security
Input validation, rate limits and the guarded client-data channel from
Architecture › Rule 4. Source
in libs/security/.
Types
| Type | Role |
|---|---|
Validate | range(...) for int/long/double (NaN refused), text(value, max, pattern, what), playerName, type, state(condition, message). Each throws ValidationException with a message fit to show the player |
RateLimiter | Per-player token bucket: tryAcquire(uuid), refusals(uuid) for logging repeated hits as security events, retryAfter, forget on quit |
GuardedChannel | The only way a STANDARD module may read custom client data. open(ctx, "ns:name", perSecond, handler) refuses CRITICAL modules; accept(player, bytes) enforces a 1 KiB size cap and the rate limit |
:::caution GuardedChannel is a stub in Phase 0 Nothing feeds it yet — no plugin-message or custom-click listener is registered on the server. The wiring arrives with the first STANDARD consumer (the HUD, Tier 2). The API is in place so that consumer can't take a shortcut. :::
Audit-log helpers live in the log library
(ctx.log().audit(...)), not here.