Add concurrency controls and fix security/config issues#4
Merged
discostu105 merged 3 commits intomasterfrom Mar 21, 2026
Merged
Add concurrency controls and fix security/config issues#4discostu105 merged 3 commits intomasterfrom
discostu105 merged 3 commits intomasterfrom
Conversation
Comprehensive review covering architecture, code quality, testing, dependencies, security, and observability across all 11 projects. https://claude.ai/code/session_01PeKjLeL9dZx8eR2hVsqCzA
- Remove hardcoded secrets: Rookout token and Discord OAuth credentials now read from configuration (user-secrets/env vars) instead of source - Upgrade all preview/pre-release packages to stable .NET 8 versions across BlazorClient, FrontendServer, StatefulGameServer, and Test projects - Add lock-based concurrency control to all repository write operations (UnitRepositoryWrite, ResourceRepositoryWrite, PlayerRepositoryWrite, AssetRepositoryWrite, ActionQueueRepository, WorldState) - Remove unused System.Security.Cryptography.X509Certificates imports and other dead using directives from 5 files - Delete legacy azure-pipelines.yml (superseded by GitHub Actions) - Add .editorconfig for consistent code style enforcement https://claude.ai/code/session_01PeKjLeL9dZx8eR2hVsqCzA
The workflow was still targeting .NET 5.0.100 while all projects target net8.0. Also bumps actions/checkout and actions/setup-dotnet to v4. https://claude.ai/code/session_01PeKjLeL9dZx8eR2hVsqCzA
discostu105
added a commit
that referenced
this pull request
Mar 30, 2026
- Convert GameLobbyViewModels to record types (Architect blocking #1) - Add GameDefType and EndTime fields to GameSummaryViewModel and GameInfo (Architect required #5) - Fix AddPlayer() race condition: move PlayerCount update inside lock, return bool for duplicate-join detection (Architect blocking #2 and #3 / QA blocking #2) - Fix duplicate-join: return Conflict(409) if player already joined (Architect blocking #2) - Add [AllowAnonymous] to GetAll() — game list is a public endpoint per BGE-131 plan (Architect required #4) - Update controller to use record constructor syntax and handle AddPlayer bool return Build: 0 errors | Tests: 117/117 passed Co-Authored-By: Paperclip <noreply@paperclip.ing>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses critical concurrency issues in the stateful game server, removes hardcoded secrets, and improves code quality through dependency updates and cleanup.
Key Changes
Security & Configuration
Program.csand moved to configuration-based approach usingbuilder.Configuration["Rookout:Token"]builder.Configuration["Discord:ClientId"]andbuilder.Configuration["Discord:ClientSecret"]InvalidOperationExceptionto fail fast if required secrets are missingConcurrency Control
Added thread-safe locking to all write operations in repository classes to prevent race conditions in the in-memory stateful server:
UnitRepositoryWrite: WrappedBuildUnit,MergeUnits,SplitUnit,SendUnit, andReturnUnitsHomewithlock (_lock)PlayerRepositoryWrite: WrappedIncrementTickandCreatePlayerwithlock (_lock)AssetRepositoryWrite: WrappedBuildAssetandExecuteGameActionswithlock (_lock)ResourceRepositoryWrite: WrappedDeductCostandAddResourceswithlock (_lock)ActionQueueRepository: WrappedGetAndRemoveDueActions,Remove, andAddActionwithlock (_lock)WorldState: Added lock field for future synchronizationCode Quality
System.Security.Cryptography.X509Certificates,System.Reflection.PortableExecutable,System.Runtime.InteropServices.ComTypes, etc.).editorconfigwith team conventions for C#, XML, JSON, and YAML files (tab indentation, nullable reference type warnings, code style preferences)azure-pipelines.yml(targeting .NET 5, superseded by GitHub Actions)MergeUnitsto extract internal logic intoMergeUnitsInternalto avoid lock nestingDependency Updates
7.0.0-preview.7.*to stable8.0.0releasesImplementation Details
object _lock = new()field for synchronizationbuilder.Configurationwith null-coalescing operators to ensure required values are present at startuphttps://claude.ai/code/session_01PeKjLeL9dZx8eR2hVsqCzA