Remove ugly hack to generate and use an insecure certificate on the fly
in the HttpCloser's https tests and replace it with the already existing
properly generated test certificate. Removes the dependency on node-forge.
If only the bot was clever enough to see that node-forge is only used
for a test that has no user input it might have had the foresight to
realize that crying wolf about completely irrelevant security issues
will only lead to legitimate issues being ignored in the future. But
alas, the AI overlords are not taking over any time soon.
Mocha's recursive search feature finds all files and then removes paths
that match the exclution filter, except that the globstar filter doesn't
match directories with a dot in them which is created by pnpm. Avoid
this madness by removing the test package.
Save disk space, time and sanity by replacing npm and lerna with pnpm.
This is more performant and doesn't have developer experience ruining
bugs like npm link removing all previous links before creating the
requested one.
The Node.js specific rules for Eslint were deprecated in favour of the
node plugin for Eslint. Add node plugin for eslint and switch over to
using its rules, fixing any issues detected.
Move the depenedncies needed to run the tests into test/package.json and
manage it using lerna. This should make it easier to selectively
install only what's needed to run the software.
Add authentication plugin that does a simple challenge response protocol
to verify that the player trying to log in is who they claim to be. The
process goes as follows:
1. A player code is generated for a player that wants to log in and is
displayed in-game.
2. The player code is input into the web interface and the master
generates a verification code as a challenge back along with a token.
3. The player inputs the verification code in-game and is logged in to
the web interface in doing so.
To do the actual login the web interface polls a verify endpoint every 2
seconds until the code has either been verified or expired. The
challenge comes from being unable to control the verification code and
having to input it as a player logging into one of the servers in order
to login.
Some additional steps are taken in order to increase the difficulty for
an attacker to subvert the challenge:
- The login process must be started from in-game.
- Generated codes are only valid for a limited timespan which is
configurable and 2 minutes by default.
- The verification code comes with a token that only works with one
player code and verification code combo and must be provided to pass
validation.
When setting up the tests there were issues with code that didn't
properly clean up after itself and left lingering connections, intervals
or timers that kept the event loop running after the tests where done.
To fix this the --exit flag was passed as a temporary measure but then
subsequently forgotten about. The issues with keeping the event loop
alive have long since been fixed on Linux, but on Windows there was a
problem with the control connector not exiting because the master server
was killed instead of shutten down properly.
With that issue fixed there are no longer any connections or timers
keeping the event loop alive and --exit can thus be removed.
The removal of the automatic TLS certificate generation removed the use
of node-forge in the master server, while the addition of the HttpCloser
added it as dependency of the tests. Fix node-forge dependency being
listed in lib and master instead of as a dev dependency in package.json.
Remove the need for installing babel and the webpack loaders used in the
webpack.common.js file separately by resolving them from the web_ui
package. This allows future changes to done to the modules used without
having to update them in each plugin that uses the web_ui common config.
Fix the issue with paths resolving incorrectly for the webpack config
when running the master server with the --dev option from the project
root folder through either npx clusteriomaster or node packages/master
Split up codebase into the packages @clsterio/lib, @clusterio/master,
@clusterio/slave, and @clusterio/ctl using lerna to manage them. This
will allow deployment to use only the parts needed reducing install
size, and better separate the code into shared library, master, slave
and control.
Remove the unused dependencies to bcrypt and bcrypt-promise. These were
used by the playerManager plugin to implement password based
authentication, but this plugin is likely not going to be ported to 2.0.
Add ESLint as a dev dependency and configure it to match the preferred
style for the project. The config options set to warn are tentative and
may not be sensible as they haven't been fully investigated yet.
Upload the created export data zip file to a new /api/upload-export
endpoint on the master server which unpacks it into the appropriate
directory on the master.
Spawn master, slave, and clusterctl in separate processes in the
clusterio integration tests and leave the test master and slave process
available for the whole test duration to allow plugins to use them as
well. This removes the need for reimplementing the startup logic in the
test code and makes the existing startup code covered by tests.
Replace socket.io with plain WebSocket using the ws library as it
doesn't really provide any useful tools over plain WebSocket when it
comes to implementing reliable communication that works across
reconnects. The widespread browser support for WebSocket also means
it has little value to add for the web interface over WebSocket.
Add a library mod for wrapping the Clusterio remote API and providing
related utilities. This eases development of Clusterio related Lua code
by providing the same interface for both mods and modules and also makes
the serialize library available without having to duplicate it.
It is not possible to implement this through save patching as mods
cannot load Lua code from the level code like they can with code from
other mods.
Close active connections and http servers during master shutdown and let
node exit on its own. If this fails with an error set output streams to
blocking and report it then shutdown with process.exit.
Also add double SIGINT handling to immediately shutdown.
The maintainers of bcrypt have in their infinite wisdom decided to stop
distributing Windows binaries. Their inner workings remain a mystery.
This is a port of 5fe98a0.
Rework client.js to support running multiple instances at once and be
managed remotely and implement the neccessary communication
infrastructure for this.
Due to circular dependencies on the implementation of this the master
branch is significantly broken after this.
Remove the .js suffix from help texts of node invocations as well as
actual invocations as this is not necessary. Removing it opens up the
possibility of restructuring the code into a directory with the same
name.
Remove Hotpatch and implement a save patcher in its place. The save
patcher takes a normal Factorio save and adds modules to it that's
loaded by a generated control.lua file. This greatly reduces the
difficulty of adding an existing game to Clusterio and using scenario
code in plugins.
The mechanism for selecting what code to patch into the saves from
plugins is temorary and expected to change with #220.
Break out the server process management to a new FactorioServer class in
lib/factorio. This class takes responsibility for managing a factorio
server, communicating with it and handling the stopping of it. It also
replaces the previous effort to do this in lib/factorioServer.
This change also updates the version of rcon-client, and since the
author of it has updated it to use UTF-8 the fork is no longer
necessary. It also removes the messageInterface implementation
in favor of just calling the rcon-client library directly since
this has rate limiting logic built in.
The lib/factorio library is intended to abstract all the interfacing
that happens with Factorio.
Hornwitser