Reauthorize recovered room joins

Validate the current room state after a departure wins the duplicate-join race, preventing bans or changed access rules from being bypassed.

Author: coder13

server/socket/namespaces/rooms.js

@@ -386,7 +386,12 @@ module.exports = (io, middlewares) => {
       }
     }
 
-    async function joinRoom(room, cb, spectating) {
+    async function joinRoom(
+      room,
+      cb,
+      spectating,
+      { password, reauthorizeOnRecovery = false } = {},
+    ) {
       if (socket.roomId) {
         if (String(socket.roomId) === String(room._id)) {
           socket.room = socket.room || room;
@@ -449,6 +454,41 @@ module.exports = (io, middlewares) => {
           message: 'Room no longer exists',
         });
       }
+      if (reauthorizeOnRecovery) {
+        const rejectRecoveryJoin = (error) => {
+          socket.leave(room.accessCode);
+          socket.leave(encodeUserRoom(socket.userId, room._id));
+          delete socket.room;
+          delete socket.roomId;
+          return cb(error);
+        };
+        const userKey = socket.userId.toString();
+        if (!isRoomTypeEnabled(currentRoom.type)) {
+          return rejectRecoveryJoin({
+            statusCode: 403,
+            message: 'Grand Prix rooms are disabled',
+          });
+        }
+        if (currentRoom.private && (!password || !(await currentRoom.authenticate(password)))) {
+          return rejectRecoveryJoin({
+            statusCode: 403,
+            message: 'Invalid password',
+          });
+        }
+        if (currentRoom.banned.get(userKey)) {
+          return rejectRecoveryJoin({
+            statusCode: 401,
+            message: 'Banned',
+            banned: true,
+          });
+        }
+        if (currentRoom.requireRevealedIdentity && !socket.user.showWCAID) {
+          return rejectRecoveryJoin({
+            statusCode: 403,
+            message: 'Must be showing WCA Identity to join room.',
+          });
+        }
+      }
       const r = await currentRoom.addUser(socket.user, spectating, sendAdminUpdate);
       if (!r) {
         const fencedRoom = await currentRoom.advancePresenceRevision(socket.userId);
@@ -564,7 +604,10 @@ module.exports = (io, middlewares) => {
           }, room);
         }
 
-        return await joinRoom(room, acknowledgment, spectating);
+        return await joinRoom(room, acknowledgment, spectating, {
+          password,
+          reauthorizeOnRecovery: true,
+        });
       } catch (e) {
         logger.error(e);
         return rejectJoin('internal_error', {

server/socket/namespaces/rooms.test.js

@@ -535,6 +535,38 @@ describe('room namespace departures and moderation', () => {
     expect(socket.room).toBe(rejoinedRoom);
   });
 
+  it('does not re-add a user banned while a duplicate join recovers from departure', async () => {
+    const room = makeRoom({
+      private: false,
+      password: null,
+      inRoom: new Map([['101', true]]),
+    });
+    room.advancePresenceRevision.mockResolvedValue(null);
+    const departedAndBannedRoom = {
+      ...room,
+      inRoom: new Map([['101', false]]),
+      banned: new Map([['101', true]]),
+      addUser: jest.fn(),
+    };
+    const connect = setup(new Map([[room._id, room]]));
+    let fetchCount = 0;
+    Room.findById.mockImplementation(() => {
+      const fetchedRoom = fetchCount === 0 ? room : departedAndBannedRoom;
+      fetchCount += 1;
+      return queryResult(fetchedRoom);
+    });
+    const socket = await connect(makeSocket({ id: 'new-tab', session: {}, userId: 101 }));
+
+    const acknowledgment = await joinRoom(socket, { id: room._id });
+
+    expect(departedAndBannedRoom.addUser).not.toHaveBeenCalled();
+    expect(acknowledgment).toHaveBeenCalledWith(expect.objectContaining({
+      statusCode: 401,
+      banned: true,
+    }));
+    expect(socket.roomId).toBeUndefined();
+  });
+
   it('finalizes one departure when two tabs explicitly leave together', async () => {
     const room = makeRoom({
       private: false,