Add own-body spectator camera and player names; record Workshop 0.0.139

services/telemetry-worker/test/dashboard-client.test.js

@@ -44,7 +44,7 @@ function fixture() {
     else if(path.includes('/events?'))data={events:[{receivedAt:1793361000,event}],nextBefore:null};
     else if(path.startsWith(`/api/missions/${sid}/`))data={receivedAt:1793361000,event};
     else if(path.startsWith('/api/missions?'))data={missions:[{...event,receivedAt:1793361000}],nextBefore:null};
-    else if(path.startsWith('/api/players'))data={players:[{playerId:sid,attempts:1,escapes:1,didNotEscape:0,bestEscapeSeconds:120,kills:2,missionsWithKills:1,friendlyKills:0,missionsWithFriendlyKills:1}],nextAfter:null};
+    else if(path.startsWith('/api/players'))data={players:[{playerId:sid,name:malicious,attempts:1,escapes:1,didNotEscape:0,bestEscapeSeconds:120,kills:2,missionsWithKills:1,friendlyKills:0,missionsWithFriendlyKills:1}],nextAfter:null};
     else throw new Error('Unexpected path '+path);
     return{ok:true,status:200,json:async()=>data};
   };
@@ -63,7 +63,7 @@ test('client login, scope, pagination, mission details, safe text and logout',as
   await f.click(f.button(f.ids.content,f.malicious));assert.ok(f.requests.some(r=>r.path.startsWith('/api/missions?')&&r.path.includes(`serverId=${f.sid}`)));
   await f.click(f.button(f.ids.content,'Everon'));assert.equal(f.ids['mission-dialog'].open,true);assert.match(f.ids['mission-body'].textContent,/Mission settings/);assert.match(f.ids['mission-body'].textContent,/Event history/);assert.ok(f.ids['mission-body'].textContent.includes(f.malicious));
   await f.click(f.ids['close-dialog']);assert.equal(f.ids['mission-dialog'].open,false);
-  await f.tab('players');assert.match(f.ids.content.textContent,/1\/1 missions reported this counter/);
+  await f.tab('players');assert.ok(f.ids.content.textContent.includes(f.malicious));assert.ok(f.ids.content.textContent.includes(f.sid));assert.equal(descendants(f.ids.content).some(x=>x.tagName==='IMG'),false);assert.match(f.ids.content.textContent,/1\/1 missions reported this counter/);
   await f.click(f.ids.logout);assert.equal(f.ids.app.hidden,true);assert.equal(f.ids.content.textContent,'');assert.equal(f.ids['mission-body'].textContent,'');
   for(const request of f.requests)assert.ok(!request.path.includes('token'));
 });

services/telemetry-worker/test/worker.test.js

@@ -398,3 +398,36 @@ test('automatic server names arrive later, follow renames, and survive blanks, r
   assert.equal((await ingest(event({serverId: managed, serverName: 'Game name', players: []}), registered.token)).status, 201);
   assert.equal((await db.prepare('SELECT name FROM servers WHERE server_id = ?').bind(managed).first()).name, 'Operator label');
 });
+
+test('player names follow newest nonblank completed reports without merging IDs or changing counters', async () => {
+  const sid = crypto.randomUUID(), second = crypto.randomUUID();
+  const secret = 'player-names-test-credential-0123456789';
+  const pid = crypto.randomUUID(), otherPid = crypto.randomUUID();
+  async function named(serverId, playerId, name, occurredAt, extra = {}) {
+    const e = event({serverId, occurredAt, ...extra});
+    e.players = [{...e.players[0], id: playerId, name, escaped: e.outcome === 'victory'}];
+    assert.equal((await ingest(e, secret)).status, 201);
+  }
+  await named(sid, pid, 'Old name', 100);
+  await named(sid, pid, '  Current name  ', 300);
+  await named(sid, pid, 'Queued old name', 200);
+  await named(sid, pid, ' ', 400);
+  await named(sid, otherPid, 'Current name', 350);
+  await named(sid, pid, 'Live-only name', 600, {type:'heartbeat',outcome:'',phase:1});
+  const scoped = await (await call(`/api/players?serverId=${sid}`, {headers: readAuth})).json();
+  assert.equal(scoped.players.length, 2);
+  const player = scoped.players.find(p => p.playerId === pid);
+  assert.equal(player.name, 'Current name'); assert.equal(player.attempts, 4); assert.equal(player.kills, 8);
+  assert.equal(scoped.players.find(p => p.playerId === otherPid).attempts, 1);
+  await named(second, pid, '<img src=x onerror=alert(1)>', 500);
+  const global = await (await call('/api/players?limit=100', {headers: readAuth})).json();
+  assert.equal(global.players.find(p => p.playerId === pid).name, '<img src=x onerror=alert(1)>');
+  const stillScoped = await (await call(`/api/players?serverId=${sid}`, {headers: readAuth})).json();
+  assert.equal(stillScoped.players.find(p => p.playerId === pid).name, 'Current name');
+  const first = await (await call(`/api/players?serverId=${sid}&limit=1`, {headers: readAuth})).json();
+  const next = await (await call(`/api/players?serverId=${sid}&limit=1&after=${first.nextAfter}`, {headers: readAuth})).json();
+  assert.notEqual(first.players[0].playerId, next.players[0].playerId);
+  const blankId = crypto.randomUUID(); await named(second, blankId, '', 700);
+  const blanks = await (await call(`/api/players?serverId=${second}`, {headers: readAuth})).json();
+  assert.equal(blanks.players.find(p => p.playerId === blankId).name, null);
+});