Per-user campaign storage and public campaign list

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/Cargo.lock

@@ -164,6 +164,7 @@ dependencies = [
  "serde",
  "serde_json",
  "tokio",
+ "tower",
 ]
 
 [[package]]

server/Cargo.toml

@@ -14,6 +14,9 @@ argon2 = "0.5"
 getrandom = "0.2"
 futures-util = "0.3.34"
 
+[dev-dependencies]
+tower = { version = "0.5", features = ["util"] }
+
 [profile.release]
 opt-level = 3
 lto = true

server/src/main.rs

@@ -18,8 +18,17 @@
 // POST   /api/saves?name=..     -> store a new savegame (body = savegame JSON)
 // PUT    /api/saves/{id}?name=  -> overwrite a savegame
 // DELETE /api/saves/{id}
+// GET    /api/campaigns                   -> own campaigns [{id, name, updated, published, size}] (newest first)
+// GET    /api/campaigns/{id}              -> campaign JSON (own)
+// POST   /api/campaigns?name=..           -> store a new campaign (body = campaign JSON) -> {id, ..}
+// PUT    /api/campaigns/{id}?name=..      -> overwrite an own campaign (keeps the published flag)
+// DELETE /api/campaigns/{id}
+// POST   /api/campaigns/{id}/publish      -> {published: true|false}
+// GET    /api/public/campaigns            -> published campaigns of all users [{owner, id, name, updated, size}]
+// GET    /api/public/campaigns/{owner}/{id} -> JSON of a published campaign (404 when not published)
 //
-// Limits: 1 MB per savegame, 500 MB in total, 30 write requests and 20 login attempts per minute.
+// Limits: 1 MB per savegame, 32 MB per campaign, 500 MB in total, 30 write requests and
+// 20 login attempts per minute.
 
 use argon2::Argon2;
 use axum::{
@@ -43,6 +52,7 @@ mod netplay;
 use netplay::Netplay;
 
 const MAX_SAVE: usize = 1024 * 1024;
+const MAX_CAMPAIGN: usize = 32 * 1024 * 1024;
 const MAX_TOTAL: u64 = 500 * 1024 * 1024;
 const WRITES_PER_MINUTE: usize = 30;
 const LOGINS_PER_MINUTE: usize = 20;
@@ -77,6 +87,32 @@ struct SaveInfo {
     time: f64,
 }
 
+// stored next to a campaign as <id>.meta
+#[derive(Serialize, Deserialize, Clone)]
+struct CampaignInfo {
+    id: String,
+    name: String,
+    updated: u64,
+    #[serde(default)]
+    published: bool,
+    #[serde(default)]
+    size: usize,
+}
+
+#[derive(Serialize)]
+struct PublicCampaignInfo {
+    owner: String,
+    id: String,
+    name: String,
+    updated: u64,
+    size: usize,
+}
+
+#[derive(Deserialize)]
+struct PublishRequest {
+    published: bool,
+}
+
 #[derive(Deserialize)]
 struct NameQuery {
     name: Option<String>,
@@ -132,9 +168,13 @@ fn valid_user(name: &str) -> bool {
 }
 
 fn clean_name(n: Option<String>) -> String {
+    clean_name_or(n, "Savegame")
+}
+
+fn clean_name_or(n: Option<String>, fallback: &str) -> String {
     let n: String = n.unwrap_or_default().chars().filter(|c| !c.is_control()).take(60).collect();
     if n.trim().is_empty() {
-        "Savegame".into()
+        fallback.into()
     } else {
         n.trim().to_string()
     }
@@ -160,6 +200,10 @@ impl AppState {
         self.dir.join("users").join(name)
     }
 
+    fn campaign_dir(&self, name: &str) -> PathBuf {
+        self.user_dir(name).join("campaigns")
+    }
+
     async fn store_users(&self) {
         let users = self.users.lock().await;
         let _ = tokio::fs::write(self.dir.join("users.json"), serde_json::to_vec_pretty(&*users).unwrap_or_default()).await;
@@ -366,6 +410,7 @@ async fn delete_user(State(st): State<AppState>, headers: HeaderMap, Path(name):
     st.sessions.lock().await.retain(|_, n| *n != name);
     st.store_users().await;
     st.store_sessions().await;
+    // savegames and campaigns (users/<name>/campaigns) of the user
     let _ = tokio::fs::remove_dir_all(st.user_dir(&name)).await;
     StatusCode::NO_CONTENT.into_response()
 }
@@ -449,8 +494,7 @@ async fn create(State(st): State<AppState>, headers: HeaderMap, Query(q): Query<
         Ok(u) => u,
         Err(r) => return r,
     };
-    let id = format!("{}-{:04x}", now(), (now_nanos() % 0xffff) as u16);
-    store(&st, &u, id, q.name, body).await
+    store(&st, &u, new_id(), q.name, body).await
 }
 
 async fn overwrite(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>, Query(q): Query<NameQuery>, body: Bytes) -> Response {
@@ -481,6 +525,177 @@ async fn delete_save(State(st): State<AppState>, headers: HeaderMap, Path(id): P
     StatusCode::NO_CONTENT.into_response()
 }
 
+// ---------------- campaigns (users/<name>/campaigns/<id>.json + <id>.meta)
+
+fn new_id() -> String {
+    format!("{}-{:04x}", now(), (now_nanos() % 0xffff) as u16)
+}
+
+async fn read_campaign_meta(dir: &std::path::Path, id: &str) -> Option<CampaignInfo> {
+    let b = tokio::fs::read(dir.join(format!("{}.meta", id))).await.ok()?;
+    serde_json::from_slice(&b).ok()
+}
+
+async fn campaign_infos(dir: &std::path::Path) -> Vec<CampaignInfo> {
+    let mut out: Vec<CampaignInfo> = Vec::new();
+    if let Ok(mut rd) = tokio::fs::read_dir(dir).await {
+        while let Ok(Some(e)) = rd.next_entry().await {
+            let p = e.path();
+            if p.extension().and_then(|x| x.to_str()) == Some("meta") {
+                if let Ok(b) = tokio::fs::read(&p).await {
+                    if let Ok(info) = serde_json::from_slice::<CampaignInfo>(&b) {
+                        out.push(info);
+                    }
+                }
+            }
+        }
+    }
+    out.sort_by(|a, b| b.updated.cmp(&a.updated));
+    out
+}
+
+async fn list_campaigns(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    Json(campaign_infos(&st.campaign_dir(&u.name)).await).into_response()
+}
+
+async fn get_campaign(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if !valid_id(&id) {
+        return err(StatusCode::BAD_REQUEST, "bad id");
+    }
+    match tokio::fs::read(st.campaign_dir(&u.name).join(format!("{}.json", id))).await {
+        Ok(b) => ([("content-type", "application/json")], b).into_response(),
+        Err(_) => err(StatusCode::NOT_FOUND, "not found"),
+    }
+}
+
+// overwriting keeps the published flag of the existing campaign (new ones start unpublished)
+async fn store_campaign(st: &AppState, user: &User, id: String, name: Option<String>, body: Bytes) -> Response {
+    if body.len() > MAX_CAMPAIGN {
+        return err(StatusCode::PAYLOAD_TOO_LARGE, "campaign too large");
+    }
+    if limited(&st.writes, WRITES_PER_MINUTE).await {
+        return err(StatusCode::TOO_MANY_REQUESTS, "too many requests");
+    }
+    if total_size(&st.dir).await + body.len() as u64 > MAX_TOTAL {
+        return err(StatusCode::INSUFFICIENT_STORAGE, "storage full");
+    }
+    // the campaign document itself is opaque; it only has to be a JSON object
+    match serde_json::from_slice::<serde_json::Value>(&body) {
+        Ok(v) if v.is_object() => {}
+        _ => return err(StatusCode::BAD_REQUEST, "not JSON"),
+    }
+    let dir = st.campaign_dir(&user.name);
+    let published = read_campaign_meta(&dir, &id).await.map(|m| m.published).unwrap_or(false);
+    let info = CampaignInfo { id: id.clone(), name: clean_name_or(name, "Campaign"), updated: now(), published, size: body.len() };
+    let _ = tokio::fs::create_dir_all(&dir).await;
+    let ok = tokio::fs::write(dir.join(format!("{}.json", id)), &body).await.is_ok()
+        && tokio::fs::write(dir.join(format!("{}.meta", id)), serde_json::to_vec(&info).unwrap_or_default()).await.is_ok();
+    if !ok {
+        return err(StatusCode::INTERNAL_SERVER_ERROR, "write failed");
+    }
+    Json(info).into_response()
+}
+
+async fn create_campaign(State(st): State<AppState>, headers: HeaderMap, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    store_campaign(&st, &u, new_id(), q.name, body).await
+}
+
+async fn overwrite_campaign(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>, Query(q): Query<NameQuery>, body: Bytes) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if !valid_id(&id) {
+        return err(StatusCode::BAD_REQUEST, "bad id");
+    }
+    store_campaign(&st, &u, id, q.name, body).await
+}
+
+async fn delete_campaign(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if !valid_id(&id) {
+        return err(StatusCode::BAD_REQUEST, "bad id");
+    }
+    if limited(&st.writes, WRITES_PER_MINUTE).await {
+        return err(StatusCode::TOO_MANY_REQUESTS, "too many requests");
+    }
+    let dir = st.campaign_dir(&u.name);
+    let _ = tokio::fs::remove_file(dir.join(format!("{}.json", id))).await;
+    let _ = tokio::fs::remove_file(dir.join(format!("{}.meta", id))).await;
+    StatusCode::NO_CONTENT.into_response()
+}
+
+async fn publish_campaign(State(st): State<AppState>, headers: HeaderMap, Path(id): Path<String>, Json(p): Json<PublishRequest>) -> Response {
+    let u = match st.auth(&headers).await {
+        Ok(u) => u,
+        Err(r) => return r,
+    };
+    if !valid_id(&id) {
+        return err(StatusCode::BAD_REQUEST, "bad id");
+    }
+    if limited(&st.writes, WRITES_PER_MINUTE).await {
+        return err(StatusCode::TOO_MANY_REQUESTS, "too many requests");
+    }
+    let dir = st.campaign_dir(&u.name);
+    let Some(mut info) = read_campaign_meta(&dir, &id).await else {
+        return err(StatusCode::NOT_FOUND, "not found");
+    };
+    info.published = p.published;
+    if tokio::fs::write(dir.join(format!("{}.meta", id)), serde_json::to_vec(&info).unwrap_or_default()).await.is_err() {
+        return err(StatusCode::INTERNAL_SERVER_ERROR, "write failed");
+    }
+    Json(info).into_response()
+}
+
+async fn list_public_campaigns(State(st): State<AppState>, headers: HeaderMap) -> Response {
+    if let Err(r) = st.auth(&headers).await {
+        return r;
+    }
+    let owners: Vec<String> = st.users.lock().await.iter().map(|u| u.name.clone()).collect();
+    let mut out: Vec<PublicCampaignInfo> = Vec::new();
+    for owner in owners {
+        for c in campaign_infos(&st.campaign_dir(&owner)).await {
+            if c.published {
+                out.push(PublicCampaignInfo { owner: owner.clone(), id: c.id, name: c.name, updated: c.updated, size: c.size });
+            }
+        }
+    }
+    out.sort_by(|a, b| b.updated.cmp(&a.updated));
+    Json(out).into_response()
+}
+
+async fn get_public_campaign(State(st): State<AppState>, headers: HeaderMap, Path((owner, id)): Path<(String, String)>) -> Response {
+    if let Err(r) = st.auth(&headers).await {
+        return r;
+    }
+    if !valid_user(&owner) || !valid_id(&id) {
+        return err(StatusCode::BAD_REQUEST, "bad id");
+    }
+    let dir = st.campaign_dir(&owner);
+    if !read_campaign_meta(&dir, &id).await.is_some_and(|m| m.published) {
+        return err(StatusCode::NOT_FOUND, "not found");
+    }
+    match tokio::fs::read(dir.join(format!("{}.json", id))).await {
+        Ok(b) => ([("content-type", "application/json")], b).into_response(),
+        Err(_) => err(StatusCode::NOT_FOUND, "not found"),
+    }
+}
+
 // Maintenance: "dungeoncraft-saves set-password <name> <password>" sets a user's password
 // (stop the service first or restart it afterwards; the user's sessions end).
 fn set_password_cli(dir: &std::path::Path, name: &str, password: &str) {
@@ -519,7 +734,17 @@ async fn main() {
         logins: Arc::new(Mutex::new(Vec::new())),
         netplay: Arc::new(Mutex::new(Netplay::new())),
     };
-    let app = Router::new()
+    let app = router(state);
+    let addr = std::env::var("LISTEN").unwrap_or_else(|_| "0.0.0.0:8080".into());
+    let listener = tokio::net::TcpListener::bind(&addr).await.expect("bind");
+    println!("DungeonCraft service on {}", addr);
+    axum::serve(listener, app).await.expect("server");
+}
+
+fn router(state: AppState) -> Router {
+    // campaigns embed map snapshots: their write routes get a larger body limit
+    let campaign_limit = || DefaultBodyLimit::max(MAX_CAMPAIGN + 1024);
+    Router::new()
         .route("/api/health", get(health))
         .route("/api/login", post(login))
         .route("/api/logout", post(logout))
@@ -531,10 +756,128 @@ async fn main() {
         .route("/api/netplay/ws", get(netplay::netplay_ws))
         .route("/api/saves", get(list).post(create))
         .route("/api/saves/{id}", get(get_save).put(overwrite).delete(delete_save))
+        .route("/api/campaigns", get(list_campaigns).post(create_campaign).layer(campaign_limit()))
+        .route("/api/campaigns/{id}", get(get_campaign).put(overwrite_campaign).delete(delete_campaign).layer(campaign_limit()))
+        .route("/api/campaigns/{id}/publish", post(publish_campaign))
+        .route("/api/public/campaigns", get(list_public_campaigns))
+        .route("/api/public/campaigns/{owner}/{id}", get(get_public_campaign))
         .layer(DefaultBodyLimit::max(MAX_SAVE + 1024))
-        .with_state(state);
-    let addr = std::env::var("LISTEN").unwrap_or_else(|_| "0.0.0.0:8080".into());
-    let listener = tokio::net::TcpListener::bind(&addr).await.expect("bind");
-    println!("DungeonCraft service on {}", addr);
-    axum::serve(listener, app).await.expect("server");
+        .with_state(state)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::body::Body;
+    use axum::http::Request;
+    use tower::ServiceExt;
+
+    fn test_state(tag: &str) -> AppState {
+        let dir = std::env::temp_dir().join(format!("dc-saves-test-{}-{}", tag, random_hex(6)));
+        std::fs::create_dir_all(dir.join("users")).unwrap();
+        let mk = |name: &str, admin: bool| User { name: name.into(), salt: String::new(), hash: String::new(), admin };
+        let users = vec![mk("boss", true), mk("alice", false), mk("bob", false)];
+        let sessions: HashMap<String, String> =
+            [("tboss", "boss"), ("talice", "alice"), ("tbob", "bob")].iter().map(|(t, n)| (t.to_string(), n.to_string())).collect();
+        AppState {
+            dir,
+            users: Arc::new(Mutex::new(users)),
+            sessions: Arc::new(Mutex::new(sessions)),
+            writes: Arc::new(Mutex::new(Vec::new())),
+            logins: Arc::new(Mutex::new(Vec::new())),
+            netplay: Arc::new(Mutex::new(Netplay::new())),
+        }
+    }
+
+    async fn call(st: &AppState, method: &str, uri: &str, token: &str, body: Vec<u8>) -> (StatusCode, Vec<u8>) {
+        let req = Request::builder()
+            .method(method)
+            .uri(uri)
+            .header("authorization", format!("Bearer {}", token))
+            .header("content-type", "application/json")
+            .body(Body::from(body))
+            .unwrap();
+        let res = router(st.clone()).oneshot(req).await.unwrap();
+        let status = res.status();
+        let b = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap();
+        (status, b.to_vec())
+    }
+
+    fn json(b: &[u8]) -> serde_json::Value {
+        serde_json::from_slice(b).unwrap()
+    }
+
+    #[tokio::test]
+    async fn campaigns_store_publish_and_share() {
+        let st = test_state("camp");
+        // a few MB: more than the savegame limit
+        let big = format!("{{\"format\":\"dungeoncraft-campaign\",\"pad\":\"{}\"}}", "x".repeat(3 * 1024 * 1024));
+        let (s, b) = call(&st, "POST", "/api/campaigns?name=My%20Camp", "talice", big.clone().into_bytes()).await;
+        assert_eq!(s, StatusCode::OK);
+        let id = json(&b)["id"].as_str().unwrap().to_string();
+
+        // not JSON / no login
+        assert_eq!(call(&st, "POST", "/api/campaigns", "talice", b"nope".to_vec()).await.0, StatusCode::BAD_REQUEST);
+        assert_eq!(call(&st, "GET", "/api/campaigns", "wrong", vec![]).await.0, StatusCode::UNAUTHORIZED);
+
+        let (s, b) = call(&st, "GET", "/api/campaigns", "talice", vec![]).await;
+        assert_eq!(s, StatusCode::OK);
+        let l = json(&b);
+        assert_eq!(l[0]["name"], "My Camp");
+        assert_eq!(l[0]["published"], false);
+        let (s, b) = call(&st, "GET", &format!("/api/campaigns/{}", id), "talice", vec![]).await;
+        assert_eq!(s, StatusCode::OK);
+        assert_eq!(b, big.as_bytes());
+        // other users do not see it, not even by id
+        assert_eq!(json(&call(&st, "GET", "/api/campaigns", "tbob", vec![]).await.1).as_array().unwrap().len(), 0);
+        assert_eq!(call(&st, "GET", &format!("/api/campaigns/{}", id), "tbob", vec![]).await.0, StatusCode::NOT_FOUND);
+        let public = format!("/api/public/campaigns/alice/{}", id);
+        assert_eq!(call(&st, "GET", &public, "tbob", vec![]).await.0, StatusCode::NOT_FOUND);
+
+        // publish: listed and readable for everybody logged in
+        let (s, _) = call(&st, "POST", &format!("/api/campaigns/{}/publish", id), "talice", br#"{"published":true}"#.to_vec()).await;
+        assert_eq!(s, StatusCode::OK);
+        let l = json(&call(&st, "GET", "/api/public/campaigns", "tbob", vec![]).await.1);
+        assert_eq!(l.as_array().unwrap().len(), 1);
+        assert_eq!(l[0]["owner"], "alice");
+        assert_eq!(l[0]["id"], id.as_str());
+        let (s, b) = call(&st, "GET", &public, "tbob", vec![]).await;
+        assert_eq!(s, StatusCode::OK);
+        assert_eq!(b.len(), big.len());
+        assert_eq!(call(&st, "GET", "/api/public/campaigns", "", vec![]).await.0, StatusCode::UNAUTHORIZED);
+
+        // overwrite keeps the published flag and renames
+        let (s, b) = call(&st, "PUT", &format!("/api/campaigns/{}?name=Renamed", id), "talice", b"{\"v\":2}".to_vec()).await;
+        assert_eq!(s, StatusCode::OK);
+        assert_eq!(json(&b)["published"], true);
+        assert_eq!(json(&b)["name"], "Renamed");
+
+        // unpublish
+        call(&st, "POST", &format!("/api/campaigns/{}/publish", id), "talice", br#"{"published":false}"#.to_vec()).await;
+        assert_eq!(call(&st, "GET", &public, "tbob", vec![]).await.0, StatusCode::NOT_FOUND);
+        assert_eq!(json(&call(&st, "GET", "/api/public/campaigns", "tbob", vec![]).await.1).as_array().unwrap().len(), 0);
+
+        // savegames keep their small limit
+        let (s, _) = call(&st, "POST", "/api/saves", "talice", big.into_bytes()).await;
+        assert_eq!(s, StatusCode::PAYLOAD_TOO_LARGE);
+
+        // delete
+        assert_eq!(call(&st, "DELETE", &format!("/api/campaigns/{}", id), "talice", vec![]).await.0, StatusCode::NO_CONTENT);
+        assert_eq!(call(&st, "GET", &format!("/api/campaigns/{}", id), "talice", vec![]).await.0, StatusCode::NOT_FOUND);
+        let _ = std::fs::remove_dir_all(&st.dir);
+    }
+
+    #[tokio::test]
+    async fn deleting_a_user_deletes_the_campaigns() {
+        let st = test_state("deluser");
+        let (s, b) = call(&st, "POST", "/api/campaigns?name=C", "tbob", b"{}".to_vec()).await;
+        assert_eq!(s, StatusCode::OK);
+        let id = json(&b)["id"].as_str().unwrap().to_string();
+        call(&st, "POST", &format!("/api/campaigns/{}/publish", id), "tbob", br#"{"published":true}"#.to_vec()).await;
+        assert!(st.campaign_dir("bob").join(format!("{}.json", id)).exists());
+        assert_eq!(call(&st, "DELETE", "/api/users/bob", "tboss", vec![]).await.0, StatusCode::NO_CONTENT);
+        assert!(!st.campaign_dir("bob").exists());
+        assert_eq!(json(&call(&st, "GET", "/api/public/campaigns", "talice", vec![]).await.1).as_array().unwrap().len(), 0);
+        let _ = std::fs::remove_dir_all(&st.dir);
+    }
 }