HeiKyu/Rendezvous
2
0
Fork 0
Code Issues 27 Pull Requests Actions Packages Projects Releases Wiki Activity

Implement bounded compatible-session browsing and listing visibility #8

New Issue
Open
opened 2026-07-15 10:04:17 +02:00 by Kyuubi · 2 comments
Kyuubi commented 2026-07-15 10:04:17 +02:00
Owner
Copy Link
Copy Source

Parent: #1
Depends on: #7

Outcome

Provide a safe server-browser data API for public and approved unlisted sessions.

Scope

  • Add list/get queries scoped by game, environment, exact protocol compatibility, region, availability, and visibility.
  • Implement stable bounded cursor pagination and deterministic ordering.
  • Enforce per-game metadata schemas plus byte, depth, property-count, collection, and scalar-length limits.
  • Treat all metadata as display data: no markup execution, endpoint interpretation, or trusted authorization fields.
  • Define unlisted/private retrieval behavior using unguessable identifiers or approved join codes.
  • Expose only compatibility, capacity, region, freshness, and validated presentation metadata.

Acceptance criteria

  • Cross-game, cross-environment, and incompatible-protocol listings never leak.
  • Expired, stale-presence, revoked, full-when-filtered, and non-public sessions are excluded correctly.
  • Pagination cannot skip/duplicate stable records under the documented consistency model.
  • Query cost, filters, page sizes, and response size are bounded.
  • Browser responses contain no raw endpoint, lease, punch, ticket, credential, or internal identifier.
  • Host capacity is documented as advisory.
  • Malicious metadata has regression tests for UI-injection and allocation abuse.
Parent: #1 Depends on: #7 ## Outcome Provide a safe server-browser data API for public and approved unlisted sessions. ## Scope - Add list/get queries scoped by game, environment, exact protocol compatibility, region, availability, and visibility. - Implement stable bounded cursor pagination and deterministic ordering. - Enforce per-game metadata schemas plus byte, depth, property-count, collection, and scalar-length limits. - Treat all metadata as display data: no markup execution, endpoint interpretation, or trusted authorization fields. - Define unlisted/private retrieval behavior using unguessable identifiers or approved join codes. - Expose only compatibility, capacity, region, freshness, and validated presentation metadata. ## Acceptance criteria - Cross-game, cross-environment, and incompatible-protocol listings never leak. - Expired, stale-presence, revoked, full-when-filtered, and non-public sessions are excluded correctly. - Pagination cannot skip/duplicate stable records under the documented consistency model. - Query cost, filters, page sizes, and response size are bounded. - Browser responses contain no raw endpoint, lease, punch, ticket, credential, or internal identifier. - Host capacity is documented as advisory. - Malicious metadata has regression tests for UI-injection and allocation abuse.
Kyuubi commented 2026-07-16 05:59:31 +02:00
Author
Owner
Copy Link
Copy Source

Starting implementation on codex/issue-8-session-browser, stacked on the verified #2–#7 foundation. I’ll implement exact tenant/protocol/region/availability filtering, public-only list plus unguessable-ID direct retrieval, stable bounded cursor pagination, response-byte ceilings, presentation-only metadata handling, and adversarial isolation/injection/allocation tests.

Starting implementation on `codex/issue-8-session-browser`, stacked on the verified #2–#7 foundation. I’ll implement exact tenant/protocol/region/availability filtering, public-only list plus unguessable-ID direct retrieval, stable bounded cursor pagination, response-byte ceilings, presentation-only metadata handling, and adversarial isolation/injection/allocation tests.
Kyuubi self-assigned this 2026-07-16 05:59:32 +02:00
Kyuubi commented 2026-07-16 06:06:54 +02:00
Author
Owner
Copy Link
Copy Source

Implemented and pushed on codex/issue-8-session-browser at a9a2b3d.

Delivered:

  • public list queries scoped by exact game/environment/protocol with optional region and full-session exclusion, always gated by live lease plus fresh authenticated presence;
  • direct public/unlisted retrieval by 128-bit unguessable listing ID plus exact tenant/protocol scope, with stale and cross-scope results hidden as not found;
  • deterministic ascending-ID keyset pagination with five-minute HMAC-signed cursors bound to every filter, rejecting tampering, expiry, and rescoping;
  • bounded live-view consistency semantics, page-size+1 store reads, and automatic response trimming under the exact 256 KiB encoded-response ceiling;
  • presentation-only DTO copies containing compatibility, region, trust/visibility presentation, advisory capacity, display/build labels, and validated string metadata—no endpoint, credential, token, capability, principal, salt, fingerprint, or store key;
  • player-facing HTTP list/get endpoints, excludeFull contract/OpenAPI support, real Kestrel integration coverage, and ADR 0006 documenting advisory capacity, cursor consistency, unlisted behavior, metadata rendering, and limits.

Verification:

  • locked restore, formatter verification, Release solution build, generated OpenAPI worktree drift check, and 100/100 tests passed;
  • tests cover cross-game/environment/protocol/region isolation; public/unlisted/stale/full/revoked filtering; exact-scope unlisted lookup; stable no-duplicate traversal; cursor tamper/expiry/rescoping; 256 KiB page trimming/continuation; JSON-escaped markup; response secret exclusion; and large bounded metadata;
  • the real HTTP lifecycle integration now also lists and directly retrieves a presence-qualified session;
  • completion and multi-lens branch audits found no remaining actionable findings.

The issue remains open until the stacked branch is landed.

Implemented and pushed on `codex/issue-8-session-browser` at `a9a2b3d`. Delivered: - public list queries scoped by exact game/environment/protocol with optional region and full-session exclusion, always gated by live lease plus fresh authenticated presence; - direct public/unlisted retrieval by 128-bit unguessable listing ID plus exact tenant/protocol scope, with stale and cross-scope results hidden as not found; - deterministic ascending-ID keyset pagination with five-minute HMAC-signed cursors bound to every filter, rejecting tampering, expiry, and rescoping; - bounded live-view consistency semantics, page-size+1 store reads, and automatic response trimming under the exact 256 KiB encoded-response ceiling; - presentation-only DTO copies containing compatibility, region, trust/visibility presentation, advisory capacity, display/build labels, and validated string metadata—no endpoint, credential, token, capability, principal, salt, fingerprint, or store key; - player-facing HTTP list/get endpoints, `excludeFull` contract/OpenAPI support, real Kestrel integration coverage, and ADR 0006 documenting advisory capacity, cursor consistency, unlisted behavior, metadata rendering, and limits. Verification: - locked restore, formatter verification, Release solution build, generated OpenAPI worktree drift check, and 100/100 tests passed; - tests cover cross-game/environment/protocol/region isolation; public/unlisted/stale/full/revoked filtering; exact-scope unlisted lookup; stable no-duplicate traversal; cursor tamper/expiry/rescoping; 256 KiB page trimming/continuation; JSON-escaped markup; response secret exclusion; and large bounded metadata; - the real HTTP lifecycle integration now also lists and directly retrieves a presence-qualified session; - completion and multi-lens branch audits found no remaining actionable findings. The issue remains open until the stacked branch is landed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Kyuubi schmidt.florian (Florian Schmidt)
No Assignees Kyuubi
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: HeiKyu/Rendezvous#8
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?