Packet Security and Replay Protection in Nexus Core

new MessageValidationChain(List.of(
    new SignatureValidator(),
    new TimestampValidator(),
    new NonceValidator()
))

@FunctionalInterface
public interface MessageValidator {
    ValidationResult validate(NexusJsonDataContainer message);
}

ValidationResult.ok()              // passes
ValidationResult.reject("reason")  // fails and logs the reason

1. sig       — Exists? HMAC verification passes?
2. timestamp — Exists? Within 5-minute window?
3. nonce     — Exists? Not seen before?
               └──► Global chain passed. Per-addon chain runs next.
4. addon.additionalValidators() — All pass?
5. addon.handleRequest()        — Returns true?
               └──► dispatch() runs the registered RequestHandler.

@Override
protected List<MessageValidator> additionalValidators() {
    return List.of(
        message -> message.containsKey("playerUuid")
            ? ValidationResult.ok()
            : ValidationResult.reject("playerUuid field is required"),

        message -> {
            String uuid = message.get("playerUuid", String.class);
            return uuid != null && uuid.length() == 36
                ? ValidationResult.ok()
                : ValidationResult.reject("playerUuid must be a valid UUID string");
        }
    );
}

export NEXUS_SIGNING_KEY="a-long-and-unpredictable-secret-key"