auth: room notice version is bounded at 4294967295 (Heimdall's one version rule)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/app/utils/trainingNotice.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import {
+  MAX_NOTICE_VERSION,
   ROOM_NOTICE_EVENT_TYPE,
   TRAINING_NOTICE_TEXT,
   parseRoomNotice,
@@ -49,6 +50,16 @@ describe('training notice', () => {
     expect(lineFor({ version: '007', scope: 'train' })).toBeUndefined();
   });
 
+  it('bounds the version at 4294967295', () => {
+    expect(MAX_NOTICE_VERSION).toBe(4294967295);
+    expect(lineFor({ version: 4294967295, scope: 'train' })).toBe(TRAINING_NOTICE_TEXT);
+    expect(parseRoomNotice({ version: 4294967295, scope: 'train' })?.version).toBe(4294967295);
+    expect(lineFor({ version: 4294967296, scope: 'train' })).toBeUndefined();
+    expect(lineFor({ version: Number.MAX_SAFE_INTEGER, scope: 'train' })).toBeUndefined();
+    expect(lineFor({ version: 4294967295.5, scope: 'train' })).toBeUndefined();
+    expect(lineFor({ version: '4294967295', scope: 'train' })).toBeUndefined();
+  });
+
   it('rejects an unknown or wrongly cased scope', () => {
     expect(lineFor({ version: 1, scope: 'everything' })).toBeUndefined();
     expect(lineFor({ version: 1, scope: 'Train' })).toBeUndefined();

src/app/utils/trainingNotice.ts

@@ -5,9 +5,11 @@ export const TRAINING_NOTICE_TEXT =
 
 /**
  * Heimdall's ruling: a room's notice is a room state event, not a pinned message. Type below,
- * state_key '', content `{version, scope}`; version a positive integer, scope exactly one of
- * show, study or train. Absent or malformed in any way means no train line.
+ * state_key '', content `{version, scope}`; scope exactly one of show, study or train. Heimdall's
+ * one version rule: a positive integer, no leading zeros, no greater than 4294967295; anything
+ * else is malformed. Absent or malformed in any way means no train line.
  */
+export const MAX_NOTICE_VERSION = 4294967295;
 export const ROOM_NOTICE_EVENT_TYPE = StateEvent.GameCultNotice;
 
 export type RoomNotice = { version: number; scope: 'show' | 'study' | 'train' };
@@ -20,6 +22,7 @@ export const parseRoomNotice = (content: unknown): RoomNotice | undefined => {
     typeof version === 'number' &&
     Number.isSafeInteger(version) &&
     version > 0 &&
+    version <= MAX_NOTICE_VERSION &&
     (scope === 'show' || scope === 'study' || scope === 'train')
   ) {
     return { version, scope };