The keeper can bring back a seat a browser lost: a new token on the ledger, the old one refused, and a link that carries it in the fragment, minted by hnefatafl-reseat.sh through a /keeper door Caddy does not proxy and that turns away anything Caddy forwarded; the join page takes a linked seat only once the server accepts it and never over a seat this browser holds that still opens, a spectator at a game in play is told both ways back, the hall asks before forgetting a game in play, and the server's tests now run with the rest

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MbtUPJ24P6vc6tE1x6RS3m

server/src/index.ts

@@ -23,7 +23,11 @@
 //   WS   /ws?room=:id&token=        {type:"update", seq} whenever the room changes; without a token,
 //                                   a seat in the Peanut Gallery, counted for the table
 //
-// Caddy serves the static site and proxies /api and /ws here.
+// Caddy serves the static site and proxies /api and /ws here. The keeper's
+// door answers only on the host itself (deploy/hnefatafl-reseat.sh):
+//
+//   GET  /keeper/rooms/:id          who sits at the table, and when each person last moved or spoke
+//   POST /keeper/rooms/:id/reseat   {seat}             a new token for a player locked out, as a link to send them
 
 import * as Sentry from '@sentry/node';
 import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
@@ -184,9 +188,24 @@ async function handleReports(req: IncomingMessage, res: ServerResponse, parts: s
 	throw new RoomError('Not here.', 404);
 }
 
+/** The keeper's door. Caddy proxies only /api and /ws, so it is reached from the host alone; a request Caddy forwarded is turned away besides. */
+async function handleKeeper(req: IncomingMessage, res: ServerResponse, parts: string[]): Promise<void> {
+	if (req.headers['x-forwarded-for'] || parts[1] !== 'rooms') throw new RoomError('Not here.', 404);
+	const room = rooms.get(parts[2] ?? '');
+	if (parts.length === 3 && req.method === 'GET') return send(res, 200, { roomId: room.id, started: !!room.state, seats: rooms.seatsForKeeper(room) });
+	if (parts[3] === 'reseat' && parts.length === 4 && req.method === 'POST') {
+		const body = await readBody(req);
+		const { seat, token } = rooms.reseat(room, body.seat);
+		// The token rides the fragment, which the browser keeps to itself: it reaches neither Caddy's log nor this server.
+		return send(res, 200, { name: seat.name, link: `${PUBLIC_URL}/join/${room.id}#seat=${seat.id}.${token}` });
+	}
+	throw new RoomError('Not here.', 404);
+}
+
 async function handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
 	const url = new URL(req.url ?? '/', 'http://localhost');
 	const parts = url.pathname.split('/').filter(Boolean);
+	if (parts[0] === 'keeper') return handleKeeper(req, res, parts);
 	if (parts[0] === 'api' && parts[1] === 'reports') return handleReports(req, res, parts);
 	if (parts[0] === 'api' && parts[1] === 'tally' && parts.length === 2 && req.method === 'GET') return send(res, 200, tallies.get());
 	if (parts[0] === 'api' && parts[1] === 'transfer' && parts.length === 2 && req.method === 'POST') {

server/src/rooms.test.ts

@@ -0,0 +1,51 @@
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { game } from '../../src/lib/game';
+import { Rooms } from './rooms';
+import { Store } from './store';
+
+let dir: string;
+beforeEach(() => {
+	dir = mkdtempSync(join(tmpdir(), 'rooms-'));
+});
+afterEach(() => {
+	rmSync(dir, { recursive: true, force: true });
+});
+
+/** A table of two: Ann, who opened it, and Bo, the game begun. */
+function table() {
+	const rooms = new Rooms(game, new Store(dir));
+	const host = rooms.create('Ann', 2);
+	const guest = rooms.join(host.room, 'Bo');
+	rooms.begin(host.room, host.token);
+	return { rooms, room: host.room, ann: host.token, bo: guest.token };
+}
+
+describe('rooms', () => {
+	it("gives a seat a new token at the keeper's word: the old one opens nothing, and a restart keeps the change", () => {
+		const { rooms, room, bo } = table();
+		const phrase = rooms.transfer(room, bo).phrase;
+		const { seat, token } = rooms.reseat(room, 'B');
+		expect(seat.name).toBe('Bo');
+		expect(rooms.seatOf(room, token).id).toBe('B');
+		expect(() => rooms.seatOf(room, bo)).toThrow(/opens no seat/);
+		// A phrase minted with the old token carries nothing now.
+		expect(() => rooms.claim(phrase)).toThrow(/unknown or has expired/);
+		const reopened = new Rooms(game, new Store(dir)).get(room.id);
+		expect(rooms.seatOf(reopened, token).id).toBe('B');
+		expect(() => rooms.seatOf(reopened, bo)).toThrow(/opens no seat/);
+	});
+
+	it('re-seats only a person, and says when each person last acted', () => {
+		const { rooms, room, ann, bo } = table();
+		expect(() => rooms.reseat(room, 'Z')).toThrow(/No person sits/);
+		const mover = rooms.waitingOn(room)[0];
+		rooms.submit(room, mover === 'A' ? ann : bo, game.botInput(room.state!, mover), 0);
+		const seats = rooms.seatsForKeeper(room);
+		expect(seats.map((s) => [s.id, s.name])).toEqual([['A', 'Ann'], ['B', 'Bo']]);
+		expect(seats.find((s) => s.id === mover)!.lastActed).toBeGreaterThan(0);
+		expect(seats.find((s) => s.id !== mover)!.lastActed).toBeNull();
+	});
+});

server/src/rooms.ts

@@ -350,6 +350,30 @@ export class Rooms<State, Input> {
 		return { seat, token };
 	}
 
+	/**
+	 * The keeper gives a person's seat a new token, for a player whose browser lost the old one. Whether the one
+	 * asking holds the seat is the keeper's judgment; this carries it out. The old token opens nothing after.
+	 */
+	reseat(room: Room<State>, seatId: unknown): { seat: Seat; token: string } {
+		const seat = room.seats.find((s) => s.id === seatId && !s.bot);
+		if (!seat) throw new RoomError('No person sits in that seat.', 404);
+		const token = newId(18);
+		this.commit(room, { t: 'reseat', at: Date.now(), id: seat.id, tokenHash: hashToken(token) });
+		// A phrase minted with the old token would carry a seat that no longer answers to it.
+		for (const [phrase, t] of this.transfers) if (t.roomId === room.id && t.seatId === seat.id) this.transfers.delete(phrase);
+		return { seat, token };
+	}
+
+	/** The table as the keeper sees it before re-seating: who sits where, and when each person last moved or spoke. */
+	seatsForKeeper(room: Room<State>): { id: SeatId; name: string; bot: boolean; lastActed: number | null }[] {
+		const last = new Map<SeatId, number>();
+		for (const line of this.store.read(room.id)) {
+			if (line.t === 'input' || line.t === 'chat') last.set(line.id, line.at);
+			else if (line.t === 'turn') for (const id of Object.keys(line.inputs)) last.set(id, line.at);
+		}
+		return room.seats.map((s) => ({ id: s.id, name: s.name, bot: s.bot, lastActed: s.bot ? null : (last.get(s.id) ?? null) }));
+	}
+
 	/** The host sends a bot away before the game begins. People leave by not coming back. */
 	unseat(room: Room<State>, token: string | undefined, seatId: unknown): void {
 		const host = this.seatOf(room, token);
@@ -486,6 +510,11 @@ export class Rooms<State, Input> {
 			case 'seat':
 				room.seats.push({ id: line.id, name: line.name, tokenHash: line.tokenHash, bot: line.bot });
 				break;
+			case 'reseat': {
+				const seat = room.seats.find((s) => s.id === line.id);
+				if (seat) seat.tokenHash = line.tokenHash;
+				break;
+			}
 			case 'galleryTalk':
 				room.galleryTalk = line.on;
 				break;

server/src/store.ts

@@ -11,6 +11,8 @@ export type LedgerLine =
 	| { t: 'room'; id: string; seats: number; createdAt: number; rematchOf?: string; expected?: string[]; options: TableOptions }
 	/** A seat holds only the hash of its token; the token itself goes once to the browser that earned it. A bot's hash is empty. */
 	| { t: 'seat'; id: SeatId; name: string; tokenHash: string; bot: boolean }
+	/** The keeper gave a person's seat a new token, for a player whose browser lost the old one; the old one opens nothing after. */
+	| { t: 'reseat'; at: number; id: SeatId; tokenHash: string }
 	/** One seat's move for the round in progress, so a restart keeps it. The turn line that follows carries every input again. */
 	| { t: 'input'; at: number; id: SeatId; input: unknown }
 	/** A bot sent away by the host before the game began; its seat id is free again. */