22 files changed, 441 insertions(+), 17 deletions(-)

M Cargo.lock
M savefile_decoder/src/main.rs
M server/Cargo.toml
M server/src/component.rs
M server/src/main.rs
M server/src/packet.rs
M starkingdoms-backplane/Cargo.toml
M starkingdoms-backplane/src/main.rs
A starkingdoms-client/login/index.html
A starkingdoms-client/signup/index.html
A starkingdoms-client/src/components/ui/PasswordInput.svelte
M starkingdoms-client/src/config.ts
M starkingdoms-client/src/hub.ts
M starkingdoms-client/src/jwt.ts
A starkingdoms-client/src/page_loaders/login.ts
A starkingdoms-client/src/page_loaders/signup.ts
M starkingdoms-client/src/pages/Home.svelte
A starkingdoms-client/src/pages/Login.svelte
A starkingdoms-client/src/pages/Signup.svelte
M starkingdoms-client/src/protocol.ts
M starkingdoms-client/vite.config.ts
M starkingdoms-common/src/lib.rs

@@ 2164,6 2164,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
 
 [[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
 name = "hexasphere"
 version = "9.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"


@@ 3562,6 3568,7 @@ dependencies = [
  "diesel-async",
  "diesel_migrations",
  "env_logger",
+ "hex",
  "hmac",
  "jwt",
  "log",


@@ 3592,9 3599,13 @@ dependencies = [
  "bevy",
  "bevy_rapier2d",
  "bevy_twite",
+ "hex",
+ "hmac",
+ "jwt",
  "rand",
  "serde",
  "serde_json",
+ "sha2",
  "starkingdoms-common",
  "tracing-subscriber",
 ]

@@ 4,7 4,7 @@ use starkingdoms_common::unpack_savefile;
 
 fn main() {
     let save = std::env::args().nth(1).unwrap();
-    let key = fs::read_to_string("/etc/starkingdoms/app_key").unwrap();
+    let key = fs::read("/etc/starkingdoms/app_key").unwrap();
     let save_data = unpack_savefile(&key, save).unwrap();
     println!("{:#?}", save_data);
 }

@@ 13,6 13,10 @@ bevy_rapier2d = "0.23.0"
 rand = "0.8.5"
 tracing-subscriber = "0.3"
 starkingdoms-common = { version = "0.1", path = "../starkingdoms-common" }
+jwt = "0.16"
+sha2 = "0.10"
+hmac = "0.12"
+hex = "0.4"
 
 [features]
 default = []

@@ 132,5 132,5 @@ impl Default for ModuleTimer {
 
 #[derive(Resource)]
 pub struct AppKeys {
-    pub app_key: String,
+    pub app_key: Vec<u8>,
 }

@@ 24,11 24,16 @@ use bevy_rapier2d::prelude::*;
 use bevy_twite::{twite::frame::MessageType, ServerEvent, TwiteServerConfig, TwiteServerPlugin};
 use component::Input;
 use component::*;
+use hmac::{Hmac, Mac};
+use jwt::VerifyWithKey;
 use packet::*;
 use rand::Rng;
+use serde::{Deserialize, Serialize};
+use sha2::Sha256;
 use starkingdoms_common::SaveModule;
 use starkingdoms_common::{pack_savefile, unpack_savefile, SaveData};
 use std::f32::consts::PI;
+use std::time::SystemTime;
 
 pub mod component;
 pub mod macros;


@@ 56,7 61,7 @@ const FREE_MODULE_CAP: usize = 30;
 
 fn main() {
     // read the key in
-    let key = std::fs::read_to_string("/etc/starkingdoms/app_key").unwrap();
+    let key = std::fs::read("/etc/starkingdoms/app_key").unwrap();
 
     App::new()
         .insert_resource(AppKeys { app_key: key })


@@ 225,7 230,7 @@ fn on_login(
             let packet: Packet = err_or_cont!(serde_json::from_str(&data));
 
             match packet {
-                Packet::ClientLogin { username, save } => {
+                Packet::ClientLogin { username, save, jwt } => {
                     let angle: f32 = {
                         let mut rng = rand::thread_rng();
                         rng.gen::<f32>() * std::f32::consts::PI * 2.


@@ 620,6 625,21 @@ fn load_savefile(
     }
     return ret;
 }
+// permissions:
+// 0 - regular user (unauthenticated is 0)
+// 10 - private alpha
+// 20 - supervisor
+// 30 - dev
+
+const REQUIRED_PERMISSION_LEVEL: i32 = 10;
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct UserToken {
+    pub id: i64,
+    pub username: String,
+    pub permission_level: i32,
+    pub expires: SystemTime,
+}
 
 fn on_message(
     mut commands: Commands,


@@ 663,6 683,46 @@ fn on_message(
             let packet: Packet = err_or_cont!(serde_json::from_str(&data));
 
             match packet {
+                Packet::SendMessage { target, content } => {
+                    // find our player
+                    let mut player = None;
+                    for (_, q_player, _, _, _) in &player_query {
+                        if q_player.addr == *addr {
+                            player = Some(q_player);
+                        }
+                    }
+                    let player = player.unwrap();
+                    if let Some(target_username) = target {
+                        let mut target_player = None;
+                        for (_, q_player, _, _, _) in &player_query {
+                            if q_player.username == target_username {
+                                target_player = Some(q_player);
+                            }
+                        }
+                        let target_player = target_player.unwrap();
+                        let packet = Packet::Message {
+                            message_type: packet::MessageType::Direct,
+                            actor: player.username.clone(),
+                            content,
+                        };
+                        let buf = serde_json::to_vec(&packet).unwrap();
+                        event_queue.push(ServerEvent::Send(
+                            target_player.addr,
+                            MessageType::Text,
+                            buf.clone(),
+                        ));
+                        event_queue.push(ServerEvent::Send(*addr, MessageType::Text, buf));
+                    } else {
+                        // send to general chat
+                        let packet = Packet::Message {
+                            message_type: packet::MessageType::Chat,
+                            actor: player.username.clone(),
+                            content,
+                        };
+                        let buf = serde_json::to_vec(&packet).unwrap();
+                        event_queue.push(ServerEvent::Broadcast(MessageType::Text, buf));
+                    }
+                }
                 Packet::PlayerInput {
                     up,
                     down,

@@ 81,6 81,7 @@ pub enum Packet {
     ClientLogin {
         username: String,
         save: Option<String>,
+        jwt: Option<String>,
     },
     SendMessage {
         target: Option<String>,

@@ 26,4 26,5 @@ password-hash = "0.5"
 rs-snowflake = "0.6"
 jwt = "0.16"
 sha2 = "0.10"
-hmac = "0.12">
\ No newline at end of file
+hmac = "0.12"
+hex = "0.4"<
\ No newline at end of file

@@ 142,7 142,7 @@ async fn main() {
         }
     }
 
-    let key = Hmac::new_from_slice(config.server.application_key.as_bytes()).unwrap();
+    let key = Hmac::new_from_slice(hex::decode(config.server.application_key).unwrap()).unwrap();
 
     let stk_epoch = UNIX_EPOCH + Duration::from_secs(1616260136);
     let id_generator = SnowflakeIdGenerator::with_epoch(

@@ 0,0 1,20 @@
+<!-- DO NOT CHANGE THIS FILE! -->
+<!-- UI is rendered by Svelte. The root of the component tree is src/pages/Login.svelte. -->
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0" />
+    <meta http-equiv="X-UA-Compatible" content="ie=edge" />
+    <title>StarKingdoms.IO</title>
+  </head>
+  <body class="bg-grid">
+    <div id="mount">
+      <!-- Rendered by Svelte -->
+    </div>
+
+    <script type="module" src="../src/page_loaders/login.ts"></script>
+  </body>
+</html>

@@ 0,0 1,20 @@
+<!-- DO NOT CHANGE THIS FILE! -->
+<!-- UI is rendered by Svelte. The root of the component tree is src/pages/Signup.svelte. -->
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta
+      name="viewport"
+      content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0" />
+    <meta http-equiv="X-UA-Compatible" content="ie=edge" />
+    <title>StarKingdoms.IO</title>
+  </head>
+  <body class="bg-grid">
+    <div id="mount">
+      <!-- Rendered by Svelte -->
+    </div>
+
+    <script type="module" src="../src/page_loaders/signup.ts"></script>
+  </body>
+</html>

@@ 0,0 1,40 @@
+<script lang="ts">
+  let clazz: string = "";
+  export { clazz as class };
+  export let id: string = "";
+  export let disabled = false;
+  export let style = "";
+  export let required = false;
+  export let autocomplete = "";
+  export let value = "";
+  export let placeholder = "";
+</script>
+
+<input
+  bind:value
+  type="password"
+  {id}
+  class="txt {clazz}"
+  {disabled}
+  on:click
+  on:focus
+  on:input
+  on:change
+  on:keydown
+  on:keyup
+  {style}
+  {required}
+  {autocomplete}
+  {placeholder} />
+
+<style lang="scss">
+  .txt {
+    appearance: none;
+    background: transparent;
+    color: var(--text);
+    padding: 0.675em 1em;
+    border: 1px solid var(--links);
+    border-radius: 0.25rem;
+    cursor: text;
+  }
+</style>

@@ 7,6 7,7 @@ const CONFIG_URL = "https://configuration.starkingdoms.io";
 
 export interface Config {
   servers: { [id: string]: ConfigServer };
+  backplane: string;
 }
 export interface ConfigServer {
   name: string;

@@ 67,6 67,7 @@ export async function hub_connect(
       c: {
         username,
         save: window.localStorage.getItem("save"),
+        jwt: window.localStorage.getItem("stk-token"),
       },
     };
     sendPacket(client, packet);


@@ 234,8 235,8 @@ export async function hub_connect(
               hud.x = new_part.transform.x;
               hud.y = new_part.transform.y;
 
-              x_pos!.innerText = Math.round(new_part.transform.x).toString();
-              y_pos!.innerText = Math.round(new_part.transform.y).toString();
+              //x_pos!.innerText = Math.round(new_part.transform.x).toString();
+              //y_pos!.innerText = Math.round(new_part.transform.y).toString();
             }
             hud.next_poll--;
           }


@@ 247,7 248,9 @@ export async function hub_connect(
         global.parts_map.set(id, part);
 
         logger(`spawn part`);
-        let part_sprite = PIXI.Sprite.from(part_texture_url(part.part_type));
+        let part_sprite = PIXI.Sprite.from(
+          part_texture_url(part.part_type, p.part.flags.attached),
+        );
         global.rendering!.part_sprite_map.set(id, part_sprite);
         global.rendering!.app.stage.addChild(part_sprite);
       } else if (packet.t == PacketType.DespawnPart) {

@@ 16,6 16,9 @@
 
 export function parseJwt(token: string) {
   let base64Url = token.split(".")[1];
+  if (base64Url === undefined) {
+    return undefined;
+  }
   let base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
   let jsonPayload = decodeURIComponent(
     window

@@ 0,0 1,10 @@
+// DO NOT CHANGE THIS FILE!
+// It's only purpose is to initialize the Svelte component tree.
+// Actual code is in src/pages/Login.svelte.
+import Login from "../pages/Login.svelte";
+
+const page = new Login({
+  target: document.getElementById("mount")!,
+});
+
+export default page;

@@ 0,0 1,10 @@
+// DO NOT CHANGE THIS FILE!
+// It's only purpose is to initialize the Svelte component tree.
+// Actual code is in src/pages/Signup.svelte.
+import Signup from "../pages/Signup.svelte";
+
+const page = new Signup({
+  target: document.getElementById("mount")!,
+});
+
+export default page;

@@ 28,8 28,10 @@
   if (window.localStorage.getItem("stk-token") != null) {
     let token = window.localStorage.getItem("stk-token")!;
     let token_parsed: any = parseJwt(token);
-    is_logged_in = true;
-    token_username = token_parsed.username;
+    if (token_parsed !== undefined) {
+      is_logged_in = true;
+      token_username = token_parsed.username;
+    }
   }
 
   const is_development = window.localStorage.getItem("stk-mode") === "debug";


@@ 94,7 96,16 @@
 
     <span id="account-info" class="account-info">
       {#if is_logged_in}
-        Logged in as {token_username}! Saves will be stored on the server.
+        Logged in as {token_username}! Saves will be stored in your browser
+        during the alpha, but will be stored on the server soon!
+        <a
+          href="#"
+          on:click={() => {
+            window.localStorage.removeItem("stk-token");
+            window.location.reload();
+          }}>
+          Logout
+        </a>
       {:else}
         You are not logged in. Save data will be stored in your browser cache. <a
           href="/login/">

@@ 0,0 1,112 @@
+<script lang="ts">
+  import { DEFAULT_CONFIG, loadConfig } from "../config.ts";
+  import createDebug from "debug";
+  import "../css/themes/catppuccin-mocha.scss";
+  import "../css/style.scss";
+  import { parseJwt } from "../jwt.ts";
+  import HeartIcon from "../icons/HeartIcon.svelte";
+  import Popup from "../components/ui/Popup.svelte";
+  import Button from "../components/ui/Button.svelte";
+  import TextInput from "../components/ui/TextInput.svelte";
+  import PasswordInput from "../components/ui/PasswordInput.svelte";
+
+  let config = DEFAULT_CONFIG;
+  // Top-level await. Sets the default config, and overwrites it when the new config is avail. Thanks reactivity!
+  (async () => {
+    config = await loadConfig();
+  })();
+
+  const logger = createDebug("main");
+  logger(
+    `Hello, world! StarKingdoms ${APP_VERSION} (${COMMIT_HASH}) at your service!`,
+  );
+  logger("Current view: Login.svelte");
+
+  if (window.localStorage.getItem("stk-token") != null) {
+    let token = window.localStorage.getItem("stk-token")!;
+    let jwt = parseJwt(token);
+    if (jwt !== undefined) {
+      window.location.href = "/";
+    }
+  }
+
+  let username = "";
+  let password = "";
+
+  let error: string | null = null;
+
+  async function login() {
+    try {
+      let resp = await fetch(`${config.backplane}/login`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          username: username,
+          password: password,
+        }),
+      });
+
+      let body = await resp.json();
+
+      if (!resp.ok) {
+        let r_error = body.errors[0];
+
+        if (r_error.code === "ERR_UNAUTHORIZED") {
+          error = "Invalid username or password";
+        } else {
+          error = JSON.stringify(body);
+        }
+
+        return;
+      }
+
+      window.localStorage.setItem("stk-token", body.token);
+      window.location.href = "/";
+    } catch (e: any) {
+      error = e.toString();
+    }
+  }
+</script>
+
+<Popup title="Login" centered style="max-width: 300px;" id="title-popup">
+  <form id="join-fm" class="form" on:submit|preventDefault={login}>
+    <label for="username" class="label">Username</label>
+    <TextInput
+      style="width: 100%; max-width: 100%;"
+      bind:value={username}
+      id="username"
+      required
+      autocomplete="off" />
+
+    <label for="password" class="label">Password</label>
+    <PasswordInput
+      style="width: 100%; max-width: 100%;"
+      bind:value={password}
+      id="password"
+      required
+      autocomplete="off" />
+
+    <Button style="width: 100%; max-width: 100%;">Login!</Button>
+
+    {#if error !== null}
+      <span class="account-info" style="color: var(--error)">
+        {error}
+      </span>
+    {/if}
+
+    <span class="account-info">
+      Don't have an account? <a href="/signup/">Create one!</a>
+      Changed your mind?
+      <a href="/">Back to the launchpad</a>
+    </span>
+  </form>
+</Popup>
+
+<span class="footer-left">
+  StarKingdoms Client {APP_VERSION} ({COMMIT_HASH})
+</span>
+<span class="footer-right">
+  Made with <HeartIcon class="footer-icon" /> by the StarKingdoms team
+</span>

@@ 0,0 1,114 @@
+<script lang="ts">
+  import { DEFAULT_CONFIG, loadConfig } from "../config.ts";
+  import createDebug from "debug";
+  import "../css/themes/catppuccin-mocha.scss";
+  import "../css/style.scss";
+  import { parseJwt } from "../jwt.ts";
+  import HeartIcon from "../icons/HeartIcon.svelte";
+  import Popup from "../components/ui/Popup.svelte";
+  import Button from "../components/ui/Button.svelte";
+  import TextInput from "../components/ui/TextInput.svelte";
+  import PasswordInput from "../components/ui/PasswordInput.svelte";
+
+  let config = DEFAULT_CONFIG;
+  // Top-level await. Sets the default config, and overwrites it when the new config is avail. Thanks reactivity!
+  (async () => {
+    config = await loadConfig();
+  })();
+
+  const logger = createDebug("main");
+  logger(
+    `Hello, world! StarKingdoms ${APP_VERSION} (${COMMIT_HASH}) at your service!`,
+  );
+  logger("Current view: Signup.svelte");
+
+  if (window.localStorage.getItem("stk-token") != null) {
+    let token = window.localStorage.getItem("stk-token")!;
+    let jwt = parseJwt(token);
+    if (jwt !== undefined) {
+      window.location.href = "/";
+    }
+  }
+
+  let username = "";
+  let password = "";
+
+  let error: string | null = null;
+
+  async function signup() {
+    try {
+      let resp = await fetch(`${config.backplane}/signup`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+          username: username,
+          password: password,
+        }),
+      });
+
+      let body = await resp.json();
+
+      if (!resp.ok) {
+        let r_error = body.errors[0];
+
+        if (
+          r_error.code === "ERR_INTERNAL_ERROR" &&
+          r_error.message.startsWith("duplicate key value")
+        ) {
+          error = "Username already taken :(";
+        } else {
+          error = JSON.stringify(body);
+        }
+
+        return;
+      }
+
+      window.location.href = "/login/";
+    } catch (e: any) {
+      error = e.toString();
+    }
+  }
+</script>
+
+<Popup title="Sign up" centered style="max-width: 300px;" id="title-popup">
+  <form id="join-fm" class="form" on:submit|preventDefault={signup}>
+    <label for="username" class="label">Username</label>
+    <TextInput
+      style="width: 100%; max-width: 100%;"
+      bind:value={username}
+      id="username"
+      required
+      autocomplete="off" />
+
+    <label for="password" class="label">Password</label>
+    <PasswordInput
+      style="width: 100%; max-width: 100%;"
+      bind:value={password}
+      id="password"
+      required
+      autocomplete="off" />
+
+    <Button style="width: 100%; max-width: 100%;">Sign up!</Button>
+
+    {#if error !== null}
+      <span class="account-info" style="color: var(--error)">
+        {error}
+      </span>
+    {/if}
+
+    <span class="account-info">
+      Already have an account? <a href="/login/">Log in!</a>
+      Changed your mind?
+      <a href="/">Back to the launchpad</a>
+    </span>
+  </form>
+</Popup>
+
+<span class="footer-left">
+  StarKingdoms Client {APP_VERSION} ({COMMIT_HASH})
+</span>
+<span class="footer-right">
+  Made with <HeartIcon class="footer-icon" /> by the StarKingdoms team
+</span>

@@ 36,6 36,7 @@ export interface PartFlags {
 export interface ClientLoginPacket {
   username: string;
   save: string | null;
+  jwt: string | null;
 }
 export interface SpawnPlayerPacket {
   id: number;

@@ 23,6 23,8 @@ export default defineConfig({
       input: {
         main: resolve(__dirname, "index.html"),
         play: resolve(__dirname, "play/index.html"),
+        signup: resolve(__dirname, "signup/index.html"),
+        login: resolve(__dirname, "login/index.html"),
       },
     },
   },

@@ 55,8 55,8 @@ pub struct Savefile {
     mac: Vec<u8>,
 }
 
-pub fn pack_savefile(key: &str, save_data: SaveData) -> String {
-    let mut mac: Hmac<Sha256> = Hmac::new_from_slice(key.as_bytes()).unwrap();
+pub fn pack_savefile(key: &[u8], save_data: SaveData) -> String {
+    let mut mac: Hmac<Sha256> = Hmac::new_from_slice(key).unwrap();
 
     let save_data_bytes = rmp_serde::to_vec(&save_data).unwrap();
     mac.update(&save_data_bytes);


@@ 71,7 71,7 @@ pub fn pack_savefile(key: &str, save_data: SaveData) -> String {
 
     base64::engine::general_purpose::STANDARD.encode(final_bytes)
 }
-pub fn unpack_savefile(key: &str, file: String) -> Result<SaveData, Box<dyn Error>> {
+pub fn unpack_savefile(key: &[u8], file: String) -> Result<SaveData, Box<dyn Error>> {
     // << reverse! <<
     let savefile_bytes = base64::engine::general_purpose::STANDARD
         .decode(file)


@@ 80,8 80,8 @@ pub fn unpack_savefile(key: &str, file: String) -> Result<SaveData, Box<dyn Erro
     let save_file: Savefile = rmp_serde::from_slice(&savefile_bytes)
         .map_err(|e| format!("error decoding savefile wrapper: {e}"))?;
 
-    let mut mac: Hmac<Sha256> = Hmac::new_from_slice(key.as_bytes())
-        .map_err(|e| format!("error loading hmac-sha256: {e}"))?;
+    let mut mac: Hmac<Sha256> =
+        Hmac::new_from_slice(key).map_err(|e| format!("error loading hmac-sha256: {e}"))?;
     mac.update(&save_file.data_msgpack);
     mac.verify_slice(&save_file.mac)
         .map_err(|e| format!("error verifying signature: {e}"))?;