Commit Graph

14 Commits

Author SHA1 Message Date
simoleo89 39c6e24097 fix(items): persist clothing grants before redeem
Redeeming clothing furniture now inserts the wardrobe grant before removing/deleting the voucher furniture. If the DB insert fails, the item remains in the room and the in-memory wardrobe is not updated.

Tests: mvn -Dtest=RedeemClothingContractTest test; mvn -DskipTests package
2026-06-14 20:51:19 +02:00
simoleo89 82c6f3f9ff fix(items): charge rentable space purchases
Deduct the computed rent cost when a user rents an InteractionRentableSpace. The previous flow only checked that the user had enough credits, then marked the space as rented without charging them, allowing free weekly rentals.

Honor ACC_INFINITE_CREDITS for staff accounts and add a contract test that keeps the charge before the rented state is assigned.
2026-06-13 18:24:16 +02:00
simoleo89 60ccc8c80b fix(items): require seed ownership for monsterplants
Reject monsterplant seed redemption when the caller does not own the placed seed. Without this guard, a user in the same room could trigger ToggleFloorItemEvent against another user's seed and have the server delete that item while creating the monsterplant pet for the attacker.

Add a contract test covering the ownership guard before createMonsterplant is reached.
2026-06-13 18:24:16 +02:00
simoleo89 19cde45d3e fix(marketplace): avoid inventory desync on failed offer insert
Expose whether a marketplace offer was persisted before mutating inventory state, refuse sells whose database insert failed, and synchronize the sold timestamp into the online seller's in-memory offer when present. This keeps failed or racing marketplace operations from desynchronizing credits/items.
2026-06-09 22:02:53 +02:00
simoleo89 5c0f2d2855 fix(session): separate forced disconnects from resume parking
Add a forced dispose path for bans, RCON disconnects, logout/account endpoints, plugin-cancelled login, duplicate login replacement, and late MAC-ban enforcement. Soft channel closes still park a session for reconnect, while security-driven closes now bypass session resume. Also null-guard client/channel disposal and cover the contract with focused tests.
2026-06-09 22:02:07 +02:00
simoleo89 bfc6ff21a5 feat: resolve furnidata by configured source 2026-06-07 22:00:20 +02:00
simoleo89 43c2c2b0f1 feat(furnidata): split-tier write to winning tier with path-traversal guard 2026-06-06 17:31:12 +02:00
simoleo89 a815c1b99d feat(furnidata): FurnidataWriter single-file comment-preserving atomic write + backup 2026-06-06 17:31:12 +02:00
simoleo89 7f4f7d6da9 feat(items): reindex returns sanitized furnidata delta 2026-06-06 17:31:11 +02:00
simoleo89 28c3e93945 fix(items): Locale.ROOT case-folding + document sanitize cap unit + tighten cap test 2026-06-06 17:31:11 +02:00
simoleo89 5bf1d42cfb feat(items): FurnitureTextProvider — volatile index, sanitize, toggle 2026-06-06 17:31:10 +02:00
simoleo89 b162b3f4d8 fix(items): guard oversized manifest NPE in FurnidataReader + document JSON5 trailing-comma limit 2026-06-06 17:31:10 +02:00
simoleo89 86498b6b4c feat(items): FurnidataReader (single + split JSON5, path-guard, size-cap, fail-safe) 2026-06-06 17:31:10 +02:00
simoleo89 f9644d83b7 test: add JUnit 5 + surefire harness 2026-06-06 17:31:10 +02:00