《游戏服务端架构·品类、状态与拓扑》10.3 玩家创造内容的服务端信任模型

// file: internal/contenttrust/contenttrust.go
// tier: L1
// verify: go test ./internal/contenttrust/
package contenttrust

import (
	"errors"
	"fmt"
	"sync"
	"time"
)

var (
	ErrBadPolicy        = errors.New("contenttrust: incomplete or invalid policy")
	ErrPolicyUnsafe     = errors.New("contenttrust: policy grants an unsafe capability")
	ErrEmptyCreator     = errors.New("contenttrust: empty creator id")
	ErrUnknownCreator   = errors.New("contenttrust: unknown creator")
	ErrDuplicateCreator = errors.New("contenttrust: creator already registered")
)

// Tier is ordered from most to least trusted. A numeric comparison is only
// used for "at least verified"; capability checks always use the policy map.
type Tier int

const (
	TierOfficial Tier = iota
	TierVerified
	TierPlayer
)

func (t Tier) String() string {
	switch t {
	case TierOfficial:
		return "official"
	case TierVerified:
		return "verified"
	case TierPlayer:
		return "player"
	default:
		return "unknown"
	}
}

func (t Tier) valid() bool { return t >= TierOfficial && t <= TierPlayer }

type Capability string

const (
	CapWorldRead        Capability = "world.read"
	CapEventInteract    Capability = "event.interact"
	CapUIOverlay        Capability = "ui.overlay"
	CapWorldWriteGlobal Capability = "world.write.global"
	CapFileRead         Capability = "fs.read"
	CapNetOutbound      Capability = "net.outbound"
	CapProcessExec      Capability = "os.exec"
	CapEconomyGrant     Capability = "economy.grant"
)

// unsafeCapabilities can never appear in any tier. They describe host access,
// not content behaviour; a UGC script that needs them needs a platform change
// and a human review, not a bigger quota.
func unsafeCapability(c Capability) bool {
	switch c {
	case CapFileRead, CapNetOutbound, CapProcessExec, CapEconomyGrant:
		return true
	}
	return false
}

type ReviewMode int

const (
	ReviewAuto ReviewMode = iota
	ReviewSampled
	ReviewMandatory
)

type Policy struct {
	Tier             Tier
	MaxScriptBytes   int64
	MaxAssetBytes    int64
	MaxEntities      int
	MaxUploadsPerDay int
	MaxLiveMaps      int
	Review           ReviewMode
	Caps             map[Capability]bool
	AllowEconomy     bool
}

func (p Policy) validate() error {
	if !p.Tier.valid() {
		return fmt.Errorf("%w: tier %d", ErrBadPolicy, p.Tier)
	}
	if p.MaxScriptBytes <= 0 || p.MaxAssetBytes <= 0 || p.MaxEntities <= 0 ||
		p.MaxUploadsPerDay <= 0 || p.MaxLiveMaps <= 0 {
		return fmt.Errorf("%w: %s has non-positive quota", ErrBadPolicy, p.Tier)
	}
	if p.Review < ReviewAuto || p.Review > ReviewMandatory {
		return fmt.Errorf("%w: review mode %d", ErrBadPolicy, p.Review)
	}
	for cap := range p.Caps {
		if unsafeCapability(cap) {
			return fmt.Errorf("%w: %s grants %s", ErrPolicyUnsafe, p.Tier, cap)
		}
		if cap == CapWorldWriteGlobal && p.Tier != TierOfficial {
			return fmt.Errorf("%w: %s grants %s", ErrPolicyUnsafe, p.Tier, cap)
		}
	}
	return nil
}

type Action int

const (
	ActionUpload Action = iota
	ActionPublish
	ActionUseCapability
	ActionTrade
	ActionPayout
)

type Request struct {
	Action       Action
	ScriptBytes  int64
	AssetBytes   int64
	Entities     int
	UploadsToday int
	LiveMaps     int
	Cap          Capability
}

type Route int

const (
	RouteRuntime Route = iota
	RouteReview
	RouteLedger
	RouteDenied
)

type DenyCode int

const (
	DenyNone DenyCode = iota
	DenySuspended
	DenyQuota
	DenyCapability
	DenyEconomy
	DenyPayout
)

type Decision struct {
	Allowed bool
	Route   Route
	Review  ReviewMode
	Code    DenyCode
}

func deny(code DenyCode) Decision {
	return Decision{Route: RouteDenied, Code: code}
}

type Violation int

const (
	ViolationContentPolicy Violation = iota
	ViolationResourceBomb
	ViolationScriptEscape
	ViolationEconomyAbuse
)

func (v Violation) severity() int {
	switch v {
	case ViolationContentPolicy:
		return 20
	case ViolationResourceBomb:
		return 30
	case ViolationScriptEscape:
		return 40
	case ViolationEconomyAbuse:
		return 50
	}
	return 0
}

type Profile struct {
	Creator        string
	Tier           Tier
	Violations     int
	Score          int
	CleanSince     time.Time
	SuspendedUntil time.Time
	Published      int
}

type Outcome struct {
	Tier           Tier
	Demoted        bool
	SuspendedUntil time.Time
	Escalated      bool
}

type Registry struct {
	mu       sync.Mutex
	policies map[Tier]Policy
	now      func() time.Time
	profiles map[string]*Profile
}

func NewRegistry(policies []Policy, now func() time.Time) (*Registry, error) {
	if len(policies) != 3 {
		return nil, fmt.Errorf("%w: need all three tiers", ErrBadPolicy)
	}
	r := &Registry{policies: make(map[Tier]Policy, 3),
		profiles: make(map[string]*Profile)}
	for _, p := range policies {
		if err := p.validate(); err != nil {
			return nil, err
		}
		if _, ok := r.policies[p.Tier]; ok {
			return nil, fmt.Errorf("%w: duplicate tier %s", ErrBadPolicy, p.Tier)
		}
		r.policies[p.Tier] = p
	}
	if len(r.policies) != 3 {
		return nil, fmt.Errorf("%w: missing tier", ErrBadPolicy)
	}
	if now == nil {
		now = time.Now
	}
	r.now = now
	return r, nil
}

func (r *Registry) Register(creator string, tier Tier) (Profile, error) {
	if creator == "" {
		return Profile{}, ErrEmptyCreator
	}
	if !tier.valid() {
		return Profile{}, fmt.Errorf("%w: %d", ErrBadPolicy, tier)
	}
	r.mu.Lock()
	defer r.mu.Unlock()
	if _, ok := r.profiles[creator]; ok {
		return Profile{}, ErrDuplicateCreator
	}
	p := &Profile{Creator: creator, Tier: tier, CleanSince: r.now()}
	r.profiles[creator] = p
	return *p, nil
}

$ cd .local/checks/gsarch-lab
$ gofmt -l internal/contenttrust
$ go test -count=1 ./internal/contenttrust/
ok  	gsarchlab/internal/contenttrust	0.419s