Skip to content
PersonalFive games · room-scoped Durable Objects · mobile WebSocket

Gamebang — Server-Authoritative Realtime Game Room

Sole designer, implementer, and deployer

2026-07-01 — present

A five-game realtime service where mobile clients request actions and a room-scoped Durable Object owns phase, turn, hidden information, and reconnect behavior.

System Architecture

Gamebang — Server-Authoritative Realtime Game Room architecture diagram

Problem Solving

1

Client-side card, turn, or result rulings create tampering and hidden-information risks

Solution Process

A room Durable Object owns authoritative state, validates phase, turn, and actions, then projects per-player views

Result

Clients receive only their own information and public state

2

Mobile disconnects could lose state or mis-handle room ownership

Solution Process

Separate connections from player identity and manage reconnect headroom, room lifecycle, and token-based return on the server

Result

Reconnect regenerates the allowed view from existing server state

Synthetic scenarios

Deterministic fixtures reproduce the code paths and boundaries without operational or personal data.

Server rulings survive a disconnect
Server rulings survive a disconnectIn this synthetic sequence the server validates a client action and, after disconnect, projects only the allowed view for a valid reconnect token.

Project Description

The mobile room-code client is separated from a Cloudflare Durable Object Room. Before dispatching an action to a pure per-game state machine, the Room validates phase, turn, and authority, then projects only the allowed player view. Server state remains authoritative across disconnects and the allowed personal view is restored when a valid reconnect token returns. The portfolio excludes real room codes, nicknames, stats, and private repository content.

Highlights

  • Five games registered through one GameDef/state-machine contract
  • Room Durable Object validates phase, turn, host, and actions
  • Per-player views isolate hidden information
  • Repository tests specify CSP/security headers, room lifecycle, and reconnect boundaries

Tech Decisions

  • ▶Use a Durable Object as the room source of truth while keeping game rules in pure state machines
  • ▶Perform playerView projection on the server to preserve per-participant hidden-information boundaries

Lessons Learned

  • •Realtime games must separate connection state from game state so reconnects do not disturb the rules source of truth.
  • •A shared engine can abstract game rules, but hidden-information projection must remain at the server boundary.

Tech Stack

TypeScriptReactWebSocketCloudflare WorkersDurable ObjectsVitest