feat(cloud_server): implement SSL secure websocket from semver2 into semver3 by Boss-1s · Pull Request #723 · TimMcCool/scratchattach

Boss-1s · 2026-08-26T03:16:16Z

Resolves nothing

Changes

Implemented SSL secure ws server (fix cloud server #658) from semver2 into semver 3
New class ~~_SaWebSockectServer~~ BaseWebSocketServer in sa.eventhandlers._base to keep things pythonic and organized
refactoring everything related cause why not

Tasks

implement
clean up to match semver3 logic
feat(cloud_server): implement SSL secure websocket from semver2 into semver3 #723 (comment)
feat(cloud_server): implement SSL secure websocket from semver2 into semver3 #723 (comment)
could be more, we may need faretek's thoughts on this as well

Tests

First, start up an insecure server to ensure it works:

import scratchattach as sa
from scratchattach.cloud.cloud import CustomCloud
import logging
from rich.traceback import install

install(show_locals=True)

# Init Server & Cloud Events

server_ip = '127.0.0.1'
server_port = 8080
project_id="1321224718"

server = sa.init_cloud_server("127.0.0.1",
                              server_port,
                              length_limit=65536,
                              allow_non_numeric=True,
                              whitelisted_projects=[project_id],
                              allow_nonscratch_names=False,
                              blocked_ips=["127.0.0.2"],
                              sync_players=True,
                              log_var_sets=True
                              )
server.start()


banned_cloud = CustomCloud(project_id='1234567',
                    cloud_host=f"ws://{server_ip}:{server_port}",
                    username = "Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

bad_user_name_cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"ws://{server_ip}:{server_port}",
                    username = "Boss_asdfghjkl",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"ws://{server_ip}:{server_port}",
                    username = "Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

no_user_cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"ws://{server_ip}:{server_port}",
                    username = None,
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

no_project_cloud = CustomCloud(project_id=None,
                    cloud_host=f"ws://{server_ip}:{server_port}",
                    username="Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

banned_cloud_events=banned_cloud.events()
bad_user_name_cloud_events=bad_user_name_cloud.events()
cloud_events=cloud.events()
no_user_cloud_events=no_user_cloud.events()
no_project_cloud_events=no_project_cloud.events()

While the above script is running, run websocat ws://127.0.0.1:8080 to interact with the websocket.

Once you have determined that this works, replace the above script with the one below:

import scratchattach as sa
from scratchattach.cloud.cloud import CustomCloud
import logging
from rich.traceback import install

install(show_locals=True)

# Init Server & Cloud Events

server_ip = '127.0.0.1'
server_port = 8080
project_id="1321224718"

# Test with ssl and make sure it works

server = sa.init_ssl_cloud_server("127.0.0.1",
                              server_port,
                              length_limit=65536,
                              allow_non_numeric=True,
                              whitelisted_projects=[project_id],
                              allow_nonscratch_names=False,
                              blocked_ips=["127.0.0.2"],
                              sync_players=True,
                              log_var_sets=True,
                              certfile="certfile.pem",
                              keyfile="keyfile.pem"
                              )
server.start()


banned_cloud = CustomCloud(project_id='1234567',
                    cloud_host=f"wss://{server_ip}:{server_port}",
                    username = "Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

bad_user_name_cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"wss://{server_ip}:{server_port}",
                    username = "Boss_asdfghjkl",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"wss://{server_ip}:{server_port}",
                    username = "Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

no_user_cloud = CustomCloud(project_id=project_id,
                    cloud_host=f"wss://{server_ip}:{server_port}",
                    username = None,
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

no_project_cloud = CustomCloud(project_id=None,
                    cloud_host=f"wss://{server_ip}:{server_port}",
                    username="Boss_1s",
                    length_limit = None,
                    allow_non_numeric = True,
                    _session = None,
                    header = None,
                    cookie = None,
                    origin = None,
                    print_connect_messages = True
                    )

banned_cloud_events=banned_cloud.events()
bad_user_name_cloud_events=bad_user_name_cloud.events()
cloud_events=cloud.events()
no_user_cloud_events=no_user_cloud.events()
no_project_cloud_events=no_project_cloud.events()

Then, generate an OpenSSL certificate:

openssl req -x509 -newkey rsa:4096 -keyout keyfile.pem -out certfile.pem -days 365 -nodes

Finally, run the server script, and interact with the WebSocket with websocat -k wss://127.0.0.1:8080

Notes

might wanna have #722 fixed before merging this, idk

…semver3 Signed-off-by: GitHub <noreply@github.com>

Signed-off-by: GitHub <noreply@github.com>

- Moved `BaseCloudServer` (Formerly `_SaCloudServer`) to sa.eventhandlers._base Signed-off-by: GitHub <noreply@github.com>

Signed-off-by: GitHub <noreply@github.com>

Boss-1s · 2026-08-30T16:05:05Z

@TheCommCraft

TheCommCraft · 2026-09-02T18:00:34Z

Tell me if you require help in applying these changes

(cherry picked from commit 8d30697) Signed-off-by: GitHub <noreply@github.com>

### sa.eventhandlers._base - changed list comp to generator comp in set_project_vars() and set_var() - reimplemented attribute type hints into BaseCloudServer. since type hints are inhierted, there is no need to restate them in child classes of BaseCloudServer. ### sa.eventhandlers.cloud_server - added type hitns to __init__ of BaseCloudServer child classes - added type hints to init_cloud_server and init_ssl_cloud_server - revert changing warnings.warn to print in 9863d50 Signed-off-by: GitHub <noreply@github.com>

Signed-off-by: GitHub <noreply@github.com>

Co-authored-by: TheCommCraft <79996518+TheCommCraft@users.noreply.github.com> Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

TheCommCraft · 2026-09-03T07:59:34Z

+                )
+            )
+
+    def set_var(self, project_id, var_name, value, *, user="@server", skip_forward=None):


Maybe we should change the server to store the variables with their actual names and then add the option to skip adding the cloud prefix

Further examination is required to determine whether the current implementation works. I might have time to do this later but at the moment I am busy.

TheCommCraft · 2026-09-03T08:09:00Z

I'm just going to try and apply these changes myself

Signed-off-by: GitHub <noreply@github.com>

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s · 2026-09-03T19:24:02Z

        *,
        user: str = "@server",
-        skip_forward=None,
+        skip_broadcast_for: WebSocket | None = None,


Should we add documentation or something of the sort for this argument?

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s · 2026-09-04T03:49:57Z

+            skip_broadcast_for=self,
+            no_prefix=True,
+        )
+        send_to_clients: CloudActivityDict = {


CloudActivityDict typed dict doesn't accept some of the values listed below

the dict must be a CloudActivityDict and the extra entries will only be ignored so we should just remove the extra entries

TheCommCraft · 2026-09-04T07:55:09Z

serveforever is implemented with a while loop of serveonce

Co-authored-by: TheCommCraft <79996518+TheCommCraft@users.noreply.github.com> Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

feat(cloud_server): implement SSL secure websocket from semver2 into …

9863d50

…semver3 Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release August 26, 2026 03:16 — with GitHub Actions Active

Boss-1s added 2 commits August 26, 2026 15:36

fix(cloud_server): expose init_ssl_cloud_sever to top-level

7e8fddd

Signed-off-by: GitHub <noreply@github.com>

chore(eventhandlers._base): move mixin class to _base

bab2905

- Moved `BaseCloudServer` (Formerly `_SaCloudServer`) to sa.eventhandlers._base Signed-off-by: GitHub <noreply@github.com>

Boss-1s had a problem deploying to release August 26, 2026 16:18 — with GitHub Actions Failure

fatal(eventhandlers._base): missing imports

5cd379d

Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release August 26, 2026 17:38 — with GitHub Actions Active

TheCommCraft reviewed Sep 2, 2026

View reviewed changes

Boss-1s deployed to release September 2, 2026 21:38 — with GitHub Actions Active

export cloud server types

2950297

(cherry picked from commit 8d30697) Signed-off-by: GitHub <noreply@github.com>

Boss-1s force-pushed the semver3-secure-ws branch from 9a6846e to 2950297 Compare September 2, 2026 21:40

Boss-1s deployed to release September 2, 2026 21:40 — with GitHub Actions Active

Boss-1s deployed to release September 2, 2026 22:04 — with GitHub Actions Active

Boss-1s requested a review from TheCommCraft September 2, 2026 22:05

fix(sa.eventhandlers._base): ensure blocked_ips is always some list

8d5aa20

Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release September 2, 2026 22:08 — with GitHub Actions Active

feat: expose BaseCloudServer

70ffb36

Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release September 2, 2026 22:30 — with GitHub Actions Active

fatal: BaseCloudServer should not have ssl-related stuff

92cc748

Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release September 2, 2026 22:36 — with GitHub Actions Active

docstrings

1924636

Signed-off-by: GitHub <noreply@github.com>

Boss-1s deployed to release September 2, 2026 22:37 — with GitHub Actions Active

TheCommCraft requested changes Sep 2, 2026

View reviewed changes

Comment thread scratchattach/eventhandlers/cloud_server.py Outdated

Comment thread scratchattach/eventhandlers/_base.py Outdated

Comment thread scratchattach/eventhandlers/_base.py Outdated

resolve TimMcCool#723 (comment)

2a5dfc9

Co-authored-by: TheCommCraft <79996518+TheCommCraft@users.noreply.github.com> Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 2, 2026 23:01 — with GitHub Actions Active

resolve

5b0ff22

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 2, 2026 23:04 — with GitHub Actions Active

revert

b80c260

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 2, 2026 23:05 — with GitHub Actions Active

Boss-1s requested a review from TheCommCraft September 2, 2026 23:06

TheCommCraft requested changes Sep 3, 2026

View reviewed changes

apply changes

f81bce7

TheCommCraft deployed to release September 3, 2026 08:36 — with GitHub Actions Active

Merge branch 'TimMcCool:main' into semver3-secure-ws

1d0bf6e

Boss-1s deployed to release September 3, 2026 13:29 — with GitHub Actions Active

Boss-1s added 4 commits September 3, 2026 15:21

.

e905eb8

Signed-off-by: GitHub <noreply@github.com>

replace all references to scratchattach/2.0.0

16b58b7

Signed-off-by: GitHub <noreply@github.com>

fatal: stale assignment to nonexistent arg websocketclass

6243190

Signed-off-by: GitHub <noreply@github.com>

Merge branch 'main' into semver3-secure-ws

c476784

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 3, 2026 15:43 — with GitHub Actions Active

rename skip_forward and annotate type

65a4ddd

TheCommCraft deployed to release September 3, 2026 18:23 — with GitHub Actions Active

Boss-1s commented Sep 3, 2026

View reviewed changes

use serveonce instead of serveforever

b77df00

TheCommCraft deployed to release September 3, 2026 20:12 — with GitHub Actions Active

prevent 100% CPU usage

3b96888

Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 4, 2026 03:47 — with GitHub Actions Active

Boss-1s commented Sep 4, 2026

View reviewed changes

TheCommCraft requested changes Sep 4, 2026

View reviewed changes

Comment thread scratchattach/eventhandlers/_base.py Outdated

revert 3b96888

1b34b7c

Co-authored-by: TheCommCraft <79996518+TheCommCraft@users.noreply.github.com> Signed-off-by: Boss_1s <95505913+Boss-1s@users.noreply.github.com>

Boss-1s deployed to release September 4, 2026 11:32 — with GitHub Actions Active

Merge branch 'TimMcCool:main' into semver3-secure-ws

b4047e5

Boss-1s deployed to release September 5, 2026 15:03 — with GitHub Actions Active

Conversation

Boss-1s commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Tasks

Tests

Notes

Uh oh!

Boss-1s commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheCommCraft commented Sep 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TheCommCraft Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

TheCommCraft Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TheCommCraft commented Sep 3, 2026

Uh oh!

Boss-1s Sep 3, 2026

Choose a reason for hiding this comment

Uh oh!

Boss-1s Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

TheCommCraft Sep 4, 2026

Choose a reason for hiding this comment

Uh oh!

TheCommCraft commented Sep 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Boss-1s commented Aug 26, 2026 •

edited

Loading

Boss-1s commented Aug 30, 2026 •

edited

Loading