fix(social): robot blocks

Blocking an auto-match opponent who is secretly a pooled robot is recorded instead in a separate `robot_blocks` table. Now blocking behaves the same in that game (struck name, hidden composer) and lists the blocked opponent under the name you saw, but is recorded only against that game — the disguise holds, the shared robot is never globally blocked, and the matchmaker keeps pairing you with robots (so you can never block yourself out of opponents). - the shared robot account is never put in `blocks` - the matchmaker keeps it free and it is not blocked under its other per-game names - the blocked list and the in-game card still show it by joining that table; an unblock deletes the row
2026-06-18 13:12:19 +02:00
parent 81b9e1529e
commit 64be0572b3
29 changed files with 700 additions and 68 deletions
@@ -10,7 +10,9 @@ import (

 	"github.com/google/uuid"

+	"scrabble/backend/internal/account"
 	"scrabble/backend/internal/engine"
+	"scrabble/backend/internal/game"
 	"scrabble/backend/internal/notify"
 	"scrabble/backend/internal/social"
 )
@@ -249,6 +251,56 @@ func TestAdminSocialLists(t *testing.T) {
 	}
 }

+// TestRobotBlockIsPerGameAndMatchmakerImmune checks that blocking a disguised-robot opponent
+// is recorded per-game in robot_blocks — never in the blocks table or against the shared robot
+// account — so the matchmaker keeps the robot free, and that unblocking by the row id removes it.
+func TestRobotBlockIsPerGameAndMatchmakerImmune(t *testing.T) {
+	ctx := context.Background()
+	svc := newSocialService()
+	accs := account.NewStore(testDB)
+	human := provisionAccount(t)
+	robot, err := accs.ProvisionRobot(ctx, "robot-block-"+uuid.NewString(), "Robbie")
+	if err != nil {
+		t.Fatalf("provision robot: %v", err)
+	}
+	g, err := newGameService().Create(ctx, game.CreateParams{
+		Variant: engine.VariantEnglish, Seats: []uuid.UUID{human, robot.ID},
+		TurnTimeout: 24 * time.Hour, Seed: openingSeed(t),
+	})
+	if err != nil {
+		t.Fatalf("create game: %v", err)
+	}
+
+	if err := svc.BlockInGame(ctx, human, robot.ID, g.ID); err != nil {
+		t.Fatalf("block robot: %v", err)
+	}
+	rbs, err := svc.ListRobotBlocks(ctx, human)
+	if err != nil {
+		t.Fatalf("list robot blocks: %v", err)
+	}
+	if len(rbs) != 1 || rbs[0].GameID != g.ID {
+		t.Fatalf("robot blocks = %v, want one for game %s", rbs, g.ID)
+	}
+	if bl, _ := svc.ListBlocks(ctx, human); len(bl) != 0 {
+		t.Errorf("blocks table must stay empty for a robot block, got %v", bl)
+	}
+	if yes, _ := svc.IsBlocked(ctx, human, robot.ID); yes {
+		t.Error("the shared robot account must never be blocked")
+	}
+	// Matchmaking immunity: the robot is never in the caller's exclusion set, so the matchmaker
+	// keeps giving robots and the player can never be starved by blocking them.
+	if with, _ := svc.BlockedWith(ctx, human); contains(with, robot.ID) {
+		t.Error("a robot block must not put the robot in BlockedWith")
+	}
+	// Unblock by the robot_blocks row id removes it.
+	if err := svc.Unblock(ctx, human, rbs[0].ID); err != nil {
+		t.Fatalf("unblock robot: %v", err)
+	}
+	if rbs, _ := svc.ListRobotBlocks(ctx, human); len(rbs) != 0 {
+		t.Errorf("robot block not removed by unblock: %v", rbs)
+	}
+}
+
 // blockedWith reads the both-direction block set for id.
 func blockedWith(t *testing.T, soc *social.Service, id uuid.UUID) []uuid.UUID {
 	t.Helper()
@@ -0,0 +1,27 @@
+-- +goose Up
+-- Per-game blocks of a disguised-robot opponent. A disguised robot is a shared pool
+-- account reused across games under different per-game names, so it must never go into
+-- `blocks` (that would make the same robot look blocked in the blocker's other games under
+-- other names, leaking that it is a bot, and show its pool name instead of the one seen).
+-- Each such block is recorded here against the specific game + seat, snapshotting the name
+-- the player saw, so the blocked list shows it as a distinct personality and the in-game
+-- card re-marks that one seat. The real robot account is never blocked, so the matchmaker
+-- leaves robots free. Unblocking deletes the row.
+SET search_path = backend, pg_catalog;
+
+CREATE TABLE robot_blocks (
+    id           uuid        PRIMARY KEY,
+    blocker_id   uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
+    game_id      uuid        NOT NULL REFERENCES games (game_id) ON DELETE CASCADE,
+    seat         smallint    NOT NULL,
+    robot_id     uuid        NOT NULL REFERENCES accounts (account_id) ON DELETE CASCADE,
+    display_name text        NOT NULL,
+    created_at   timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (blocker_id, game_id, seat)
+);
+
+CREATE INDEX robot_blocks_blocker_idx ON robot_blocks (blocker_id);
+
+-- +goose Down
+SET search_path = backend, pg_catalog;
+DROP TABLE robot_blocks;
@@ -2,6 +2,7 @@ package server

 import (
 	"net/http"
+	"strings"

 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -13,9 +14,21 @@ import (
 // not delete — any friendship (an unblock restores it). They reuse the friend handlers'
 // targetIDRequest and account-ref resolution.

-// blockListDTO is the accounts the caller has blocked.
+// blockListDTO is the accounts the caller has blocked, plus the per-game disguised-robot
+// blocks (not real accounts), which the blocked list shows as distinct personalities.
 type blockListDTO struct {
 	Blocked []accountRefDTO `json:"blocked"`
+	Robots  []robotBlockDTO `json:"robots"`
+}
+
+// robotBlockDTO is one per-game disguised-robot block: the row id (used to unblock it), the
+// game name the player saw, and the game + seat it was blocked in (so the in-game card can
+// re-mark that seat).
+type robotBlockDTO struct {
+	ID          string `json:"id"`
+	DisplayName string `json:"display_name"`
+	GameID      string `json:"game_id"`
+	Seat        int    `json:"seat"`
 }

 // handleBlock blocks the body-supplied account.
@@ -35,7 +48,18 @@ func (s *Server) handleBlock(c *gin.Context) {
 		abortBadRequest(c, "invalid account id")
 		return
 	}
-	if err := s.social.Block(c.Request.Context(), uid, target); err != nil {
+	// An in-game block carries the game id, so a disguised-robot opponent is recorded as a
+	// per-game block (BlockInGame); a settings-screen block (no game) blocks a human directly.
+	var err error
+	if strings.TrimSpace(req.GameID) == "" {
+		err = s.social.Block(c.Request.Context(), uid, target)
+	} else if gameID, ok := parseUUIDField(req.GameID); !ok {
+		abortBadRequest(c, "invalid game id")
+		return
+	} else {
+		err = s.social.BlockInGame(c.Request.Context(), uid, target, gameID)
+	}
+	if err != nil {
 		s.abortErr(c, err)
 		return
 	}
@@ -68,10 +92,20 @@ func (s *Server) handleListBlocks(c *gin.Context) {
 		abortBadRequest(c, "missing identity")
 		return
 	}
-	ids, err := s.social.ListBlocks(c.Request.Context(), uid)
+	ctx := c.Request.Context()
+	ids, err := s.social.ListBlocks(ctx, uid)
 	if err != nil {
 		s.abortErr(c, err)
 		return
 	}
-	c.JSON(http.StatusOK, blockListDTO{Blocked: s.accountRefs(c.Request.Context(), ids)})
+	robots, err := s.social.ListRobotBlocks(ctx, uid)
+	if err != nil {
+		s.abortErr(c, err)
+		return
+	}
+	dto := blockListDTO{Blocked: s.accountRefs(ctx, ids)}
+	for _, r := range robots {
+		dto.Robots = append(dto.Robots, robotBlockDTO{ID: r.ID.String(), DisplayName: r.DisplayName, GameID: r.GameID.String(), Seat: r.Seat})
+	}
+	c.JSON(http.StatusOK, dto)
 }
@@ -48,9 +48,12 @@ type redeemResultDTO struct {
 	Friend accountRefDTO `json:"friend"`
 }

-// targetIDRequest carries a single counterpart account id.
+// targetIDRequest carries a single counterpart account id. GameID is set only by an
+// in-game block (so a disguised-robot opponent can be recorded as a per-game block); the
+// other target paths leave it empty.
 type targetIDRequest struct {
 	AccountID string `json:"account_id"`
+	GameID    string `json:"game_id"`
 }

 // friendRespondRequest accepts or declines a pending request from a requester.
@@ -35,15 +35,23 @@ func (svc *Service) Block(ctx context.Context, blockerID, blockedID uuid.UUID) e
 	return nil
 }

-// Unblock removes blockerID's block on blockedID and confirms it to the (former)
-// blocker with a user_unblocked event so their open game screens restore the controls
-// and un-strike the name in place. Any friendship the block had been overriding becomes
-// effective again. It is idempotent.
-func (svc *Service) Unblock(ctx context.Context, blockerID, blockedID uuid.UUID) error {
-	if err := svc.store.deleteBlock(ctx, blockerID, blockedID); err != nil {
+// Unblock removes blockerID's block on the given target and confirms it to the (former)
+// blocker with a user_unblocked event so their open game screens restore the controls and
+// un-strike the name in place. The target is either a blocked human's account id (the
+// blocks table) or a robot_blocks row id (a per-game disguised-robot block) — the robot
+// block is tried first, falling back to the human block. Any friendship the block had been
+// overriding becomes effective again. It is idempotent.
+func (svc *Service) Unblock(ctx context.Context, blockerID, target uuid.UUID) error {
+	removed, err := svc.store.deleteRobotBlock(ctx, blockerID, target)
+	if err != nil {
 		return err
 	}
-	svc.pub.Publish(notify.NotificationAccount(blockerID, notify.NotifyUserUnblocked, svc.accountRef(ctx, blockedID)))
+	if !removed {
+		if err := svc.store.deleteBlock(ctx, blockerID, target); err != nil {
+			return err
+		}
+	}
+	svc.pub.Publish(notify.NotificationAccount(blockerID, notify.NotifyUserUnblocked, svc.accountRef(ctx, target)))
 	return nil
 }

@@ -0,0 +1,115 @@
+package social
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/google/uuid"
+
+	"scrabble/backend/internal/notify"
+)
+
+// RobotBlock is one per-game block of a disguised-robot opponent: the row id (used to
+// unblock it), the game name the player saw, and the game + seat it was blocked in.
+type RobotBlock struct {
+	ID          uuid.UUID
+	DisplayName string
+	GameID      uuid.UUID
+	Seat        int
+}
+
+// BlockInGame blocks blockedID for blockerID from within gameID. A human is blocked
+// normally (the blocks table, via Block). A disguised-robot opponent is instead recorded
+// per-game in robot_blocks — never the shared robot account — so the matchmaker keeps
+// robots free and the same robot stays unblocked in the blocker's other games (under its
+// other names); the row snapshots the seat and the name the player saw so the blocked list
+// and the in-game card can show it. It is the entry point for the in-game block control;
+// the settings-screen block (no game) goes through Block directly.
+func (svc *Service) BlockInGame(ctx context.Context, blockerID, blockedID, gameID uuid.UUID) error {
+	if blockerID == blockedID {
+		return ErrSelfRelation
+	}
+	isRobot, err := svc.accounts.IsRobot(ctx, blockedID)
+	if err != nil {
+		return err
+	}
+	if !isRobot {
+		return svc.Block(ctx, blockerID, blockedID)
+	}
+	if gameID == uuid.Nil {
+		return ErrNotParticipant
+	}
+	seats, _, _, err := svc.games.Participants(ctx, gameID)
+	if err != nil {
+		return err
+	}
+	seat := slices.Index(seats, blockedID)
+	if seat < 0 {
+		return ErrNotParticipant
+	}
+	name, _ := svc.games.SeatName(ctx, gameID, blockedID)
+	if err := svc.store.insertRobotBlock(ctx, blockerID, gameID, seat, blockedID, name); err != nil {
+		return err
+	}
+	svc.pub.Publish(notify.NotificationAccount(blockerID, notify.NotifyUserBlocked, svc.accountRef(ctx, blockedID)))
+	return nil
+}
+
+// ListRobotBlocks returns blockerID's per-game disguised-robot blocks, newest first.
+func (svc *Service) ListRobotBlocks(ctx context.Context, blockerID uuid.UUID) ([]RobotBlock, error) {
+	return svc.store.listRobotBlocks(ctx, blockerID)
+}
+
+// insertRobotBlock records a per-game robot block; a duplicate (same blocker, game, seat)
+// is ignored.
+func (s *Store) insertRobotBlock(ctx context.Context, blocker, gameID uuid.UUID, seat int, robotID uuid.UUID, name string) error {
+	id, err := uuid.NewV7()
+	if err != nil {
+		return fmt.Errorf("social: new robot block id: %w", err)
+	}
+	const q = `INSERT INTO backend.robot_blocks (id, blocker_id, game_id, seat, robot_id, display_name)
+VALUES ($1, $2, $3, $4, $5, $6)
+ON CONFLICT (blocker_id, game_id, seat) DO NOTHING`
+	if _, err := s.db.ExecContext(ctx, q, id, blocker, gameID, int16(seat), robotID, name); err != nil {
+		return fmt.Errorf("social: insert robot block: %w", err)
+	}
+	return nil
+}
+
+// deleteRobotBlock removes blocker's robot block by its row id, reporting whether a row
+// matched (so the caller can fall back to a human block).
+func (s *Store) deleteRobotBlock(ctx context.Context, blocker, id uuid.UUID) (bool, error) {
+	const q = `DELETE FROM backend.robot_blocks WHERE id = $2 AND blocker_id = $1`
+	res, err := s.db.ExecContext(ctx, q, blocker, id)
+	if err != nil {
+		return false, fmt.Errorf("social: delete robot block: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("social: delete robot block rows: %w", err)
+	}
+	return n > 0, nil
+}
+
+// listRobotBlocks returns blocker's robot blocks, newest first.
+func (s *Store) listRobotBlocks(ctx context.Context, blocker uuid.UUID) ([]RobotBlock, error) {
+	const q = `SELECT id, display_name, game_id, seat FROM backend.robot_blocks
+WHERE blocker_id = $1 ORDER BY created_at DESC`
+	rows, err := s.db.QueryContext(ctx, q, blocker)
+	if err != nil {
+		return nil, fmt.Errorf("social: list robot blocks: %w", err)
+	}
+	defer rows.Close()
+	var out []RobotBlock
+	for rows.Next() {
+		var rb RobotBlock
+		var seat int16
+		if err := rows.Scan(&rb.ID, &rb.DisplayName, &rb.GameID, &seat); err != nil {
+			return nil, fmt.Errorf("social: scan robot block: %w", err)
+		}
+		rb.Seat = int(seat)
+		out = append(out, rb)
+	}
+	return out, rows.Err()
+}