Add private chat to multiplayer rooms

scripts/test-multiplayer-http.mjs

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { randomUUID } from "node:crypto";
 import { existsSync } from "node:fs";
 import { createClient } from "@supabase/supabase-js";
 if (existsSync(".env.local")) process.loadEnvFile(".env.local");
@@ -52,6 +53,57 @@ try {
   assert.deepEqual(preview.rounds, []);
   await outsider(`${path}/media`, undefined, 403);
   const joined = await friend(`${path}/join`, { displayName: "HTTP Friend" });
+  await outsider(`${path}/chat`, undefined, 403);
+  await outsider(
+    `${path}/chat`,
+    { text: "Intruder", clientId: randomUUID() },
+    403,
+  );
+  const sent = {
+    text: "HTTP hello <b>plain text</b>",
+    clientId: randomUUID(),
+    name: "Forged",
+  };
+  const messages = (await host(`${path}/chat`, sent)).messages;
+  assert.equal(
+    messages[0].name,
+    "HTTP Host",
+    "sender name is server-controlled",
+  );
+  assert.equal(messages[0].playerId, hostView.you);
+  assert.equal((await host(`${path}/chat`, sent)).messages.length, 1);
+  assert.deepEqual((await friend(`${path}/chat`)).messages, messages);
+  await friend(`${path}/chat`, { text: " ", clientId: randomUUID() }, 400);
+  await friend(
+    `${path}/chat`,
+    { text: "x".repeat(501), clientId: randomUUID() },
+    400,
+  );
+  await friend(
+    `${path}/chat`,
+    { text: "x\u202e", clientId: randomUUID() },
+    400,
+  );
+  const concurrentMessages = await Promise.allSettled([
+    friend(`${path}/chat`, {
+      text: "First simultaneous send",
+      clientId: randomUUID(),
+    }),
+    friend(`${path}/chat`, {
+      text: "Second simultaneous send",
+      clientId: randomUUID(),
+    }),
+  ]);
+  assert.equal(
+    concurrentMessages.filter((result) => result.status === "fulfilled").length,
+    1,
+    "only one simultaneous new message succeeds",
+  );
+  assert.match(
+    concurrentMessages.find((result) => result.status === "rejected").reason
+      .message,
+    /Too many chat messages/,
+  );
   assert.equal(
     (await friend(`${path}/join`, { displayName: "HTTP Other" })).you,
     joined.you,
@@ -122,6 +174,18 @@ try {
   }
   assert.equal(results.players[0].id, hostView.you);
   assert.equal(results.players[0].total, 25000);
+  assert.equal(
+    (await host(`${path}/chat`)).messages.length,
+    2,
+    "messages persist over five rounds",
+  );
+  await friend(`${path}/leave`, {});
+  await friend(`${path}/chat`, undefined, 403);
+  await friend(
+    `${path}/chat`,
+    { text: "After leaving", clientId: randomUUID() },
+    403,
+  );
   assert.equal(results.rounds.flatMap((round) => round.results).length, 10);
   const capacityHost = player();
   const full = await capacityHost("rooms", {
@@ -149,7 +213,7 @@ try {
   assert.match(rejection.reason.message, /This room is full/);
   assert.equal((await capacityHost(`rooms/${full.id}`)).playerCount, 16);
   console.log(
-    "Multiplayer HTTP smoke passed: private invite joining, shared signed media and timers, five-round ranking, reconnects, retries, and simultaneous 16-player capacity checks.",
+    "Multiplayer HTTP smoke passed: private room chat, trusted sender names, validation, concurrent-send throttling, retries, revoked membership, five shared rounds, signed media, and simultaneous 16-player capacity checks.",
   );
 } finally {
   if (rooms.length) {