3b93716
@@ -20,6 +20,15 @@
import { parseSituation, type Situation } from "./plan/situation.ts";
import { sign } from "./who.ts";
import { PAGE_ACTIONS, PAGE_IDS } from "./client/stage.test-helper.ts";
import { EXAMPLE_ACTIONS, EXAMPLE_IDS } from "./example/stage.test-helper.ts";
// The rooms, for the two doors at the end of this file: what a code is, what
// the hub holds, and the frames that cross a socket once one is open.
import { isRoomCode } from "./rooms/code.ts";
import { CLOSE_TOO_BIG, MESSAGE_MAX, ROOM_CAP } from "./rooms/hub.ts";
import { levelOf, SNAPSHOT_HZ, TEAM_SIZE } from "./rooms/room.ts";
import { applySnapshot, readDown, writeInput, INPUT_BYTES, SNAPSHOT_FRAME, type Hello } from "./rooms/wire.ts";
import { COMPETITIVE, SHORT } from "./client/match.ts";
import type { PlayedMap } from "./mapname.ts";
import { createWorld, NO_INPUT } from "./client/world.ts";
process.env.FORGE_APP_DATA = mkdtempSync(join(tmpdir(), "app-"));
process.env.PORT = "0";
@@ -29,8 +38,8 @@
const BUNDLES = bundlesDir();
// The test is the forge: it holds the same key and signs identities with it.
const KEY = "the-key-the-forge-signs-with";
process.env.FORGE_APP_IDENTITY_KEY = KEY;
const { server, MATCH_LIMIT, GUEST_ADDRESS_LIMIT, PLAN_ID, onError, findScripts, holdStatic } =
  await import("./server.ts");
const { server, MATCH_LIMIT, GUEST_ADDRESS_LIMIT, PLAN_ID, ROOM_LIMIT, SOCKET_PATH, hub, onError, findScripts,
  holdStatic } = await import("./server.ts");
const base = `http://${server.hostname}:${server.port}`;
/** The two headers the forge puts on a request it proxies for a signed-in person. */
@@ -1236,3 +1245,520 @@
test("the endpoint meta is how a page names where a plan comes from", () => {
  // Escaped like everything else the shell is handed.
  expect(endpoints([{ id: 'x"y', href: '/a"b' }])).toContain('id="x&quot;y" content="/a&quot;b"');
});
// --- the room's two doors ---------------------------------------------------
/**
 * `POST /api/room` and the socket upgrade are the only two endpoints here that
 * hold a connection open, and the only two a stranger reaches with no result to
 * post. The four test files under `src/rooms/` are the hub, the room and the
 * codec through plain objects and never see a request; what follows is the
 * doors themselves — the statuses, the headers, the cookie, the cut on a name
 * and every refusal — against the server this file has been fetching all along.
 *
 * Two habits every test below keeps, because a room is a world this process
 * steps 64 times a second for as long as it is held:
 *
 * - **It gives its room back.** The hub frees an empty room after `IDLE_MS`,
 *   which is ninety seconds and outlives this suite, so a room left behind
 *   would be stepped for the rest of the run and would push the next test
 *   towards `ROOM_CAP`. `finish` closes the sockets and deletes the room, and
 *   the last test here reads the hub to prove nothing was forgotten.
 * - **It is its own caller.** `ROOM_LIMIT` is three rooms per caller keyed by
 *   address and session, and every test here comes from this one address — so
 *   each takes a session cookie nobody else uses and spends its own three
 *   tokens. Nothing below depends on where in the file it runs, the flood test
 *   included.
 *
 * It is in this already long file rather than in a sibling of its own for one
 * mechanical reason: `bun test` runs every file in one process with one module
 * registry, so a second file that imported `./server.ts` would share *this*
 * file's server — and, running before it, would set `FORGE_APP_DATA` after the
 * bundles had been built into somewhere else. One file imports the server, and
 * `src/rooms/room.test.ts` already says the socket's own half is here.
 */
/** A caller nobody else here is: the session cookie derived from a test's label. */
const caller = (label: string): string =>
  `cs_session=${new Bun.CryptoHasher("sha256").update(label).digest("hex").slice(0, 32)}`;
/** The room door, with the bytes a caller actually wrote. */
const postRoom = (body: string, headers: Record<string, string> = {}): Promise<Response> =>
  fetch(base + "/api/room", { method: "POST", headers: { "content-type": "application/json", ...headers }, body });
/** …and the usual case: a JSON object, from a caller of this test's own. */
const askRoom = (label: string, asked: unknown = {}): Promise<Response> =>
  postRoom(JSON.stringify(asked), { cookie: caller(label) });
/** What the room door answers with, once it has answered. */
type Opened = { code: string; map: string; length: string };
const openedRoom = async (label: string, asked: unknown = {}): Promise<Opened> => {
  const response = await askRoom(label, asked);
  expect(response.status).toBe(200);
  return (await response.json()) as Opened;
};
/** Poll until this is true or the deadline passes; the answer is what it was. */
const until = async (ready: () => boolean, ms = 2000): Promise<boolean> => {
  const deadline = Date.now() + ms;
  while (!ready() && Date.now() < deadline) await Bun.sleep(5);
  return ready();
};
/** What a page holds: the socket, every frame it was handed, and the close. */
type Client = {
  ws: WebSocket;
  frames: (string | Uint8Array)[];
  /** The code the connection was closed with, or null while it is open. */
  closeCode: () => number | null;
  /** Closes it and waits for the socket to be shut, so no test leaks one. */
  close: () => Promise<void>;
};
/** A real browser's end of a room, connected and open. */
async function connect(query: string): Promise<Client> {
  const ws = new WebSocket(`${base.replace("http://", "ws://")}${SOCKET_PATH}?${query}`);
  ws.binaryType = "arraybuffer";
  const frames: (string | Uint8Array)[] = [];
  let closed: number | null = null;
  ws.addEventListener("message", (event: MessageEvent) => {
    frames.push(typeof event.data === "string" ? event.data : new Uint8Array(event.data as ArrayBuffer));
  });
  ws.addEventListener("close", (event: CloseEvent) => { closed = event.code; });
  const client: Client = {
    ws, frames,
    closeCode: () => closed,
    close: async () => {
      ws.close();
      await until(() => ws.readyState === WebSocket.CLOSED);
    },
  };
  expect(await until(() => ws.readyState === WebSocket.OPEN || closed !== null)).toBe(true);
  expect(ws.readyState).toBe(WebSocket.OPEN);
  return client;
}
/** The end of a test: close what it opened, and hand the room back to the hub. */
const finish = async (code: string, ...clients: Client[]): Promise<void> => {
  for (const client of clients) await client.close();
  hub.rooms.delete(code);
};
/**
 * The 101 itself, read off the wire. A `WebSocket` hands a page the socket and
 * never the response it came out of, so the handshake is written here by hand
 * and the status line and headers are read back before the connection is
 * dropped: it is the only way to see what a browser's upgrade was answered
 * with. The bytes after the blank line are the room's first frames and are not
 * read — this is about the head.
 */
async function handshake(query: string, extra: Record<string, string> = {}): Promise<{
  status: number; headers: Headers;
}> {
  const key = btoa(String.fromCharCode(...crypto.getRandomValues(new Uint8Array(16))));
  const request = [
    `GET ${SOCKET_PATH}?${query} HTTP/1.1`,
    `Host: ${new URL(base).host}`,
    "Upgrade: websocket",
    "Connection: Upgrade",
    `Sec-WebSocket-Key: ${key}`,
    "Sec-WebSocket-Version: 13",
    ...Object.entries(extra).map(([name, value]) => `${name}: ${value}`),
  ].join("\r\n") + "\r\n\r\n";
  let head = "";
  const where = new URL(base);
  const socket = await Bun.connect({
    hostname: where.hostname,
    port: Number(where.port),
    socket: {
      open(connection) { connection.write(request); },
      data(_connection, chunk) { head += chunk.toString("latin1"); },
    },
  });
  expect(await until(() => head.includes("\r\n\r\n"))).toBe(true);
  socket.end();
  const [status, ...rest] = head.slice(0, head.indexOf("\r\n\r\n")).split("\r\n");
  const headers = new Headers();
  for (const line of rest) {
    const at = line.indexOf(":");
    if (at > 0) headers.append(line.slice(0, at).trim(), line.slice(at + 1).trim());
  }
  return { status: Number((status ?? "").split(" ")[1]), headers };
}
test("`POST /api/room` answers a code as no-store JSON, on the floor, with a session", async () => {
  const response = await askRoom("opens one");
  expect(response.status).toBe(200);
  expect(response.headers.get("content-type")).toBe("application/json; charset=utf-8");
  expect(response.headers.get("cache-control")).toBe("no-store");
  // The floor a plan comes back on, header for header: this is data and not a
  // document, so it carries the policy with no style hash in it.
  const plan = await askPlan(JSON.stringify(situation()));
  expect(response.headers.get("content-security-policy")).toBe(plan.headers.get("content-security-policy"));
  expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(response.headers.get("x-content-type-options")).toBe("nosniff");
  expect(response.headers.get("referrer-policy")).toBe("strict-origin-when-cross-origin");
  expect(response.headers.get("permissions-policy")).toBe("camera=(), microphone=(), geolocation=()");
  // The session it arrived with, back in the cookie every page here sets.
  const cookie = response.headers.get("set-cookie") ?? "";
  expect(cookie).toContain(caller("opens one"));
  expect(cookie).toContain("HttpOnly");
  expect(cookie).toContain("SameSite=Lax");
  expect(cookie).toContain("Path=/");
  // And the answer is a code, a map and a length, and nothing else at all.
  const room = (await response.json()) as Opened;
  expect(isRoomCode(room.code)).toBe(true);
  expect(room).toEqual({ code: room.code, map: "de_forge", length: "short" });
  // The code names a room this process is holding, with nobody in it yet.
  expect(hub.find(room.code)?.map).toBe("de_forge");
  expect(hub.find(room.code)?.members.size).toBe(0);
  await finish(room.code);
});
test("a browser with no session is given one on the way into its first room", async () => {
  // The one test here with no cookie of its own, because that is the thing it
  // is about: the caller keyed `room:<address>|-` is this one and nobody else.
  const response = await postRoom("{}");
  expect(response.status).toBe(200);
  expect(response.headers.get("set-cookie")).toMatch(/^cs_session=[0-9a-f]{32}; Path=\/; HttpOnly; SameSite=Lax/);
  await finish(((await response.json()) as Opened).code);
});
test("the map and the length are settled at the door: an unknown map is de_forge, and only `long` is long", async () => {
  const cases: [unknown, PlayedMap, "short" | "long"][] = [
    [{}, "de_forge", "short"],
    [{ map: "de_dust2", length: "epic" }, "de_forge", "short"],
    [{ map: 7, length: 1 }, "de_forge", "short"],
    [{ map: null, length: "Long" }, "de_forge", "short"],
    [{ map: "<script>alert(1)</script>", length: ["long"] }, "de_forge", "short"],
    [{ map: "generated" }, "de_forge", "short"],
    [{ map: "de_forge", length: "long" }, "de_forge", "long"],
    [{ map: "gen_14u5j6g", length: "long" }, "gen_14u5j6g", "long"],
  ];
  for (const [asked, map, length] of cases) {
    const room = await openedRoom(`map ${JSON.stringify(asked)}`, asked);
    expect([room.map, room.length]).toEqual([map, length]);
    // The room this process is holding is the one the answer described, and
    // the rules under it are the long match's only when the answer said long.
    const held = hub.find(room.code);
    expect(held?.map).toBe(map);
    expect(held?.length).toBe(length);
    expect(held?.rules).toBe(length === "long" ? COMPETITIVE : SHORT);
    await finish(room.code);
  }
  // A body that is not an object at all is not an error: it asked for nothing,
  // so it gets what asking for nothing gets.
  for (const body of ["[]", "null", '"de_dust2"', "7", "{}"]) {
    const response = await postRoom(body, { cookie: caller(`not an object ${body}`) });
    expect(response.status).toBe(200);
    const room = (await response.json()) as Opened;
    expect([room.map, room.length]).toEqual(["de_forge", "short"]);
    await finish(room.code);
  }
});
test("a room is opened by this page and by nobody else, and never by a read", async () => {
  const before = hub.rooms.size;
  const elsewhere: Record<string, string>[] = [
    { "sec-fetch-site": "cross-site" },
    { "sec-fetch-site": "same-site" },
    { origin: "https://evil.example" },
  ];
  for (const headers of elsewhere) {
    const response = await postRoom(JSON.stringify({ map: "de_forge" }), { ...headers, cookie: caller("cross-site") });
    expect(response.status).toBe(403);
    expect(await response.text()).toBe("forbidden");
    expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
    expect(response.headers.get("set-cookie")).toBeNull();
  }
  // And it is not a read: nothing opens a room for a GET or a HEAD.
  expect((await fetch(base + "/api/room")).status).toBe(404);
  expect((await server.fetch(new Request(base + "/api/room", { method: "HEAD" }))).status).toBe(404);
  // Not one of them left a world behind for this process to step.
  expect(hub.rooms.size).toBe(before);
});
test("a body that is not a room to open is refused by the bytes read, and opens nothing", async () => {
  const before = hub.rooms.size;
  const bad = await postRoom("{", { cookie: caller("bad json") });
  expect(bad.status).toBe(400);
  expect(await bad.text()).toBe("bad json");
  // A kilobyte is the cap, counted as it arrives rather than believed off a
  // header: this body declares nothing and is cut off anyway.
  const big = await postRoom(`{"map":"de_forge","pad":"${"x".repeat(4096)}"}`, { cookie: caller("too large") });
  expect(big.status).toBe(413);
  expect(await big.text()).toBe("too large");
  for (const response of [bad, big])
    expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(hub.rooms.size).toBe(before);
});
test("one caller cannot open rooms as fast as it likes", async () => {
  // This spends one caller's bucket to the last token. Every other test here
  // has a caller of its own, so this one poisons nothing and needs no place in
  // the file — which is why it is here and not last.
  const mine = { cookie: caller("flooder") };
  const codes: string[] = [];
  let refused: Response | undefined;
  for (let i = 0; i <= ROOM_LIMIT.burst; i++) {
    const response = await postRoom("{}", mine);
    if (response.status === 429) { refused = response; break; }
    expect(response.status).toBe(200);
    codes.push(((await response.json()) as Opened).code);
  }
  expect(codes.length).toBe(ROOM_LIMIT.burst);
  expect(refused?.status).toBe(429);
  expect(await refused?.text()).toBe("slow down");
  expect(refused?.headers.get("retry-after")).toBe(String(ROOM_LIMIT.per / 1000));
  expect(refused?.headers.get("content-security-policy")).toContain("default-src 'self'");
  // Somebody else's bucket is their own: one flood does not close the door.
  const other = await postRoom("{}", { cookie: caller("bystander") });
  expect(other.status).toBe(200);
  codes.push(((await other.json()) as Opened).code);
  for (const code of codes) await finish(code);
});
test("past ROOM_CAP the answer is 503 and the sentence names the cap", async () => {
  // Nineteen rooms through the hub and only the twentieth through the route:
  // nineteen POSTs would want seven callers to get past ROOM_LIMIT, and the
  // room this test is about is the one the route refuses rather than the ones
  // underneath it. It is cheap either way — nineteen de_forge rooms are 6.5 ms
  // on this tree — so what picked the hub was the limiter, not the clock.
  const filled: string[] = [];
  while (hub.rooms.size < ROOM_CAP - 1) {
    const room = hub.open({ map: "de_forge", seed: hub.rooms.size, length: "short", now: Date.now() });
    expect(room).not.toBeNull();
    filled.push((room as { code: string }).code);
  }
  try {
    const last = await postRoom("{}", { cookie: caller("cap") });
    expect(last.status).toBe(200);
    filled.push(((await last.json()) as Opened).code);
    expect(hub.rooms.size).toBe(ROOM_CAP);
    const refused = await postRoom("{}", { cookie: caller("cap") });
    expect(refused.status).toBe(503);
    expect(await refused.text()).toBe(`every room is taken — this deployment holds ${ROOM_CAP}`);
    expect(refused.headers.get("content-type")).toBe("text/plain; charset=utf-8");
    expect(refused.headers.get("content-security-policy")).toContain("default-src 'self'");
    // A refusal is not a room: the cap is still the cap.
    expect(hub.rooms.size).toBe(ROOM_CAP);
  } finally {
    for (const code of filled) hub.rooms.delete(code);
  }
});
test("the upgrade refuses at the door: no code is 400, an unknown code is 404, another site is 403", async () => {
  const room = await openedRoom("upgrade refusals");
  try {
    // Nothing asked for, and things asked for that are not codes: the wrong
    // length, a space, and the letters the alphabet leaves out (O, 0, I, L, 1, S).
    for (const query of ["", "?room=", "?room=ABCDE", "?room=ABCDEFG", `?room=${encodeURIComponent("ABC DEF")}`,
      "?room=O0IL1S", "?room=../../etc", `?room=${encodeURIComponent("<script>")}`]) {
      const response = await fetch(base + SOCKET_PATH + query);
      expect(response.status).toBe(400);
      expect(await response.text()).toBe("not a room code");
      expect(response.headers.get("content-type")).toBe("text/plain; charset=utf-8");
      expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
    }
    // A code shaped like one, for a room nobody is holding. The one in a
    // billion where the hub drew it a moment ago is made impossible here.
    hub.rooms.delete("ABCDEF");
    const gone = await fetch(`${base}${SOCKET_PATH}?room=ABCDEF`);
    expect(gone.status).toBe(404);
    expect(await gone.text()).toBe("no room with that code — it may have been idle too long");
    expect(gone.headers.get("content-type")).toBe("text/plain; charset=utf-8");
    // And another site cannot upgrade, with a code that is real and current:
    // the refusal comes before the room is even looked up.
    const elsewhere: Record<string, string>[] = [{ "sec-fetch-site": "cross-site" }, { origin: "https://evil.example" }];
    for (const headers of elsewhere) {
      const response = await fetch(`${base}${SOCKET_PATH}?room=${room.code}`, { headers });
      expect(response.status).toBe(403);
      expect(await response.text()).toBe("forbidden");
      expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
    }
    // Not one of those refusals seated anybody.
    expect(hub.find(room.code)?.members.size).toBe(0);
  } finally {
    await finish(room.code);
  }
});
test("a plain `GET /ws` with no upgrade header is the app's own 404 page, not an error", async () => {
  const room = await openedRoom("plain get");
  try {
    // Lower case on purpose: the code is upper-cased at the door, so this one
    // resolves — a code that did not would be the plain-text 404 above, and
    // what comes back instead is the document every wrong path gets.
    const miss = await fetch(`${base}${SOCKET_PATH}?room=${room.code.toLowerCase()}`);
    expect(miss.status).toBe(404);
    expect(miss.headers.get("content-type")).toBe("text/html; charset=utf-8");
    const body = await miss.text();
    expect(body.startsWith("<!doctype html>")).toBe(true);
    expect(body).toContain("<h1>not found</h1>");
    expect(floorOf(miss)).toEqual(floorOf(await fetch(base + "/nope")));
    // HEAD is that 404 with nothing to read, like every other path here. It
    // goes over the wire rather than through `server.fetch`, because this route
    // asks the listener to upgrade and `server.fetch` hands it no listener.
    const head = await fetch(`${base}${SOCKET_PATH}?room=${room.code}`, { method: "HEAD" });
    expect(head.status).toBe(404);
    expect(await head.text()).toBe("");
    // Reading a room is not joining one.
    expect(hub.find(room.code)?.members.size).toBe(0);
  } finally {
    await finish(room.code);
  }
});
test("the upgrade is a 101 carrying the session cookie and the security floor", async () => {
  const room = await openedRoom("handshake");
  try {
    const session = "d".repeat(32);
    const { status, headers } = await handshake(`room=${room.code}&name=handshake`, {
      Cookie: `cs_session=${session}`,
    });
    expect(status).toBe(101);
    expect(headers.get("upgrade")?.toLowerCase()).toBe("websocket");
    expect(headers.get("sec-websocket-accept")).not.toBeNull();
    // The session it arrived with, not a new one: a browser that has a cookie
    // keeps it, and the cookie is the same one every page here sets.
    expect(headers.get("set-cookie")).toContain(`cs_session=${session}`);
    expect(headers.get("set-cookie")).toContain("HttpOnly");
    expect(headers.get("set-cookie")).toContain("SameSite=Lax");
    // The floor rides on the 101 like it does on every other answer.
    expect(headers.get("content-security-policy")).toContain("default-src 'self'");
    expect(headers.get("x-content-type-options")).toBe("nosniff");
    expect(headers.get("referrer-policy")).toBe("strict-origin-when-cross-origin");
    expect(headers.get("permissions-policy")).toBe("camera=(), microphone=(), geolocation=()");
    // A browser with no cookie is given one on the 101 as well.
    const fresh = await handshake(`room=${room.code}&name=handshake`);
    expect(fresh.status).toBe(101);
    expect(fresh.headers.get("set-cookie")).toMatch(/cs_session=[0-9a-f]{32}; Path=\/; HttpOnly; SameSite=Lax/);
    // Both connections were dropped by `handshake`; the seats go with them.
    expect(await until(() => hub.find(room.code)?.members.size === 0)).toBe(true);
  } finally {
    await finish(room.code);
  }
});
test("a real socket into a real room is handed hello and then the round, sixteen times a second", async () => {
  const room = await openedRoom("hello", { map: "de_forge" });
  const client = await connect(`room=${room.code}&name=torque`);
  try {
    expect(await until(() => client.frames.some((frame) => typeof frame !== "string"))).toBe(true);
    // The first thing down the wire is the hello, and it is about this room.
    const hello = readDown(client.frames[0] as string) as Hello;
    expect(hello?.k).toBe("hello");
    expect(hello.code).toBe(room.code);
    expect(hello.map).toBe("de_forge");
    expect(hello.rules).toBe("short");
    expect(hello.snapshotHz).toBe(SNAPSHOT_HZ);
    expect(hello.roster.length).toBe(TEAM_SIZE * 2);
    expect(hello.roster[hello.seat]?.name).toBe("torque");
    expect(hello.roster[hello.seat]?.bot).toBe(false);
    // The room agrees: one member, holding that seat.
    const held = hub.find(room.code);
    expect(held?.members.size).toBe(1);
    expect([...(held?.members.values() ?? [])][0]?.seat).toBe(hello.seat);
    // Then the round itself, as bytes a page reads: the same snapshot the
    // shooter's own client applies, against a world carved from the two
    // numbers the hello handed over.
    const snapshot = client.frames.find((frame) => typeof frame !== "string") as Uint8Array;
    expect(snapshot[0]).toBe(SNAPSHOT_FRAME);
    const watching = createWorld(levelOf("de_forge"), SHORT, "watching", "ct", TEAM_SIZE, hello.seed);
    const read = applySnapshot(watching, snapshot, hello.seat);
    expect(read).not.toBeNull();
    expect(read?.tick).toBeGreaterThan(0);
  } finally {
    await client.close();
    // The close is what frees the seat, and the bot takes its body back.
    expect(await until(() => hub.find(room.code)?.members.size === 0)).toBe(true);
    expect(hub.find(room.code)?.world.players.every((p) => p.bot)).toBe(true);
    hub.rooms.delete(room.code);
  }
});
test("a name longer than 24 characters is cut at the door, before the room ever sees it", async () => {
  // The door cuts at 24; the room then strips what is not printable and cuts at
  // 20 (`uniqueName`). A name whose first ten characters are control codes
  // tells the two apart: cut at 24 first and fourteen letters survive, cut only
  // at 20 in the room and twenty would.
  const wanted = "\u0001".repeat(10) + "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
  const room = await openedRoom("long name");
  const client = await connect(`room=${room.code}&name=${encodeURIComponent(wanted)}`);
  try {
    expect(await until(() => client.frames.length > 0)).toBe(true);
    const hello = readDown(client.frames[0] as string) as Hello;
    expect(hello.roster[hello.seat]?.name).toBe("ABCDEFGHIJKLMN");
  } finally {
    await finish(room.code, client);
  }
});
test("a text frame on the socket is dropped, and the same bytes as binary are an input", async () => {
  const room = await openedRoom("text frame");
  const client = await connect(`room=${room.code}&name=typist`);
  try {
    expect(await until(() => client.frames.length > 0)).toBe(true);
    const member = [...(hub.find(room.code)?.members.values() ?? [])][0];
    expect(member).toBeDefined();
    // Fourteen characters, the exact width of an input frame, as text. Text is
    // not part of this protocol in this direction, so it is dropped before the
    // room: not driven, and not even counted as a frame the room refused.
    client.ws.send("x".repeat(INPUT_BYTES));
    // The binary frame behind it is the clock: once its tick has landed, the
    // text frame in front of it has been through the same handler.
    client.ws.send(new Uint8Array(writeInput({
      tick: 5, input: { ...NO_INPUT, forward: 1 }, yaw: 0, pitch: 0, switchCode: 0, buy: null,
    })));
    expect(await until(() => member?.lastTick === 5)).toBe(true);
    expect(member?.dropped).toBe(0);
    expect(client.closeCode()).toBeNull();
  } finally {
    await finish(room.code, client);
  }
});
test("a binary frame over MESSAGE_MAX closes the connection before this process holds it", async () => {
  const room = await openedRoom("huge frame");
  const client = await connect(`room=${room.code}&name=shouter`);
  try {
    expect(await until(() => client.frames.length > 0)).toBe(true);
    const member = [...(hub.find(room.code)?.members.values() ?? [])][0];
    client.ws.send(new Uint8Array(MESSAGE_MAX + 1));
    expect(await until(() => client.closeCode() !== null)).toBe(true);
    // Bun refuses a frame past `maxPayloadLength` itself, so this close is the
    // runtime's and never the hub's own 4001: the bytes were never handed to a
    // room, which is why there is nothing here to parse and nothing counted.
    expect(client.closeCode()).not.toBe(CLOSE_TOO_BIG);
    expect(member?.dropped).toBe(0);
    // And the seat goes back to the bot that had it.
    expect(await until(() => hub.find(room.code)?.members.size === 0)).toBe(true);
    expect(hub.find(room.code)?.world.players.every((p) => p.bot)).toBe(true);
  } finally {
    await finish(room.code, client);
  }
});
test("every room these tests opened was given back, and every socket closed", async () => {
  // The invariant the whole section is written to: nothing above leaves a world
  // being stepped, and no seat is held by a connection that is gone. A failure
  // here names a test above that forgot its `finish`.
  expect(await until(() => hub.members() === 0)).toBe(true);
  expect([...hub.rooms.keys()]).toEqual([]);
});
@@ -302,9 +302,16 @@
const roomLimit = createLimiter(ROOM_LIMIT);
 * session are two members, and a reload is a new one whose predecessor is taken
 * out of the room by its own close. So a seat is never held by a tab that is
 * gone, and a session cookie is not a claim on a seat.
 *
 * The hub is exported for one reason, and it is the tests': `src/server.test.ts`
 * drives the two doors below over a real socket, and a room opened by a test is
 * a world this process steps until the hub's sweep takes it ninety seconds
 * later. So a test gives its room back when it is done — `hub.rooms.delete` —
 * and reads the member it just made to check what the room was told. Nothing in
 * this app imports it; a room is still opened only through the route below.
 */
const sockets = new Map<string, Bun.ServerWebSocket<Joined>>();
const hub = createHub({
export const hub = createHub({
  deliver(id, frame) {
    sockets.get(id)?.send(frame);
  },
		@@ -302,9 +302,16 @@ const roomLimit = createLimiter(ROOM_LIMIT);
302	302	* session are two members, and a reload is a new one whose predecessor is taken
303	303	* out of the room by its own close. So a seat is never held by a tab that is
304	304	* gone, and a session cookie is not a claim on a seat.
	305	*
	306	* The hub is exported for one reason, and it is the tests': `src/server.test.ts`
	307	* drives the two doors below over a real socket, and a room opened by a test is
	308	* a world this process steps until the hub's sweep takes it ninety seconds
	309	* later. So a test gives its room back when it is done — `hub.rooms.delete` —
	310	* and reads the member it just made to check what the room was told. Nothing in
	311	* this app imports it; a room is still opened only through the route below.
305	312	*/
306	313	const sockets = new Map<string, Bun.ServerWebSocket<Joined>>();
307		const hub = createHub({
	314	export const hub = createHub({
308	315	deliver(id, frame) {
309	316	sockets.get(id)?.send(frame);
310	317	},