* [Server] Instrument command processing, game starts, and event loops
Add a lock-free MetricsRegistry that accumulates per-command processing
times in preallocated histogram slots (one per protobuf command type,
bucketed at 1/5/10/25/50/100/250/500/1000/2500/5000 ms +Inf). The
hot-path observeCommand() uses only relaxed atomic adds — no locks,
no allocations, no cache-line ping-pong beyond the unavoidable counter
updates.
Wire the registry into AbstractServerSocketInterface::processCommandContainer()
so every processed command is attributed with its container's wall-clock
time. When a container exceeds metrics/slow_command_ms (default 500),
a warning is logged including the connected username.
Add an EventLoopWatchdog heartbeat that runs on every socket pool thread.
If a heartbeat overshoots metrics/stall_warn_ms (default 2000 ms), the
overshoot is recorded in atomic counters and a warning is logged. Both
thresholds are configurable in servatrice.ini; setting stall_warn_ms to 0
disables the watchdogs entirely.
Track game-start durations via a separate histogram in MetricsRegistry.
Server_Game::startGameNow() measures the time from zone creation through
player materialization and reports it via Server::observeGameStartDurationMs().
Add a live card-count gauge: Server_Game exposes getCardsInGame() and
Servatrice::getCardsInGamesTotal() sums across all running games under
the appropriate read locks.
Include a standalone metrics_registry_test (Google Test) that validates
empty registries, single/multi-sample histograms, kind encoding,
overflow-slot collapse, negative-duration clamping, gauge rendering,
and the game-start histogram separation.
Took 10 minutes
* [Client/Server/Protocol] Surface live metrics in the Developer tab
Extend Response_GetServerStats with live counters from the in-process
MetricsRegistry: cards in games, event loop stall totals/worst,
total commands processed, average command time, active command types,
and game-start count/duration. Add a repeated CommandStats message
carrying per-command breakdowns (kind, extension number, resolved
protobuf name, count, total ms) for every type that has seen at
least one sample.
Server-side cmdGetServerStats() populates all new fields after the
existing DB uptime snapshot query, resolving protobuf extension names
via the descriptor pool for human-readable labels like
session/Command_Ping.
Expand TabDeveloper with two tables: an overview section (existing
DB stats plus the new live metrics) and a per-command breakdown table
(Command / Count / Total ms / Avg ms) sorted by total_ms descending
so the hottest commands surface first.
Took 55 minutes
Took 47 seconds
* [Server] Drop dead Prometheus histogram, add developer command metrics, fix watchdog init order
- metrics_registry: remove toPrometheusText/appendCumulativeBuckets and the time-bucket histogram that nothing in production ever emitted (the future /metrics exporter can bring it back); keep counts/totals read by the Developer tab
- Fix +Inf bucket routing that never incremented, and its test that locked the bug in
- Instrument developer_command container (kind 6) in processCommandContainer and stats label resolution
- Read metrics/{slow_command_ms,stall_warn_ms} at the top of initServer() so stall_warn_ms=0 disables the watchdogs before pool threads start
- Shrink KindStride to 1280 (largest extension in use is 1206) with a static_assert; document scrape cost of getCardsInGamesTotal; note slow_command logging has no rate limit in servatrice.ini.example
* [Tests] Give metrics_registry_test an explicit main
* [Server] Record only the dispatched command family; drop unused totals
processCommandContainer recorded every family in a container even though
the base if/else-if dispatch processes at most one. An unauthenticated
client could batch a session command (login) with fabricated developer,
moderator, and admin entries and forge genuine-looking samples that were
never executed or authorized. Mirror the base's selection, skip when the
handler was already deleted, and skip entries whose extension number is
-1 (which would otherwise wrap into the previous kind's id range).
[Server] Drop dead process-lifetime byte/uptime counters
txBytesTotal/rxBytesTotal added an atomic RMW to every socket write and
read for counters nothing consumes (cmdGetServerStats fills tx_bytes,
rx_bytes, and uptime_secs from the DB snapshot). Remove the two atomics
and the getTxBytesTotal/getRxBytesTotal/getUptimeSeconds getters; the
incTxBytes/incRxBytes slots and mutexes remain for the ISL legacy
counters.
[Protocol] Document kind 5 as developer in CommandStats
NumKinds is 6 and the server emits kind_index = 5 for developer
commands; the comment stopped at 4.
* [Client] Togglable auto-refresh for Developer stats tab
* [Oracle] Fix clang-format alignment of card type priority list
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Server/Client/Protocol] Add developer staff role
Introduce a Developer staff level (proto flag 32, DB admin bit 8) that
sits between admin and moderator: no kick/ban/warn/report/admin powers,
but gets server log access via a new developer command container family
(GET_SERVER_STATS, VIEWLOG_HISTORY) and an idle-timeout exemption.
- Protocol: IsDeveloper flag, developer_commands.proto envelope,
Command_GetServerStats/Command_GetLogHistory, Response_GetServerStats,
Command_AdjustMod.should_be_developer
- Servatrice: fail-closed developer dispatcher, uptime snapshot handler,
shared log history handler reuse, bit-8 DB mapping
- Client: burgundy pawn/badge/labels/sort order, prepareDeveloperCommand,
minimal Developer stats tab, log tab access, promote/demote actions
Took 24 minutes
Took 18 seconds
* [Server/Client/Protocol] Address developer role review feedback
Address ZeizaZach's review of the developer staff role:
- Nudge the developer log query to exclude private chat and sender IPs
(the ModeratorCommand path still sees everything).
- Deduplicate Command_GetLogHistory into Command_ViewLogHistory, which now
extends both ModeratorCommand (ext) and DeveloperCommand (dev_ext); the
client picks the DeveloperCommand-scoped extension by extendee, and the
server reads it via the extension number.
- Pull the uptime snapshot SQL into Servatrice_DatabaseInterface as
getLatestUptimeSnapshot() and widen the reported counters to 64-bit.
- Document the admin bitfield (1 admin, 2 moderator, 4 judge, 8 developer)
and add a server-side test for the developer command path.
* Add missing trailing newline to user_context_menu.cpp
* Remove stale includes of deleted command_get_log_history proto
The Command_GetLogHistory message was folded into Command_ViewLogHistory,
which deleted command_get_log_history.proto, but serversocketinterface
still #included its generated header. Fresh CI builds fail on the missing
file; local builds masked it by reusing a previously generated header.
* [Server] Exclude chat rows when private-chat filter is bypassable
A developer who omits log_location entirely — or sends only "chat" —
leaves chatType, gameType, roomType all false, so getMessageLogHistory
skips the target_type clause and returns every row, private messages
included. When !allowPrivateChat the server now forces game+room when
no surviving location was requested, guaranteeing the query always
carries a target_type restriction.
[Client] Demote mod+dev to moderator path in log-tab dispatch
The developer command family is strictly weaker than the moderator one
(no private chat, no sender_ip, ip filter ignored), so granting the
developer bit to an existing moderator must not silently strip their
capabilities. useDeveloperCommands is now true only when the user holds
the developer bit and not the moderator bit.
[Client] Hide the IP-address filter for developer log tab users
The developer path ignores the ip_address query field server-side.
Showing the field lets a developer type an IP and get results that are
silently unfiltered by it rather than an empty result set — reads as a
broken filter. Hide labelFindIPAddress/findIPAddress alongside the
privateChat checkbox.
* Developer pawn is silver.
* [Client] Fix indentation of merged Card Art Rules / Developer tabs
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Server/Client/Protocol] Reporting users + moderation queue functionality
Took 6 minutes
Took 3 minutes
Took 8 seconds
Took 11 minutes
Took 12 minutes
Took 7 minutes
Took 15 seconds
Took 2 minutes
Took 1 minute
Took 30 seconds
Took 16 seconds
* CI Fix
Took 6 minutes
* CI Fix
Took 6 minutes
* [Protocol] Add moderation investigation commands
Adds the protocol layer for the moderation investigation suite:
- Command_GetUserSessions/GetUserAlts/GetModeratorLastLogins/ResetUserPassword/RemoveUserAvatar (1013-1017)
- Response extensions 1215-1219 with ServerInfo messages for sessions, alts, and staff logins
- last_login on Response_ReportUserInfo and warning_il on Response_WarnList
Took 2 minutes
* [Utility] Add warning categories parser with infraction levels
Parses the server's 'officialwarnings' setting (comma-separated, optional
'|IL' suffix) into WarningCategory structs so the client can display the
infraction level of each warning category. Includes GTest coverage.
* [Server] Add moderation investigation tools
Implements the server side of the moderation suite:
- getUserSessions/getUserAlts/getModeratorLastLogins/removeUserAvatar DB methods
- Handlers for all five new commands with audit records (PASSWORD_RESET,
REMOVE_USER_AVATAR); password resets return a generated temporary password
- cmdGetWarnList now reports per-category infraction levels from the
officialwarnings setting; cmdReportUserInfo reports last_login
- Update servatrice.ini.example with the warning taxonomy
- Password/avatar mutations report RespNameNotFound when the user does not exist
* [Client] Add moderation tab with investigate, password reset, and avatar removal
- New Moderation tab: search a user to show account info, alternate
accounts, login sessions, and staff last logins; actions to reset the
user's password (shows the generated temporary password) and remove the
user's avatar
- 'Investigate user' entry in the user context menu opens the tab pre-loaded
for that user
- Warning dialog shows the infraction level of each warning category
- Tab wired into TabSupervisor with a moderator-gated menu action, shortcut,
and tabs.ini persistence (default closed)
* [Server/Client/Protocol] Address PR #7091 review: security, bug, and perf fixes
Security:
- Promote RESET_USER_PASSWORD to admin-only dispatch (was moderator-accessible)
- Reject password reset on users with equal/higher privilege than caller
- Notify affected user via Event_NotifyUser::CUSTOM when password is reset
- Add server-side category whitelist for reports
- Drop reporter name fallback in comment/details authorization (ID-only)
- Force password change: new DB column + login enforcement + client disconnect
Bugs:
- XSS via QTextEdit::append() → insertPlainText() in report tab and utils
- allNotified initialized to true even with empty recipients list
- Warning combo box: use currentData() instead of baked-in display text
- Report resolution now records who resolved (resolved_by column + audit)
Performance:
- IP-correlation subquery: add 6-month window + LIMIT 200
- getUserSessions: clamp limit to 500
Non-blocking:
- Palette-aware colors in report_utils.cpp (dark/light mode)
- Report list pagination: offset/limit fields + total_count in response
- SessionCommand enum gap comment for reserved values 1201-1203
Schema: 36→37 (force_password_change), 37→38 (resolved_by)
Took 12 minutes
Took 16 seconds
* Fix macOs pedantry
Took 5 minutes
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* [Room] Additionally show a tab for friends and ignored users instead of just all online users.
Took 21 minutes
Took 12 minutes
* [Room][UserList] Introduce style delegate for user list
- Allow users to set a card name and parameters as their background banner
- Allow mods to white/blacklist cards
- Allow toggling back to the old display style
Took 7 minutes
Took 28 seconds
Took 2 minutes
Took 2 minutes
* Right checkstate.
Took 14 minutes
Took 2 minutes
* Utility for test.
Took 9 minutes
Took 8 seconds
Took 2 seconds
* Lint.
Took 10 minutes
* Algorithm for sql schema migration
Took 13 minutes
* Use {prefix}, bound card name, return errors.
Took 27 seconds
* Convert queue to while loop.
Took 19 seconds
* Hover popup.
Took 36 minutes
Took 1 minute
* More granular signals, popup for user info.
Took 25 minutes
Took 8 seconds
Took 16 minutes
---------
Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
* update format.sh
add shellcheck to format.sh
add statement macros to .clang-format
add no clang format to format.sh
add changed file list to format.sh diff
rename --cf-version to --print-version in format.sh
lint files
* enable --shell on ci runs
* remove useless semicolons
removes the semicolons after empty function definitions
these semicolons are optional, they don't do anything
this will have functions be consistently formatted
if we want to keep the option to have these on the same line like they
were before we should use the option AllowShortFunctionsOnASingleLine: None
* fix script
* update echo line in lint_cpp.sh which doesn't lint cpp only at all
* move common server files
* update includes with move
* create participant, move code
* fix linker errors
* fix regressions
* mark function as override to make clang happy
* split out spectator to new file
* forgot to add to cmakelists
* autocompleter picking wrong casing for var name
* clean up forwards declarations in player
* fix includes in game
* new protos
* implement commands on server
* add buttons
* icons
* run formatter
* Message on get replay code failure
* Add new commands to switch statement
* Better failure messages
* Fix permission check query
* Change hash method
* Prevent adding duplicate replays
* Clean up TabReplay ui
* Copy over replay name
* base64 encode the hash
* Shorten hash
* Better failure messages
* change icon back to search icon
* check hash before checking if user already has access
* update share icon
* Update label text
Add lock around deleting arrows for commanding cards
Add support for Qt6 w/ Backwards Qt5
Handle Qt5/6 cross compilation better
Last cleanups
caps matter
Fix serv
Prevent crash on 6.3.0 Linux & bump to 5.8 min
Prevent out of bounds indexing
Delete shutdown timer if it exists
Fixup ticket comments, remove unneeded guards
Try to add support for missing OSes
Update .ci/release_template.md
Update PR based on comments
Update XML name after done and remove Hirsute
Address local game crash
Address comments from PR (again)
Tests don't work on mac, will see if a problem on other OSes
make soundengine more consistent across qt versions
disable tests on distros that are covered by others
Fix Oracle Crash due to bad memory access
Update Oracle to use new Qt6 way of adding translations
Add support for Qt5/Qt6 compiling of Cockatrice
Remove unneeded calls to QtMath/cmath/math.h
Update how we handle bitwise comparisons for enums with Tray Icon
Change header guards to not duplicate function
Leave comment & Fix Path for GHA Qt
Update common/server.h
Update cockatrice/src/window_main.cpp
Rollback change on cmake module path for NSIS
check docker image requirements
add size limit to ccache
put variables in quotes
properly set build type on mac
avoid names used in cmake
fix up cmake module path
cmake 3.10 does not recognize prepend
Support Tests in FindQtRuntime
set ccache size on non debug builds as well
immediately return when removing non existing client
handle incTxBytes with a signal instead
don't set common link libraries in cockatrice/CMakeLists.txt
add comments
set macos qt version to 6
Try upgrading XCode versions to latest they can be supported on
Ensure Qt gets linked
add tmate so i can see what's going on
Qt6 points two directories further down than Qt5 with regard to the top lib path, so we need to account for this
Establish Plugins directory for Qt6
Establish TLS plugins for Qt6 services
Minor change for release channel network manager
Let windows build in parallel cores
Wrong symbols
Qt6 patch up for signal
add missing qt6 package on deb builds
boolean expressions are hard
negative indexes should go to the end
Intentionally fail cache
move size checks to individual zone types
Hardcode libs needed for building on Windows, as the regex was annoying
Update wording
use the --parallel option in all builds
clean up the .ci scripts some more
tweak fedora build
add os parameter to compile.sh
I don't really like this but it seems the easiest way
I'd prefer if these types of quirks would live in the main configuration
file, the yml
fixup yml
readd appended cache key to vcpkg step
fix windows 32 quirk
the json hash is already added to the key as well
remove os parameter and clean up ci files
set name_build.sh to output relative paths
set backwards compatible version of xcode and qt on mac
set QTDIR for mac builds on qt5
has no effect for qt6
export BUILD_DIR to name_build.sh
merge mac build steps
merge homebrew steps, set package suffix
link qt5
remove brew link
set qtdir to qt5 only
compile.sh vars need to be empty not 0
fix sets manager search bar on qt 5.12/15
fix oracle subprocess errors being ignored on qt 5
clean up translation loading
move en@source translation file so it will not get included in packages
NOTE: this needs to be done at transifex as well!
Use generator platform over osname
Short circuit if not Win defined
* implement max lengths for input dialogs that are sent to the server
* missed a double setMaxLength
* implement max string lengths server side
* add custom getText dialog with max length
* fix deck storage tab and miscellaneous server side
* add max size for deck uploads
* final pass on client side limits
* Support getting a user's password salt via initial websocket connection (added to Event_ServerIdentification)
* Nonsense stuff to figure out later
* move passwordhasher to correct location
* protobuf changes
* add ext to protobuf
* implement request password salt server side
* add supportspasswordhash to server identification
* check backwards compatibility
* reset some changes to master
* implement get password salt client side
* implement checking hashed passwords on server login
* check for registration requirement on getting password salt
* properly check password salt response and show errors
* remove unused property
* add password salt to list of response types
Co-authored-by: ZeldaZach <zahalpern+github@gmail.com>
* add option to delete a user's messages
add optional parameter remove_messages to the ban and warn commands
add event for clients to redact messages
implement server side command and message handling
implement server history removal
todo: client side implementation
add option to remove messages to moderator action dialogs
add storage of message beginnings to chatview
add redactMessage command
handle Event_RemoveMessages on rooms
this approach is favored over parsing the chatroom after the fact but
will use additional memory to store the block indexes
this also leaves a problem in that user messages from the chat backlog
are not removed in the same way because they don't have a user
associated with them
add workaround for old qt versions
add action for users to remove messages from users in chats
add chat history to userMessagePositions with regex
proper const usage for userName
allow removing the messages of unregistered users
add menus to usernames in chat history
this allows you to remove user messages on chat history as well
this also allows moderators to take actions on users in chat history
Apply suggestions from code review
* readd missing call to handler
* Support registration domain whitelist (registration/emailproviderwhitelist) that, if set, will require a user to have an email with one of the specified domain providers. Will require client updates to see the Whitelist message, otherwise they'll be greeted with a default alert.
This also works to remove the pain of Google Email addresses and their infinite combination of usernames for the same account (i.e. remove periods and everything after the first plus sign).
* Make blacklist response show custom dialog
* Some improvements to Servatice network code
1. fix crash on fuzzy connection (tcp server only)
2. ensure websockets are parent()ed to avoid leaking them
3. quick catch disconnect()ed sockets instead of waiting for a socket error to happen
4. supporto mulltiple connection pools on the websocket server; they are still bound to the same thread due to a qt5 limitation.
* Added few unsigned to ints in order to get rid of warnings.
Added column to users table, for when password is changed(issue#3015).
Moved password length check to separate method, to make it cleaner.
* Added migration file and changed schema version to 27 due to servatrice.sql schema modification.
* Make password length configurable.
