|
1 | | -# What Claude 3 Sonnet Would Say |
2 | | - |
3 | | -Will correct over time. Don't take Claude's words as fact yet. |
4 | | - |
5 | | -### `./endpoints/load_assets.py` |
6 | | - |
7 | | -This script is responsible for handling requests to load assets (e.g., images, audio, or other media files) from the server. It takes input in the form of HTTP requests, which specify the asset(s) that need to be loaded. The script achieves its purpose by utilizing the `game.assets` module from the application's core functionality. It first extracts the asset identifier(s) from the incoming HTTP request, then passes this information to the `game.assets` module for loading the requested asset(s). The `game.assets` module likely contains functions or methods that can retrieve and load the specified assets from a local cache or an online source. After loading the asset(s), the script generates an appropriate HTTP response containing the asset data and sends it back to the client. |
8 | | - |
9 | | -### `./endpoints/setup_player.py` |
10 | | - |
11 | | -This script is responsible for handling requests to set up or configure the application in "player" mode. It does not take any direct input and does not produce any output. The script achieves its purpose by importing and executing specific functions or classes from other modules or packages within the application's core functionality. Without seeing the actual code, it is difficult to provide more details about the logic or data transformations happening within this script. |
12 | | - |
13 | | -### `./endpoints/setup_rcc.py` |
14 | | - |
15 | | -This script is responsible for handling requests to set up or configure the application's RCC (Roblox Client Communicator) component. It does not take any direct input and does not produce any output. The script achieves its purpose by importing and executing specific functions or classes from other modules or packages within the application's core functionality. Without seeing the actual code, it is difficult to provide more details about the logic or data transformations happening within this script. |
16 | | - |
17 | | -### `./endpoints/text_filter.py` |
18 | | - |
19 | | -This script is responsible for handling requests to filter or sanitize text data. It takes input in the form of HTTP requests, which contain the text data that needs to be filtered or sanitized. The script achieves its purpose by utilizing the `text_filter` module from the application's core functionality. It first extracts the text data from the incoming HTTP request, then passes this data to the `text_filter` module for processing. The `text_filter` module likely contains functions or methods that can filter or sanitize the text data by removing or replacing inappropriate or sensitive content. After processing the text data, the script generates an appropriate HTTP response containing the filtered or sanitized text and sends it back to the client. |
20 | | - |
21 | | -### `./endpoints/_main.py` |
22 | | - |
23 | | -This script likely serves as the main entry point for the web server's endpoints functionality. It does not take any direct input and does not produce any output. The script achieves its purpose by importing and executing specific functions or classes from other modules or packages within the `endpoints` package. It likely sets up the necessary routing or mapping between different HTTP request paths and the corresponding endpoint scripts (e.g., `data_transfer.py`, `load_assets.py`, `setup_player.py`, etc.). Without seeing the actual code, it is difficult to provide more details about the logic or data transformations happening within this script. |
24 | | - |
25 | | -### `./_logic.py` |
26 | | - |
27 | | -This script likely contains shared logic or utility functions used by other scripts within the `web_server` package. Without seeing the actual code, it is difficult to provide specific details about its purpose, inputs, outputs, or logic flows. |
28 | | - |
29 | | -### `./_main.py` |
30 | | - |
31 | | -This script is likely the main entry point for the web server component of the application. It takes input in the form of command line arguments or configuration settings, which specify the server's listening address, port, and other relevant options. The script achieves its purpose by utilizing a web server framework or library (e.g., Flask, Django, FastAPI) and importing the necessary endpoint scripts from the `endpoints` package. It sets up the web server with the specified configuration, maps the endpoint scripts to their respective URL paths, and starts the server to listen for incoming HTTP requests. When a request is received, the server routes the request to the appropriate endpoint script for processing and generates the corresponding response, which is then sent back to the client. |
| 1 | +# Web Server (`web_server/`) |
| 2 | + |
| 3 | +#### Note: This README file has been generated using Deepseek v4. Certain explanations might be wrong. Will correct over time. |
| 4 | + |
| 5 | +The web server module provides an HTTP(S) server that emulates Rōblox web APIs, allowing the RFD client and RCC (Rōblox Cloud Compute) to function without connecting to Rōblox's official servers. |
| 6 | + |
| 7 | +## Architecture |
| 8 | + |
| 9 | +``` |
| 10 | +web_server/ |
| 11 | +├── __init__.py # Package entry; exposes make_server() |
| 12 | +├── _logic.py # Core server, handler, and routing infrastructure |
| 13 | +├── endpoints/ |
| 14 | +│ ├── __init__.py # Imports all endpoints; serves root "/" |
| 15 | +│ ├── assets.py # Asset and thumbnail delivery |
| 16 | +│ ├── avatar.py # Character appearance data |
| 17 | +│ ├── badges.py # Badge awarding and checking |
| 18 | +│ ├── data_transfer.py # RCC ↔ server data exchange |
| 19 | +│ ├── funds.py # Player currency balance |
| 20 | +│ ├── groups.py # Group rank retrieval |
| 21 | +│ ├── join_data.py # Player join/registration flow |
| 22 | +│ ├── marketplace.py # Gamepass and developer product purchases |
| 23 | +│ ├── persistence.py # DataStore (set, get, increment, sorted) |
| 24 | +│ ├── player_info.py # Player lookup by name/ID |
| 25 | +│ ├── save_place.py # game:SavePlace() support |
| 26 | +│ ├── setup_player.py # Player configuration and settings endpoints |
| 27 | +│ ├── setup_rcc.py # RCC configuration (MD5 hashes, versions, policies) |
| 28 | +│ ├── studio.py # Studio login and user endpoints |
| 29 | +│ └── text_filter.py # Chat filtering/moderation |
| 30 | +└── README.md |
| 31 | +``` |
| 32 | + |
| 33 | +## Core (`_logic.py`) |
| 34 | + |
| 35 | +The foundation of the web server. Key components: |
| 36 | + |
| 37 | +- **`server_path()` decorator** — Registers handler functions into the global `SERVER_FUNCS` routing table. Supports static path matching, regex path matching, version-specific routes, and HTTP method filtering (GET, POST, etc.). |
| 38 | +- **`web_server`** — Extends `http.server.ThreadingHTTPServer`. Accepts `port`, `is_ipv6`, `game_config`, `server_mode`, and `log_filter`. Holds references to game storage, data transferer, and logger. |
| 39 | +- **`web_server_ssl`** — Extends `web_server` with TLS support. Generates a self-signed certificate via the `trustme` library. |
| 40 | +- **`web_server_handler`** — Extends `BaseHTTPRequestHandler`. Handles GET, POST, HEAD, PATCH, and DELETE. Parses the Host header, query string, and request body. Routes requests by matching against `SERVER_FUNCS` using static path lookup then regex fallback. Provides helpers: `send_json()`, `send_data()`, `send_redirect()`. |
| 41 | + |
| 42 | +## Endpoints |
| 43 | + |
| 44 | +### `__init__.py` |
| 45 | +Serves the root `/` path with server version and Rōblox version info: `"Rōblox Freedom Distribution webserver <version> [<rōblox_version>]"`. |
| 46 | + |
| 47 | +### `assets.py` |
| 48 | +- `/asset`, `/Asset`, `/v1/asset`, etc. — Fetches assets and thumbnails from the asset cache. Returns the asset data, a redirect, or a 404. Blocks access to the place file (`PLACE_IDEN_CONST`) unless the request is privileged (from localhost). |
| 49 | +- `/ownership/hasasset` — Always returns `true` (collective ownership — no catalogue API planned). |
| 50 | +- `/Game/Tools/ThumbnailAsset.ashx`, `/Thumbs/Asset.ashx` — Fetches asset thumbnails via cache. |
| 51 | + |
| 52 | +### `avatar.py` |
| 53 | +Returns player character appearance data. Two version-specific implementations: |
| 54 | +- **v347**: `/v1.1/avatar-fetch/` — Animations, accessory versions, body colors, scales. |
| 55 | +- **v463**: `/v1/avatar`, `/v1/avatar-fetch` — Asset+type IDs, animation asset IDs, body colors, scales, emotes. |
| 56 | +- `/v1.1/game-start-info` — Returns universe avatar configuration (scales, collision type, body type). |
| 57 | + |
| 58 | +### `badges.py` |
| 59 | +- `/Game/Badge/HasBadge.ashx` (v347) — Checks if a user owns a badge. |
| 60 | +- `/assets/award-badge` — Awards a badge to a player. |
| 61 | +- `/v1/users/{id}/badges/awarded-dates` (v463) — Returns awarded badge dates. |
| 62 | + |
| 63 | +### `data_transfer.py` |
| 64 | +- `/rfd/data-transfer` — Privileged-only (localhost) endpoint. Accepts a JSON dict via POST, inserts it into the data transfer buffer, and returns accumulated output. Used for RCC ↔ server communication. |
| 65 | + |
| 66 | +### `funds.py` |
| 67 | +- `/currency/balance` — Returns the player's robux and ticket balance. |
| 68 | + |
| 69 | +### `groups.py` |
| 70 | +- `/Game/LuaWebService/HandleSocialRequest.ashx` (v347) — Handles `GetGroupRank` method, returning the player's rank in a group. |
| 71 | +- `/v2/users/{id}/groups/roles` (v463) — Returns all groups and roles for a player. |
| 72 | + |
| 73 | +### `join_data.py` |
| 74 | +Handles the player join and registration flow: |
| 75 | +- `gen_player()` / `init_player()` — Creates or retrieves a player entry in the database. Initializes default funds on first join. |
| 76 | +- `perform_and_send_join()` — Constructs the join-data JSON (server connection, user info, session ID, etc.) and sends it. |
| 77 | +- `/game/join.ashx` (v347, v463) — Main join endpoint. Returns version-specific join data with appropriate `--rbxsig` prefix. |
| 78 | +- `/game/PlaceLauncher.ashx` — Returns join script URL and authentication ticket. |
| 79 | +- `/login/negotiate.ashx` — Always returns `true` (authentication passthrough). |
| 80 | +- `/universes/validate-place-join` — Always returns `true`. |
| 81 | + |
| 82 | +### `marketplace.py` |
| 83 | +Full marketplace implementation: |
| 84 | +- `purchase_gamepass()` / `purchase_devproduct()` — Deducts funds and records ownership. |
| 85 | +- `/Game/GamePass/GamePassHandler.ashx` — Checks gamepass ownership. |
| 86 | +- `/v1/purchases/products/{id}` — Purchases a gamepass. |
| 87 | +- `/v2/developer-products/{id}/purchase` — Purchases a developer product. |
| 88 | +- `/marketplace/purchase`, `/marketplace/submitpurchase` — Alternate purchase endpoints. |
| 89 | +- `/marketplace/game-pass-product-info` — Returns gamepass details. |
| 90 | +- `/marketplace/productinfo`, `/productDetails` — Returns product/developer product details. |
| 91 | +- `/gametransactions/getpendingtransactions` — Returns pending transaction receipts. |
| 92 | +- `/marketplace/validatepurchase` — Validates purchase receipts. |
| 93 | + |
| 94 | +### `persistence.py` |
| 95 | +DataStore API implementation: |
| 96 | +- `/persistence/set` — Stores a key-value pair with scope, target, and type. |
| 97 | +- `/persistence/getv2` — Retrieves multiple key-value pairs in bulk. |
| 98 | +- `/persistence/getSortedValues` — Retrieves sorted paginated data with min/max filtering. |
| 99 | +- `/persistence/increment` — Atomically increments numeric values. |
| 100 | + |
| 101 | +### `player_info.py` |
| 102 | +- `/users/{id}` — Returns username for a given user ID. |
| 103 | +- `/users/get-by-username` — Returns user ID for a given username. |
| 104 | +- `/v1/users/{id}/friends` (v463) — Returns empty friend list (dummy). |
| 105 | +- `/points/get-point-balance` — Returns zero point balance. |
| 106 | + |
| 107 | +### `save_place.py` |
| 108 | +- `/v1/places/{id}/symbolic-links` — Returns empty package list (packages not used in RFD). |
| 109 | +- `/ide/publish/UploadExistingAsset` — Saves the place file from Studio's `game:SavePlace()`. Creates a `.bak` backup before overwriting. Only works for local place files, not online URIs. Privileged-only. |
| 110 | + |
| 111 | +### `setup_player.py` |
| 112 | +Miscellaneous player/client configuration endpoints: |
| 113 | +- `/rfd/default-user-code` — Returns the default user code string. |
| 114 | +- `/rfd/is-player-allowed` — Checks if a user is allowed to join. |
| 115 | +- `/rfd/rōblox-version` — Returns the configured Rōblox version name. |
| 116 | +- `/game/validate-machine` — Always returns success. |
| 117 | +- `/Setting/QuietGet/StudioAppSettings/`, `ClientAppSettings/` — Returns empty settings (all defaults). |
| 118 | +- `/avatar-thumbnail/json`, `/avatar-thumbnail/image` — Returns empty/does nothing. |
| 119 | +- `/asset-thumbnail/json` — Returns game icon thumbnail URL. |
| 120 | +- `/Thumbs/GameIcon.ashx` — Serves the game icon from cache. |
| 121 | +- `/v1/settings/application` — Returns empty application settings. |
| 122 | +- `/v1/player-policies-client` — Returns player policy flags (ads allowed, trading allowed, etc.). |
| 123 | +- `/users/{id}/canmanage/{id}` — Checks if a user has admin rights (via `server_core`). |
| 124 | +- `/v1/user/{id}/is-admin-developer-console-enabled` — Checks admin console access. |
| 125 | + |
| 126 | +### `setup_rcc.py` |
| 127 | +RCC (Rōblox Cloud Compute) configuration endpoints: |
| 128 | +- `/api.GetAllowedMD5Hashes/` — Returns a hardcoded list of allowed MD5 hashes. |
| 129 | +- `/api.GetAllowedSecurityVersions/` — Returns allowed security versions (v347: `0.348.0pcplayer`, v463: `0.463.0pcplayer`). |
| 130 | +- `/game/load-place-info` — Returns place metadata (creator, version, game ID). |
| 131 | +- `/v1.1/Counters/BatchIncrement`, `/v1.0/SequenceStatistics/BatchAddToSequencesV2` — No-op, returns empty JSON. |
| 132 | +- `/universal-app-configuration/v1/behaviors/app-patch/content` — Returns canary/rollout config. |
| 133 | +- `/universal-app-configuration/v1/behaviors/app-policy/content` — Returns app feature flags (chat, game details, catalog, etc.). |
| 134 | +- `/v1/autolocalization/games/{id}/autolocalizationtable` — Returns localization disabled. |
| 135 | + |
| 136 | +### `studio.py` |
| 137 | +Rōblox Studio-specific endpoints: |
| 138 | +- `/studio/e.png` — Returns empty bytes (tracking pixel). |
| 139 | +- `/login/RequestAuth.ashx` — Redirects to negotiate endpoint. |
| 140 | +- `/v2/login` — Mock login. Accepts any password without `1`; rejects passwords containing `1` (debugging aid). |
| 141 | +- `/Users/1630228`, `/game/GetCurrentUser.ashx` — Returns hardcoded user ID `1630228`. Includes a 2-second sleep for Studio 2021E compatibility. |
| 142 | +- `/users/account-info` — Returns user roles, ID, and robux balance. |
| 143 | +- `/device/initialize` — Returns zero device identifiers. |
| 144 | +- `/v1/users/authenticated` — Returns hardcoded "RŌBLOX" user. |
| 145 | +- `/my/settings/json` — Returns empty settings. |
| 146 | + |
| 147 | +### `text_filter.py` |
| 148 | +- `/game/players/{id}/`, `/127.0.0.1/game/players/{id}/` — Returns `"ChatFilter": "blacklist"`. |
| 149 | +- `/moderation/v2/filtertext` — Passes text through the server core's text filter and returns filtered output. |
0 commit comments