SSE 헤더 인증과 연결 수명 검증 및 HTTP 오류 정보 보호

app/game-api/test/authenticatedRealtimeConnection.test.ts

@@ -0,0 +1,95 @@
+import { PassThrough } from 'node:stream';
+import type { ServerResponse } from 'node:http';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import { AuthenticatedRealtimeConnection } from '../src/realtime/authenticatedConnection.js';
+
+const payload = (): GameSessionTokenPayload => ({
+    version: 1,
+    sessionId: 'test-session',
+    profile: 'che:default',
+    issuedAt: new Date().toISOString(),
+    expiresAt: new Date(Date.now() + 60_000).toISOString(),
+    user: {
+        id: 'test-user',
+        username: 'test',
+        displayName: 'test',
+        roles: ['user'],
+        createdAt: new Date().toISOString(),
+    },
+    sanctions: {},
+});
+const fixture = (resolve: () => Promise<GameSessionTokenPayload | null>, auth = payload()) => {
+    const response = new PassThrough();
+    const frames: string[] = [];
+    response.on('data', (chunk) => frames.push(String(chunk)));
+    const connection = new AuthenticatedRealtimeConnection(auth, response as unknown as ServerResponse, resolve);
+    return { response, frames, connection };
+};
+afterEach(() => vi.useRealTimers());
+
+describe('authenticated realtime connection', () => {
+    it('does not forward an in-flight result after the token is revoked during its work', async () => {
+        const auth = payload();
+        let current: GameSessionTokenPayload | null = auth;
+        const { connection, frames } = fixture(async () => current, auth);
+        connection.enqueue(async () => {
+            current = null;
+            return 'private invalidation';
+        });
+        await vi.waitFor(() => expect(connection.closed).toBe(true));
+        expect(frames).toEqual([]);
+    });
+    it.each(['sessionId', 'profile'] as const)('rejects a replacement %s even for the same user', async (field) => {
+        const auth = payload();
+        const { connection, frames } = fixture(async () => ({ ...auth, [field]: 'replacement' }), auth);
+        connection.enqueue(async () => 'private invalidation');
+        await vi.waitFor(() => expect(connection.closed).toBe(true));
+        expect(frames).toEqual([]);
+    });
+    it('fails closed when authentication storage fails', async () => {
+        const { connection, frames } = fixture(async () => {
+            throw new Error('redis unavailable');
+        });
+        connection.enqueue(async () => 'private invalidation');
+        await vi.waitFor(() => expect(connection.closed).toBe(true));
+        expect(frames).toEqual([]);
+    });
+    it('ends an idle expired stream and releases subscriptions only once', async () => {
+        vi.useFakeTimers();
+        const auth = payload();
+        const { connection } = fixture(async () => auth, auth);
+        const cleanup = vi.fn();
+        connection.onClose(cleanup);
+        await vi.advanceTimersByTimeAsync(60_001);
+        expect(connection.closed).toBe(true);
+        expect(cleanup).toHaveBeenCalledTimes(1);
+        connection.close();
+        expect(cleanup).toHaveBeenCalledTimes(1);
+    });
+    it('bounds queued work while an earlier event is blocked', async () => {
+        const auth = payload();
+        const { connection, frames } = fixture(async () => auth, auth);
+        let release!: () => void;
+        const waiting = new Promise<void>((resolve) => {
+            release = resolve;
+        });
+        connection.enqueue(async () => {
+            await waiting;
+            return 'private invalidation';
+        });
+        for (let i = 0; i < 100; i += 1) connection.enqueue(async () => 'private invalidation');
+        expect(connection.closed).toBe(true);
+        release();
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        expect(frames).toEqual([]);
+    });
+    it('ends a slow socket instead of retaining further frames', async () => {
+        const auth = payload();
+        const { connection, response } = fixture(async () => auth, auth);
+        response.write = vi.fn(() => false);
+        connection.enqueue(async () => 'event: ping\ndata: {}\n\n');
+        await vi.waitFor(() => expect(connection.closed).toBe(true));
+        expect(response.writableEnded).toBe(true);
+    });
+});

app/game-api/test/httpErrorPrivacy.test.ts

@@ -0,0 +1,51 @@
+import fastify from 'fastify';
+import { TRPCError } from '@trpc/server';
+import { fastifyTRPCPlugin } from '@trpc/server/adapters/fastify';
+import { describe, expect, it } from 'vitest';
+import { router as gameRouter, sessionActivityProcedure } from '../src/trpc.js';
+
+const internalFailure = () => {
+    throw new Error('synthetic-db-secret', { cause: new Error('synthetic-cause-secret') });
+};
+const badInput = () => {
+    throw new TRPCError({
+        code: 'BAD_REQUEST',
+        message: '잘못된 입력입니다.',
+        cause: new Error('synthetic-private-cause'),
+    });
+};
+
+describe('public HTTP error privacy', () => {
+    it('the real router factory hides internal errors and all stacks while preserving validation messages', async () => {
+        const app = fastify();
+        await app.register(fastifyTRPCPlugin, {
+            prefix: '/game',
+            trpcOptions: {
+                router: gameRouter({
+                    internal: sessionActivityProcedure.query(internalFailure),
+                    invalid: sessionActivityProcedure.query(badInput),
+                }),
+                createContext: () => ({}),
+            },
+        });
+        try {
+            const address = await app.listen({ host: '127.0.0.1', port: 0 });
+            for (const prefix of ['game']) {
+                for (const procedure of ['internal', 'invalid']) {
+                    const response = await fetch(`${address}/${prefix}/${procedure}`);
+                    const body = (await response.json()) as {
+                        error: { message: string; data: { code: string; stack?: string } };
+                    };
+                    expect(response.status).toBe(procedure === 'internal' ? 500 : 400);
+                    expect(body.error.message).toBe(
+                        procedure === 'internal' ? 'Internal server error' : '잘못된 입력입니다.'
+                    );
+                    expect(body.error.data.stack).toBeUndefined();
+                    expect(JSON.stringify(body)).not.toContain('synthetic-');
+                }
+            }
+        } finally {
+            await app.close();
+        }
+    });
+});

app/game-api/test/safeHttpLogger.test.ts

@@ -0,0 +1,46 @@
+import { Writable } from 'node:stream';
+import fastify from 'fastify';
+import { describe, expect, it } from 'vitest';
+import { safeHttpLoggerOptions, safeHttpErrorHandler } from '@sammo-ts/common';
+
+describe('HTTP log credential boundaries', () => {
+    it('logs static routes/status but no query, unmatched path, header, body, stack or cause secrets', async () => {
+        let output = '';
+        const stream = new Writable({
+            write(chunk, _encoding, done) {
+                output += String(chunk);
+                done();
+            },
+        });
+        const app = fastify({ logger: { ...safeHttpLoggerOptions, stream } });
+        app.setErrorHandler(safeHttpErrorHandler);
+        app.post('/events', async () => {
+            throw Object.assign(new Error('synthetic-error-secret', { cause: new Error('synthetic-cause-secret') }), {
+                code: 'P2002',
+                detail: 'synthetic-detail-secret',
+            });
+        });
+        try {
+            const address = await app.listen({ host: '127.0.0.1', port: 0 });
+            const response = await fetch(`${address}/events?token=synthetic-query-secret`, {
+                method: 'POST',
+                headers: { authorization: 'Bearer synthetic-header-secret', 'content-type': 'application/json' },
+                body: JSON.stringify({ password: 'synthetic-body-secret' }),
+            });
+            expect(await response.json()).toMatchObject({ message: 'Internal server error' });
+            await fetch(`${address}/synthetic-path-secret`);
+            const logs = output
+                .trim()
+                .split('\n')
+                .map((line) => JSON.parse(line));
+            expect(logs.some((entry) => entry.req?.url === '/events')).toBe(true);
+            expect(logs.some((entry) => entry.res?.statusCode === 500)).toBe(true);
+            expect(logs.some((entry) => entry.err?.code === 'P2002')).toBe(true);
+            for (const field of ['query', 'header', 'body', 'error', 'cause', 'detail', 'path']) {
+                expect(output).not.toContain(`synthetic-${field}-secret`);
+            }
+        } finally {
+            await app.close();
+        }
+    });
+});

app/game-api/test/securityTransport.integration.test.ts

@@ -1,3 +1,4 @@
+import { buildGameEventChannel } from '@sammo-ts/common';
 import { createHash } from 'node:crypto';
 import { projectCurrentGeneral } from '../src/router/playAudit/projection.js';
 import { asRecord } from '@sammo-ts/common';
@@ -2317,9 +2318,51 @@ integration('game API security over HTTP transport', () => {
                     {
                         decisionId: decisionIds[0]!,
                         ordinal: 0,
-                        steps: Array.from({ length: 128 }, (_, sequence) => sequence === 127
-                            ? { ...step, sequence, kind: 'DECISION_START', reservedAction: '휴식', effectivePolicy: {"schemaVersion":1,"general":{"priority":["징병"],"flags":{"징병":true,"출병":false}},"nation":{"priority":["천도"],"flags":{"천도":true},"values":{"reqNationGold":4321,"reqNationRice":100,"reqHumanWarUrgentGold":100,"reqHumanWarUrgentRice":100,"reqHumanWarRecommandGold":100,"reqHumanWarRecommandRice":100,"reqHumanDevelGold":100,"reqHumanDevelRice":100,"reqNpcWarGold":100,"reqNpcWarRice":100,"reqNpcDevelGold":100,"reqNpcDevelRice":100,"minimumResourceActionAmount":100,"maximumResourceActionAmount":100,"minNpcWarLeadership":100,"minWarCrew":100,"minNpcRecruitCityPopulation":100,"safeRecruitCityPopulationRatio":100,"properWarTrainAtmos":100,"cureThreshold":100},"combatForce":{"1":[2,3]},"supportForce":[4],"developForce":[5],"secret":"decision-secret"},"secret":"decision-secret"} }
-                            : ({ ...step, sequence })),
+                        steps: Array.from({ length: 128 }, (_, sequence) =>
+                            sequence === 127
+                                ? {
+                                      ...step,
+                                      sequence,
+                                      kind: 'DECISION_START',
+                                      reservedAction: '휴식',
+                                      effectivePolicy: {
+                                          schemaVersion: 1,
+                                          general: { priority: ['징병'], flags: { 징병: true, 출병: false } },
+                                          nation: {
+                                              priority: ['천도'],
+                                              flags: { 천도: true },
+                                              values: {
+                                                  reqNationGold: 4321,
+                                                  reqNationRice: 100,
+                                                  reqHumanWarUrgentGold: 100,
+                                                  reqHumanWarUrgentRice: 100,
+                                                  reqHumanWarRecommandGold: 100,
+                                                  reqHumanWarRecommandRice: 100,
+                                                  reqHumanDevelGold: 100,
+                                                  reqHumanDevelRice: 100,
+                                                  reqNpcWarGold: 100,
+                                                  reqNpcWarRice: 100,
+                                                  reqNpcDevelGold: 100,
+                                                  reqNpcDevelRice: 100,
+                                                  minimumResourceActionAmount: 100,
+                                                  maximumResourceActionAmount: 100,
+                                                  minNpcWarLeadership: 100,
+                                                  minWarCrew: 100,
+                                                  minNpcRecruitCityPopulation: 100,
+                                                  safeRecruitCityPopulationRatio: 100,
+                                                  properWarTrainAtmos: 100,
+                                                  cureThreshold: 100,
+                                              },
+                                              combatForce: { '1': [2, 3] },
+                                              supportForce: [4],
+                                              developForce: [5],
+                                              secret: 'decision-secret',
+                                          },
+                                          secret: 'decision-secret',
+                                      },
+                                  }
+                                : { ...step, sequence }
+                        ),
                     },
                     {
                         decisionId: decisionIds[0]!,
@@ -3530,6 +3573,108 @@ integration('game API security over HTTP transport', () => {
         }
     });
 
+    const openRealtime = async (accessToken: string) => {
+        const abort = new AbortController();
+        const response = await fetch(`${baseUrl}${server!.config.eventsPath}`, {
+            headers: { authorization: `Bearer ${accessToken}` },
+            signal: abort.signal,
+        });
+        expect(response.status).toBe(200);
+        expect(response.headers.get('content-type')).toBe('text/event-stream');
+        const reader = response.body!.getReader();
+        const ready = await reader.read();
+        expect(new TextDecoder().decode(ready.value)).toContain('event: ready');
+        return { abort, reader };
+    };
+
+    it('SSE accepts header auth and rejects query or cross-profile credentials', async () => {
+        const token = await createAccessToken('sse-query', {});
+        const queryOnly = await fetch(`${baseUrl}${server!.config.eventsPath}?token=${encodeURIComponent(token)}`);
+        expect(queryOnly.status).toBe(401);
+        const foreign = await accessTokenStore.create({ ...buildPayload('sse-foreign', {}), profile: 'other:default' });
+        if (!foreign) throw new Error('SSE foreign token fixture failed');
+        try {
+            const response = await fetch(`${baseUrl}${server!.config.eventsPath}`, {
+                headers: { authorization: `Bearer ${foreign.accessToken}` },
+            });
+            expect(response.status).toBe(401);
+            const stream = await openRealtime(token);
+            stream.abort.abort();
+        } finally {
+            await accessTokenStore.revoke(token);
+            await accessTokenStore.revoke(foreign.accessToken);
+        }
+    });
+
+    it.each([
+        { label: 'ban', sanctions: { bannedUntil: '2099-01-01T00:00:00.000Z' } },
+        { label: 'suspension', sanctions: { suspendedUntil: '2099-01-01T00:00:00.000Z' } },
+        {
+            label: 'profile game restriction',
+            sanctions: { serverRestrictions: { [profileName]: { blockedFeatures: ['game'] } } },
+        },
+    ])('SSE rejects $label before opening a stream', async ({ label, sanctions }) => {
+        const token = await createAccessToken(`sse-${label}`, sanctions);
+        try {
+            const response = await fetch(`${baseUrl}${server!.config.eventsPath}`, {
+                headers: { authorization: `Bearer ${token}` },
+            });
+            expect(response.status).toBe(401);
+            expect(response.headers.get('content-type')).not.toBe('text/event-stream');
+        } finally {
+            await accessTokenStore.revoke(token);
+        }
+    });
+
+    it('SSE closes on idle expiry without forwarding another frame', async () => {
+        const auth = { ...buildPayload('sse-expiry', {}), expiresAt: new Date(Date.now() + 3500).toISOString() };
+        const created = await accessTokenStore.create(auth);
+        if (!created) throw new Error('SSE expiry token fixture failed');
+        const stream = await openRealtime(created.accessToken);
+        try {
+            expect(await stream.reader.read()).toMatchObject({ done: true });
+            expect((await requestTrpc('general.me', { accessToken: created.accessToken })).response.status).toBe(401);
+        } finally {
+            stream.abort.abort();
+            await accessTokenStore.revoke(created.accessToken);
+        }
+    });
+
+    it('SSE rechecks a revoked token before forwarding a relevant event or refresh grant', async () => {
+        const accessToken = await createAccessToken('sse-revoke', {});
+        const stream = await openRealtime(accessToken);
+        const channel = server!.config.profileName;
+        try {
+            const event = JSON.stringify({ type: 'tournamentChanged' });
+            await redis!.client.publish(buildGameEventChannel(channel), event);
+            const valid = await stream.reader.read();
+            expect(new TextDecoder().decode(valid.value)).toContain('refreshGrant');
+            expect(await accessTokenStore.revoke(accessToken)).toBe(true);
+            await redis!.client.publish(buildGameEventChannel(channel), event);
+            expect(await stream.reader.read()).toMatchObject({ done: true });
+        } finally {
+            stream.abort.abort();
+            await accessTokenStore.revoke(accessToken);
+        }
+    });
+
+    it('SSE closes an idle flushed user immediately without waiting for heartbeat', async () => {
+        const sseUser = `security-http-sse-flush-${process.pid}`;
+        const created = await accessTokenStore.create(buildPayload('sse-flush', {}, sseUser));
+        if (!created) throw new Error('SSE flush fixture failed');
+        const stream = await openRealtime(created.accessToken);
+        try {
+            await redis!.client.publish(
+                `${redisPrefix}:flush`,
+                JSON.stringify({ userId: sseUser, flushedAt: new Date().toISOString() })
+            );
+            expect(await stream.reader.read()).toMatchObject({ done: true });
+        } finally {
+            stream.abort.abort();
+            await accessTokenStore.revoke(created.accessToken);
+        }
+    });
+
     // Flush invalidates every token issued before the user watermark. Keep it
     // last so this lifecycle assertion cannot invalidate the actor tokens used
     // by the transport authorization matrix above.