fix(anon): let pinned teammates see each other

With anonymizeNames on, seesReal was true only for yourself or a viewer granted
reveal access, so in a Team game you could not identify your own teammate. A team
that cannot coordinate is not a team.

A player now also sees the real name of anyone on their pinned team. Only pinned
teams: those are assigned server-side (matchmakingTeams), so the server knows
them here. A team game that groups by clanTag/friends is resolved on the clients
and the server has no answer to give, so nothing is revealed there.

Safe for the same reason 'target === viewer' already is: this widens only
username and cosmetics, neither of which the simulation reads (Player.hash
excludes names). clanTag and friends DO feed assignTeams and are still blanked
identically for every viewer.

Author: Zixer1

src/server/GameServer.ts

@@ -335,10 +335,37 @@ export class GameServer {
   // Whether `viewer` should see `target`'s real identity: when names aren't
   // anonymized, when looking at themselves, or when the host granted the
   // viewer reveal access (nameReveals).
+  // Teammates in a matchmade game. Anonymizing a player from their own team
+  // makes the team unplayable — you cannot coordinate with someone you cannot
+  // identify — so a pinned team sees itself, exactly as a player already sees
+  // themselves. Only PINNED teams: those are assigned server-side, so the server
+  // knows them here. A team game that groups by clanTag/friends is resolved on
+  // the clients, and the server has no answer to give.
+  //
+  // Safe for the same reason `target === viewer` is: this only widens `username`
+  // and `cosmetics`, neither of which the simulation reads (Player.hash excludes
+  // names). The fields that DO feed assignTeams — clanTag and friends — are
+  // blanked identically for every viewer and are untouched here.
+  private sameMatchmadeTeam(
+    viewer: ClientID | undefined,
+    target: ClientID,
+  ): boolean {
+    if (viewer === undefined) return false;
+    const viewerClient = this.allClients.get(viewer);
+    const targetClient = this.allClients.get(target);
+    if (viewerClient === undefined || targetClient === undefined) return false;
+    const viewerTeam = this.matchmakingTeamIndex(viewerClient);
+    return (
+      viewerTeam !== undefined &&
+      viewerTeam === this.matchmakingTeamIndex(targetClient)
+    );
+  }
+
   private seesReal(viewer: ClientID | undefined, target: ClientID): boolean {
     return (
       !this.gameConfig.anonymizeNames ||
       target === viewer ||
+      this.sameMatchmadeTeam(viewer, target) ||
       this.viewerSeesAllNames(viewer)
     );
   }

tests/server/AnonymizeNamesTeammates.test.ts

@@ -0,0 +1,115 @@
+import { GameType } from "../../src/core/game/Game";
+import { Client } from "../../src/server/Client";
+import { GameServer } from "../../src/server/GameServer";
+
+function makeMockWs() {
+  return {
+    on: () => {},
+    removeAllListeners: () => {},
+    send: vi.fn(),
+    close: vi.fn(),
+    readyState: 1,
+  };
+}
+
+function makeClient(clientID: string, username: string, publicId: string) {
+  return new Client(
+    clientID,
+    `${clientID}-pid`,
+    null,
+    null,
+    undefined,
+    "127.0.0.1",
+    username,
+    null,
+    makeMockWs() as any,
+    undefined,
+    publicId,
+    [],
+  );
+}
+
+// alice+bob are one pinned team, carol+dave the other.
+function makeGame(matchmakingTeams?: string[][]) {
+  const logger: any = {
+    child: vi.fn().mockReturnThis(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  };
+  const game = new GameServer(
+    "g1",
+    logger,
+    Date.now(),
+    { gameType: GameType.Private, anonymizeNames: true } as any,
+    "creator-pid",
+    undefined,
+    undefined,
+    matchmakingTeams,
+  );
+  [
+    makeClient("alice", "AliceReal", "alice-pub"),
+    makeClient("bob", "BobReal", "bob-pub"),
+    makeClient("carol", "CarolReal", "carol-pub"),
+    makeClient("dave", "DaveReal", "dave-pub"),
+  ].forEach((c) => game.joinClient(c));
+  return game;
+}
+
+const TEAMS = [
+  ["alice-pub", "bob-pub"],
+  ["carol-pub", "dave-pub"],
+];
+const REAL = ["AliceReal", "BobReal", "CarolReal", "DaveReal"];
+const byId = (info: any, id: string) =>
+  info.clients.find((c: any) => c.clientID === id);
+
+describe("anonymizeNames: pinned teammates see each other", () => {
+  beforeEach(() => vi.useFakeTimers());
+  afterEach(() => {
+    vi.clearAllTimers();
+    vi.useRealTimers();
+  });
+
+  it("shows a teammate's real name", () => {
+    // Anonymizing a player from their own team makes the team unplayable.
+    const info = makeGame(TEAMS).gameInfo("alice");
+    expect(byId(info, "bob").username).toBe("BobReal");
+  });
+
+  it("still hides the other team", () => {
+    const info = makeGame(TEAMS).gameInfo("alice");
+    for (const id of ["carol", "dave"]) {
+      expect(REAL).not.toContain(byId(info, id).username);
+    }
+  });
+
+  it("hides everyone when the game is not matchmade", () => {
+    // Without pins the server has no team to compare — teams are resolved on the
+    // clients from clanTag/friends — so nothing is revealed.
+    const info = makeGame(undefined).gameInfo("alice");
+    expect(byId(info, "alice").username).toBe("AliceReal"); // self, as before
+    for (const id of ["bob", "carol", "dave"]) {
+      expect(REAL).not.toContain(byId(info, id).username);
+    }
+  });
+
+  it("reveals nothing to a player who is in no pinned team", () => {
+    const info = makeGame([["carol-pub", "dave-pub"]]).gameInfo("alice");
+    for (const id of ["bob", "carol", "dave"]) {
+      expect(REAL).not.toContain(byId(info, id).username);
+    }
+  });
+
+  it("is symmetric — the teammate sees back", () => {
+    const info = makeGame(TEAMS).gameInfo("bob");
+    expect(byId(info, "alice").username).toBe("AliceReal");
+  });
+
+  it("keeps the team-assignment inputs blank for everyone", () => {
+    // clanTag and friends feed assignTeams, so revealing them per viewer would
+    // desync. Only username/cosmetics widen.
+    const info = makeGame(TEAMS).gameInfo("alice");
+    expect(byId(info, "bob").clanTag ?? null).toBeNull();
+  });
+});