Repository navigation
Web/API server - #2
Merged
Merged
Conversation
uses fastify, right now it's just an API and nothing more. has a websocket server too, and makes it easy to add new APIs and API versions as well as websocket message types. also has optional sentry for error handling and drizzle + any postgresql compatible database for production
since it has yet to be a part of the source code, most people who serve on rojo will get an error
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an API server using Fastify (no real web frontend) as well as a WebSocket server. It also supports a database with Drizzle ORM using a PostgreSQL-compatible database and Sentry for error logging. There is also a simple but modular architecture in order to easily add a new API or WebSocket message type(?).
Why
This is mainly for cross-game session state, which will come sometime. I had tried an alternative (documented here) using
TeleportData, but theReturn to "{place}"button in the Roblox client (which is the most seamless/UX-friendly way of going back to Spawnpad) doesn't yet return the previous data.Changes
Problems that won't be addressed/known problems
Pretty much anyone who knows just a little about the API can edit someone else's session. All you really need to know is their user ID and then it's 2 requests from there. I don't really know what I can do to prevent this, especially when you have an open-source system like this, that doesn't require Roblox Open Cloud OAuth.
Tested (manually)
/api/v1/auth/robloxwith a user ID works and returns a valid token, database also registers that tokenWhat's next
Automatically expire tokens over their expiration time as well as closing previous clients using that token(793e2b6)Add a max token limit per-user (most likely 3)(6db6043)