Authorize one client to attempt one direct connection to one active session without confusing connection permission with gameplay admission.
Scope
Add join-attempt issuance after tenant, visibility, compatibility, lease, presence, and policy validation.
Create distinct opaque host/client punch capabilities scoped to role, attempt, session, game, environment, protocol, expiry, and mediator.
Store only capability hashes and atomic state; allow idempotent UDP duplicates from the same bound endpoint while rejecting endpoint/role substitution.
Issue a separate compact connection ticket for the eventual LiteNetLib connection.
Define ticket validation/consumption by the host, cancellation, retry window, expiry, and revocation.
Keep capabilities within LiteNetLib's NAT token limit and out of logs/browser data.
Acceptance criteria
Altered, expired, replayed, cross-session, cross-role, cross-tenant, incompatible, revoked, and concurrently consumed credentials are rejected.
One join attempt cannot cross-wire with another attempt for the same session.
Legitimate duplicate UDP packets remain safe within the attempt window.
The host can validate the connection ticket without granting Rendezvous gameplay authority.
Full/admission decisions made after connection remain host-owned.
Issuance and consumption are atomic and deterministically tested.
Token and key material is redacted everywhere.
Parent: #1
Depends on: #5, #7
## Outcome
Authorize one client to attempt one direct connection to one active session without confusing connection permission with gameplay admission.
## Scope
- Add join-attempt issuance after tenant, visibility, compatibility, lease, presence, and policy validation.
- Create distinct opaque host/client punch capabilities scoped to role, attempt, session, game, environment, protocol, expiry, and mediator.
- Store only capability hashes and atomic state; allow idempotent UDP duplicates from the same bound endpoint while rejecting endpoint/role substitution.
- Issue a separate compact connection ticket for the eventual LiteNetLib connection.
- Define ticket validation/consumption by the host, cancellation, retry window, expiry, and revocation.
- Keep capabilities within LiteNetLib's NAT token limit and out of logs/browser data.
## Acceptance criteria
- Altered, expired, replayed, cross-session, cross-role, cross-tenant, incompatible, revoked, and concurrently consumed credentials are rejected.
- One join attempt cannot cross-wire with another attempt for the same session.
- Legitimate duplicate UDP packets remain safe within the attempt window.
- The host can validate the connection ticket without granting Rendezvous gameplay authority.
- Full/admission decisions made after connection remain host-owned.
- Issuance and consumption are atomic and deterministically tested.
- Token and key material is redacted everywhere.
Starting implementation from stacked SDK commit 06c3973 on branch codex/issue-10-join-attempts.
Initial plan:
Ground the existing join/ticket wire contracts, policy checks, mediator limits, and atomic store seams.
Specify capability/ticket derivation, hashes, expiry, cancellation, and one-time consumption.
Implement atomic join issuance and credential lifecycle with strict scope validation.
Add deterministic adversarial tests for tamper/replay/cross-scope/concurrency/duplicates/redaction.
Run audit, full gates, commit/push, and update #10 plus roadmap #1.
Dependencies #5 and #7 are present in the stacked branch.
Starting implementation from stacked SDK commit `06c3973` on branch `codex/issue-10-join-attempts`.
Initial plan:
1. Ground the existing join/ticket wire contracts, policy checks, mediator limits, and atomic store seams.
2. Specify capability/ticket derivation, hashes, expiry, cancellation, and one-time consumption.
3. Implement atomic join issuance and credential lifecycle with strict scope validation.
4. Add deterministic adversarial tests for tamper/replay/cross-scope/concurrency/duplicates/redaction.
5. Run audit, full gates, commit/push, and update #10 plus roadmap #1.
Dependencies #5 and #7 are present in the stacked branch.
Implemented issue #10 on codex/issue-10-join-attempts at 1baa105.
Added typed create, host-poll, and client-cancel join-attempt flows with exact tenant, visibility, compatibility, policy, lease, and live-presence validation.
Added distinct host/client punch capabilities and connection tickets. Only fingerprints are stored; 43-character credentials remain below transport limits.
Ticket validity starts at introduction, is bounded to 20 seconds, and supports atomic one-time consumption plus cancellation, expiry, revocation, retry, and replay rejection.
Added the caller-owned client ticket validator and documented that gameplay admission remains host-owned.
Audit fixes centralized cursor protection and store-result mapping, removed caller-controlled validation time, and hardened canonical Base64URL credential parsing.
Verification: formatting clean, Release build clean, client package produced, and 126/126 tests pass. The issue remains open until the stacked branch is landed.
Implemented issue #10 on `codex/issue-10-join-attempts` at `1baa105`.
- Added typed create, host-poll, and client-cancel join-attempt flows with exact tenant, visibility, compatibility, policy, lease, and live-presence validation.
- Added distinct host/client punch capabilities and connection tickets. Only fingerprints are stored; 43-character credentials remain below transport limits.
- Ticket validity starts at introduction, is bounded to 20 seconds, and supports atomic one-time consumption plus cancellation, expiry, revocation, retry, and replay rejection.
- Added the caller-owned client ticket validator and documented that gameplay admission remains host-owned.
- Covered cross-scope substitution, malformed/tampered credentials, cursor isolation, duplicate/retry behavior, concurrency, expiry, redaction, and full-session authorization.
- Audit fixes centralized cursor protection and store-result mapping, removed caller-controlled validation time, and hardened canonical Base64URL credential parsing.
Verification: formatting clean, Release build clean, client package produced, and 126/126 tests pass. The issue remains open until the stacked branch is landed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #5, #7
Outcome
Authorize one client to attempt one direct connection to one active session without confusing connection permission with gameplay admission.
Scope
Acceptance criteria
Starting implementation from stacked SDK commit
06c3973on branchcodex/issue-10-join-attempts.Initial plan:
Dependencies #5 and #7 are present in the stacked branch.
Implemented issue #10 on
codex/issue-10-join-attemptsat1baa105.Verification: formatting clean, Release build clean, client package produced, and 126/126 tests pass. The issue remains open until the stacked branch is landed.