+
<.header1>
<%= @title %>
@@ -113,11 +113,12 @@ defmodule CopiWeb.PlayerLive.FormComponent do
{:ok, player} ->
{:ok, updated_game} = Cornucopia.Game.find(socket.assigns.player.game_id)
CopiWeb.Endpoint.broadcast(topic(updated_game.id), "game:updated", updated_game)
+ capability = CopiWeb.PlayerCapability.sign(player.game_id, player.id)
{:noreply,
socket
|> assign(:game, updated_game)
- |> push_navigate(to: ~p"/games/#{player.game_id}/players/#{player.id}")}
+ |> push_event("exchange-player-capability", %{capability: capability})}
{:error, :game_already_started} ->
# V15.4: Race condition caught by transaction - game started between check and insert
diff --git a/copi.owasp.org/lib/copi_web/live/player_live/show.ex b/copi.owasp.org/lib/copi_web/live/player_live/show.ex
index a193c8851..c7eb90836 100644
--- a/copi.owasp.org/lib/copi_web/live/player_live/show.ex
+++ b/copi.owasp.org/lib/copi_web/live/player_live/show.ex
@@ -8,6 +8,7 @@ defmodule CopiWeb.PlayerLive.Show do
alias Copi.Cornucopia.Player
alias Copi.Cornucopia.Game
alias Copi.Cornucopia.DealtCard
+ alias CopiWeb.PlayerSessions
alias CopiWeb.Resilience
defmodule BadPlayerID do
@@ -17,50 +18,71 @@ defmodule CopiWeb.PlayerLive.Show do
@impl true
def mount(_params, session, socket) do
ip = socket.assigns[:client_ip] || Map.get(session, "client_ip") || Copi.IPHelper.get_ip_from_socket(socket)
- {:ok, assign(socket, :client_ip, ip)}
+ {:ok,
+ socket
+ |> assign(:client_ip, ip)
+ |> assign(:player_sessions, session["resume_player_session"])}
end
@impl true
- def handle_params(%{"id" => player_id}, _, socket) do
- case validate_ulid_format(player_id) do
- :ok ->
+ def handle_params(%{"game_id" => game_id, "id" => player_id} = params, _, socket) do
+ with :ok <- validate_ulid_format(game_id),
+ :ok <- validate_ulid_format(player_id) do
+ if authorized_player_url?(socket, params) do
case player_module().find(player_id) do
- {:ok, player} ->
- case game_module().find(player.game_id) do
- {:ok, game} ->
- CopiWeb.Endpoint.subscribe(topic(player.game_id))
+ {:ok, %{game_id: ^game_id} = player} ->
+ case game_module().find(game_id) do
+ {:ok, game} ->
+ CopiWeb.Endpoint.subscribe(topic(game_id))
+
+ {:noreply,
+ socket
+ |> assign(:game, game)
+ |> assign(:player, player)
+ |> assign(:player_load_retry_count, 0)}
+
+ {:error, :not_found} ->
+ {:noreply,
+ socket
+ |> put_flash(:error, "Game not found.")
+ |> redirect(to: "/games")}
+
+ {:error, reason} ->
+ handle_transient_player_load_failure(socket, params, reason)
+ end
- {:noreply,
- socket
- |> assign(:game, game)
- |> assign(:player, player)
- |> assign(:player_load_retry_count, 0)}
+ {:ok, _player} ->
+ redirect_to_public_game(socket, game_id)
{:error, :not_found} ->
- {:noreply,
- socket
- |> put_flash(:error, "Game not found.")
- |> redirect(to: "/games")}
+ raise Ecto.NoResultsError, queryable: Player
{:error, reason} ->
- handle_transient_player_load_failure(socket, player_id, reason)
+ handle_transient_player_load_failure(socket, params, reason)
end
-
- {:error, :not_found} ->
- raise Ecto.NoResultsError, queryable: Player
-
- {:error, reason} ->
- handle_transient_player_load_failure(socket, player_id, reason)
- end
-
+ else
+ redirect_to_public_game(socket, game_id)
+ end
+ else
:invalid_format ->
raise BadPlayerID
end
end
@impl true
- def handle_info({:retry_player_show_load, player_id}, socket) do
- handle_params(%{"id" => player_id}, nil, socket)
+ def handle_info({:retry_player_show_load, params}, socket) when is_map(params) do
+ handle_params(params, nil, socket)
+ end
+
+ def handle_info({:retry_player_show_load, player_id}, socket) when is_binary(player_id) do
+ handle_params(
+ %{
+ "game_id" => socket.assigns.game.id,
+ "id" => player_id
+ },
+ nil,
+ socket
+ )
end
@impl true
@@ -270,7 +292,8 @@ defmodule CopiWeb.PlayerLive.Show do
end
end
- defp handle_transient_player_load_failure(socket, player_id, reason) do
+ defp handle_transient_player_load_failure(socket, params, reason) do
+ player_id = params["id"]
retry_count = socket.assigns[:player_load_retry_count] || 0
Logger.debug(
@@ -279,7 +302,7 @@ defmodule CopiWeb.PlayerLive.Show do
cond do
socket.assigns[:game] && socket.assigns[:player] && retry_count < Resilience.max_player_load_retries() ->
- Process.send_after(self(), {:retry_player_show_load, player_id}, Resilience.retry_delay_ms())
+ Process.send_after(self(), {:retry_player_show_load, params}, Resilience.retry_delay_ms())
{:noreply,
socket
@@ -312,6 +335,17 @@ defmodule CopiWeb.PlayerLive.Show do
Application.get_env(:copi, :player_live_show_dealt_card_module, DealtCard) || DealtCard
end
+ defp authorized_player_url?(socket, %{"game_id" => game_id, "id" => player_id}) do
+ PlayerSessions.authorized?(socket.assigns.player_sessions, game_id, player_id)
+ end
+
+ defp redirect_to_public_game(socket, game_id) do
+ {:noreply,
+ socket
+ |> put_flash(:error, "This player link is not available in this browser session.")
+ |> redirect(to: "/games/#{game_id}")}
+ end
+
defp validate_ulid_format(id) when is_binary(id) do
case String.length(id) do
26 ->
diff --git a/copi.owasp.org/lib/copi_web/live/player_live/show.html.heex b/copi.owasp.org/lib/copi_web/live/player_live/show.html.heex
index 1b1a0b87d..f8013bcb8 100644
--- a/copi.owasp.org/lib/copi_web/live/player_live/show.html.heex
+++ b/copi.owasp.org/lib/copi_web/live/player_live/show.html.heex
@@ -3,7 +3,12 @@
phx-hook="PersistPlayerSession"
data-game-id={@game.id}
data-player-id={@player.id}
- data-store-player-session={if is_nil(@game.finished_at), do: "true", else: "false"}
+ data-store-player-session={
+ cond do
+ @game.finished_at -> "false"
+ true -> nil
+ end
+ }
class="hidden"
>
diff --git a/copi.owasp.org/lib/copi_web/player_capability.ex b/copi.owasp.org/lib/copi_web/player_capability.ex
new file mode 100644
index 000000000..f42437fd9
--- /dev/null
+++ b/copi.owasp.org/lib/copi_web/player_capability.ex
@@ -0,0 +1,34 @@
+defmodule CopiWeb.PlayerCapability do
+ @moduledoc false
+
+ @salt "player-capability"
+ @max_age 5 * 60
+
+ def sign(game_id, player_id) do
+ Phoenix.Token.sign(CopiWeb.Endpoint, @salt, %{
+ "purpose" => "player",
+ "game_id" => game_id,
+ "player_id" => player_id
+ })
+ end
+
+ def verify(token) when is_binary(token) do
+ case Phoenix.Token.verify(CopiWeb.Endpoint, @salt, token, max_age: @max_age) do
+ {:ok, %{"purpose" => "player", "game_id" => game_id, "player_id" => player_id}}
+ when is_binary(game_id) and is_binary(player_id) ->
+ {:ok, %{game_id: game_id, player_id: player_id}}
+
+ _ ->
+ {:error, :invalid}
+ end
+ end
+
+ def verify(_token), do: {:error, :invalid}
+
+ def verify(token, game_id, player_id) do
+ case verify(token) do
+ {:ok, %{game_id: ^game_id, player_id: ^player_id}} -> :ok
+ _ -> {:error, :invalid}
+ end
+ end
+end
diff --git a/copi.owasp.org/lib/copi_web/player_sessions.ex b/copi.owasp.org/lib/copi_web/player_sessions.ex
new file mode 100644
index 000000000..3dc3aed5b
--- /dev/null
+++ b/copi.owasp.org/lib/copi_web/player_sessions.ex
@@ -0,0 +1,51 @@
+defmodule CopiWeb.PlayerSessions do
+ @moduledoc false
+
+ @max_entries 20
+
+ def add(session_value, game_id, player_id) do
+ entry = %{"game_id" => game_id, "player_id" => player_id}
+
+ session_value
+ |> entries()
+ |> Enum.reject(&(&1 == entry))
+ |> then(&[entry | &1])
+ |> Enum.take(@max_entries)
+ end
+
+ def authorized?(session_value, game_id, player_id) do
+ Enum.any?(entries(session_value), fn entry ->
+ entry == %{"game_id" => game_id, "player_id" => player_id}
+ end)
+ end
+
+ def player_ids_for_game(session_value, game_id) do
+ session_value
+ |> entries()
+ |> Enum.filter(&(&1["game_id"] == game_id))
+ |> Enum.map(& &1["player_id"])
+ end
+
+ def remove(session_value, game_id, player_id) do
+ entry = %{"game_id" => game_id, "player_id" => player_id}
+ Enum.reject(entries(session_value), &(&1 == entry))
+ end
+
+ def entries(%{"game_id" => game_id, "player_id" => player_id})
+ when is_binary(game_id) and is_binary(player_id) do
+ [%{"game_id" => game_id, "player_id" => player_id}]
+ end
+
+ def entries(entries) when is_list(entries) do
+ Enum.filter(entries, fn
+ %{"game_id" => game_id, "player_id" => player_id}
+ when is_binary(game_id) and is_binary(player_id) ->
+ true
+
+ _ ->
+ false
+ end)
+ end
+
+ def entries(_session_value), do: []
+end
diff --git a/copi.owasp.org/lib/copi_web/router.ex b/copi.owasp.org/lib/copi_web/router.ex
index db760efa9..c3311f46a 100644
--- a/copi.owasp.org/lib/copi_web/router.ex
+++ b/copi.owasp.org/lib/copi_web/router.ex
@@ -49,17 +49,12 @@ defmodule CopiWeb.Router do
get "/cards/:version/:id", CardController, :show
end
- scope "/api", CopiWeb do
- pipe_through :api
-
- put "/games/:game_id/players/:player_id/card", ApiController, :play_card
- end
-
scope "/api", CopiWeb do
pipe_through :browser_api
- put "/games/:game_id/players/:player_id/session", ApiController, :persist_player_session
- delete "/games/:game_id/player-session", ApiController, :clear_player_session
+ post "/player-capabilities/exchange", ApiController, :exchange_player_capability
+ put "/games/:game_id/players/:player_id/card", ApiController, :play_card
+ delete "/games/:game_id/players/:player_id/session", ApiController, :clear_player_session
end
# Health check endpoint for Fly.io - no pipeline needed for plain text response
diff --git a/copi.owasp.org/lib/copi_web/security_headers.ex b/copi.owasp.org/lib/copi_web/security_headers.ex
index 1df70cfb1..82e65c691 100644
--- a/copi.owasp.org/lib/copi_web/security_headers.ex
+++ b/copi.owasp.org/lib/copi_web/security_headers.ex
@@ -1,6 +1,7 @@
defmodule CopiWeb.SecurityHeaders do
def browser_headers do
%{
+ "referrer-policy" => "no-referrer",
"content-security-policy" =>
"default-src 'self'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; frame-src 'self'; font-src 'self'; media-src 'self'; object-src 'self'; manifest-src 'self'; worker-src 'self';"
}
@@ -8,6 +9,7 @@ defmodule CopiWeb.SecurityHeaders do
def live_reload_headers do
%{
+ "referrer-policy" => "no-referrer",
"content-security-policy" =>
"default-src 'self'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-src 'self'; font-src 'self'; media-src 'self'; object-src 'self'; manifest-src 'self'; worker-src 'self';"
}
diff --git a/copi.owasp.org/lib/copi_web/session_store.ex b/copi.owasp.org/lib/copi_web/session_store.ex
new file mode 100644
index 000000000..09afee2ba
--- /dev/null
+++ b/copi.owasp.org/lib/copi_web/session_store.ex
@@ -0,0 +1,108 @@
+defmodule CopiWeb.SessionStore do
+ @moduledoc false
+
+ @behaviour Plug.Session.Store
+
+ import Ecto.Query
+
+ alias Copi.Encrypted.Binary, as: EncryptedBinary
+ alias Copi.Repo
+ alias Copi.SessionRecord
+
+ @postgres_session_id "postgres_session_id"
+
+ @impl true
+ def init(opts) do
+ %{cookie: Plug.Session.COOKIE.init(opts)}
+ end
+
+ @impl true
+ def get(conn, raw_cookie, %{cookie: cookie_opts}) do
+ if postgres_enabled?() do
+ get_from_postgres(conn, raw_cookie, cookie_opts)
+ else
+ Plug.Session.COOKIE.get(conn, raw_cookie, cookie_opts)
+ end
+ end
+
+ @impl true
+ def put(conn, session_id, session, %{cookie: cookie_opts}) do
+ if postgres_enabled?() do
+ put_in_postgres(conn, session_id, session, cookie_opts)
+ else
+ Plug.Session.COOKIE.put(conn, session_id, session, cookie_opts)
+ end
+ end
+
+ @impl true
+def delete(conn, session_id, %{cookie: cookie_opts}) do
+ if postgres_enabled?() do
+ Repo.delete_all(from record in SessionRecord, where: record.id == ^session_id)
+ Plug.Session.COOKIE.delete(conn, session_id, cookie_opts)
+ else
+ Plug.Session.COOKIE.delete(conn, session_id, cookie_opts)
+ end
+end
+
+ defp get_from_postgres(conn, raw_cookie, cookie_opts) do
+ with {_cookie_id, %{@postgres_session_id => session_id}} when is_binary(session_id) <-
+ Plug.Session.COOKIE.get(conn, raw_cookie, cookie_opts),
+ %SessionRecord{} = record <- Repo.get(SessionRecord, session_id),
+ :gt <- DateTime.compare(record.expires_at, DateTime.utc_now()),
+ {:ok, session} when is_map(session) <- decrypt_database_session(record.data) do
+ {session_id, session}
+ else
+ _ -> {nil, %{}}
+ end
+ end
+
+ defp put_in_postgres(conn, session_id, session, cookie_opts) do
+ session_id = session_id || new_session_id()
+ now = DateTime.utc_now()
+ expires_at = DateTime.add(now, session_ttl_seconds(), :second)
+ {:ok, data} = encrypt_database_session(session)
+
+ Repo.insert!(
+ %SessionRecord{id: session_id, data: data, expires_at: expires_at},
+ on_conflict: [set: [data: data, expires_at: expires_at]],
+ conflict_target: [:id]
+ )
+
+ Repo.delete_all(from record in SessionRecord, where: record.expires_at <= ^now)
+
+ Plug.Session.COOKIE.put(
+ conn,
+ nil,
+ %{@postgres_session_id => session_id},
+ cookie_opts
+ )
+ end
+
+ defp encrypt_database_session(session) do
+ session
+ |> :erlang.term_to_binary(compressed: 6)
+ |> EncryptedBinary.encrypt()
+ end
+
+ defp decrypt_database_session(data) do
+ with {:ok, plaintext} <- EncryptedBinary.decrypt(data) do
+ {:ok, Plug.Crypto.non_executable_binary_to_term(plaintext)}
+ end
+ rescue
+ ArgumentError -> {:error, :invalid_session}
+ end
+
+ defp new_session_id do
+ 32
+ |> :crypto.strong_rand_bytes()
+ |> Base.url_encode64(padding: false)
+ end
+
+ defp postgres_enabled? do
+ Application.get_env(:copi, :postgres_session_store_enabled, false)
+ end
+
+ defp session_ttl_seconds do
+ Application.fetch_env!(:copi, :session_ttl_seconds)
+ end
+end
diff --git a/copi.owasp.org/priv/repo/migrations/20260717000001_create_security_session_tables.exs b/copi.owasp.org/priv/repo/migrations/20260717000001_create_security_session_tables.exs
new file mode 100644
index 000000000..b7d67d0c9
--- /dev/null
+++ b/copi.owasp.org/priv/repo/migrations/20260717000001_create_security_session_tables.exs
@@ -0,0 +1,20 @@
+defmodule Copi.Repo.Migrations.CreateSecuritySessionTables do
+ use Ecto.Migration
+
+ def change do
+ create table(:copi_sessions, primary_key: false) do
+ add :id, :string, primary_key: true
+ add :data, :binary, null: false
+ add :expires_at, :utc_datetime_usec, null: false
+ end
+
+ create index(:copi_sessions, [:expires_at])
+
+ create table(:player_capability_consumptions, primary_key: false) do
+ add :digest, :binary, primary_key: true
+ add :expires_at, :utc_datetime_usec, null: false
+ end
+
+ create index(:player_capability_consumptions, [:expires_at])
+ end
+end
diff --git a/copi.owasp.org/test/copi/player_capability_registry_test.exs b/copi.owasp.org/test/copi/player_capability_registry_test.exs
new file mode 100644
index 000000000..11f50efdf
--- /dev/null
+++ b/copi.owasp.org/test/copi/player_capability_registry_test.exs
@@ -0,0 +1,148 @@
+defmodule Copi.PlayerCapabilityRegistryTest do
+ use ExUnit.Case, async: false
+
+ alias Copi.PlayerCapabilityRegistry
+
+ setup do
+ :sys.replace_state(PlayerCapabilityRegistry, fn state ->
+ %{state | consumed: %{}}
+ end)
+
+ :ok
+ end
+
+ test "consumes a capability only once" do
+ capability = "one-time-capability"
+
+ assert :ok = PlayerCapabilityRegistry.consume(capability)
+ assert {:error, :already_used} = PlayerCapabilityRegistry.consume(capability)
+ end
+
+ test "stores a digest instead of the capability" do
+ capability = "sensitive-capability"
+
+ assert :ok = PlayerCapabilityRegistry.consume(capability)
+
+ state = :sys.get_state(PlayerCapabilityRegistry)
+ refute Map.has_key?(state.consumed, capability)
+ assert Map.has_key?(state.consumed, :crypto.hash(:sha256, capability))
+ end
+
+ test "allows exactly one concurrent consumer" do
+ capability = "concurrent-capability"
+
+ results =
+ 1..10
+ |> Enum.map(fn _ -> Task.async(fn -> PlayerCapabilityRegistry.consume(capability) end) end)
+ |> Task.await_many()
+
+ assert Enum.count(results, &(&1 == :ok)) == 1
+ assert Enum.count(results, &(&1 == {:error, :already_used})) == 9
+ end
+
+ test "removes expired digests before consuming" do
+ capability = "expired-registry-entry"
+ digest = :crypto.hash(:sha256, capability)
+
+ :sys.replace_state(PlayerCapabilityRegistry, fn state ->
+ %{state | consumed: %{digest => System.system_time(:millisecond) - 1}}
+ end)
+
+ assert :ok = PlayerCapabilityRegistry.consume(capability)
+ end
+
+ test "uses local replay protection by default" do
+ state = :sys.get_state(PlayerCapabilityRegistry)
+
+ refute state.cluster_enabled
+ assert :undefined == :global.whereis_name(state.global_name)
+ end
+
+ test "cluster mode merges active entries before accepting a capability" do
+ name = :cluster_registry_test
+ global_name = {:cluster_registry_test, System.unique_integer([:positive])}
+ capability = "capability-consumed-on-another-node"
+ digest = :crypto.hash(:sha256, capability)
+ expires_at = System.system_time(:millisecond) + :timer.minutes(5)
+
+ start_supervised!(
+ {PlayerCapabilityRegistry, name: name, cluster_enabled: true, global_name: global_name}
+ )
+
+ assert %{^digest => ^expires_at} =
+ GenServer.call(name, {:merge_consumed, %{digest => expires_at}})
+
+ assert {:error, :already_used} = PlayerCapabilityRegistry.consume(name, capability)
+ send(name, :cluster_sync)
+ assert eventually(fn -> is_pid(:global.whereis_name(global_name)) end)
+ end
+
+ test "cluster mode falls back to local replay protection when the global owner is unavailable" do
+ name = :cluster_fallback_registry_test
+ global_name = {:cluster_fallback_registry_test, System.unique_integer([:positive])}
+ unavailable_owner = spawn(fn -> Process.sleep(:infinity) end)
+ :yes = :global.register_name(global_name, unavailable_owner)
+
+ start_supervised!(
+ {PlayerCapabilityRegistry, name: name, cluster_enabled: true, global_name: global_name}
+ )
+
+ assert :ok = PlayerCapabilityRegistry.consume(name, "fallback-capability")
+
+ assert {:error, :already_used} =
+ PlayerCapabilityRegistry.consume(name, "fallback-capability")
+
+ Process.exit(unavailable_owner, :kill)
+ end
+
+ test "cluster mode synchronizes a locally consumed digest with the global owner" do
+ owner_name = :cluster_owner_registry_test
+ follower_name = :cluster_follower_registry_test
+ global_name = {:cluster_sync_registry_test, System.unique_integer([:positive])}
+ capability = "locally-consumed-during-partition"
+ digest = :crypto.hash(:sha256, capability)
+ expires_at = System.system_time(:millisecond) + :timer.minutes(5)
+
+ start_supervised!(
+ Supervisor.child_spec(
+ {PlayerCapabilityRegistry,
+ name: owner_name, cluster_enabled: true, global_name: global_name},
+ id: owner_name
+ )
+ )
+
+ send(owner_name, :cluster_sync)
+ assert eventually(fn -> :global.whereis_name(global_name) == Process.whereis(owner_name) end)
+
+ start_supervised!(
+ Supervisor.child_spec(
+ {PlayerCapabilityRegistry,
+ name: follower_name, cluster_enabled: true, global_name: global_name},
+ id: follower_name
+ )
+ )
+
+ GenServer.call(follower_name, {:merge_consumed, %{digest => expires_at}})
+ send(follower_name, :cluster_sync)
+
+ assert eventually(fn ->
+ match?(
+ {:error, :already_used},
+ PlayerCapabilityRegistry.consume(owner_name, capability)
+ )
+ end)
+ end
+
+ defp eventually(check, attempts \\ 20)
+
+ defp eventually(check, attempts) when attempts > 0 do
+ if check.() do
+ true
+ else
+ Process.sleep(10)
+ eventually(check, attempts - 1)
+ end
+ end
+
+ defp eventually(_check, 0), do: false
+end
diff --git a/copi.owasp.org/test/copi_web/controllers/api_controller_test.exs b/copi.owasp.org/test/copi_web/controllers/api_controller_test.exs
index 5054f5484..7bdd7d7ab 100644
--- a/copi.owasp.org/test/copi_web/controllers/api_controller_test.exs
+++ b/copi.owasp.org/test/copi_web/controllers/api_controller_test.exs
@@ -31,7 +31,7 @@ defmodule CopiWeb.ApiControllerTest do
end
end
- setup do
+ setup %{conn: conn} do
old_game_mod = Application.get_env(:copi, :api_game_module)
old_repo_mod = Application.get_env(:copi, :api_repo_module)
old_game_mode = Application.get_env(:copi, :api_game_stub_mode)
@@ -59,7 +59,11 @@ defmodule CopiWeb.ApiControllerTest do
Application.put_env(:copi, :api_game_stub_step, old_step)
end)
- %{game: game, player: player, dealt_card: dealt_card}
+ conn = init_test_session(conn, %{
+ "resume_player_session" => %{"game_id" => game.id, "player_id" => player.id}
+ })
+
+ %{conn: conn, game: game, player: player, dealt_card: dealt_card}
end
test "play_card success", %{conn: conn, game: game, player: player, dealt_card: dealt_card} do
@@ -75,6 +79,28 @@ defmodule CopiWeb.ApiControllerTest do
assert updated.played_in_round == 1
end
+ test "play_card requires a player session", %{conn: conn, game: game, player: player, dealt_card: dealt_card} do
+ conn =
+ conn
+ |> clear_session()
+ |> put("/api/games/#{game.id}/players/#{player.id}/card", %{
+ "dealt_card_id" => to_string(dealt_card.id)
+ })
+
+ assert json_response(conn, 401)["error"] == "Valid player session required"
+ assert Repo.get(DealtCard, dealt_card.id).played_in_round == nil
+ end
+
+ test "play_card rejects a different player than the signed-in player", %{conn: conn, game: game} do
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other Player", game_id: game.id})
+
+ conn = put(conn, "/api/games/#{game.id}/players/#{other_player.id}/card", %{
+ "dealt_card_id" => "1"
+ })
+
+ assert json_response(conn, 401)["error"] == "Valid player session required"
+ end
+
test "play_card fails if card already played", %{conn: conn, game: game, player: player, dealt_card: dealt_card} do
{:ok, _} = Repo.update(Ecto.Changeset.change(dealt_card, played_in_round: 1))
@@ -87,7 +113,7 @@ defmodule CopiWeb.ApiControllerTest do
assert json_response(conn, 406)["error"] == "Card already played"
end
- test "play_card returns 404 when dealt card not found for player", %{conn: conn, game: game} do
+ test "play_card rejects a player from another game", %{conn: conn, game: game} do
{:ok, other_game} = Cornucopia.create_game(%{name: "Other Game"})
{:ok, other_player} = Cornucopia.create_player(%{name: "Other", game_id: other_game.id})
{:ok, card2} = Cornucopia.create_card(%{
@@ -105,7 +131,7 @@ defmodule CopiWeb.ApiControllerTest do
"dealt_card_id" => to_string(other_dealt.id)
})
- assert json_response(conn, 404)["error"] == "Player not found in this game"
+ assert json_response(conn, 401)["error"] == "Valid player session required"
end
test "play_card fails if player already played in round", %{conn: conn, game: game, player: player, dealt_card: dealt_card} do
@@ -127,24 +153,24 @@ defmodule CopiWeb.ApiControllerTest do
assert json_response(conn, 403)["error"] == "Player already played a card in this round"
end
- test "play_card returns 404 when player_id doesn't belong to game", %{conn: conn, game: game} do
+ test "play_card rejects a player id that does not match the session", %{conn: conn, game: game} do
conn = put(conn, "/api/games/#{game.id}/players/99999/card", %{
"game_id" => game.id,
"player_id" => "99999",
"dealt_card_id" => "1"
})
- assert json_response(conn, 404)["error"] == "Player not found in this game"
+ assert json_response(conn, 401)["error"] == "Valid player session required"
end
- test "play_card returns 404 when game does not exist", %{conn: conn, player: player, dealt_card: dealt_card} do
+ test "play_card rejects a game id that does not match the session", %{conn: conn, player: player, dealt_card: dealt_card} do
conn = put(conn, "/api/games/00000000000000000000000099/players/#{player.id}/card", %{
"game_id" => "00000000000000000000000099",
"player_id" => player.id,
"dealt_card_id" => to_string(dealt_card.id)
})
- assert json_response(conn, 404)["error"] == "Could not find game"
+ assert json_response(conn, 401)["error"] == "Valid player session required"
end
test "play_card returns 404 when dealt card id is missing for valid player", %{conn: conn, game: game, player: player} do
@@ -226,57 +252,221 @@ defmodule CopiWeb.ApiControllerTest do
assert json_response(conn, 422)["error"] == "Could not play card"
end
- test "persist_player_session stores a single encrypted resume pointer in the session", %{conn: conn, game: game, player: player} do
+ test "exchange stores an encrypted player capability in the session", %{conn: conn, game: game, player: player} do
+ capability = CopiWeb.PlayerCapability.sign(game.id, player.id)
+
conn =
conn
|> init_test_session(%{})
- |> put("/api/games/#{game.id}/players/#{player.id}/session", %{
- "game_id" => game.id,
- "player_id" => player.id
- })
+ |> post("/api/player-capabilities/exchange", %{"capability" => capability})
- assert json_response(conn, 200)["ok"] == true
- assert get_session(conn, "resume_player_session") == %{"game_id" => game.id, "player_id" => player.id}
+ assert json_response(conn, 200)["redirect_to"] == "/games/#{game.id}/players/#{player.id}"
+ assert get_session(conn, "resume_player_session") == [
+ %{"game_id" => game.id, "player_id" => player.id}
+ ]
assert get_resp_header(conn, "cache-control") == ["no-store"]
end
- test "persist_player_session rejects malformed identifiers", %{conn: conn} do
+ test "exchange adds a capability and returns a clean player URL", %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ {:ok, second_player} = Cornucopia.create_player(%{name: "Second Player", game_id: game.id})
+ {:ok, other_game} = Cornucopia.create_game(%{name: "Other Game"})
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other Player", game_id: other_game.id})
+
+ existing_sessions = [
+ %{"game_id" => game.id, "player_id" => player.id},
+ %{"game_id" => other_game.id, "player_id" => other_player.id}
+ ]
+
+ capability = CopiWeb.PlayerCapability.sign(game.id, second_player.id)
+
conn =
conn
- |> init_test_session(%{})
- |> put("/api/games/bad/players/also-bad/session", %{
- "game_id" => "bad",
- "player_id" => "also-bad"
- })
+ |> init_test_session(%{"resume_player_session" => existing_sessions})
+ |> post("/api/player-capabilities/exchange", %{"capability" => capability})
+
+ clean_path = "/games/#{game.id}/players/#{second_player.id}"
+ assert json_response(conn, 200)["redirect_to"] == clean_path
+ refute response(conn, 200) =~ capability
+ assert get_resp_header(conn, "cache-control") == ["no-store"]
- assert json_response(conn, 400)["error"] == "Invalid player session parameters"
- assert get_session(conn, "resume_player_session") == nil
+ assert get_session(conn, "resume_player_session") == [
+ %{"game_id" => game.id, "player_id" => second_player.id},
+ %{"game_id" => game.id, "player_id" => player.id},
+ %{"game_id" => other_game.id, "player_id" => other_player.id}
+ ]
+
+ assert Enum.any?(get_resp_header(conn, "set-cookie"), &String.contains?(&1, "max-age=604800"))
end
- test "persist_player_session rejects cross-game player session writes", %{conn: conn, game: game} do
- {:ok, other_game} = Cornucopia.create_game(%{name: "Another Game"})
- {:ok, other_player} = Cornucopia.create_player(%{name: "Other Player", game_id: other_game.id})
+ test "exchange rejects an invalid capability without changing existing sessions", %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ conn = post(conn, "/api/player-capabilities/exchange", %{"capability" => "invalid"})
+
+ assert json_response(conn, 401)["error"] == "Invalid or expired player capability"
+ assert get_session(conn, "resume_player_session") == %{
+ "game_id" => game.id,
+ "player_id" => player.id
+ }
+ end
+
+ test "exchange rejects a capability older than five minutes", %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ expired_capability =
+ Phoenix.Token.sign(
+ CopiWeb.Endpoint,
+ "player-capability",
+ %{"purpose" => "player", "game_id" => game.id, "player_id" => player.id},
+ signed_at: System.system_time(:second) - 301
+ )
conn =
+ post(conn, "/api/player-capabilities/exchange", %{
+ "capability" => expired_capability
+ })
+
+ assert json_response(conn, 401)["error"] == "Invalid or expired player capability"
+ end
+
+ test "exchange adds capabilities for the same game and other games", %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ {:ok, second_player} = Cornucopia.create_player(%{name: "Second Player", game_id: game.id})
+ {:ok, other_game} = Cornucopia.create_game(%{name: "Other Game"})
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other Game Player", game_id: other_game.id})
+
+ second_capability = CopiWeb.PlayerCapability.sign(game.id, second_player.id)
+
+ second_conn =
conn
- |> init_test_session(%{})
- |> put("/api/games/#{game.id}/players/#{other_player.id}/session", %{
- "game_id" => game.id,
- "player_id" => other_player.id
+ |> post("/api/player-capabilities/exchange", %{"capability" => second_capability})
+
+ assert json_response(second_conn, 200)["redirect_to"] == "/games/#{game.id}/players/#{second_player.id}"
+
+ sessions_after_second = get_session(second_conn, "resume_player_session")
+
+ assert sessions_after_second == [
+ %{"game_id" => game.id, "player_id" => second_player.id},
+ %{"game_id" => game.id, "player_id" => player.id}
+ ]
+
+ other_capability = CopiWeb.PlayerCapability.sign(other_game.id, other_player.id)
+
+ other_conn =
+ build_conn()
+ |> init_test_session(%{"resume_player_session" => sessions_after_second})
+ |> post("/api/player-capabilities/exchange", %{"capability" => other_capability})
+
+ assert json_response(other_conn, 200)["redirect_to"] == "/games/#{other_game.id}/players/#{other_player.id}"
+
+ assert get_session(other_conn, "resume_player_session") == [
+ %{"game_id" => other_game.id, "player_id" => other_player.id},
+ %{"game_id" => game.id, "player_id" => second_player.id},
+ %{"game_id" => game.id, "player_id" => player.id}
+ ]
+ end
+
+ test "session supports multiple players in one game and players in multiple games", %{
+ conn: conn,
+ game: game,
+ player: player,
+ dealt_card: dealt_card
+ } do
+ {:ok, second_player} = Cornucopia.create_player(%{name: "Second Player", game_id: game.id})
+ second_dealt_card = Repo.insert!(%DealtCard{player_id: second_player.id, card_id: dealt_card.card_id})
+
+ {:ok, other_game} = Cornucopia.create_game(%{name: "Other Game"})
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other Game Player", game_id: other_game.id})
+ other_dealt_card = Repo.insert!(%DealtCard{player_id: other_player.id, card_id: dealt_card.card_id})
+
+ sessions = [
+ %{"game_id" => game.id, "player_id" => player.id},
+ %{"game_id" => game.id, "player_id" => second_player.id},
+ %{"game_id" => other_game.id, "player_id" => other_player.id}
+ ]
+
+ second_player_conn =
+ conn
+ |> init_test_session(%{"resume_player_session" => sessions})
+ |> put("/api/games/#{game.id}/players/#{second_player.id}/card", %{
+ "dealt_card_id" => to_string(second_dealt_card.id)
+ })
+
+ assert json_response(second_player_conn, 200)["id"] == second_dealt_card.id
+
+ other_game_conn =
+ build_conn()
+ |> init_test_session(%{"resume_player_session" => sessions})
+ |> put("/api/games/#{other_game.id}/players/#{other_player.id}/card", %{
+ "dealt_card_id" => to_string(other_dealt_card.id)
})
- assert json_response(conn, 403)["error"] == "Player does not belong to this game"
- assert get_session(conn, "resume_player_session") == nil
+ assert json_response(other_game_conn, 200)["id"] == other_dealt_card.id
+
+ mismatched_pair_conn =
+ build_conn()
+ |> init_test_session(%{"resume_player_session" => sessions})
+ |> put("/api/games/#{game.id}/players/#{other_player.id}/card", %{
+ "dealt_card_id" => to_string(other_dealt_card.id)
+ })
+
+ assert json_response(mismatched_pair_conn, 401)["error"] == "Valid player session required"
+ end
+
+ test "exchange rejects requests without a capability", %{conn: conn, game: game, player: player} do
+ conn = post(conn, "/api/player-capabilities/exchange", %{})
+
+ assert json_response(conn, 400)["error"] == "Invalid player capability request"
+ assert get_session(conn, "resume_player_session") == %{"game_id" => game.id, "player_id" => player.id}
end
- test "clear_player_session removes the stored resume pointer for the matching game", %{conn: conn, game: game, player: player} do
+ test "exchange rejects a replay without changing the second session", %{conn: conn, game: game, player: player} do
+ capability = CopiWeb.PlayerCapability.sign(game.id, player.id)
+
+ first_conn =
+ conn
+ |> init_test_session(%{})
+ |> post("/api/player-capabilities/exchange", %{"capability" => capability})
+
+ assert json_response(first_conn, 200)["redirect_to"] == "/games/#{game.id}/players/#{player.id}"
+
+ replay_conn =
+ build_conn()
+ |> init_test_session(%{})
+ |> post("/api/player-capabilities/exchange", %{"capability" => capability})
+
+ assert json_response(replay_conn, 401)["error"] == "Invalid or expired player capability"
+ assert get_session(replay_conn, "resume_player_session") == nil
+ end
+
+ test "clear_player_session removes only the matching game and player pair", %{conn: conn, game: game, player: player} do
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other Player", game_id: game.id})
+
conn =
conn
- |> init_test_session(%{"resume_player_session" => %{"game_id" => game.id, "player_id" => player.id}})
- |> delete("/api/games/#{game.id}/player-session")
+ |> init_test_session(%{
+ "resume_player_session" => [
+ %{"game_id" => game.id, "player_id" => player.id},
+ %{"game_id" => game.id, "player_id" => other_player.id}
+ ]
+ })
+ |> delete("/api/games/#{game.id}/players/#{player.id}/session")
assert json_response(conn, 200)["ok"] == true
- assert get_session(conn, "resume_player_session") == nil
+ assert get_session(conn, "resume_player_session") == [
+ %{"game_id" => game.id, "player_id" => other_player.id}
+ ]
assert get_resp_header(conn, "cache-control") == ["no-store"]
end
end
\ No newline at end of file
diff --git a/copi.owasp.org/test/copi_web/gameplay_flow_test.exs b/copi.owasp.org/test/copi_web/gameplay_flow_test.exs
new file mode 100644
index 000000000..0103b2fbd
--- /dev/null
+++ b/copi.owasp.org/test/copi_web/gameplay_flow_test.exs
@@ -0,0 +1,199 @@
+defmodule CopiWeb.GameplayFlowTest do
+ use CopiWeb.ConnCase, async: false
+
+ import Phoenix.LiveViewTest
+
+ alias Copi.Cornucopia
+ alias Copi.Cornucopia.DealtCard
+ alias Copi.Cornucopia.Game
+ alias Copi.Cornucopia.Vote
+ alias Copi.Repo
+ alias CopiWeb.PlayerCapability
+
+ @category "Integration"
+
+ setup do
+ {:ok, game} =
+ Cornucopia.create_game(%{
+ name: "Complete game flow",
+ edition: "webapp",
+ suits: [@category]
+ })
+
+ players =
+ for name <- ["Player One", "Player Two", "Player Three"] do
+ {:ok, player} = Cornucopia.create_player(%{name: name, game_id: game.id})
+ player
+ end
+
+ for number <- 1..6 do
+ {:ok, _card} =
+ Cornucopia.create_card(%{
+ category: @category,
+ value: Integer.to_string(number),
+ description: "Integration card #{number}",
+ misc: "integration",
+ edition: "webapp",
+ external_id: "INTEGRATION_#{number}",
+ language: "en",
+ version: "3.0",
+ owasp_scp: [],
+ owasp_devguide: [],
+ owasp_asvs: [],
+ owasp_appsensor: [],
+ capec: [],
+ safecode: [],
+ owasp_mastg: [],
+ owasp_masvs: []
+ })
+ end
+
+ %{game: game, players: players}
+ end
+
+ test "one browser completes a round as three authorized players", %{
+ conn: conn,
+ game: game,
+ players: players
+ } do
+ browser = exchange_capabilities(conn, game, players)
+
+ public_response = get(browser, "/games/#{game.id}")
+ assert html_response(public_response, 200) =~ game.name
+
+ csrf_token = csrf_token(html_response(public_response, 200))
+ browser = public_response |> recycle() |> put_req_header("x-csrf-token", csrf_token)
+
+ {:ok, watcher, waiting_html} = live(browser, "/games/#{game.id}")
+ assert waiting_html =~ "Start Game"
+ render_click(watcher, "start_game", %{})
+
+ {:ok, started_game} = Game.find(game.id)
+ assert started_game.started_at
+
+ dealt_cards =
+ Map.new(started_game.players, fn player ->
+ assert length(player.dealt_cards) == 2
+ {player.id, hd(player.dealt_cards)}
+ end)
+
+ for player <- players do
+ clean_path = "/games/#{game.id}/players/#{player.id}"
+ {:ok, _player_view, player_html} = live(browser, clean_path)
+ assert player_html =~ player.name
+
+ dealt_card = Map.fetch!(dealt_cards, player.id)
+
+ response =
+ put(browser, "/api/games/#{game.id}/players/#{player.id}/card", %{
+ "dealt_card_id" => Integer.to_string(dealt_card.id)
+ })
+
+ assert json_response(response, 200)["id"] == dealt_card.id
+ end
+
+ {:ok, game_after_cards} = Game.find(game.id)
+
+ assert Enum.all?(game_after_cards.players, fn player ->
+ Enum.count(player.dealt_cards, &(&1.played_in_round == 1)) == 1
+ end)
+
+ [first_player, second_player | _] = players
+ second_player_card = Map.fetch!(dealt_cards, second_player.id)
+
+ {:ok, first_player_view, _html} =
+ live(browser, "/games/#{game.id}/players/#{first_player.id}")
+
+ render_click(first_player_view, "toggle_vote", %{
+ "dealt_card_id" => Integer.to_string(second_player_card.id)
+ })
+
+ assert Repo.get_by(Vote,
+ player_id: first_player.id,
+ dealt_card_id: second_player_card.id
+ )
+
+ render_click(first_player_view, "next_round", %{})
+
+ {:ok, round_two_game} = Game.find(game.id)
+ assert round_two_game.rounds_played == 1
+ assert render(watcher) =~ "Round
2"
+ end
+
+ test "public watching works but an unstored player pair cannot enter or play", %{
+ conn: conn,
+ game: game,
+ players: [authorized_player, unauthorized_player | _]
+ } do
+ browser = exchange_capabilities(conn, game, [authorized_player])
+
+ public_response = get(browser, "/games/#{game.id}")
+ assert html_response(public_response, 200) =~ game.name
+
+ clean_path = "/games/#{game.id}/players/#{unauthorized_player.id}"
+ player_response = get(recycle(public_response), clean_path)
+ assert redirected_to(player_response, 302) == "/games/#{game.id}"
+
+ dealt_card =
+ Repo.insert!(%DealtCard{
+ player_id: unauthorized_player.id,
+ card_id: create_extra_card!().id
+ })
+
+ csrf_token = csrf_token(html_response(public_response, 200))
+
+ card_response =
+ public_response
+ |> recycle()
+ |> put_req_header("x-csrf-token", csrf_token)
+ |> put("/api/games/#{game.id}/players/#{unauthorized_player.id}/card", %{
+ "dealt_card_id" => Integer.to_string(dealt_card.id)
+ })
+
+ assert json_response(card_response, 401)["error"] == "Valid player session required"
+ assert Repo.reload(dealt_card).played_in_round == nil
+ end
+
+ defp exchange_capabilities(conn, game, players) do
+ Enum.reduce(players, conn, fn player, browser ->
+ capability = PlayerCapability.sign(game.id, player.id)
+ response =
+ post(browser, "/api/player-capabilities/exchange", %{"capability" => capability})
+
+ clean_path = json_response(response, 200)["redirect_to"]
+ assert clean_path == "/games/#{game.id}/players/#{player.id}"
+ refute clean_path =~ capability
+
+ recycle(response)
+ end)
+ end
+
+ defp csrf_token(html) do
+ [_, token] = Regex.run(~r/
init_test_session(%{"resume_player_session" => %{"game_id" => game.id, "player_id" => player.id}})
+ |> init_test_session(%{
+ "resume_player_session" => [
+ %{"game_id" => game.id, "player_id" => first_player.id},
+ %{"game_id" => game.id, "player_id" => second_player.id},
+ %{"game_id" => other_game.id, "player_id" => other_player.id}
+ ]
+ })
{:ok, _view, html} = live(conn, "/games/#{game.id}")
- assert html =~ "Resume your player session from this browser session."
- assert html =~ "/games/#{game.id}/players/#{player.id}"
+ assert html =~ "Resume a player session from this browser."
+ assert html =~ "Resume First Resume"
+ assert html =~ "Resume Second Resume"
+ assert html =~ "/games/#{game.id}/players/#{first_player.id}"
+ assert html =~ "/games/#{game.id}/players/#{second_player.id}"
+ refute html =~ "Resume Other Resume"
+ refute html =~ "/games/#{other_game.id}/players/#{other_player.id}"
end
test "handle_info with non-matching topic is no-op", %{conn: conn, game: game} do
diff --git a/copi.owasp.org/test/copi_web/live/player_live/form_component_test.exs b/copi.owasp.org/test/copi_web/live/player_live/form_component_test.exs
index 69005e666..53fbf7e06 100644
--- a/copi.owasp.org/test/copi_web/live/player_live/form_component_test.exs
+++ b/copi.owasp.org/test/copi_web/live/player_live/form_component_test.exs
@@ -18,12 +18,11 @@ defmodule CopiWeb.PlayerLive.FormComponentTest do
test "allows player creation under limit", %{conn: conn, game: game} do
{:ok, view, _html} = live(conn, "/games/#{game.id}/players/new")
- result = view
- |> form("#player-form", player: %{name: "Test Player", game_id: game.id})
- |> render_submit()
+ view
+ |> form("#player-form", player: %{name: "Test Player", game_id: game.id})
+ |> render_submit()
- # Should redirect to player show page
- assert {:ok, _view, _html} = follow_redirect(result, conn)
+ assert {:ok, _view, _html} = exchange_player_creation(view, conn)
end
test "shows error message when limit exceeded", %{conn: conn, game: game, ip: _ip} do
@@ -61,18 +60,22 @@ defmodule CopiWeb.PlayerLive.FormComponentTest do
assert html =~ "can" || html =~ "blank" || html =~ "required" || html =~ "invalid"
# Should still be able to create a valid player (rate limit not consumed)
- result = view
- |> form("#player-form", player: %{name: "Valid Player", game_id: game.id})
- |> render_submit()
+ view
+ |> form("#player-form", player: %{name: "Valid Player", game_id: game.id})
+ |> render_submit()
- # Should redirect successfully
- assert {:ok, _view, _html} = follow_redirect(result, conn)
+ assert {:ok, _view, _html} = exchange_player_creation(view, conn)
end
test "updates player successfully without rate limiting", %{conn: conn, game: game} do
{:ok, player} = Cornucopia.create_player(%{name: "Original", game_id: game.id})
# Go to player show page which has Edit link
+ conn =
+ init_test_session(conn, %{
+ "resume_player_session" => [%{"game_id" => game.id, "player_id" => player.id}]
+ })
+
{:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
# Verify player name is displayed
@@ -176,4 +179,18 @@ defmodule CopiWeb.PlayerLive.FormComponentTest do
assert updated_socket.assigns.form != nil
end
end
+
+ defp exchange_player_creation(view, conn) do
+ assert_push_event(view, "exchange-player-capability", %{capability: capability})
+
+ exchange_response =
+ post(conn, "/api/player-capabilities/exchange", %{"capability" => capability})
+
+ clean_path = json_response(exchange_response, 200)["redirect_to"]
+ refute clean_path =~ capability
+
+ exchange_response
+ |> recycle()
+ |> live(clean_path)
+ end
end
diff --git a/copi.owasp.org/test/copi_web/live/player_live/show_test.exs b/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
index 19c1e1cfb..c6369df8e 100644
--- a/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
+++ b/copi.owasp.org/test/copi_web/live/player_live/show_test.exs
@@ -44,10 +44,23 @@ defmodule CopiWeb.PlayerLive.ShowTest do
@game_attrs %{name: "show test game"}
- defp create_player(_) do
+ defp create_player(%{conn: conn}) do
{:ok, game} = Cornucopia.create_game(@game_attrs)
{:ok, player} = Cornucopia.create_player(%{name: "Player 1", game_id: game.id})
- %{player: player}
+ conn = init_test_session(conn, %{
+ "resume_player_session" => [%{"game_id" => game.id, "player_id" => player.id}]
+ })
+ %{conn: conn, player: player}
+ end
+
+ defp player_url(game_id, player_id) do
+ "/games/#{game_id}/players/#{player_id}"
+ end
+
+ defp authorize_player(conn, game_id, player_id) do
+ init_test_session(conn, %{
+ "resume_player_session" => [%{"game_id" => game_id, "player_id" => player_id}]
+ })
end
defp create_game_with_dealt_card(game_name, card_ext_id) do
@@ -371,7 +384,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
Application.put_env(:copi, :player_live_show_dealt_card_module, DealtCardStub)
Application.put_env(:copi, :player_live_show_dealt_card_stub_mode, :transient)
- {:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game.id, player.id), player_url(game.id, player.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => to_string(dealt.id)})
assert render(view) =~ "Temporary issue loading card. Please try again."
@@ -383,7 +396,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
Application.put_env(:copi, :player_live_show_player_module, PlayerStub)
Application.put_env(:copi, :player_live_show_player_stub_mode, :real)
- {:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game.id, player.id), player_url(game.id, player.id))
Application.put_env(:copi, :player_live_show_player_stub_mode, :transient)
send(view.pid, {:retry_player_show_load, player.id})
@@ -404,7 +417,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
Application.put_env(:copi, :player_live_show_dealt_card_module, DealtCardStub)
Application.put_env(:copi, :player_live_show_dealt_card_stub_mode, :vote_conflict)
- {:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game.id, player.id), player_url(game.id, player.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => to_string(dealt.id)})
assert render(view) =~ game.name
@@ -412,11 +425,33 @@ defmodule CopiWeb.PlayerLive.ShowTest do
end
describe "toggle_vote authorization" do
+ test "redirects when the URL selects a player not stored in the session", %{conn: conn} do
+ {:ok, game} = Cornucopia.create_game(%{name: "Player URL Authorization"})
+ {:ok, authorized_player} = Cornucopia.create_player(%{name: "Authorized", game_id: game.id})
+ {:ok, other_player} = Cornucopia.create_player(%{name: "Other", game_id: game.id})
+
+ conn =
+ init_test_session(conn, %{
+ "resume_player_session" => [
+ %{"game_id" => game.id, "player_id" => authorized_player.id}
+ ]
+ })
+
+ expected_path = "/games/#{game.id}"
+
+ assert {:error,
+ {:redirect,
+ %{
+ to: ^expected_path,
+ flash: %{"error" => "This player link is not available in this browser session."}
+ }}} = live(conn, "/games/#{game.id}/players/#{other_player.id}")
+ end
+
test "rejects cross-game vote and shows error flash", %{conn: conn} do
{game1, player1, _dc1} = create_game_with_dealt_card("Auth Game One", "AUTH_G1_C1")
{_game2, _player2, dc2} = create_game_with_dealt_card("Auth Game Two", "AUTH_G2_C1")
- {:ok, view, _html} = live(conn, "/games/#{game1.id}/players/#{player1.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game1.id, player1.id), player_url(game1.id, player1.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => to_string(dc2.id)})
assert render(view) =~ "Invalid card selection"
@@ -438,7 +473,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
player_id: other_player.id, card_id: card2.id, played_in_round: 1
})
- {:ok, view, _html} = live(conn, "/games/#{game1.id}/players/#{player1.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game1.id, player1.id), player_url(game1.id, player1.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => to_string(dc2.id)})
{:ok, refreshed_card} = DealtCard.find(dc2.id)
@@ -448,7 +483,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
test "shows not found flash when toggling vote with missing dealt card", %{conn: conn} do
{game1, player1, _dc1} = create_game_with_dealt_card("Auth Game Four", "AUTH_G4_C1")
- {:ok, view, _html} = live(conn, "/games/#{game1.id}/players/#{player1.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game1.id, player1.id), player_url(game1.id, player1.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => "999999"})
assert render(view) =~ "Card not found. Please refresh and try again."
@@ -457,7 +492,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
test "shows error flash when toggling vote with invalid dealt card id format", %{conn: conn} do
{game1, player1, _dc1} = create_game_with_dealt_card("Auth Game Five", "AUTH_G5_C1")
- {:ok, view, _html} = live(conn, "/games/#{game1.id}/players/#{player1.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game1.id, player1.id), player_url(game1.id, player1.id))
render_click(view, "toggle_vote", %{"dealt_card_id" => "invalid_card_id"})
assert render(view) =~ "Invalid card format. Please refresh and try again."
@@ -465,7 +500,10 @@ defmodule CopiWeb.PlayerLive.ShowTest do
test "returns 404 when player does not exist", %{conn: conn} do
assert_error_sent 404, fn ->
- get(conn, "/games/00000000000000000000000001/players/00000000000000000000000002")
+ get(
+ authorize_player(conn, "00000000000000000000000001", "00000000000000000000000002"),
+ player_url("00000000000000000000000001", "00000000000000000000000002")
+ )
end
end
@@ -492,7 +530,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
test "keeps socket when player no longer exists", %{conn: conn} do
{game, player, dc} = create_game_with_dealt_card("HandleInfo Missing Player", "HI_MP_1")
- {:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game.id, player.id), player_url(game.id, player.id))
Copi.Repo.delete!(dc)
{:ok, _} = Copi.Cornucopia.delete_player(player)
@@ -507,7 +545,7 @@ defmodule CopiWeb.PlayerLive.ShowTest do
test "retry player show load message does not crash", %{conn: conn} do
{game, player, _dc} = create_game_with_dealt_card("Retry Player Show", "HI_RETRY_1")
- {:ok, view, _html} = live(conn, "/games/#{game.id}/players/#{player.id}")
+ {:ok, view, _html} = live(authorize_player(conn, game.id, player.id), player_url(game.id, player.id))
send(view.pid, {:retry_player_show_load, player.id})
:timer.sleep(50)
diff --git a/copi.owasp.org/test/copi_web/live/player_live_test.exs b/copi.owasp.org/test/copi_web/live/player_live_test.exs
index 37e9f9b6b..d1396e698 100644
--- a/copi.owasp.org/test/copi_web/live/player_live_test.exs
+++ b/copi.owasp.org/test/copi_web/live/player_live_test.exs
@@ -60,9 +60,16 @@ defmodule CopiWeb.PlayerLiveTest do
player
end
- defp create_player(_) do
+ defp create_player(%{conn: conn}) do
player = fixture(:player)
- %{player: player}
+ conn =
+ init_test_session(conn, %{
+ "resume_player_session" => [
+ %{"game_id" => player.game_id, "player_id" => player.id}
+ ]
+ })
+
+ %{conn: conn, player: player}
end
describe "player :index action" do
@@ -106,11 +113,11 @@ defmodule CopiWeb.PlayerLiveTest do
|> form("#player-form", player: @invalid_attrs)
|> render_change() =~ "can't be blank"
- {:ok, _, html} =
- index_live
- |> form("#player-form", player: %{name: "some updated name", game_id: player.game_id})
- |> render_submit()
- |> follow_redirect(conn)
+ index_live
+ |> form("#player-form", player: %{name: "some updated name", game_id: player.game_id})
+ |> render_submit()
+
+ {:ok, _, html} = exchange_player_creation(index_live, conn)
assert html =~ "Hi some updated name, waiting for the game to start..."
assert html =~ "Hi some updated name, waiting for the game to start..."
@@ -218,6 +225,20 @@ defmodule CopiWeb.PlayerLiveTest do
end
end
+ defp exchange_player_creation(view, conn) do
+ assert_push_event(view, "exchange-player-capability", %{capability: capability})
+
+ exchange_response =
+ post(conn, "/api/player-capabilities/exchange", %{"capability" => capability})
+
+ clean_path = json_response(exchange_response, 200)["redirect_to"]
+ refute clean_path =~ capability
+
+ exchange_response
+ |> recycle()
+ |> live(clean_path)
+ end
+
describe "Show" do
setup [:create_player]
diff --git a/copi.owasp.org/test/copi_web/postgres_session_integration_test.exs b/copi.owasp.org/test/copi_web/postgres_session_integration_test.exs
new file mode 100644
index 000000000..7db11c800
--- /dev/null
+++ b/copi.owasp.org/test/copi_web/postgres_session_integration_test.exs
@@ -0,0 +1,137 @@
+defmodule CopiWeb.PostgresSessionIntegrationTest do
+ use CopiWeb.ConnCase, async: false
+
+ import Phoenix.LiveViewTest
+
+ alias Copi.Cornucopia
+ alias Copi.Encrypted.Binary, as: EncryptedBinary
+ alias Copi.PlayerCapabilityConsumption
+ alias Copi.PlayerCapabilityRegistry
+ alias Copi.Repo
+ alias Copi.SessionCleanup
+ alias Copi.SessionRecord
+ alias CopiWeb.PlayerCapability
+
+ setup do
+ previous_value = Application.get_env(:copi, :postgres_session_store_enabled, false)
+
+ on_exit(fn ->
+ Application.put_env(:copi, :postgres_session_store_enabled, previous_value)
+ end)
+
+ {:ok, game} = Cornucopia.create_game(%{name: "Postgres session game"})
+ {:ok, player} = Cornucopia.create_player(%{name: "Postgres player", game_id: game.id})
+
+ %{game: game, player: player}
+ end
+
+ test "configured PostgreSQL mode persists the session and rejects replay after local state loss",
+ %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+ capability = PlayerCapability.sign(game.id, player.id)
+
+ exchange_response = exchange_capability(conn, game.id, capability)
+ clean_path = json_response(exchange_response, 200)["redirect_to"]
+
+ assert clean_path == "/games/#{game.id}/players/#{player.id}"
+ assert Repo.aggregate(SessionRecord, :count) == 1
+ assert Repo.aggregate(PlayerCapabilityConsumption, :count) == 1
+
+ session_record = Repo.one!(SessionRecord)
+ assert binary_part(session_record.data, 0, 4) == "ENC1"
+ refute session_record.data =~ game.id
+ refute session_record.data =~ player.id
+
+ assert {:ok, plaintext_session} = EncryptedBinary.decrypt(session_record.data)
+ database_session = Plug.Crypto.non_executable_binary_to_term(plaintext_session)
+
+ assert database_session["resume_player_session"] == [
+ %{"game_id" => game.id, "player_id" => player.id}
+ ]
+
+ {:ok, _player_view, player_html} =
+ exchange_response
+ |> recycle()
+ |> live(clean_path)
+
+ assert player_html =~ player.name
+
+ :sys.replace_state(PlayerCapabilityRegistry, fn state ->
+ %{state | consumed: %{}}
+ end)
+
+ replay_response = exchange_capability(recycle(exchange_response), game.id, capability)
+ assert json_response(replay_response, 401)["error"] == "Invalid or expired player capability"
+ assert Repo.aggregate(PlayerCapabilityConsumption, :count) == 1
+ end
+
+ test "default mode keeps session and replay state out of PostgreSQL", %{
+ conn: conn,
+ game: game,
+ player: player
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, false)
+ capability = PlayerCapability.sign(game.id, player.id)
+
+ exchange_response = exchange_capability(conn, game.id, capability)
+
+ assert json_response(exchange_response, 200)["redirect_to"] ==
+ "/games/#{game.id}/players/#{player.id}"
+
+ assert Repo.aggregate(SessionRecord, :count) == 0
+ assert Repo.aggregate(PlayerCapabilityConsumption, :count) == 0
+ end
+
+ test "startup cleanup removes expired PostgreSQL sessions and keeps active sessions" do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+ now = DateTime.utc_now()
+
+ Repo.insert!(%SessionRecord{
+ id: "expired-session",
+ data: "expired",
+ expires_at: DateTime.add(now, -1, :second)
+ })
+
+ Repo.insert!(%SessionRecord{
+ id: "active-session",
+ data: "active",
+ expires_at: DateTime.add(now, Application.fetch_env!(:copi, :session_ttl_seconds), :second)
+ })
+
+ assert {:ok, 1} = SessionCleanup.run()
+ refute Repo.get(SessionRecord, "expired-session")
+ assert Repo.get(SessionRecord, "active-session")
+ end
+
+ test "startup cleanup leaves sessions alone when PostgreSQL session storage is disabled" do
+ Application.put_env(:copi, :postgres_session_store_enabled, false)
+
+ Repo.insert!(%SessionRecord{
+ id: "disabled-cleanup-session",
+ data: "expired",
+ expires_at: DateTime.add(DateTime.utc_now(), -1, :second)
+ })
+
+ assert :ok = SessionCleanup.run()
+ assert Repo.get(SessionRecord, "disabled-cleanup-session")
+ end
+
+ defp exchange_capability(conn, game_id, capability) do
+ public_response = get(conn, "/games/#{game_id}")
+ csrf_token = csrf_token(html_response(public_response, 200))
+
+ public_response
+ |> recycle()
+ |> put_req_header("x-csrf-token", csrf_token)
+ |> post("/api/player-capabilities/exchange", %{"capability" => capability})
+ end
+
+ defp csrf_token(html) do
+ [_, token] = Regex.run(~r/
put_req_header("accept", "application/json")
|> put("/api/games/#{game.id}/players/#{player.id}/card", %{"dealt_card_id" => "123"})
- assert conn.status in [200, 400, 403, 404, 406, 422, 500]
+ assert json_response(conn, 401)["error"] == "Valid player session required"
end
end
diff --git a/copi.owasp.org/test/copi_web/session_store_test.exs b/copi.owasp.org/test/copi_web/session_store_test.exs
new file mode 100644
index 000000000..91d9777f0
--- /dev/null
+++ b/copi.owasp.org/test/copi_web/session_store_test.exs
@@ -0,0 +1,201 @@
+defmodule CopiWeb.SessionStoreTest do
+ use CopiWeb.ConnCase, async: false
+
+ alias Copi.Encrypted.Binary, as: EncryptedBinary
+ alias Copi.Repo
+ alias Copi.SessionRecord
+ alias CopiWeb.SessionStore
+
+ setup do
+ previous_postgres_enabled = Application.get_env(:copi, :postgres_session_store_enabled)
+ previous_session_ttl = Application.get_env(:copi, :session_ttl_seconds)
+
+ on_exit(fn ->
+ restore_env(:postgres_session_store_enabled, previous_postgres_enabled)
+ restore_env(:session_ttl_seconds, previous_session_ttl)
+ end)
+
+ opts =
+ SessionStore.init(
+ key: "_copi_key",
+ signing_salt: "K7VwkdRe",
+ encryption_salt: "vJ7hQp2L",
+ secret_key_base: String.duplicate("a", 64)
+ )
+
+ %{opts: opts}
+ end
+
+ test "cookie mode stores, reads, and deletes sessions", %{conn: conn, opts: opts} do
+ Application.put_env(:copi, :postgres_session_store_enabled, false)
+
+ session = %{
+ "resume_player_session" => [
+ %{"game_id" => "game-1", "player_id" => "player-1"}
+ ]
+ }
+
+ stored_conn = SessionStore.put(conn, nil, session, opts)
+ raw_cookie = cookie_value(stored_conn)
+
+ assert {session_id, ^session} = SessionStore.get(conn, raw_cookie, opts)
+ assert is_binary(session_id)
+
+ deleted_conn = SessionStore.delete(conn, session_id, opts)
+
+ assert deleted_conn.resp_cookies["_copi_key"].max_age == 0
+ end
+
+ test "postgres mode stores, restores, updates, and prunes expired sessions", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+ Application.put_env(:copi, :session_ttl_seconds, 3600)
+
+ Repo.insert!(%SessionRecord{
+ id: "expired-session",
+ data: "expired",
+ expires_at: DateTime.add(DateTime.utc_now(), -1, :second)
+ })
+
+ first_session = %{
+ "resume_player_session" => [
+ %{"game_id" => "game-1", "player_id" => "player-1"}
+ ]
+ }
+
+ first_conn = SessionStore.put(conn, nil, first_session, opts)
+ first_cookie = cookie_value(first_conn)
+
+ refute Repo.get(SessionRecord, "expired-session")
+
+ [record] = Repo.all(SessionRecord)
+ assert binary_part(record.data, 0, 4) == "ENC1"
+ assert DateTime.compare(record.expires_at, DateTime.utc_now()) == :gt
+ assert {record.id, ^first_session} = SessionStore.get(conn, first_cookie, opts)
+
+ updated_session = %{
+ "resume_player_session" => [
+ %{"game_id" => "game-2", "player_id" => "player-2"}
+ ]
+ }
+
+ updated_conn = SessionStore.put(conn, record.id, updated_session, opts)
+ updated_cookie = cookie_value(updated_conn)
+
+ assert Repo.aggregate(SessionRecord, :count) == 1
+ assert {record.id, ^updated_session} = SessionStore.get(conn, updated_cookie, opts)
+ end
+
+ test "postgres mode delete removes the backing record", %{conn: conn, opts: opts} do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+ Application.put_env(:copi, :session_ttl_seconds, 3600)
+
+ stored_conn =
+ SessionStore.put(
+ conn,
+ nil,
+ %{"resume_player_session" => [%{"game_id" => "game", "player_id" => "player"}]},
+ opts
+ )
+
+ session_id = postgres_session_id(conn, cookie_value(stored_conn), opts)
+
+ deleted_conn = SessionStore.delete(conn, session_id, opts)
+
+ refute Repo.get(SessionRecord, session_id)
+ assert deleted_conn.resp_cookies["_copi_key"].max_age == 0
+ end
+
+ test "postgres mode returns an empty session when the cookie is missing", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+
+ assert {nil, %{}} = SessionStore.get(conn, nil, opts)
+ end
+
+ test "postgres mode returns an empty session when the record is missing", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+
+ raw_cookie = postgres_cookie(conn, opts, "missing-session")
+
+ assert {nil, %{}} = SessionStore.get(conn, raw_cookie, opts)
+ end
+
+ test "postgres mode returns an empty session when the record is expired", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+
+ Repo.insert!(%SessionRecord{
+ id: "expired-session",
+ data: "expired",
+ expires_at: DateTime.add(DateTime.utc_now(), -1, :second)
+ })
+
+ raw_cookie = postgres_cookie(conn, opts, "expired-session")
+
+ assert {nil, %{}} = SessionStore.get(conn, raw_cookie, opts)
+ end
+
+ test "postgres mode returns an empty session when the payload cannot be decrypted", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+
+ Repo.insert!(%SessionRecord{
+ id: "undecryptable-session",
+ data: "not-encrypted",
+ expires_at: DateTime.add(DateTime.utc_now(), 3600, :second)
+ })
+
+ raw_cookie = postgres_cookie(conn, opts, "undecryptable-session")
+
+ assert {nil, %{}} = SessionStore.get(conn, raw_cookie, opts)
+ end
+
+ test "postgres mode returns an empty session when decrypted data is not a serialized term", %{
+ conn: conn,
+ opts: opts
+ } do
+ Application.put_env(:copi, :postgres_session_store_enabled, true)
+
+ {:ok, invalid_term_blob} = EncryptedBinary.encrypt("not an erlang term")
+
+ Repo.insert!(%SessionRecord{
+ id: "invalid-term-session",
+ data: invalid_term_blob,
+ expires_at: DateTime.add(DateTime.utc_now(), 3600, :second)
+ })
+
+ raw_cookie = postgres_cookie(conn, opts, "invalid-term-session")
+
+ assert {nil, %{}} = SessionStore.get(conn, raw_cookie, opts)
+ end
+
+ defp postgres_cookie(conn, opts, session_id) do
+ conn
+ |> Plug.Session.COOKIE.put(nil, %{"postgres_session_id" => session_id}, opts.cookie)
+ |> cookie_value()
+ end
+
+ defp postgres_session_id(conn, raw_cookie, opts) do
+ {_cookie_id, %{"postgres_session_id" => session_id}} =
+ Plug.Session.COOKIE.get(conn, raw_cookie, opts.cookie)
+
+ session_id
+ end
+
+ defp cookie_value(conn), do: conn.resp_cookies["_copi_key"].value
+
+ defp restore_env(key, nil), do: Application.delete_env(:copi, key)
+ defp restore_env(key, value), do: Application.put_env(:copi, key, value)
+end