fix(housekeeping): protect room owner mutations

2026-06-20 07:26:18 +00:00 · 2026-06-14 22:17:47 +02:00
parent 93c4565660
commit ec24283e0f
7 changed files with 106 additions and 6 deletions
@@ -0,0 +1,47 @@
+package com.eu.habbo.messages.incoming.housekeeping;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class HousekeepingRoomGuardContractTest {
+    @Test
+    void destructiveRoomActionsRespectOwnerRankCeiling() throws Exception {
+        Path base = Path.of("src/main/java/com/eu/habbo/messages/incoming/housekeeping");
+
+        for (String handler : List.of(
+                "HousekeepingDeleteRoomEvent.java",
+                "HousekeepingKickAllFromRoomEvent.java",
+                "HousekeepingMuteRoomEvent.java",
+                "HousekeepingRoomStateEvent.java",
+                "HousekeepingTransferRoomOwnershipEvent.java"
+        )) {
+            String source = Files.readString(base.resolve(handler));
+
+            assertTrue(source.contains("HousekeepingRoomGuard.canManageRoom(this.client.getHabbo(), room)"),
+                    handler + " must reject room mutations when the room owner is peer-or-higher ranked");
+            assertTrue(source.contains("housekeeping.error.rank_too_high"),
+                    handler + " must surface a rank-ceiling error for protected room owners");
+        }
+    }
+
+    @Test
+    void roomGuardDelegatesToTargetRankGuard() throws Exception {
+        String source = Files.readString(Path.of("src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingRoomGuard.java"));
+
+        assertTrue(source.contains("HousekeepingTargetRankGuard.canTargetUser(operator, room.getOwnerId())"),
+                "room-owner checks must use the same core-rank peer override as user moderation");
+    }
+
+    @Test
+    void roomMuteRejectsNegativeDurations() throws Exception {
+        String source = Files.readString(Path.of("src/main/java/com/eu/habbo/messages/incoming/housekeeping/HousekeepingMuteRoomEvent.java"));
+
+        assertTrue(source.contains("minutes < 0"),
+                "room mute should reject negative duration values instead of treating them as unmute");
+    }
+}