Release Healer Man 0.1.21

server/online-session.test.mjs

@@ -112,3 +112,52 @@ test("rejects non-leader world updates and forged enemy events", () => {
   });
   assert.equal(state.events.length, 0);
 });
+
+test("relays member interactions but bounds authoritative world snapshots", () => {
+  const manager = createOnlineSessionManager();
+  const snapshot = groupSnapshot();
+  const interaction = manager.sync({ id: "healer" }, snapshot, {
+    presence,
+    events: [{
+      clientEventId: "interact:door:1",
+      kind: "interact",
+      sourceActorId: "online-player:healer",
+      targetActorId: "temple-door",
+    }],
+  });
+  assert.equal(interaction.events[0]?.kind, "interact");
+  assert.equal(interaction.events[0]?.targetActorId, "temple-door");
+
+  assert.throws(() => manager.sync({ id: "leader" }, snapshot, {
+    presence,
+    world: { padding: "x".repeat(4 * 1024 * 1024) },
+  }), (error) => error instanceof GameDatabaseError && error.code === "world_state_too_large");
+});
+
+test("accepts party teleports only from the activity leader", () => {
+  const manager = createOnlineSessionManager();
+  const snapshot = groupSnapshot();
+  const forged = manager.sync({ id: "healer" }, snapshot, {
+    presence,
+    events: [{
+      clientEventId: "teleport:forged",
+      kind: "party-teleport",
+      sourceActorId: "online-player:healer",
+      targetActorId: "party",
+      position: [9, 8, 7],
+    }],
+  });
+  assert.equal(forged.events.length, 0);
+
+  const accepted = manager.sync({ id: "leader" }, snapshot, {
+    presence,
+    events: [{
+      clientEventId: "teleport:leader",
+      kind: "party-teleport",
+      sourceActorId: "online-player:leader",
+      targetActorId: "party",
+      position: [9, 8, 7],
+    }],
+  });
+  assert.deepEqual(accepted.events[0]?.position, [9, 8, 7]);
+});