Hide other players' letters and the bag from game payloads

[paskal]

Problem

Every GAME_UPDATED emit and the unauthenticated GET /game/:id returned the full Game row, which includes letters — every player's hand plus the pot (the bag contents and its exact draw order). Any player (or any anonymous visitor hitting GET /game/:id) could read opponents' tiles and the upcoming draw order straight from the payload, making the game trivially cheatable.

Fix

Added services/sanitizeGame.ts:

• sanitizeGame(game, userId) returns a plain object where letters contains only the recipient's own hand; the pot is replaced by an array of the same length filled with "" (the client only reads letters.pot.length); previousLetters/putLetters are included only for the player who made the turn currently on the board. Anonymous recipients (userId === null) get no hand.
• emitGameUpdated(server, gameId, game) iterates the game room and emits GAME_UPDATED sanitised per socket, using each socket's playerId.

Wired it into every place that previously broadcast or returned a raw game: the turn/approve/undo/change/start routes now call emitGameUpdated, GET /game/:id sanitises with an optionally-authenticated user id (new getRequestUserId helper, so logged-in players still get their hand while spectators get none), and the socket-login path in handlers.ts sanitises with the authenticated user's id.

Client compatibility: the client reads game.letters[user.id] for its own hand and game.letters.pot.length for the bag counter only, so the masked pot and per-recipient hand keep it working unchanged.

[Copilot]

Pull request overview

This PR prevents game-state payloads from leaking hidden information (other players’ hands and the exact bag/draw order) by sanitizing letters per recipient before sending GAME_UPDATED updates or serving GET /game/:id.

Changes:

• Added sanitizeGame(game, userId) to remove other players’ hands and mask letters.pot while preserving pot length.
• Added emitGameUpdated(server, gameId, game) to emit per-socket sanitized GAME_UPDATED messages in the game room.
• Updated game routes and socket login flow to use sanitized game payloads (including optional auth for GET /game/:id).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
services/sanitizeGame.ts	Introduces per-recipient game sanitization and per-socket GAME_UPDATED emission.
routers/game.ts	Switches game update broadcasts and GET /game/:id to send sanitized game payloads (with optional auth parsing).
handlers.ts	Sanitizes the initial game payload sent to a socket after successful login.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Ksinia]

why do we need this line?

[paskal]

It converts the Sequelize model instance into a plain object. We need that to safely spread it ({ ...json, letters, ... }) and read fields like json.letters / json.turnOrder: spreading a Sequelize instance directly doesn't expose the column values (they live behind getters / dataValues), so without toJSON() the rebuilt object would be missing the game data.

[Ksinia]

I still don't understand why we didn't need this before. Also, does it mean that this JSON object is any? Can we type it more strictly?

[paskal]

Why it wasn't needed before: previously we passed the raw Sequelize game instance straight into socket.emit/res.send, and the JSON serialization that socket.io/Express do calls the instance's toJSON() automatically on the way out - so the plain-object conversion always happened, just implicitly at send time. Now we rebuild the object server-side to mask the letters, so we need a plain, spreadable object up front, hence the explicit toJSON().

On typing: you're right, it was effectively any. Fixed in 428a3c2 - it's now cast to a GameJson interface where the fields we read (letters, turnOrder, turn, previousLetters, putLetters) are typed and a string index signature carries the rest of the game fields through the spread. sourceLetters is typed { [key: string]: string[] } too.

[Ksinia]

what's the difference between GameJson and Sequelize game type?

[paskal]

Agreed, and both done in d8b9661.

Difference between GameJson and the Sequelize Game type: Game is the model instance type - it carries the Sequelize machinery (update, save, toJSON, dataValues, association setters). game.toJSON() returns only the plain column values, no methods, so typing that result as Game would be a lie (you can't call .update() on it), and we rebuild it into a fresh plain object anyway.

Stricter: you're right that my hand-written interface was too loose - the [key: string]: unknown index signature meant any typo or unknown field passed silently. It's now derived from the model:

type GameJson = InferAttributes<Game>;
type GameLetters = GameJson["letters"];

InferAttributes (sequelize 6.37) gives exactly the model's data attributes and drops the methods, so there's a single source of truth and no index signature - json.somethingUnknown is now a compile error. letters uses the model's own type too, so the hand is keyed by the numeric user id like the model declares (same JSON on the wire).

Comment above the type removed.