amaurycoudr/chess-project
2
0
Fork 0
Code Issues 12 Pull requests 2 Projects Releases Packages 1 Activity Actions 2

The Guest holds the Seat: the server mints it, the browser keeps and sends it, the Seat token is gone #372

New issue
Closed
opened 2026-10-11 16:26:18 +00:00 by root · 25 comments
root commented 2026-10-11 16:26:18 +00:00 (Migrated from gitlab.core-project.space)
Copy link

Imported from GitHub amaurycoudr/chess-project#372, opened by @amaurycoudr on 2026-10-11 16:26 UTC.

Parent

#355

What to build

A browser proves its Seat with one Guest, in every Room, instead of a Seat token per Room (ADR 0034).

When a browser creates a Room or takes a Seat without a Guest, the server mints one: at least 128 random bits, URL-safe, through a constructor option. The response says which Guest it minted, or that it minted none, and that response is the only time the secret crosses the wire. A refused take (NO_FREE_SEAT) mints nothing, so a Spectator never gets a Guest. The API's RPC context reads the Guest header and hashes the secret with SHA-256 on arrival. From then on the caller's occupant is a union with one variant today, a Guest known by its hash. Resolving the caller stays synchronous and reads no database. An unknown secret is a Guest with nothing to its name, never a validation error.

The Room keys each occupant by its Guest and is always handed one; it no longer mints anything. A Guest that already holds a Seat in a Room gets that Seat back on a second take, never the other one.

The front keeps the Guest under one localStorage key of its own. It sends the Guest in its header on every call and replaces it with whatever a response minted. The store sits where both room/ and a future games/ vertical may import it. Entering a Room always calls seat.take, still deduplicated per Room code. The answer either hands back the held Seat, takes a free one, or refuses, and a refusal makes the browser a Spectator. Leaving forgets nothing. If storage throws, play still works, but a reload loses the Seat.

The Seat token is removed everywhere: its contract schema and header, the token in the create and take output, the per-Room front storage, and the API's handling of its header. Leftover per-Room keys in browsers are ignored. Comments that cite ADR 0016 are repointed to ADR 0034 or dropped. A Player sees no difference.

Seam: the Room with its fixtures (seating by Guest); the RPC wire with the in-process app (minting, acting for a Seat); the Room view tests with their harness and MSW (keeping and sending the Guest); e2e (the existing reload and second-tab specs kept green).

Acceptance criteria

  • room.create and seat.take with no Guest mint one and say so. With a known or unknown Guest, they mint nothing.
  • A refused seat.take (NO_FREE_SEAT) mints no Guest (story 3).
  • A call with no header, or with another browser's Guest missing, cannot move, offer, resign or leave for a Seat. Knowing the Room code is not enough (story 5).
  • A Guest taking again in a Room where it sits gets the same Seat and no new Guest (story 6).
  • The secret is hashed in the RPC context. Nothing past the context sees it, and resolving the caller does no I/O.
  • The front stores the Guest under one key, sends it in a header (never in a URL) on every call including refetches, and replaces it with a minted one (story 2).
  • Entering a Room always calls seat.take once per Room code, and a refusal lands the browser as a Spectator.
  • Front storage that throws on read or write still lets the browser play.
  • The existing reload and second-tab e2e specs pass unchanged in what they assert (story 4).
  • No Seat token schema, header, output field, front storage or ADR 0016 comment remains.
  • The PR body proposes rewording the three rule files that still name the Seat token (the API header rule, the e2e rule on each Player's token, the contracts' branded-identifier example). They are not edited here.
> _Imported from GitHub [amaurycoudr/chess-project#372](https://github.com/amaurycoudr/chess-project/issues/372), opened by [@amaurycoudr](https://github.com/amaurycoudr) on 2026-10-11 16:26 UTC._ <!-- github-issue:372 --> --- ## Parent #355 ## What to build A browser proves its **Seat** with one **Guest**, in every **Room**, instead of a **Seat token** per **Room** (ADR 0034). When a browser creates a **Room** or takes a **Seat** without a **Guest**, the server mints one: at least 128 random bits, URL-safe, through a constructor option. The response says which **Guest** it minted, or that it minted none, and that response is the only time the secret crosses the wire. A refused take (`NO_FREE_SEAT`) mints nothing, so a **Spectator** never gets a **Guest**. The API's RPC context reads the **Guest** header and hashes the secret with SHA-256 on arrival. From then on the caller's occupant is a union with one variant today, a **Guest** known by its hash. Resolving the caller stays synchronous and reads no database. An unknown secret is a **Guest** with nothing to its name, never a validation error. The **Room** keys each occupant by its **Guest** and is always handed one; it no longer mints anything. A **Guest** that already holds a **Seat** in a **Room** gets that **Seat** back on a second take, never the other one. The front keeps the **Guest** under one `localStorage` key of its own. It sends the **Guest** in its header on every call and replaces it with whatever a response minted. The store sits where both `room/` and a future `games/` vertical may import it. Entering a **Room** always calls `seat.take`, still deduplicated per **Room code**. The answer either hands back the held **Seat**, takes a free one, or refuses, and a refusal makes the browser a **Spectator**. Leaving forgets nothing. If storage throws, play still works, but a reload loses the **Seat**. The **Seat token** is removed everywhere: its contract schema and header, the token in the create and take output, the per-**Room** front storage, and the API's handling of its header. Leftover per-**Room** keys in browsers are ignored. Comments that cite ADR 0016 are repointed to ADR 0034 or dropped. A Player sees no difference. Seam: the `Room` with its fixtures (seating by **Guest**); the RPC wire with the in-process app (minting, acting for a **Seat**); the **Room** view tests with their harness and MSW (keeping and sending the **Guest**); e2e (the existing reload and second-tab specs kept green). ## Acceptance criteria - [ ] `room.create` and `seat.take` with no **Guest** mint one and say so. With a known or unknown **Guest**, they mint nothing. - [ ] A refused `seat.take` (`NO_FREE_SEAT`) mints no **Guest** (story 3). - [ ] A call with no header, or with another browser's **Guest** missing, cannot move, offer, resign or leave for a **Seat**. Knowing the **Room code** is not enough (story 5). - [ ] A **Guest** taking again in a **Room** where it sits gets the same **Seat** and no new **Guest** (story 6). - [ ] The secret is hashed in the RPC context. Nothing past the context sees it, and resolving the caller does no I/O. - [ ] The front stores the **Guest** under one key, sends it in a header (never in a URL) on every call including refetches, and replaces it with a minted one (story 2). - [ ] Entering a **Room** always calls `seat.take` once per **Room code**, and a refusal lands the browser as a **Spectator**. - [ ] Front storage that throws on read or write still lets the browser play. - [ ] The existing reload and second-tab e2e specs pass unchanged in what they assert (story 4). - [ ] No **Seat token** schema, header, output field, front storage or ADR 0016 comment remains. - [ ] The PR body proposes rewording the three rule files that still name the **Seat token** (the API header rule, the e2e rule on each Player's token, the contracts' branded-identifier example). They are not edited here.
root commented 2026-10-11 16:26:18 +00:00 (Migrated from gitlab.core-project.space)
Copy link

GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links).

> _GitHub issue relations, imported as "related" links (GitLab CE has no sub-issues or blocking links)._ <!-- github-relations --> - Parent (sub-issue of): #355 - Blocked by: #371, #370 - Blocking: #373
root commented 2026-10-13 08:39:45 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #373

mentioned in issue #373
root commented 2026-10-13 08:41:21 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #355

mentioned in issue #355
root commented 2026-10-13 08:41:24 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #370

mentioned in issue #370
root commented 2026-10-13 08:41:24 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in issue #371

mentioned in issue #371
root commented 2026-10-13 08:42:26 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #355

marked this issue as related to #355
root commented 2026-10-13 08:42:34 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #370

marked this issue as related to #370
root commented 2026-10-13 08:42:34 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #371

marked this issue as related to #371
root commented 2026-10-13 08:42:34 +00:00 (Migrated from gitlab.core-project.space)
Copy link

marked this issue as related to #373

marked this issue as related to #373
root commented 2026-10-13 14:34:05 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 8ad1fd91fe

mentioned in commit 8ad1fd91feaaa4c662dc6de37211803a2592d6dc
root commented 2026-10-13 14:34:05 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit d5cf28a684

mentioned in commit d5cf28a684edded345fd2c9a7951dab33a299ab2
root commented 2026-10-13 14:34:05 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit c56a5f5454

mentioned in commit c56a5f54542789e32ad9ccd18b8d2c7647fcd57b
root commented 2026-10-13 14:34:05 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit d6459084e7

mentioned in commit d6459084e7ac41fd78d70bd7542611d1c496343a
root commented 2026-10-13 14:34:05 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit d5b42b7f11

mentioned in commit d5b42b7f115b57cf8fbcaef5b4142701b76cc769
root commented 2026-10-13 14:34:16 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in merge request !515

mentioned in merge request !515
root commented 2026-10-14 07:52:22 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 941c8132bd

mentioned in commit 941c8132bdcce61ba98a8649b74fb2b755b14d75
root commented 2026-10-14 07:52:23 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 7d0a5a725e

mentioned in commit 7d0a5a725eda1896cbe81f2926e988cbc7621c8c
root commented 2026-10-14 07:52:23 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 66524f0f45

mentioned in commit 66524f0f45e8142d27205fe7cbc00ebe3aa970e8
root commented 2026-10-14 07:52:23 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit ff47973c19

mentioned in commit ff47973c1977b486690f0696542686b78af8a06b
root commented 2026-10-14 07:52:24 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 1696cd91ef

mentioned in commit 1696cd91ef410552b021bfdcd81d7f047ecd4c5c
root commented 2026-10-14 09:31:43 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit f453e2ce3f

mentioned in commit f453e2ce3f28c25fb44a56bc38e101102d8d708e
root commented 2026-10-14 09:31:43 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit c1eb8e46e2

mentioned in commit c1eb8e46e2d4426e0813ae851fd34ed751325125
root commented 2026-10-14 09:31:43 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 084b9e5706

mentioned in commit 084b9e570619d59578deafd4f5efb9db9f50b265
root commented 2026-10-14 09:31:44 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit d7ee32c058

mentioned in commit d7ee32c0580feb5b3e1453a5d25a3d684bdd804d
root commented 2026-10-14 09:31:44 +00:00 (Migrated from gitlab.core-project.space)
Copy link

mentioned in commit 309352130c

mentioned in commit 309352130c16a3f26e31df154d789f79cdb89a49
root (Migrated from gitlab.core-project.space) closed this issue 2026-10-14 09:31:57 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
docs/training-platform-pivot
ci/499-remove-gitlab-ci
fix/front-browser-pages
docs/contributing-forgejo-ci
fix/storybook-ghsa-f2ph-cmg5-wxc8
prototype/dead-end-page
prototype/puzzles-ui-redesign
prototype/399-front-screens
ci/front-test-one-job
feat/370-drizzle-gateway
pr-screenshots
feat/369-postgres-per-stack
claude/pawn-promotion-capture-score-46fffb
claude/github-workflow-improvements-30cf86
docs/352-adr-claim-guest
docs/351-adr-seat-identity
claude/retro-last-10-conversations-9af723
docs/accounts-adrs
claude/lighthouse-pt-4b5a78
docs/350-adr-sessions
feat/game-status-326
research/postgres-on-vps
research/email-provider
prototype/offer-overlay
ci/339-pr-screenshots
prototype/game-status
ci/317-faster-pipeline
spec/303-vps-hosting
claude/paste-invite-link-room-code
docs/309-adr-vps-hosting
fix/311-client-route-fallback
claude/back-navigation-feature-2166ea
claude/resource-contract
claude/api-nest-orpc
claude/adr-nest-orpc
claude/e2e-tests-new-features-1ce2a1
claude/la-spec-273-fd55ac
claude/matt-pocock-skills-integration-444ba9
chore/adopt-the-cognitive-load-coding-rules-270
feat/choose-the-promotion-piece-in-a-popover-instead-of-auto-queening-267
feat/animate-piece-moves-on-the-board-264
feat/show-drag-state-on-the-board-263
feat/move-a-piece-by-dragging-and-dropping-it-261
feat/blocking-modal-when-the-room-has-closed-246
feat/truthful-opponent-presence-lost-connection-left-new-opponent-248
feat/horizontal-game-and-room-action-bars-with-a-confirmed-leave-247
feat/room-status-block-with-a-fixed-height-and-seat-relative-wording-245
docs/amend-adr-0016-a-vacated-seat-replaces-the-60-second-left-timer-244
feat/lint-against-hard-coded-copy-in-the-front-front-no-literal-copy-252
feat/translate-the-front-with-a-language-provider-english-french-242
docs/adr-front-i18n-paraglide
docs/stacked-prs
fix/render-build-fails-on-corepack-enable-record-the-hosting-adr-240
front/8-lint-error
front/7-local-home-align
front/6-comment-purge
front/5-cache-policy
front/3-dissolve-room-actions
front/4-tests-through-view
front/2-room-restructure
front/1-test-harness
feat/deploy-to-render-free-tier-with-a-preview-per-pr-233
harness/6-coding-standards
harness/5-adrs
harness/4-mechanical-rules
harness/3-drop-sandcastle
harness/2-skill-forks
harness/1-adr-index
claude/e2e-test-sub-agents-f8d06b
claude/e2e-hook-performance-072aa8
e2e-restart
e2e-spectator
e2e-draw-offer
e2e-resign-and-reload
e2e-mate-two-browsers
orchestrate-issue-168-implementation
implement-issue-169-and-pr
orpc-ws-room-feature
home-page-issues
comment-audit-and-rules
local/4-local-rail
local/3-local-board
local/2-design-prep
local/1-engine-accessors
prototype/home-page
prototype/game-screen-layout
worktree-front
chore/worktree-env-and-ports
feat/slice-1-3a-front-store-ws-effect-connection-status-screen-136
fix/143-release-seat-on-disconnect
claude/sandcastle-runner-contract
feat/slice-1-2a-apps-api-skeleton-hono-ws-echo-origin-allowlist-132
feat/slice-1-1-chess-contracts-package-context-md-cleanup-128
refactor/reorganise-src-into-layered-folders-per-adr-0008-123
refactor/refactor-engine-reorganise-src-into-layered-folders-per-adr-0008-123
refactor/introduce-the-piecereader-read-port-118
refactor/move-isattacked-to-attacks-ts-with-board-only-signature-111
feat/slice-b1-zobrist-key-computation-for-positions-99
refactor/slice-a-re-back-squareset-with-split-32-representation-97
sandcastle/sequential-reviewer/1779180017269
feat/san-formatter-core-encoding-moves-captures-en-passant-promotion-castling-92
sandcastle/sequential-reviewer/1779111400188
refactor/engine-pr-10-1-migrate-stalemate-into-a-draw-status-variant-86
sandcastle/sequential-reviewer/1779099667568
feat/engine-pr-9-1-castling-rights-tracking-updatecastlingrights-applymove-wiring-80
refactor/extract-piece-attacks-registry-and-rewire-isattacked-movegen-77
sandcastle/sequential-reviewer/1779027444485
backup/pre-axis-a-rewrite
Labels
Clear labels   
bug
Something isn't working

  
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
question
Further information is requested

  
spec
Parent spec written by to-spec

  
wayfinder:grilling

   
wayfinder:map

   
wayfinder:prototype

   
wayfinder:research

   
wayfinder:task

   
wontfix
This will not be worked on

No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
spec
wayfinder:grilling
wayfinder:map
wayfinder:prototype
wayfinder:research
wayfinder:task
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#373 Store each decided Online game once, owned by the Guest in each Seat
amaurycoudr/chess-project
Depends on
#370 The Drizzle Gateway browses every stack through an SSH tunnel
amaurycoudr/chess-project
#371 Production is dumped nightly, checked by a restore, encrypted and kept off the VPS
amaurycoudr/chess-project
Reference
amaurycoudr/chess-project#372
No description provided.