eric/game-kit
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The keeper's door asks for a key only root and the game's user can read, so another service on the host cannot re-seat anyone; the deploy makes the key once and the reseat script sends it from a file descriptor; and a seat link is taken out of the address bar with the browser's own call, since the page reads it before the router starts

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m
This commit is contained in:
Eric Wagoner
2026-10-13 18:27:13 -04:00
co-authored by Claude Opus 5.5
parent 4721b0e97b
commit 7b4080c91f
5 changed files with 41 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
template/deploy/__SLUG__-reseat.sh
+6 -2
View File
@@ -8,8 +8,12 @@
set -euo pipefail
ROOM="${1:?usage: __SLUG__-reseat.sh ROOM [SEAT]}"
DOOR="http://127.0.0.1:__PORT__/keeper/rooms/${ROOM^^}"
[ -s /etc/__SLUG__/keeper.key ] || { echo "No keeper's key at /etc/__SLUG__/keeper.key; a deploy makes it." >&2; exit 1; }
# The key goes as a header read from a file descriptor, never on a command line another user could see.
KEY="@/dev/fd/3"
exec 3< <(printf 'x-keeper-key: %s\n' "$(cat /etc/__SLUG__/keeper.key)")
if [ $# -lt 2 ]; then
curl -s "$DOOR" | python3 -c '
curl -s -H "$KEY" "$DOOR" | python3 -c '
import datetime, json, sys
r = json.load(sys.stdin)
if "error" in r: sys.exit(r["error"])
@@ -19,7 +23,7 @@ for s in r["seats"]:
print(" %-3s %-24s %s" % (s["id"], s["name"], when))
'
else
curl -s -X POST -H 'content-type: application/json' -d "{\"seat\":\"$2\"}" "$DOOR/reseat" | python3 -c '
curl -s -X POST -H "$KEY" -H 'content-type: application/json' -d "{\"seat\":\"$2\"}" "$DOOR/reseat" | python3 -c '
import json, sys
r = json.load(sys.stdin)
if "error" in r: sys.exit(r["error"])