fix(api): secure /api/archive_singleplayer_game endpoint with JWT validation

src/client/LocalServer.ts

@@ -18,7 +18,7 @@ import {
   decompressGameRecord,
   replacer,
 } from "../core/Util";
-import { getPersistentID } from "./Auth";
+import { getPersistentID, getPlayToken, isLoggedIn } from "./Auth";
 import { LobbyConfig } from "./ClientGameRunner";
 import {
   GameSpeedDownIntentEvent,
@@ -297,27 +297,44 @@ export class LocalServer {
       console.error("Error parsing game record", error);
       return;
     }
-    const workerPath = ClientEnv.workerPath(
-      this.lobbyConfig.gameStartInfo.gameID,
-    );
+    isLoggedIn().then((loggedIn) => {
+      if (!loggedIn) {
+        console.log(
+          "Player is not logged in, skipping singleplayer game archiving",
+        );
+        return;
+      }
+
+      const workerPath = ClientEnv.workerPath(
+        this.lobbyConfig.gameStartInfo!.gameID,
+      );
 
-    const jsonString = JSON.stringify(result.data, replacer);
+      const jsonString = JSON.stringify(result.data, replacer);
 
-    compress(jsonString)
-      .then((compressedData) => {
-        return fetch(`/${workerPath}/api/archive_singleplayer_game`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "Content-Encoding": "gzip",
-          },
-          body: compressedData,
-          keepalive: true, // Ensures request completes even if page unloads
+      Promise.all([compress(jsonString), getPlayToken()])
+        .then(([compressedData, token]) => {
+          return fetch(`/${workerPath}/api/archive_singleplayer_game`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "Content-Encoding": "gzip",
+              Authorization: `Bearer ${token}`,
+            },
+            body: compressedData,
+            keepalive: true, // Ensures request completes even if page unloads
+          });
+        })
+        .then((response) => {
+          if (response && !response.ok) {
+            console.error(
+              `Failed to archive singleplayer game: HTTP ${response.status} ${response.statusText}`,
+            );
+          }
+        })
+        .catch((error) => {
+          console.error("Failed to archive singleplayer game:", error);
         });
-      })
-      .catch((error) => {
-        console.error("Failed to archive singleplayer game:", error);
-      });
+    });
   }
 }
 

src/server/Worker.ts

@@ -233,6 +233,23 @@ export async function startWorker() {
 
   app.post("/api/archive_singleplayer_game", async (req, res) => {
     try {
+      let persistentID: string;
+      const authHeader = req.headers.authorization;
+      if (authHeader?.startsWith("Bearer ")) {
+        const token = authHeader.substring("Bearer ".length);
+        const tokenResult = await verifyClientToken(token);
+        if (tokenResult.type === "success") {
+          persistentID = tokenResult.persistentId;
+        } else {
+          log.warn(
+            `Invalid token for archive_singleplayer_game: ${tokenResult.message}`,
+          );
+          return res.status(401).json({ error: "Invalid token" });
+        }
+      } else {
+        return res.status(401).json({ error: "Authorization header required" });
+      }
+
       const record = req.body;
 
       const result = PartialGameRecordSchema.safeParse(record);
@@ -260,6 +277,17 @@ export async function startWorker() {
         return res.status(400).json({ error: "Invalid request" });
       }
 
+      const player = result.data.info.players[0];
+      if (player.persistentID !== persistentID) {
+        log.warn("Authenticated user does not match record persistentID", {
+          tokenUser: persistentID,
+          recordUser: player.persistentID,
+        });
+        return res
+          .status(403)
+          .json({ error: "Unauthorized user for this record" });
+      }
+
       log.info("archiving singleplayer game", {
         gameID: gameRecord.info.gameID,
       });