HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Implement short-lived join attempts, punch capabilities, and connection tickets #10

New Issue
Closed
opened 2026-07-15 10:04:19 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:19 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #5, #7

Outcome

Authorize one client to attempt one direct connection to one active session without confusing connection permission with gameplay admission.

Scope

  • Add join-attempt issuance after tenant, visibility, compatibility, lease, presence, and policy validation.
  • Create distinct opaque host/client punch capabilities scoped to role, attempt, session, game, environment, protocol, expiry, and mediator.
  • Store only capability hashes and atomic state; allow idempotent UDP duplicates from the same bound endpoint while rejecting endpoint/role substitution.
  • Issue a separate compact connection ticket for the eventual LiteNetLib connection.
  • Define ticket validation/consumption by the host, cancellation, retry window, expiry, and revocation.
  • Keep capabilities within LiteNetLib's NAT token limit and out of logs/browser data.

Acceptance criteria

  • Altered, expired, replayed, cross-session, cross-role, cross-tenant, incompatible, revoked, and concurrently consumed credentials are rejected.
  • One join attempt cannot cross-wire with another attempt for the same session.
  • Legitimate duplicate UDP packets remain safe within the attempt window.
  • The host can validate the connection ticket without granting Rendezvous gameplay authority.
  • Full/admission decisions made after connection remain host-owned.
  • Issuance and consumption are atomic and deterministically tested.
  • Token and key material is redacted everywhere.
Parent: #1 Depends on: #5, #7 ## Outcome Authorize one client to attempt one direct connection to one active session without confusing connection permission with gameplay admission. ## Scope - Add join-attempt issuance after tenant, visibility, compatibility, lease, presence, and policy validation. - Create distinct opaque host/client punch capabilities scoped to role, attempt, session, game, environment, protocol, expiry, and mediator. - Store only capability hashes and atomic state; allow idempotent UDP duplicates from the same bound endpoint while rejecting endpoint/role substitution. - Issue a separate compact connection ticket for the eventual LiteNetLib connection. - Define ticket validation/consumption by the host, cancellation, retry window, expiry, and revocation. - Keep capabilities within LiteNetLib's NAT token limit and out of logs/browser data. ## Acceptance criteria - Altered, expired, replayed, cross-session, cross-role, cross-tenant, incompatible, revoked, and concurrently consumed credentials are rejected. - One join attempt cannot cross-wire with another attempt for the same session. - Legitimate duplicate UDP packets remain safe within the attempt window. - The host can validate the connection ticket without granting Rendezvous gameplay authority. - Full/admission decisions made after connection remain host-owned. - Issuance and consumption are atomic and deterministically tested. - Token and key material is redacted everywhere.
Kyuubi commented 2026-07-16 06:28:27 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation from stacked SDK commit 06c3973 on branch codex/issue-10-join-attempts.

Initial plan:

  1. Ground the existing join/ticket wire contracts, policy checks, mediator limits, and atomic store seams.
  2. Specify capability/ticket derivation, hashes, expiry, cancellation, and one-time consumption.
  3. Implement atomic join issuance and credential lifecycle with strict scope validation.
  4. Add deterministic adversarial tests for tamper/replay/cross-scope/concurrency/duplicates/redaction.
  5. Run audit, full gates, commit/push, and update #10 plus roadmap #1.

Dependencies #5 and #7 are present in the stacked branch.

Starting implementation from stacked SDK commit `06c3973` on branch `codex/issue-10-join-attempts`. Initial plan: 1. Ground the existing join/ticket wire contracts, policy checks, mediator limits, and atomic store seams. 2. Specify capability/ticket derivation, hashes, expiry, cancellation, and one-time consumption. 3. Implement atomic join issuance and credential lifecycle with strict scope validation. 4. Add deterministic adversarial tests for tamper/replay/cross-scope/concurrency/duplicates/redaction. 5. Run audit, full gates, commit/push, and update #10 plus roadmap #1. Dependencies #5 and #7 are present in the stacked branch.
Kyuubi added reference codex/issue-10-join-attempts 2026-07-16 06:28:27 +02:00
Kyuubi self-assigned this 2026-07-16 06:28:27 +02:00
Kyuubi commented 2026-07-16 06:56:57 +02:00
Author
Owner
Copy Link
Copy Source

Implemented issue #10 on codex/issue-10-join-attempts at 1baa105.

  • Added typed create, host-poll, and client-cancel join-attempt flows with exact tenant, visibility, compatibility, policy, lease, and live-presence validation.
  • Added distinct host/client punch capabilities and connection tickets. Only fingerprints are stored; 43-character credentials remain below transport limits.
  • Ticket validity starts at introduction, is bounded to 20 seconds, and supports atomic one-time consumption plus cancellation, expiry, revocation, retry, and replay rejection.
  • Added the caller-owned client ticket validator and documented that gameplay admission remains host-owned.
  • Covered cross-scope substitution, malformed/tampered credentials, cursor isolation, duplicate/retry behavior, concurrency, expiry, redaction, and full-session authorization.
  • Audit fixes centralized cursor protection and store-result mapping, removed caller-controlled validation time, and hardened canonical Base64URL credential parsing.

Verification: formatting clean, Release build clean, client package produced, and 126/126 tests pass. The issue remains open until the stacked branch is landed.

Implemented issue #10 on `codex/issue-10-join-attempts` at `1baa105`. - Added typed create, host-poll, and client-cancel join-attempt flows with exact tenant, visibility, compatibility, policy, lease, and live-presence validation. - Added distinct host/client punch capabilities and connection tickets. Only fingerprints are stored; 43-character credentials remain below transport limits. - Ticket validity starts at introduction, is bounded to 20 seconds, and supports atomic one-time consumption plus cancellation, expiry, revocation, retry, and replay rejection. - Added the caller-owned client ticket validator and documented that gameplay admission remains host-owned. - Covered cross-scope substitution, malformed/tampered credentials, cursor isolation, duplicate/retry behavior, concurrency, expiry, redaction, and full-session authorization. - Audit fixes centralized cursor protection and store-result mapping, removed caller-controlled validation time, and hardened canonical Base64URL credential parsing. Verification: formatting clean, Release build clean, client package produced, and 126/126 tests pass. The issue remains open until the stacked branch is landed.
Sign in to join this conversation.
codex/issue-10-join-attempts
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#10
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?