Harden Playerbot authorization and random bot provisioning (#478)

* Harden player-owned bot command authorization

* Constrain random bot mounts to Classic eligibility

* Create only missing random bot classes

* Guard unsupported random bot classes

* Authorize raid warnings by dispatched command

* Guard random bot race policy assertions

* Add project headers to Playerbot policy files

* Use command-specific Playerbot authorization

* Keep master-relative bot tactics owner-only

Author: MadMaxMangos

src/modules/Bots/playerbot/PlayerbotAI.cpp

@@ -650,11 +650,6 @@ void PlayerbotAI::Reset()
  */
 void PlayerbotAI::HandleCommand(uint32 type, const string& text, Player& fromPlayer)
 {
-    if (!GetSecurity()->CheckLevelFor(PLAYERBOT_SECURITY_INVITE, type != CHAT_MSG_WHISPER, &fromPlayer))
-    {
-        return;
-    }
-
     if (type == CHAT_MSG_ADDON)
     {
         return;
@@ -682,18 +677,24 @@ void PlayerbotAI::HandleCommand(uint32 type, const string& text, Player& fromPla
     // and because a channel line is fanned out to every random bot in the world, one "~who"
     // in trade chat returned a whisper from each of them at once -- disclosure and a
     // whisper flood from a single message. It now needs TALK, the level the module already
-    // uses to mean "may hold a conversation with this bot"; everything else still needs
-    // full control.
-    PlayerbotSecurityLevel required = (filtered.find("who") == 0)
-        ? PLAYERBOT_SECURITY_TALK
-        : PLAYERBOT_SECURITY_ALLOW_ALL;
+    // uses to mean "may hold a conversation with this bot". Follow, stay and attack use the
+    // same-subgroup tactical tier; everything else still needs full control.
+    bool const dispatchesRaidWarning =
+        type == CHAT_MSG_RAID_WARNING &&
+        filtered.find(bot->GetName()) != string::npos &&
+        filtered.find("award") == string::npos;
+
+    // Keep this check after all prefix/filter normalization. The same routing decision is
+    // used below so authorization always describes the command that will actually run.
+    PlayerbotSecurityLevel required =
+        GetPlayerbotDispatchedCommandSecurityLevel(filtered, dispatchesRaidWarning);
 
     if (!GetSecurity()->CheckLevelFor(required, type != CHAT_MSG_WHISPER, &fromPlayer))
     {
         return;
     }
 
-    if (type == CHAT_MSG_RAID_WARNING && filtered.find(bot->GetName()) != string::npos && filtered.find("award") == string::npos)
+    if (dispatchesRaidWarning)
     {
         ChatCommandHolder cmd("warning", &fromPlayer, type);
         chatCommands.push(cmd);

src/modules/Bots/playerbot/PlayerbotAIConfig.cpp

@@ -5,6 +5,7 @@
 #include "PlayerbotAIConfig.h"
 #include "playerbot.h"
 #include "RandomPlayerbotFactory.h"
+#include "RandomBotClassPolicy.h"
 #include "AccountMgr.h"
 #include "SystemConfig.h"
 
@@ -582,35 +583,36 @@ void PlayerbotAIConfig::CreateRandomBots()
 
         randomBotAccounts.push_back(accountId);
 
-        // Count the classes this loop will actually create rather than assuming ten. It
-        // creates one per playable class, and vanilla has nine -- 6 and 10 do not exist
-        // here -- so an account that was already full at nine looked incomplete against a
-        // threshold of ten and got a second full set. Every restart without a wipe
-        // therefore doubled the roster, 450 characters to 900 at eighteen per account,
-        // until the count finally cleared ten. CreateRandomBot bypasses the normal
-        // per-account character limit, so nothing else stopped it.
-        uint32 expectedChars = 0;
-        for (uint8 cls = CLASS_WARRIOR; cls < MAX_CLASSES; ++cls)
+        vector<uint8> existingClasses;
+        QueryResult* characters = CharacterDatabase.PQuery(
+            "SELECT `class` FROM `characters` WHERE `account` = '%u' UNION ALL SELECT 0",
+            accountId);
+        if (!characters)
         {
-            if (cls != 10 && cls != 6)
-            {
-                ++expectedChars;
-            }
+            sLog.outError("Unable to inspect random bot classes for account %u", accountId);
+            totalRandomBotChars += sAccountMgr.GetCharactersCount(accountId);
+            continue;
         }
 
-        int count = sAccountMgr.GetCharactersCount(accountId);
-        if (count >= (int)expectedChars)
+        do
         {
-            totalRandomBotChars += count;
-            continue;
-        }
+            existingClasses.push_back(characters->Fetch()[0].GetUInt8());
+        } while (characters->NextRow());
+
+        delete characters;
 
-        RandomPlayerbotFactory factory(accountId);
-        for (uint8 cls = CLASS_WARRIOR; cls < MAX_CLASSES; ++cls)
+        vector<uint8> missingClasses = ai::GetMissingRandomBotClasses(existingClasses);
+        if (!missingClasses.empty())
         {
-            if (cls != 10 && cls != 6)
+            RandomPlayerbotFactory factory(accountId);
+            for (vector<uint8>::const_iterator itr = missingClasses.begin();
+                 itr != missingClasses.end(); ++itr)
             {
-                factory.CreateRandomBot(cls);
+                if (!factory.CreateRandomBot(*itr))
+                {
+                    sLog.outError("Unable to create missing random bot class %u for account %u",
+                                  *itr, accountId);
+                }
             }
         }
 

src/modules/Bots/playerbot/PlayerbotFactory.cpp

@@ -7,6 +7,7 @@
 #include "SQLStorages.h"
 #include "ItemPrototype.h"
 #include "PlayerbotAIConfig.h"
+#include "PlayerbotMountPolicy.h"
 #include "AccountMgr.h"
 #include "DBCStore.h"
 #include "SharedDefines.h"
@@ -2111,96 +2112,29 @@ void PlayerbotFactory::InitAmmo()
  */
 void PlayerbotFactory::InitMounts()
 {
-    // This used to group every SPELL_AURA_MOUNTED spell by speed and then learn one from
-    // EVERY group, twice over, with no check of level, class, race or riding skill. Two
-    // consequences, both confirmed against the live character_spell table: all 200 bots
-    // knew 3363 Summon Riding Gryphon -- a 499% flyer, the sole member of its speed group,
-    // on characters as low as level 1 -- and class mounts leaked across classes, with the
-    // Paladin Warhorse and Warlock Felsteed turning up on priests, rogues and druids.
-    //
-    // Riding skill is the real gate and InitSkills has already set it from the bot's level:
-    // 75 buys the 60% mount at 40, 150 buys the 100% mount at 60.
     uint32 riding = bot->GetSkillValue(SKILL_RIDING);
-    if (riding < 75)
-    {
-        return;
-    }
-
-    // Effect base points carry speed-minus-one, so a 60% mount reads 59 and a 100% reads 99.
-    // Anything above that is a flying mount, which 1.12 does not have.
-    const int32 maxIncrease = (riding >= 150) ? 99 : 59;
-
-    const uint32 raceMask = bot->getRaceMask();
-    const uint32 classMask = bot->getClassMask();
-
-    map<int32, vector<uint32> > spells;
-
-    for (uint32 spellId = 0; spellId < sSpellStore.GetNumRows(); ++spellId)
+    vector<uint32> candidates = GetPlayerbotMountSpells(bot->getRace(), bot->getClass(), riding);
+    vector<uint32> available;
+    for (vector<uint32>::const_iterator itr = candidates.begin(); itr != candidates.end(); ++itr)
     {
-        SpellEntry const *spellInfo = sSpellStore.LookupEntry(spellId);
-        if (!spellInfo || spellInfo->EffectAura[0] != SPELL_AURA_MOUNTED)
+        SpellEntry const* spellInfo = sSpellStore.LookupEntry(*itr);
+        if (!spellInfo)
         {
             continue;
         }
 
-        if (GetSpellCastTime(spellInfo) < 500 || GetSpellDuration(spellInfo) != -1)
+        int32 speedIncrease = max(spellInfo->EffectBasePoints[1], spellInfo->EffectBasePoints[2]);
+        if (IsPlayerbotMountSpellCompatible(
+                riding, spellInfo->EffectAura[0] == SPELL_AURA_MOUNTED,
+                GetSpellCastTime(spellInfo), GetSpellDuration(spellInfo), speedIncrease))
         {
-            continue;
+            available.push_back(*itr);
         }
-
-        int32 effect = max(spellInfo->EffectBasePoints[1], spellInfo->EffectBasePoints[2]);
-        if (effect < 50 || effect > maxIncrease)
-        {
-            continue;
-        }
-
-        // Class mounts carry a SkillLineAbility row that names the class -- Warhorse is
-        // classMask 2, Felsteed is 256 -- so where one exists it must be honoured. Racial
-        // and vendor mounts have no row at all in 1.12 (Brown Horse 458 and the rest), so
-        // an absent row cannot mean "forbidden" or every bot would end up on foot.
-        SkillLineAbilityMapBounds bounds = sSpellMgr.GetSkillLineAbilityMapBounds(spellId);
-        bool restricted = false;
-        bool permitted = false;
-        for (SkillLineAbilityMap::const_iterator i = bounds.first; i != bounds.second; ++i)
-        {
-            SkillLineAbilityEntry const* ability = i->second;
-            if (!ability->RaceMask && !ability->ClassMask)
-            {
-                continue;
-            }
-
-            restricted = true;
-            if (ability->RaceMask && !(ability->RaceMask & raceMask))
-            {
-                continue;
-            }
-            if (ability->ClassMask && !(ability->ClassMask & classMask))
-            {
-                continue;
-            }
-
-            permitted = true;
-            break;
-        }
-
-        if (restricted && !permitted)
-        {
-            continue;
-        }
-
-        spells[effect].push_back(spellId);
-    }
-
-    // One mount, at the best speed this bot has the skill for -- not one from every tier.
-    if (spells.empty())
-    {
-        return;
     }
 
-    vector<uint32>& ids = spells.rbegin()->second;
-    if (!ids.empty())
+    if (!available.empty())
     {
-        bot->learnSpell(ids[urand(0, ids.size() - 1)], false);
+        bot->learnSpell(available[urand(0, available.size() - 1)], false);
     }
 }
 

src/modules/Bots/playerbot/PlayerbotMountPolicy.h

@@ -0,0 +1,162 @@
+/**
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * MaNGOS is a full featured server for World of Warcraft, supporting
+ * the following clients: 1.12.x, 2.4.3, 3.3.5a, 4.3.4a and 5.4.8
+ *
+ * Copyright (C) 2005-2026 MaNGOS <https://www.getmangos.eu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ * World of Warcraft, and all World of Warcraft or Warcraft art, images,
+ * and lore are copyrighted by Blizzard Entertainment, Inc.
+ */
+
+#pragma once
+
+#include "SharedDefines.h"
+
+#include <vector>
+
+namespace ai
+{
+    inline bool IsPlayerbotMountSpellCompatible(uint32 riding, bool isMountAura,
+                                                 int32 castTime, int32 duration,
+                                                 int32 speedIncrease)
+    {
+        // Classic mount rows cast for at least 500 ms, last indefinitely, and store their
+        // speed increase minus one in EffectBasePoints: 59 means 60%, 99 means 100%.
+        if (riding < 75 || !isMountAura || castTime < 500 || duration != -1)
+        {
+            return false;
+        }
+        return speedIncrease == (riding >= 150 ? 99 : 59);
+    }
+
+    inline void AddPlayerbotRacialMounts(std::vector<uint32>& spells, uint8 race, bool fast)
+    {
+        switch (race)
+        {
+            case RACE_HUMAN:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23227, 23228, 23229});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {458, 470, 472, 6648});
+                }
+                break;
+            case RACE_ORC:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23250, 23251, 23252});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {580, 6653, 6654});
+                }
+                break;
+            case RACE_DWARF:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23238, 23239, 23240});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {6777, 6898, 6899});
+                }
+                break;
+            case RACE_NIGHTELF:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23219, 23221, 23338});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {8394, 10789, 10793});
+                }
+                break;
+            case RACE_UNDEAD:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {17465, 23246});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {17462, 17463, 17464});
+                }
+                break;
+            case RACE_TAUREN:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23247, 23248, 23249});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {18989, 18990});
+                }
+                break;
+            case RACE_TROLL:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23241, 23242, 23243});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {8395, 10796, 10799});
+                }
+                break;
+            case RACE_GNOME:
+                if (fast)
+                {
+                    spells.insert(spells.end(), {23222, 23223, 23225});
+                }
+                else
+                {
+                    spells.insert(spells.end(), {10873, 10969, 17453, 17454});
+                }
+                break;
+        }
+    }
+
+    inline void AddPlayerbotClassMount(std::vector<uint32>& spells, uint8 race,
+                                       uint8 cls, bool fast)
+    {
+        if (cls == CLASS_PALADIN && (race == RACE_HUMAN || race == RACE_DWARF))
+        {
+            spells.push_back(fast ? 23214 : 13819);
+        }
+        else if (cls == CLASS_WARLOCK &&
+                 (race == RACE_HUMAN || race == RACE_ORC ||
+                  race == RACE_UNDEAD || race == RACE_GNOME))
+        {
+            spells.push_back(fast ? 23161 : 5784);
+        }
+    }
+
+    inline std::vector<uint32> GetPlayerbotMountSpells(uint8 race, uint8 cls, uint32 riding)
+    {
+        std::vector<uint32> spells;
+        if (riding < 75)
+        {
+            return spells;
+        }
+
+        bool const fast = riding >= 150;
+        AddPlayerbotRacialMounts(spells, race, fast);
+        AddPlayerbotClassMount(spells, race, cls, fast);
+        return spells;
+    }
+}