path: root/internal/game/account_txn.go

package game

import (
	"crypto/rand"
	"encoding/hex"
	"fmt"
	"log"
	"os"
	"strings"

	"thehouseoficarus/internal/net"
	"thehouseoficarus/internal/persistence"
	"thehouseoficarus/internal/player"
)

// Account/character lifecycle operations. Each is one journal transaction
// over the affected files (account list, character files), executed with the
// game's single-owner guarantee: the online check, file mutation, registry
// update, and cross-session refresh happen without any interleaved session
// input, closing the check-then-rename gap. Save/remove errors are
// propagated to the caller, never ignored.
//
// All handlers here are invoked from session input (already on the owner).

// journalDir is the persistence journal directory under the game data dir.
func (g *Game) journalDir() string {
	return persistence.JournalDir(g.DataDir)
}

// newTxn starts a lifecycle transaction.
func (g *Game) newTxn() *persistence.Transaction {
	return persistence.NewTransaction(g.journalDir())
}

// adoptCharacterIdentity backfills stable identity fields on a loaded
// character: a UUID (assigned once at first load and persisted) and the
// owning account name. Legacy characters without these fields get them at
// first connection and are re-saved so subsequent authorizations can use
// them. Called from the owner goroutine only.
func (g *Game) adoptCharacterIdentity(p *player.Player, accountName string) {
	assignedID := ""
	if p.ID == "" {
		p.ID = newCharacterID()
		assignedID = p.ID
	}
	if p.Account == "" {
		p.Account = accountName
	}
	if err := g.AccountStore.SaveCharacter(p); err != nil {
		// Identity backfill is best-effort, but a NON-DURABLE ID must not
		// survive in memory: a later startup's backfill would assign a
		// different one, and any reference cached under this ID would point
		// at nothing. Fall back to the durable character name instead.
		if assignedID != "" {
			p.ID = ""
		}
		log.Printf("identity backfill for %s: %v", p.Name, err)
	}
}

// newCharacterID returns a random UUID (v4, formatted without dashes is
// unnecessary; standard hyphenated form is used).
func newCharacterID() string {
	var b [16]byte
	if _, err := rand.Read(b[:]); err != nil {
		panic(fmt.Sprintf("character id generation: %v", err))
	}
	b[6] = (b[6] & 0x0f) | 0x40 // version 4
	b[8] = (b[8] & 0x3f) | 0x80 // RFC 4122 variant
	s := hex.EncodeToString(b[:])
	return s[0:8] + "-" + s[8:12] + "-" + s[12:16] + "-" + s[16:20] + "-" + s[20:32]
}

// backfillCharacterIDs migrates every character file at startup: assigns
// missing IDs and owner fields (owner derived from account character lists
// for legacy files) and persists them.
func (g *Game) backfillCharacterIDs() {
	names, err := g.AccountStore.ListCharacterNames()
	if err != nil {
		return
	}
	owners := map[string]string{} // character (lower) -> owning account
	accounts, _ := g.AccountStore.ListAccountNames()
	for _, accName := range accounts {
		acc, err := g.AccountStore.LoadAccount(accName)
		if err != nil {
			continue
		}
		for _, c := range acc.Characters {
			owners[strings.ToLower(c)] = acc.Name
		}
	}
	for _, name := range names {
		p, err := g.AccountStore.LoadCharacter(name)
		if err != nil {
			log.Printf("character migration load %s: %v", name, err)
			continue
		}
		changed := false
		if p.ID == "" {
			p.ID = newCharacterID()
			changed = true
		}
		if p.Account == "" {
			if owner, ok := owners[strings.ToLower(p.Name)]; ok {
				p.Account = owner
				changed = true
			}
		}
		if changed {
			if err := g.AccountStore.SaveCharacter(p); err != nil {
				log.Printf("character migration save %s: %v", p.Name, err)
			}
		}
	}
}

// canonicChar returns the character name in its canonical on-disk form.
func (g *Game) canonicalChar(name string) (string, error) {
	return g.AccountStore.FindCharacter(name)
}

// validateAccountName and validateCharacterName reject names that any
// AccountPath/CharPath join would interpret as a path (separators, dots) or
// that no account/character in this store may carry. Every lifecycle
// transaction validates its names BEFORE it touches the filesystem: a
// caller-supplied or account-file-supplied name such as "../../x" would
// otherwise make AccountPath/CharPath read or delete files outside
// players/, and a transaction is not the place to discover that.
func validateAccountName(name string) error {
	if err := player.ValidName(name); err != nil {
		return fmt.Errorf("invalid account name %q: %w", name, err)
	}
	return nil
}

func validateCharacterName(name string) error {
	if err := player.ValidName(name); err != nil {
		return fmt.Errorf("invalid character name %q: %w", name, err)
	}
	return nil
}

// createCharacterTxn creates the character file and appends it to the
// owning account in a single transaction. Returns the created player.
func (g *Game) createCharacterTxn(accountName, charName string, startingRoom int) (*player.Player, error) {
	if err := validateAccountName(accountName); err != nil {
		return nil, err
	}
	if err := validateCharacterName(charName); err != nil {
		return nil, err
	}
	p := player.New(charName)
	p.RoomID = startingRoom
	p.Stats.RecordRoomVisit(startingRoom)
	p.ID = newCharacterID()
	p.Account = accountName
	data, err := g.AccountStore.MarshalCharacter(p)
	if err != nil {
		return nil, err
	}
	txn := g.newTxn()
	if err := txn.Replace(g.AccountStore.CharPath(charName), data, 0600); err != nil {
		return nil, err
	}
	acc, err := g.AccountStore.LoadAccount(accountName)
	if err != nil {
		return nil, err
	}
	acc.Characters = append(acc.Characters, charName)
	accData, err := g.AccountStore.MarshalAccount(acc)
	if err != nil {
		return nil, err
	}
	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
		return nil, err
	}
	return p, txn.Commit()
}

// renameCharacterTxn atomically renames the character file, persists the new
// name inside it, and updates the owning account's character list.
func (g *Game) renameCharacterTxn(accountName, oldName, newName string) error {
	if err := validateAccountName(accountName); err != nil {
		return err
	}
	if err := validateCharacterName(oldName); err != nil {
		return err
	}
	if err := validateCharacterName(newName); err != nil {
		return err
	}
	txn := g.newTxn()
	if err := txn.Move(g.AccountStore.CharPath(oldName), g.AccountStore.CharPath(newName)); err != nil {
		return err
	}
	p, err := g.AccountStore.LoadCharacter(oldName)
	if err != nil {
		return err
	}
	p.Name = newName
	if p.ID == "" {
		// Assign the stable identity at rename time so cached references
		// (and the owner/membership checks) resolve the renamed character
		// by ID rather than the new filename.
		p.ID = newCharacterID()
	}
	data, err := g.AccountStore.MarshalCharacter(p)
	if err != nil {
		return err
	}
	if err := txn.Replace(g.AccountStore.CharPath(newName), data, 0600); err != nil {
		return err
	}
	acc, err := g.AccountStore.LoadAccount(accountName)
	if err != nil {
		return err
	}
	chars := make([]string, 0, len(acc.Characters))
	for _, c := range acc.Characters {
		if c == oldName {
			chars = append(chars, newName)
		} else {
			chars = append(chars, c)
		}
	}
	acc.Characters = chars
	accData, err := g.AccountStore.MarshalAccount(acc)
	if err != nil {
		return err
	}
	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
		return err
	}
	return txn.Commit()
}

// deleteCharacterTxn removes the character file and updates the account list
// atomically.
func (g *Game) deleteCharacterTxn(accountName, charName string) error {
	if err := validateAccountName(accountName); err != nil {
		return err
	}
	if err := validateCharacterName(charName); err != nil {
		return err
	}
	txn := g.newTxn()
	if err := txn.Delete(g.AccountStore.CharPath(charName)); err != nil {
		return err
	}
	acc, err := g.AccountStore.LoadAccount(accountName)
	if err != nil {
		return err
	}
	var chars []string
	for _, c := range acc.Characters {
		if c != charName {
			chars = append(chars, c)
		}
	}
	acc.Characters = chars
	accData, err := g.AccountStore.MarshalAccount(acc)
	if err != nil {
		return err
	}
	if err := txn.Replace(g.AccountStore.AccountPath(accountName), accData, 0600); err != nil {
		return err
	}
	return txn.Commit()
}

// purgeAccountTxn removes the account file and every character file in one
// transaction. The account's character list arrives from the account file,
// so every name in it is validated before the first CharPath join: a
// hand-edited or corrupt entry must not turn a purge into a delete outside
// players/characters/.
func (g *Game) purgeAccountTxn(accountName string, characters []string) error {
	if err := validateAccountName(accountName); err != nil {
		return err
	}
	for _, name := range characters {
		if err := validateCharacterName(name); err != nil {
			return err
		}
	}
	txn := g.newTxn()
	for _, name := range characters {
		if err := txn.Delete(g.AccountStore.CharPath(name)); err != nil {
			return err
		}
	}
	if err := txn.Delete(g.AccountStore.AccountPath(accountName)); err != nil {
		return err
	}
	return txn.Commit()
}

// renameAccountTxn moves the account file, rewrites its embedded name,
// and rewrites every owned character file's owner field in one
// transaction. Without the character rewrite the renamed account loses
// access to its characters: membership authorization compares the
// character file's owner against the account name.
//
// Both names and every entry of the account's character list are validated
// up front: each one is joined into AccountPath/CharPath below, and a
// path-like name would escape players/.
func (g *Game) renameAccountTxn(oldName, newName string) error {
	if err := validateAccountName(oldName); err != nil {
		return err
	}
	if err := validateAccountName(newName); err != nil {
		return err
	}
	acc, err := g.AccountStore.LoadAccount(oldName)
	if err != nil {
		return err
	}
	for _, charName := range acc.Characters {
		if err := validateCharacterName(charName); err != nil {
			return err
		}
	}
	txn := g.newTxn()
	if err := txn.Move(g.AccountStore.AccountPath(oldName), g.AccountStore.AccountPath(newName)); err != nil {
		return err
	}
	acc.Name = newName
	accData, err := g.AccountStore.MarshalAccount(acc)
	if err != nil {
		return err
	}
	if err := txn.Replace(g.AccountStore.AccountPath(newName), accData, 0600); err != nil {
		return err
	}
	// Re-point each owned character at the new account name inside the
	// same transaction. Legacy or unreadable character files are skipped:
	// membership falls back to the account list, which is already
	// rewritten above.
	for _, charName := range acc.Characters {
		p, err := g.AccountStore.LoadCharacter(charName)
		if err != nil || p.Account == "" || !equalsFold(p.Account, oldName) {
			continue
		}
		p.Account = newName
		charData, err := g.AccountStore.MarshalCharacter(p)
		if err != nil {
			return err
		}
		if err := txn.Replace(g.AccountStore.CharPath(charName), charData, 0600); err != nil {
			return err
		}
	}
	return txn.Commit()
}

// isMemberOf reports whether characterName belongs to accountName by
// checking the character file's owner field (falling back to the account's
// character list for legacy files), case-insensitively.
func (g *Game) isMemberOf(accountName, characterName string) bool {
	p, err := g.AccountStore.LoadCharacter(characterName)
	if err != nil {
		return false
	}
	if p.Account != "" {
		return equalsFold(p.Account, accountName)
	}
	acc, err := g.AccountStore.LoadAccount(accountName)
	if err != nil {
		return false
	}
	for _, c := range acc.Characters {
		if equalsFold(c, characterName) {
			return true
		}
	}
	return false
}

// publishAccountUpdate reloads the account from disk and republishes its
// state to every session of that account, resetting stale pending menu
// selections (pending character names, menu choices) after lifecycle
// mutations. A session whose account no longer exists on disk is reset to the
// account-name prompt (resetToAccountName) and closed. Called from the owner
// goroutine only.
//
// oldName and newName differ only for an account rename: sessions
// authenticated before the rename still carry the OLD cached account
// name, so both must match or stale sessions would be left bound to a
// name that no longer exists on disk.
func (g *Game) publishAccountUpdate(oldName, newName string) {
	for _, sess := range g.allSessionsOfEitherAccount(oldName, newName) {
		acc, err := g.AccountStore.LoadAccount(newName)
		if err != nil {
			// The account file vanished (purge or a raw admin delete from
			// another session); the session is stale and must leave the menu.
			// resetToAccountName clears PendingPass and the pending state
			// alongside Account: a stale confirm-password still matching
			// PendingPass would otherwise reach a handler that expects an
			// account bound to the session.
			sess.WriteLine("\nYour account no longer exists.")
			g.resetToAccountName(sess)
			sess.Close()
			continue
		}
		sess.Account = &player.Account{
			Name:         acc.Name,
			PasswordHash: acc.PasswordHash,
			Characters:   acc.Characters,
			Aliases:      acc.Aliases,
			Colors:       acc.Colors,
			Options:      acc.Options,
			Admin:        acc.Admin,
		}
		if sess.Account.Aliases == nil {
			sess.Account.Aliases = make(map[string]string)
		}
		if sess.Account.Colors == nil {
			sess.Account.Colors = make(map[string]string)
		}
		if sess.Account.Options == nil {
			sess.Account.Options = make(map[string]any)
		}
		// Any pending selection referencing a deleted/renamed character is
		// stale now; revalidate before reuse.
		sess.PendingMenu = nil
		if sess.PendingChar != "" && sess.PendingChar != "connect" {
			found := false
			for _, c := range sess.Account.Characters {
				if equalsFold(c, sess.PendingChar) {
					found = true
					break
				}
			}
			if !found {
				sess.PendingChar = ""
				sess.SetState(net.StateMenu)
				g.showMenu(sess)
			}
		}
	}
}

// allSessionsOfAccount returns every session authenticated to accountName,
// including sessions sitting in menus (not just in-game characters).
func (g *Game) allSessionsOfAccount(accountName string) []*net.Session {
	return g.allSessionsOfEitherAccount(accountName, accountName)
}

// allSessionsOfEitherAccount matches sessions authenticated to either
// account name (an account rename leaves stale sessions under the old
// name until they are republished).
func (g *Game) allSessionsOfEitherAccount(oldName, newName string) []*net.Session {
	if g.Hub == nil {
		return nil
	}
	var out []*net.Session
	for _, sess := range g.Hub.AllSessions() {
		if sess.Account != nil && (equalsFold(sess.Account.Name, oldName) || equalsFold(sess.Account.Name, newName)) {
			out = append(out, sess)
		}
	}
	return out
}

// equalsFold is a small case-insensitive string equality helper.
func equalsFold(a, b string) bool {
	if len(a) != len(b) {
		return false
	}
	for i := 0; i < len(a); i++ {
		ca, cb := a[i], b[i]
		if 'A' <= ca && ca <= 'Z' {
			ca += 'a' - 'A'
		}
		if 'A' <= cb && cb <= 'Z' {
			cb += 'a' - 'A'
		}
		if ca != cb {
			return false
		}
	}
	return true
}

// recoverJournals rolls back leftover lifecycle journals and surfaces
// unrecoverable ones. It scans every journal in the directory, so it must run
// only where no other transaction can be in flight: at startup, or on the game
// owner goroutine (which serializes every transaction). The mid-game caller in
// video_poker_banks.go is on the owner.
func (g *Game) recoverJournals() {
	if err := persistence.Recover(g.journalDir()); err != nil {
		fmt.Fprintf(os.Stderr, "lifecycle journal recovery failed: %v\n", err)
		os.Exit(1)
	}
}