Merge branch 'main' into feature/survey-unique-parity

2026-07-26 04:18:00 +00:00
parent c2a3b5b797 1d2ca3e17e
commit dccf1fd356
20 changed files with 1973 additions and 608 deletions
@@ -0,0 +1,185 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import type { GameSessionTokenPayload } from '@sammo-ts/common/auth/gameToken';
+import type { RedisConnector } from '@sammo-ts/infra';
+
+import { InMemoryFlushStore } from '../src/auth/flushStore.js';
+import { RedisAccessTokenStore } from '../src/auth/accessTokenStore.js';
+import type { DatabaseClient, GameApiContext, GeneralRow } from '../src/context.js';
+import { appRouter } from '../src/router.js';
+
+const now = new Date('2026-01-01T00:00:00Z');
+const general = (overrides: Partial<GeneralRow> = {}): GeneralRow => ({
+    id: 1,
+    userId: 'user-1',
+    name: '아군',
+    nationId: 1,
+    cityId: 1,
+    troopId: 0,
+    npcState: 0,
+    affinity: null,
+    bornYear: 180,
+    deadYear: 300,
+    picture: null,
+    imageServer: 0,
+    leadership: 70,
+    strength: 60,
+    intel: 50,
+    injury: 0,
+    experience: 0,
+    dedication: 0,
+    officerLevel: 1,
+    gold: 1000,
+    rice: 1000,
+    crew: 500,
+    crewTypeId: 1,
+    train: 90,
+    atmos: 90,
+    weaponCode: 'None',
+    bookCode: 'None',
+    horseCode: 'None',
+    itemCode: 'None',
+    turnTime: now,
+    recentWarTime: null,
+    age: 20,
+    startAge: 20,
+    personalCode: 'None',
+    specialCode: 'None',
+    special2Code: 'None',
+    lastTurn: {},
+    meta: { defence_train: 80 },
+    penalty: {},
+    createdAt: now,
+    updatedAt: now,
+    ...overrides,
+});
+const auth = (roles: string[] = []): GameSessionTokenPayload => ({
+    version: 1,
+    profile: 'che:default',
+    issuedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + 86400000).toISOString(),
+    sessionId: 'session',
+    user: { id: 'user-1', username: 'tester', displayName: 'Tester', roles },
+    sanctions: {},
+});
+const city = (id: number, nationId: number) => ({
+    id,
+    name: `도시${id}`,
+    level: 6,
+    nationId,
+    supplyState: 1,
+    frontState: 0,
+    population: 1000,
+    populationMax: 2000,
+    agriculture: 10,
+    agricultureMax: 20,
+    commerce: 11,
+    commerceMax: 21,
+    security: 12,
+    securityMax: 22,
+    trust: 50,
+    trade: 100,
+    defence: 13,
+    defenceMax: 23,
+    wall: 14,
+    wallMax: 24,
+    region: 2,
+    conflict: {},
+    meta: {},
+});
+
+const context = (options: { me?: GeneralRow; roles?: string[]; nationMeta?: Record<string, unknown> } = {}) => {
+    const me = options.me ?? general();
+    const cities = [city(1, 1), city(2, 2), city(3, 2), city(80, 1)];
+    const foreign = general({ id: 2, userId: 'user-2', name: '적군', nationId: 2, cityId: 2, crew: 777 });
+    const db = {
+        general: {
+            findFirst: vi.fn(async () => me),
+            findMany: vi.fn(async (args: { where?: Record<string, unknown>; select?: Record<string, boolean> }) => {
+                if (args.where?.nationId === 1 && args.select?.cityId) return [{ cityId: me.cityId }];
+                if (args.where?.cityId === 2) return [foreign];
+                if (args.where?.cityId === 3) return [foreign];
+                if (args.where?.officerLevel) return [];
+                return [];
+            }),
+        },
+        nation: {
+            findUnique: vi.fn(async () => ({
+                id: 1,
+                name: '아국',
+                color: '#008000',
+                level: 1,
+                capitalCityId: 1,
+                meta: options.nationMeta ?? {},
+            })),
+            findMany: vi.fn(async () => [
+                { id: 1, name: '아국', color: '#008000', level: 1, capitalCityId: 1, meta: { power: 100 } },
+                { id: 2, name: '적국', color: '#800000', level: 1, capitalCityId: 2, meta: { power: 90 } },
+            ]),
+        },
+        city: { findMany: vi.fn(async () => cities) },
+        worldState: { findFirst: vi.fn(async () => ({ meta: { turntime: '2026-01-01' } })) },
+        generalTurn: { findMany: vi.fn(async () => []) },
+        diplomacy: { findMany: vi.fn(async () => []) },
+    };
+    const redis = { get: vi.fn(async () => null), set: vi.fn(async () => null) } as unknown as RedisConnector['client'];
+    const accessTokenStore = new RedisAccessTokenStore(redis, 'che:default');
+    return {
+        db: db as unknown as DatabaseClient,
+        redis,
+        turnDaemon: {} as GameApiContext['turnDaemon'],
+        battleSim: {} as GameApiContext['battleSim'],
+        profile: { id: 'che', scenario: 'default', name: 'che:default' },
+        auth: auth(options.roles),
+        uploadDir: 'uploads',
+        uploadPath: '/uploads',
+        uploadPublicUrl: null,
+        accessTokenStore,
+        flushStore: new InMemoryFlushStore(),
+        gameTokenSecret: 'secret',
+    } satisfies GameApiContext;
+};
+
+describe('in-game information permissions', () => {
+    it('does not expose nation-only pages to a wandering general', async () => {
+        const caller = appRouter.createCaller(context({ me: general({ nationId: 0, officerLevel: 0 }) }));
+        await expect(caller.nation.getNationInfo()).rejects.toMatchObject({ code: 'PRECONDITION_FAILED' });
+        await expect(caller.nation.getCityOverview()).rejects.toMatchObject({ code: 'PRECONDITION_FAILED' });
+    });
+
+    it('lets a wandering general select only the current city', async () => {
+        const caller = appRouter.createCaller(context({ me: general({ nationId: 0, officerLevel: 0 }) }));
+        const result = await caller.world.getCurrentCity({ cityId: 2 });
+        expect(result.city.id).toBe(2);
+        expect(result.options.map((entry) => entry.id)).toEqual([1]);
+        expect(result.visibility.full).toBe(false);
+        expect(result.city.population).toBeNull();
+        expect(result.generals).toEqual([]);
+    });
+
+    it('keeps adjacent foreign detail redacted and never reveals military fields', async () => {
+        const result = await appRouter
+            .createCaller(context({ me: general({ cityId: 80 }) }))
+            .world.getCurrentCity({ cityId: 2 });
+        expect(result.visibility).toEqual({ full: false, detailed: true });
+        expect(result.city.agriculture).toBeNull();
+        expect(result.city.defence).toBeNull();
+        expect(result.generals[0]).toMatchObject({ crew: null, train: null, atmos: null, crewTypeId: null });
+    });
+
+    it('allows a spied city in full but still redacts foreign-general private details', async () => {
+        const result = await appRouter
+            .createCaller(context({ nationMeta: { spy: { 2: 2 } } }))
+            .world.getCurrentCity({ cityId: 2 });
+        expect(result.visibility.full).toBe(true);
+        expect(result.city.population).toBe(1000);
+        expect(result.generals[0]).toMatchObject({ crew: 777, train: null, atmos: null, crewTypeId: null });
+    });
+
+    it('allows administrative roles to inspect all city and general fields', async () => {
+        const result = await appRouter.createCaller(context({ roles: ['admin'] })).world.getCurrentCity({ cityId: 3 });
+        expect(result.options).toHaveLength(4);
+        expect(result.visibility.full).toBe(true);
+        expect(result.generals[0]).toMatchObject({ crew: 777, train: 90, atmos: 90, crewTypeId: 1 });
+    });
+});