });
 
     app.get('/healthz', async (_request, reply) => {

app/game-api/src/trpc.ts

@@ -1,3 +1,4 @@
+import { safeTrpcErrorFormatter } from '@sammo-ts/common';
 import { randomUUID } from 'node:crypto';
 import { initTRPC, TRPCError } from '@trpc/server';
 import { middlewareMarker } from '@trpc/server/unstable-core-do-not-import';
@@ -20,7 +21,7 @@ import {
 import { getDeferredGeneralAccessLimit } from './services/deferredGeneralAccess.js';
 import { recordGeneralActivity } from './services/generalActivity.js';
 
-const t = initTRPC.context<GameApiContext>().create();
+const t = initTRPC.context<GameApiContext>().create({ errorFormatter: safeTrpcErrorFormatter });
 
 const requireAuthMiddleware = t.middleware(({ ctx, next }) => {
     if (!ctx.auth) {