From ad60843fbf577eda80105e3916822d663aaefcb3 Mon Sep 17 00:00:00 2001 From: historia <[not public]> Date: Wed, 16 Sep 2026 02:14:02 -0400 Subject: fix: economy recovery double-refund/erased-liability/cap-drops, entity editor path traversal --- internal/game/casino.go | 13 ++- internal/game/economy.go | 49 ++++++--- internal/game/economy_recovery_regression_test.go | 118 ++++++++++++++++++++++ 3 files changed, 161 insertions(+), 19 deletions(-) (limited to 'internal/game') diff --git a/internal/game/casino.go b/internal/game/casino.go index 3f06b41..bc1e690 100644 --- a/internal/game/casino.go +++ b/internal/game/casino.go @@ -82,15 +82,20 @@ func (w casinoWallet) PayCredits(amount int) error { } creditsBefore := w.p.Credits chipsBefore := countChips(w.p) - creditsAfter, err := addCreditsChecked(creditsBefore, amount) - if err != nil { - return err - } + creditsAfter, capErr := addCreditsChecked(creditsBefore, amount) + // The journal record is written FIRST, even when the economy cap + // blocks the payout: a won settlement must never be silently dropped. + // With the cap blocking, the balance is unchanged and the open record + // keeps the owed amount durable; startup recovery re-applies it once + // the balance has room below the cap. rec, err := w.g.Economy.start("payout", w.p, 0, amount, creditsBefore, creditsAfter, chipsBefore, chipsBefore) if err != nil { return casino.ErrWalletPersistence } + if capErr != nil { + return capErr + } w.p.Credits = creditsAfter if err := w.g.AccountStore.SaveCharacter(w.p); err != nil { w.p.Credits = creditsBefore diff --git a/internal/game/economy.go b/internal/game/economy.go index 04508be..afdcdd8 100644 --- a/internal/game/economy.go +++ b/internal/game/economy.go @@ -353,13 +353,21 @@ func (g *Game) recoverEconomy() { players[name] = p return p } - hasLaterPayout := func(name string, seq int) bool { + // laterPayoutEvidence reports whether any non-void payout record was + // journaled for the player after seq — evidence the round resolved and + // its settlement was recorded — together with the total credits those + // records promise. A payout covering the stake's full value returned + // the stake inside the payout (win, push, or refund); a smaller total + // (e.g. the credit side of a crashed mixed refund) leaves the chip + // side of the stake outstanding. + laterPayoutEvidence := func(name string, seq int) (resolved bool, credits int) { for _, fr := range folded { if fr.rec.Kind == "payout" && fr.rec.Player == name && fr.rec.Status != "void" && fr.seq > seq { - return true + resolved = true + credits += fr.rec.Credit } } - return false + return resolved, credits } compensated := 0 @@ -413,13 +421,23 @@ func (g *Game) recoverEconomy() { paid++ compensated++ } - for _, other := range group { - if paid == 0 { - break + for idx, other := range group { + if idx < paid { + g.Economy.settle(other) + settled[other.ID] = true + continue } - g.Economy.settle(other) - settled[other.ID] = true - paid-- + // An unpaid sibling (the save failed, or the credit cap + // blocked re-application) stays owed. Re-anchor its + // checkpoints to the current durable balance so a later + // recovery re-applies it against a balance it can actually + // be paid from — without this, the balance a PAID sibling + // moved reads as this record's own durability and the + // liability is silently settled instead of paid. + other.CreditsBefore = p.Credits + other.CreditsAfter = p.Credits + other.Credit + settled[other.ID] = true // handled for the rest of this run + _ = g.Economy.append(*other) } case p.Credits == rec.CreditsAfter && len(group) == 1: g.Economy.settle(rec) @@ -439,7 +457,7 @@ func (g *Game) recoverEconomy() { } for k := len(openWagers) - 1; k >= 0; k-- { rec := &folded[openWagers[k]].rec - resolvedByPayout := hasLaterPayout(rec.Player, folded[openWagers[k]].seq) + resolvedByPayout, laterPayoutCredits := laterPayoutEvidence(rec.Player, folded[openWagers[k]].seq) p := loadPlayer(rec.Player) if p == nil { continue @@ -449,11 +467,12 @@ func (g *Game) recoverEconomy() { creditsNow, chipsNow := p.Credits, countChips(p) // Chips are recovered independently of the credit checkpoints. Any // state where the chip debit is durable but the chips have not come - // back (post-debit chip balance) still owes the chips, even when a - // later payout record already resolves the credit side. A durable - // chip refund always restores the balance to ChipsBefore, so this - // cannot double-return. - chipsOwed := rec.Chips > 0 && chipsNow == rec.ChipsAfter + // back (post-debit chip balance) still owes the chips — unless the + // resolving payout already returned the stake's full value in + // credits (a win, push, or refund includes the stake): returning + // the chips in kind on top would double-refund the round. + chipsOwed := rec.Chips > 0 && chipsNow == rec.ChipsAfter && + (!resolvedByPayout || laterPayoutCredits < rec.Chips+rec.Credit) if chipsOwed && !g.giveChips(p, rec.Chips) { // No inventory room for the chip return: keep the record open // for operator inspection rather than silently dropping the diff --git a/internal/game/economy_recovery_regression_test.go b/internal/game/economy_recovery_regression_test.go index 12df39b..0e764ca 100644 --- a/internal/game/economy_recovery_regression_test.go +++ b/internal/game/economy_recovery_regression_test.go @@ -359,3 +359,121 @@ func TestRecoveryRestoresChipsFromMixedRefundCrash(t *testing.T) { t.Fatalf("nothing may stay owed after recovery: %+v", open) } } + +// TestRecoveryDoesNotReturnPaidChipStakeInKind: a chip wager whose round +// resolved with a durable payout (a win returns the stake inside the +// payout) must not ALSO get the chips back in kind on recovery — the +// resolving payout is the refund. Only a payout that does not cover the +// stake's full value (e.g. the credit side of a crashed mixed refund) +// leaves the chip side outstanding. +func TestRecoveryDoesNotReturnPaidChipStakeInKind(t *testing.T) { + h := newHarness(t) + h.seedAccount("alice", "pw", false) + p := h.seedCharacter("alice", "alice") + h.g.RunOnOwner(func() { + p.Credits = 100 + p.SetInvSlot(0, &player.InventorySlot{ItemID: "chips", Quantity: 10}) + w := casinoWallet{g: h.g, p: p} + if _, err := w.Wager(10); err != nil { + t.Error(err) + return + } + // The round resolved: a 2x payout (20) is durable, then the crash + // lands before the stake's resolution marker. + if err := w.PayCredits(20); err != nil { + t.Error(err) + return + } + h.g.recoverEconomy() + }) + loaded, err := h.g.AccountStore.LoadCharacter("alice") + if err != nil { + t.Fatal(err) + } + if loaded.Credits != 120 || countChips(loaded) != 0 { + t.Fatalf("won chip bet after recovery = (%d credits, %d chips), want (120, 0) — no double refund", + loaded.Credits, countChips(loaded)) + } +} + +// TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries: an unpaid payout +// liability (the credit cap blocked re-application) must survive repeated +// recoveries. Without checkpoint re-anchoring, a later recovery mistakes +// the balance a paid sibling moved for the unpaid record's own durability +// and silently erases the owed amount. +func TestRecoveryUnpaidLiabilitySurvivesLaterRecoveries(t *testing.T) { + h := newHarness(t) + h.seedAccount("alice", "pw", false) + p := h.seedCharacter("alice", "alice") + h.g.RunOnOwner(func() { + p.Credits = casino.MaxCredits - 30 + if err := h.g.AccountStore.SaveCharacter(p); err != nil { + t.Error(err) + return + } + for i := 0; i < 2; i++ { + if _, err := h.g.Economy.start("payout", p, 0, 20, p.Credits, p.Credits+20, 0, 0); err != nil { + t.Error(err) + return + } + } + h.g.recoverEconomy() + if len(h.g.Economy.loadOpen()) != 1 { + t.Errorf("setup: expected one unpaid record after capped recovery, got %d", len(h.g.Economy.loadOpen())) + return + } + // A later startup over the same files: the liability stays owed. + h.g.recoverEconomy() + if got := len(h.g.Economy.loadOpen()); got != 1 { + t.Errorf("second recovery erased the unpaid 20-credit liability: open=%d, want 1", got) + } + }) + loaded, err := h.g.AccountStore.LoadCharacter("alice") + if err != nil { + t.Fatal(err) + } + if loaded.Credits != casino.MaxCredits-10 { + t.Fatalf("balance after repeated recovery = %d, want %d (one payout applied)", loaded.Credits, casino.MaxCredits-10) + } +} + +// TestCapBlockedPayoutIsJournaled: a won payout at the economy cap must be +// recorded as an owed (open) payout record even though it cannot be +// applied — a reported win is never silently dropped. +func TestCapBlockedPayoutIsJournaled(t *testing.T) { + h := newHarness(t) + h.seedAccount("alice", "pw", false) + p := h.seedCharacter("alice", "alice") + h.g.RunOnOwner(func() { + p.Credits = casino.MaxCredits + w := casinoWallet{g: h.g, p: p} + if _, err := w.Wager(10); err != nil { + t.Error(err) + return + } + if err := w.PayCredits(20); err == nil { + t.Error("payout at the credit cap must fail, not silently clamp") + return + } + if p.Credits != casino.MaxCredits-10 { + t.Errorf("cap-blocked payout mutated the balance: %d", p.Credits) + } + }) + if err := h.g.AccountStore.SaveCharacter(p); err != nil { + t.Fatal(err) + } + restarted := harnessFromDir(t, h.dir) + loaded, err := restarted.g.AccountStore.LoadCharacter("alice") + if err != nil { + t.Fatal(err) + } + // Recovery: the owed win cannot be applied (cap), so the liability + // stays open for operator inspection, never erased; the consumed + // stake is settled against the payout evidence. + if got := len(restarted.g.Economy.loadOpen()); got != 1 { + t.Fatalf("owed cap-blocked payout must stay open after recovery, open records: %+v", restarted.g.Economy.loadOpen()) + } + if loaded.Credits != casino.MaxCredits-10 { + t.Fatalf("recovery mutated a capped balance: %d", loaded.Credits) + } +} -- cgit v1.2.3