feat: add Battle.net presence detection through BGS

catapult-api/Dockerfile

@@ -7,27 +7,39 @@ RUN apk add --no-cache git
 COPY gradlew settings.gradle.kts build.gradle.kts gradle.properties ./
 COPY gradle ./gradle
 COPY catapult-common/build.gradle.kts ./catapult-common/
+COPY catapult-bgs/build.gradle.kts ./catapult-bgs/
 COPY catapult-api/build.gradle.kts ./catapult-api/
 COPY catapult-web/build.gradle.kts ./catapult-web/
 RUN ./gradlew :catapult-api:dependencies --no-daemon -q
 
 COPY catapult-common/src ./catapult-common/src
+COPY catapult-bgs/src ./catapult-bgs/src
 COPY catapult-api/src ./catapult-api/src
 COPY CHANGELOG.md ./
 COPY .git ./.git
 # bootJar alone: `build` would also run the tests and leave a second (-plain) jar for the COPY below
 RUN ./gradlew :catapult-api:bootJar --no-daemon
 
-FROM eclipse-temurin:25-jre-alpine
+# glibc base: Chromium (Battle.net login, Playwright) does not run on musl
+FROM eclipse-temurin:25-jre-noble
 
 WORKDIR /app
 
-RUN apk add --no-cache curl jq
-RUN addgroup -S catapult && adduser -S catapult -G catapult
+RUN apt-get update && apt-get install -y --no-install-recommends curl jq && rm -rf /var/lib/apt/lists/*
+RUN groupadd --system catapult && useradd --system --create-home --home-dir /home/catapult --gid catapult catapult
 
 COPY --from=builder /app/catapult-api/build/libs/*.jar app.jar
 
-RUN chown catapult:catapult app.jar
+# Chromium and its OS libraries are installed at build time (never at startup) with Playwright's CLI, run from
+# the boot jar's classpath through PropertiesLauncher; the browsers live in a folder the catapult user can read
+ENV PLAYWRIGHT_BROWSERS_PATH=/ms-playwright
+RUN java -Dloader.main=com.microsoft.playwright.CLI -cp app.jar \
+        org.springframework.boot.loader.launch.PropertiesLauncher install --with-deps chromium \
+    && rm -rf /var/lib/apt/lists/* \
+    && chown -R catapult:catapult /ms-playwright app.jar
+
+# Only Chromium is baked in: Playwright.create() must not try to download the other browsers at runtime
+ENV PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1
 
 USER catapult
 

catapult-api/build.gradle.kts

@@ -32,6 +32,7 @@ val springCloudContextVersion = "5.0.4"
 
 dependencies {
     implementation(project(":catapult-common"))
+    implementation(project(":catapult-bgs"))
 
     implementation("org.springframework.boot:spring-boot-starter-actuator")
     implementation("org.springframework.boot:spring-boot-starter-data-jpa")
@@ -61,6 +62,7 @@ dependencies {
     implementation("io.sentry:sentry-spring-boot-4-starter")
     implementation("io.sentry:sentry-logback")
     implementation("org.jsoup:jsoup:$jsoupVersion")
+    implementation("com.microsoft.playwright:playwright:1.64.0")
     implementation("org.commonmark:commonmark:$commonmarkVersion")
     implementation("org.springframework.cloud:spring-cloud-context:$springCloudContextVersion")
 
@@ -133,7 +135,7 @@ val englishConventions = tasks.register<Test>("englishConventions") {
     testClassesDirs = testSourceSet.output.classesDirs
     classpath = testSourceSet.runtimeClasspath
     filter.includeTestsMatching("*EnglishConventionsTest")
-    listOf("catapult-common", "catapult-web").forEach { module ->
+    listOf("catapult-common", "catapult-bgs", "catapult-web").forEach { module ->
         inputs.dir(rootProject.file("$module/src"))
             .withPropertyName("${module}Sources")
             .withPathSensitivity(PathSensitivity.RELATIVE)

catapult-api/src/main/java/fr/enimaloc/catapult/api/admin/ApiAdminBattleNetAccountsController.java

@@ -0,0 +1,57 @@
+package fr.enimaloc.catapult.api.admin;
+
+import fr.enimaloc.catapult.api.ApiPaths;
+import fr.enimaloc.catapult.service.battlenet.BattleNetServiceAccountAdmin;
+import fr.enimaloc.catapult.service.battlenet.BattleNetServiceAccountAdmin.AccountDto;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+@RestController
+@RequestMapping(ApiPaths.ADMIN + "/battlenet-accounts")
+@RequiredArgsConstructor
+@ConditionalOnBooleanProperty("battlenet.enabled")
+public class ApiAdminBattleNetAccountsController {
+
+    private final BattleNetServiceAccountAdmin accounts;
+
+    @GetMapping
+    public List<AccountDto> list() {
+        return accounts.list();
+    }
+
+    /** 202: the account is stored and its login runs in the background (poll the list for its auth state). */
+    @PostMapping
+    public ResponseEntity<AccountDto> create(@RequestBody Map<String, String> body) {
+        return ResponseEntity.accepted().body(
+                accounts.create(body.get("label"), body.get("email"), body.get("password")));
+    }
+
+    /** The 2FA code of a login waiting for one; 409 when none is. */
+    @PostMapping("/{id}/code")
+    public ResponseEntity<Void> submitCode(@PathVariable UUID id, @RequestBody Map<String, String> body) {
+        accounts.submitCode(id, body.get("code"));
+        return ResponseEntity.accepted().build();
+    }
+
+    @PostMapping("/{id}/reauth")
+    public ResponseEntity<AccountDto> reauth(@PathVariable UUID id) {
+        return ResponseEntity.accepted().body(accounts.reauth(id));
+    }
+
+    @PatchMapping("/{id}")
+    public AccountDto update(@PathVariable UUID id, @RequestBody Map<String, Object> body) {
+        return accounts.update(id, body);
+    }
+
+    @DeleteMapping("/{id}")
+    public ResponseEntity<Void> delete(@PathVariable UUID id) {
+        accounts.delete(id);
+        return ResponseEntity.noContent().build();
+    }
+}

catapult-api/src/main/java/fr/enimaloc/catapult/api/channel/ChannelDashboardAssembler.java

@@ -8,6 +8,7 @@
 import fr.enimaloc.catapult.common.dto.channel.DtddMappingProposalDto;
 import fr.enimaloc.catapult.common.dto.channel.DtddMappingStatusDto;
 import fr.enimaloc.catapult.common.dto.channel.GameDto;
+import fr.enimaloc.catapult.common.dto.channel.BattleNetData;
 import fr.enimaloc.catapult.common.dto.channel.MinecraftData;
 import fr.enimaloc.catapult.common.dto.channel.ObsData;
 import fr.enimaloc.catapult.common.dto.channel.TwitchatData;
@@ -51,6 +52,7 @@
 import fr.enimaloc.catapult.service.igdb.AdminCclService;
 import fr.enimaloc.catapult.api.CustomBindingViews;
 import fr.enimaloc.catapult.service.igdb.IgdbService;
+import fr.enimaloc.catapult.service.battlenet.BattleNetLinkStateService;
 import fr.enimaloc.catapult.service.minecraft.MinecraftLinkStateService;
 import fr.enimaloc.catapult.service.notification.TwitchatWidgetSettingsService;
 import lombok.RequiredArgsConstructor;
@@ -92,6 +94,8 @@ public class ChannelDashboardAssembler {
     private final OAuthTokenRepository oAuthTokenRepository;
     // Only present when minecraft.enabled (the service is @ConditionalOnBooleanProperty).
     private final Optional<MinecraftLinkStateService> minecraftLinkStates;
+    // Only present when battlenet.enabled.
+    private final Optional<BattleNetLinkStateService> battleNetLinkStates;
     private final TwitchatWidgetSettingsService twitchatWidgetSettingsService;
     private final RaidRestoreGateService raidRestoreGate;
     private final CustomBindingViews customBindingViews;
@@ -147,6 +151,7 @@ public ChannelPageData page(UserAccount viewer, UserAccount channel, String user
                 steamData(channel, owner),
                 xboxEnabled ? new XboxData(hasXboxToken(channel)) : null,
                 owner ? minecraftData(channel) : null,
+                owner ? battleNetData(channel) : null,
                 owner ? obsData(widget) : null,
                 owner ? TwitchatData.of(widget.getTwitchatBranch()) : null,
                 custom,
@@ -249,6 +254,15 @@ private MinecraftData minecraftData(UserAccount channel) {
                 .orElse(null);
     }
 
+    /** The Battle.net link as the connect endpoint states it, null without Battle.net or when it's unavailable. */
+    private BattleNetData battleNetData(UserAccount channel) {
+        return battleNetLinkStates
+                .map(service -> service.state(channel))
+                .filter(state -> !BattleNetLinkStateService.UNAVAILABLE.equals(state.status()))
+                .map(state -> new BattleNetData(state.status(), state.battleTag(), state.serviceAccountBattleTag()))
+                .orElse(null);
+    }
+
     /** The Twitchat relay's OBS settings, without the password itself. */
     private static ObsData obsData(TwitchatWidgetSettings settings) {
         return new ObsData(settings.isEnabled(), settings.getObsHost(), settings.getObsPort(),

catapult-api/src/main/java/fr/enimaloc/catapult/api/connect/ApiBattleNetConnectController.java

@@ -0,0 +1,54 @@
+package fr.enimaloc.catapult.api.connect;
+
+import fr.enimaloc.catapult.api.ApiPaths;
+import fr.enimaloc.catapult.api.ApiUserResolver;
+import fr.enimaloc.catapult.api.error.ApiProblem;
+import fr.enimaloc.catapult.common.dto.connect.BattleNetLinkStateResponse;
+import fr.enimaloc.catapult.common.error.ErrorCode;
+import fr.enimaloc.catapult.domain.account.UserAccount;
+import fr.enimaloc.catapult.service.battlenet.BattleNetFriendService;
+import fr.enimaloc.catapult.service.battlenet.BattleNetGateService;
+import fr.enimaloc.catapult.service.battlenet.BattleNetLinkStateService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.UUID;
+
+/**
+ * A member's own Battle.net link. Linking itself goes through Blizzard's OAuth flow (see
+ * {@code CatapultOAuth2UserService}); this only states the link and leaves it. Deliberately not transactional:
+ * unenrolling commits its own transaction before the bot and the dashboards are told.
+ */
+@RestController
+@RequestMapping(ApiPaths.USER + "/links/battlenet")
+@RequiredArgsConstructor
+@ConditionalOnBooleanProperty("battlenet.enabled")
+public class ApiBattleNetConnectController {
+
+    private final BattleNetFriendService friendService;
+    private final BattleNetLinkStateService linkStates;
+    private final BattleNetGateService gateService;
+    private final ApiUserResolver userResolver;
+
+    @PreAuthorize("@authz.isSelf(#userId)")
+    @GetMapping
+    public BattleNetLinkStateResponse status(@PathVariable UUID userId, @AuthenticationPrincipal Jwt jwt) {
+        return linkStates.state(userResolver.viewer(jwt));
+    }
+
+    @PreAuthorize("@authz.isSelf(#userId)")
+    @DeleteMapping
+    @ResponseStatus(HttpStatus.NO_CONTENT)
+    public void unenroll(@PathVariable UUID userId, @AuthenticationPrincipal Jwt jwt) {
+        UserAccount user = userResolver.viewer(jwt);
+        if (!gateService.isAvailableFor(user)) {
+            throw new ApiProblem(ErrorCode.FEATURE_DISABLED, "Battle.net is not available for this account");
+        }
+        friendService.unenroll(user);
+    }
+}

catapult-api/src/main/java/fr/enimaloc/catapult/config/OAuth2ClientConfig.java

@@ -70,8 +70,8 @@ public ClientRegistrationRepository clientRegistrationRepository() {
         }
 
         if (configured(battleNetClientId, battleNetClientSecret)) {
+            // No "openid": it would switch Spring to the OIDC flow and bypass CatapultOAuth2UserService; Blizzard's userinfo needs no scope.
             registrations.add(authorizationCode("battlenet", battleNetClientId, battleNetClientSecret)
-                .scope("openid")
                 .authorizationUri("https://oauth.battle.net/authorize")
                 .tokenUri("https://oauth.battle.net/token")
                 .userInfoUri("https://oauth.battle.net/userinfo")

catapult-api/src/main/java/fr/enimaloc/catapult/domain/battlenet/BattleNetFriendLink.java

@@ -0,0 +1,52 @@
+package fr.enimaloc.catapult.domain.battlenet;
+
+import fr.enimaloc.catapult.domain.account.UserAccount;
+
+import jakarta.persistence.*;
+import lombok.Getter;
+import lombok.Setter;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "battlenet_friend_link")
+@Getter
+@Setter
+public class BattleNetFriendLink {
+
+    public enum Status {
+        PENDING, ACCEPTED, REMOVED, INVITE_REJECTED
+    }
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    private UUID id;
+
+    @OneToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "user_id", nullable = false, unique = true)
+    private UserAccount user;
+
+    @ManyToOne(fetch = FetchType.LAZY, optional = false)
+    @JoinColumn(name = "service_account_id", nullable = false)
+    private BattleNetServiceAccount serviceAccount;
+
+    /** BGS account id of the streamer (from OAuth userinfo.id). */
+    @Column(nullable = false)
+    private long bnetAccountId;
+
+    @Column(nullable = false)
+    private String battleTag;
+
+    /** Id of the invitation sent by the bot, when known. */
+    private Long invitationId;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false)
+    private Status status = Status.PENDING;
+
+    @Column(nullable = false)
+    private Instant requestedAt = Instant.now();
+
+    private Instant acceptedAt;
+}

catapult-api/src/main/java/fr/enimaloc/catapult/domain/battlenet/BattleNetServiceAccount.java

@@ -0,0 +1,77 @@
+package fr.enimaloc.catapult.domain.battlenet;
+
+import jakarta.persistence.*;
+import lombok.Getter;
+import lombok.Setter;
+import lombok.ToString;
+
+import java.time.Instant;
+import java.util.UUID;
+
+@Entity
+@Table(name = "battlenet_service_account")
+@Getter
+@Setter
+@ToString
+public class BattleNetServiceAccount {
+
+    public enum AuthState {
+        NEW, CODE_REQUIRED, READY, AUTH_FAILED
+    }
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.UUID)
+    private UUID id;
+
+    @Column(nullable = false)
+    private String label;
+
+    @ToString.Exclude
+    @Column(nullable = false)
+    private String email;
+
+    /** Battle.net password, encrypted through TokenEncryptionService. */
+    @ToString.Exclude
+    @Column(nullable = false, columnDefinition = "text")
+    private String passwordEnc;
+
+    /** Playwright storageState (cookies), encrypted through TokenEncryptionService. */
+    @ToString.Exclude
+    @Column(columnDefinition = "text")
+    private String storageStateEnc;
+
+    /** Filled from OnLogonComplete; null before the first login. */
+    private String battleTag;
+
+    /** BGS account id (equals the OAuth userinfo id); null before the first login. */
+    @Column(unique = true)
+    private Long bnetAccountId;
+
+    @Enumerated(EnumType.STRING)
+    @Column(nullable = false)
+    private AuthState authState = AuthState.NEW;
+
+    @Column(nullable = false)
+    private int fillOrder;
+
+    @Column(nullable = false)
+    private boolean friendLimitReached;
+
+    @Column(nullable = false)
+    private boolean enabled = true;
+
+    @Column(nullable = false)
+    private Instant createdAt = Instant.now();
+
+    @Column(nullable = false)
+    private Instant updatedAt = Instant.now();
+
+    /** Optimistic lock: admin edits and in-flight logins both write the account. */
+    @Version
+    private long version;
+
+    @PreUpdate
+    void onUpdate() {
+        this.updatedAt = Instant.now();
+    }
+}

catapult-api/src/main/java/fr/enimaloc/catapult/experiment/BattleNetIntegrationExperiment.java

@@ -0,0 +1,20 @@
+package fr.enimaloc.catapult.experiment;
+
+import fr.enimaloc.catapult.domain.experiment.ExperimentAssignmentRule.RuleType;
+
+/**
+ * Gate of the Battle.net feature (account linking + presence detection).
+ * Control 0 % / enabled 100 %: once ACTIVE, everyone is in
+ * enabled, so activating it in the admin works as the feature's switch.
+ */
+@ExperimentSpec(
+        key         = "battlenet.integration",
+        name        = "Intégration Battle.net",
+        description = "Liaison de compte Battle.net et détection de présence via les comptes de service (protocole BGS)",
+        variants    = {
+                @ExperimentSpec.Variant(key = "control", name = "Sans Battle.net", weight = 0, control = true),
+                @ExperimentSpec.Variant(key = "enabled", name = "Avec Battle.net", weight = 100)
+        },
+        rules = @ExperimentSpec.Rule(type = RuleType.RANDOM, percent = 100)
+)
+public class BattleNetIntegrationExperiment {}