Add SCUM Source RCON transport

2026-07-23 10:55:31 +08:00
parent ec96c22e4c
commit 742f96ea02
33 changed files with 1297 additions and 19 deletions
@@ -0,0 +1,37 @@
+## ADDED Requirements
+
+### Requirement: Platform dispatches a typed SCUM Source RCON command
+Platform SHALL accept a server-authorized typed request for either a SCUM chat message or a bounded raw SCUM command only when the installed plugin declares `remote.run.rcon.command`, the selected runtime profile declares the RCON transport, the endpoint reports the capability, and a selected ready Windows amd64 UE4SS DLL extension provides the Source RCON plan. Chat requests SHALL validate a type from 0 through 7, 1–1024 UTF-8 message bytes, and an optional 17-digit SteamID64 before Platform formats the DLL-supported `SendChat` command. Raw commands SHALL be non-empty UTF-8, contain no NUL/newline control framing, and fit within the declared Source RCON packet bound.
+
+#### Scenario: Authorized chat dispatch is queued
+- **WHEN** an authorized operator submits a valid broadcast or targeted chat request for a compatible ready SCUM server
+- **THEN** Platform creates one scoped `remote.run.rcon.command` job with a frozen Source RCON plan and returns only safe queued state.
+
+#### Scenario: Unsupported command request is rejected before dispatch
+- **WHEN** a request has malformed chat data, an unsafe raw command, an undeclared RCON capability, an unpublished extension, or a non-Windows endpoint
+- **THEN** Platform rejects it without creating a job or retaining command text.
+
+### Requirement: Raw RCON input is transient and one-time
+Platform SHALL hold raw RCON command text only in a bounded in-memory one-time broker keyed by the dispatch job. The persisted job, job assignment, browser DTOs, audit events, and result messages SHALL omit command text, chat text, source responses, host paths, and RCON credentials. RCON command jobs SHALL have one attempt and SHALL not automatically retry.
+
+#### Scenario: Active Run lease consumes a command once
+- **WHEN** the active leased Run attempt requests its RCON input
+- **THEN** Platform returns the command once and removes it from the broker.
+
+#### Scenario: Repeated, expired, or restarted delivery fails closed
+- **WHEN** a broker payload was already consumed, expired, or lost after a Platform restart
+- **THEN** a later Run input request fails safely and does not replay the command.
+
+### Requirement: Only the active signed Run attempt receives RCON input
+Platform SHALL expose RCON command input only through a signed Run-only route after validating the endpoint, session, job ID, lease token, attempt, scoped server, RCON capability, and frozen Source RCON plan. Browser and plugin APIs SHALL never receive the RCON input, password, host address, or generated local config path.
+
+#### Scenario: Stale or foreign lease cannot read a command
+- **WHEN** a Run input request has a wrong endpoint, session, lease token, attempt, or job capability
+- **THEN** Platform denies it and leaves a valid unconsumed broker payload intact.
+
+### Requirement: Management console provides direct chat and command controls
+The server management surface SHALL render direct chat and raw-command controls only through the typed Platform API. It SHALL not request a secondary confirmation, retain a command transcript, expose RCON connection material, or show raw Source RCON replies.
+
+#### Scenario: Console sends a chat without creating history
+- **WHEN** an authorized operator submits a valid chat form
+- **THEN** the console displays the safe dispatch status and does not render the chat text as a durable command record.