From: Carl Worth <cworth@cworth.org>
Date: Fri, 5 Jun 2020 14:15:33 +0000 (-0700)
Subject: tictactoe: Enforce only legal moves with regard to team membership
X-Git-Url: https://git.cworth.org/git?p=empires-server;a=commitdiff_plain;h=92382a8dd4bfc9c83b7cf5fa1c0981b01096efd0

tictactoe: Enforce only legal moves with regard to team membership

Rejecting any attempt to move if a player cannot be found from the
current session, or if the player is not on the right team, etc.

Commit includes testing.
---

diff --git a/lmno.js b/lmno.js
index 5d4ca3e..18e60ef 100644
--- a/lmno.js
+++ b/lmno.js
@@ -309,8 +309,15 @@ for (let key in engines) {
     router.post('/move', (request, response) => {
       const game = request.game;
       const move = request.body.move;
+      const player = game.players[request.session.id];
 
-      const result = game.add_move(move);
+      /* Reject move if there is no player for this session. */
+      if (! player) {
+        response.json({legal: false, message: "No valid player from session"});
+        return;
+      }
+
+      const result = game.add_move(player, move);
 
       /* Feed move response back to the client. */
       response.json(result);
diff --git a/test b/test
index 853ee8f..b480b5f 100755
--- a/test
+++ b/test
@@ -302,7 +302,7 @@ tictactoe_game_path=tictactoe/$tictactoe_game_id
 
 tictactoe_move()
 {
-    curl_post $tictactoe_game_path/move "{ \"move\": $1 }"
+    curl_post $tictactoe_game_path/move "{ \"move\": $1 }" "-b .test-cookie"
 }
 
 lmno_profile()
@@ -372,12 +372,25 @@ TEST_END
 
 TEST_SUBSECTION "Tic Tac Toe /move"
 
-TEST "Move to the center square"
+TEST "Illegal to move when not on a team"
+result=$(tictactoe_move 4)
+test "$result" = '{"legal":false,"message":"You must be on a team to take a turn"}'
+TEST_END
+
+TEST "Illegal to move when it's not your turn"
+tictactoe_player_team O
+result=$(tictactoe_move 4)
+test "$result" = '{"legal":false,"message":"It'"'"'s not your turn to move"}'
+TEST_END
+
+TEST "Legal move to center square"
+tictactoe_player_team X
 result=$(tictactoe_move 4)
 test "$result" = '{"legal":true}'
 TEST_END
 
 TEST "Move to center square again is now illegal"
+tictactoe_player_team O
 result=$(tictactoe_move 4)
 test "$result" = '{"legal":false,"message":"Square is already occupied"}'
 TEST_END
diff --git a/tictactoe.js b/tictactoe.js
index 3501984..f919843 100644
--- a/tictactoe.js
+++ b/tictactoe.js
@@ -13,10 +13,28 @@ class TicTacToe extends Game {
   }
 
   /* Returns true if move was legal and added, false otherwise. */
-  add_move(square) {
+  add_move(player, square) {
+
+    /* Cannot move if you are not on a team. */
+    if (player.team === "")
+    {
+      return { legal: false,
+               message: "You must be on a team to take a turn" };
+    }
+
+    /* Cannot move if it's not this player's team's turn. */
+    if (player.team !== this.state.next_player)
+    {
+      return { legal: false,
+               message: "It's not your turn to move" };
+    }
+
     /* Cannot move to an occupied square. */
     if (this.state.board[square])
-      return { legal: false, message: "Square is already occupied" };
+    {
+      return { legal: false,
+               message: "Square is already occupied" };
+    }
 
     this.state.board[square] = this.state.next_player;
     this.state.moves.push(square);