Provide a safe server-browser data API for public and approved unlisted sessions.
Scope
Add list/get queries scoped by game, environment, exact protocol compatibility, region, availability, and visibility.
Implement stable bounded cursor pagination and deterministic ordering.
Enforce per-game metadata schemas plus byte, depth, property-count, collection, and scalar-length limits.
Treat all metadata as display data: no markup execution, endpoint interpretation, or trusted authorization fields.
Define unlisted/private retrieval behavior using unguessable identifiers or approved join codes.
Expose only compatibility, capacity, region, freshness, and validated presentation metadata.
Acceptance criteria
Cross-game, cross-environment, and incompatible-protocol listings never leak.
Expired, stale-presence, revoked, full-when-filtered, and non-public sessions are excluded correctly.
Pagination cannot skip/duplicate stable records under the documented consistency model.
Query cost, filters, page sizes, and response size are bounded.
Browser responses contain no raw endpoint, lease, punch, ticket, credential, or internal identifier.
Host capacity is documented as advisory.
Malicious metadata has regression tests for UI-injection and allocation abuse.
Parent: #1
Depends on: #7
## Outcome
Provide a safe server-browser data API for public and approved unlisted sessions.
## Scope
- Add list/get queries scoped by game, environment, exact protocol compatibility, region, availability, and visibility.
- Implement stable bounded cursor pagination and deterministic ordering.
- Enforce per-game metadata schemas plus byte, depth, property-count, collection, and scalar-length limits.
- Treat all metadata as display data: no markup execution, endpoint interpretation, or trusted authorization fields.
- Define unlisted/private retrieval behavior using unguessable identifiers or approved join codes.
- Expose only compatibility, capacity, region, freshness, and validated presentation metadata.
## Acceptance criteria
- Cross-game, cross-environment, and incompatible-protocol listings never leak.
- Expired, stale-presence, revoked, full-when-filtered, and non-public sessions are excluded correctly.
- Pagination cannot skip/duplicate stable records under the documented consistency model.
- Query cost, filters, page sizes, and response size are bounded.
- Browser responses contain no raw endpoint, lease, punch, ticket, credential, or internal identifier.
- Host capacity is documented as advisory.
- Malicious metadata has regression tests for UI-injection and allocation abuse.
Starting implementation on codex/issue-8-session-browser, stacked on the verified #2–#7 foundation. I’ll implement exact tenant/protocol/region/availability filtering, public-only list plus unguessable-ID direct retrieval, stable bounded cursor pagination, response-byte ceilings, presentation-only metadata handling, and adversarial isolation/injection/allocation tests.
Starting implementation on `codex/issue-8-session-browser`, stacked on the verified #2–#7 foundation. I’ll implement exact tenant/protocol/region/availability filtering, public-only list plus unguessable-ID direct retrieval, stable bounded cursor pagination, response-byte ceilings, presentation-only metadata handling, and adversarial isolation/injection/allocation tests.
Kyuubi
self-assigned this 2026-07-16 05:59:32 +02:00
Implemented and pushed on codex/issue-8-session-browser at a9a2b3d.
Delivered:
public list queries scoped by exact game/environment/protocol with optional region and full-session exclusion, always gated by live lease plus fresh authenticated presence;
direct public/unlisted retrieval by 128-bit unguessable listing ID plus exact tenant/protocol scope, with stale and cross-scope results hidden as not found;
deterministic ascending-ID keyset pagination with five-minute HMAC-signed cursors bound to every filter, rejecting tampering, expiry, and rescoping;
bounded live-view consistency semantics, page-size+1 store reads, and automatic response trimming under the exact 256 KiB encoded-response ceiling;
presentation-only DTO copies containing compatibility, region, trust/visibility presentation, advisory capacity, display/build labels, and validated string metadata—no endpoint, credential, token, capability, principal, salt, fingerprint, or store key;
player-facing HTTP list/get endpoints, excludeFull contract/OpenAPI support, real Kestrel integration coverage, and ADR 0006 documenting advisory capacity, cursor consistency, unlisted behavior, metadata rendering, and limits.
the real HTTP lifecycle integration now also lists and directly retrieves a presence-qualified session;
completion and multi-lens branch audits found no remaining actionable findings.
The issue remains open until the stacked branch is landed.
Implemented and pushed on `codex/issue-8-session-browser` at `a9a2b3d`.
Delivered:
- public list queries scoped by exact game/environment/protocol with optional region and full-session exclusion, always gated by live lease plus fresh authenticated presence;
- direct public/unlisted retrieval by 128-bit unguessable listing ID plus exact tenant/protocol scope, with stale and cross-scope results hidden as not found;
- deterministic ascending-ID keyset pagination with five-minute HMAC-signed cursors bound to every filter, rejecting tampering, expiry, and rescoping;
- bounded live-view consistency semantics, page-size+1 store reads, and automatic response trimming under the exact 256 KiB encoded-response ceiling;
- presentation-only DTO copies containing compatibility, region, trust/visibility presentation, advisory capacity, display/build labels, and validated string metadata—no endpoint, credential, token, capability, principal, salt, fingerprint, or store key;
- player-facing HTTP list/get endpoints, `excludeFull` contract/OpenAPI support, real Kestrel integration coverage, and ADR 0006 documenting advisory capacity, cursor consistency, unlisted behavior, metadata rendering, and limits.
Verification:
- locked restore, formatter verification, Release solution build, generated OpenAPI worktree drift check, and 100/100 tests passed;
- tests cover cross-game/environment/protocol/region isolation; public/unlisted/stale/full/revoked filtering; exact-scope unlisted lookup; stable no-duplicate traversal; cursor tamper/expiry/rescoping; 256 KiB page trimming/continuation; JSON-escaped markup; response secret exclusion; and large bounded metadata;
- the real HTTP lifecycle integration now also lists and directly retrieves a presence-qualified session;
- completion and multi-lens branch audits found no remaining actionable findings.
The issue remains open until the stacked branch is landed.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Parent: #1
Depends on: #7
Outcome
Provide a safe server-browser data API for public and approved unlisted sessions.
Scope
Acceptance criteria
Starting implementation on
codex/issue-8-session-browser, stacked on the verified #2–#7 foundation. I’ll implement exact tenant/protocol/region/availability filtering, public-only list plus unguessable-ID direct retrieval, stable bounded cursor pagination, response-byte ceilings, presentation-only metadata handling, and adversarial isolation/injection/allocation tests.Implemented and pushed on
codex/issue-8-session-browserata9a2b3d.Delivered:
excludeFullcontract/OpenAPI support, real Kestrel integration coverage, and ADR 0006 documenting advisory capacity, cursor consistency, unlisted behavior, metadata rendering, and limits.Verification:
The issue remains open until the stacked branch is landed.