IslandzVW / halcyon

InWorldz Halcyon 3d virtual reality world simulator
BSD 3-Clause "New" or "Revised" License
21 stars 26 forks source link

Money Enforcement on Uploads Inconsistent #418

Closed Vinhold closed 6 years ago

Vinhold commented 6 years ago

I just installed a new grid to test some other features and made this discovery: No Economy was put in place with the website (which creates the bank user and UUID setting a value for the world bank in the DB); however the Halcyon.ini did have an incorrect world UUID for the bank account, the account did not exist in the DB. Prices were set for for PriceUpload and PriceGroupCreate in Halcyon.ini. I was able to create a group with no money in my user account. But I was not allowed to upload a texture. Money test should be applied for uploads and group creation consistently. I propose this test:

Apply money payment requirement only if there is a Bank account in the DB (valid UUID check set in Halcyon.ini) and world has funds>0 and there is a Halcyon.ini money value >0 assigned to the actions in the [Economy]. Then see if the User has the funds to pay for the transaction.

appurist commented 6 years ago

We have been moving to money transfers that indicate success/fail. See Mantis 1747 (now implemented) and Mantis 3258 which is planned soon. The server code may be recognizing that the bank avatar ID is unable to receive the transfer and failing it in the case of the upload. (This would actually be a bug in the groups case, however since you cannot create a group from a script it might ignore the failure and proceed.)

I would suggest that you retest this with a valid EconomyBaseAccount (e.g. create a user named "World Bank" or something) and use that UUID. That's the way a grid economy is intended to be set up. Giving it a valid UUID may allow the upload transfer to succeed.

appurist commented 6 years ago

If we fix the inconsistency, to confirm the actual funds transfer in groups as we do for uploads, neither would work with your invalid currency account. That would fix the inconsistency (and also any hacker windows of opportunity on simultaneous groups creation) and be coded as it should be, but I think this would mean both operations would fail with your current setup. So tests with a valid UUID are definitely in order here.

Vinhold commented 6 years ago

My issue statement is that the implementation of upload fee and group creation fee, when PriceUpload and PriceGroupCreate settings in the {Economy] are set, are inconsistent. Now I can say it is incomplete and the results are not what is expected. The tests were done only using viewer dialog boxes to import and create a group. Here are a set of tests run on Halcyon release 0.9.36:

This set of tests is to examine operation of the economy process under selective conditions and record what happens to see if there are any edge cases where it fails to work as expected.

1. No Economy: This means there are no grid fees set, prices set in Halcyon.ini [Economy]: PriceUpload = 0 PriceGroupCreate = 0 and CurrencyAccount =

Test Set:

No money in user account. a. Upload a texture, a Linkset, and a mesh. Expected result: It simply happens and no fee is tested or applied. Actual Result: Texture: Opened Dialog and uploaded a texture for $0. Linkset: Opened idalog and uploaded selected item. No charge. Mesh: Opened dialog and showed $0 for upload fee.

b. Create a Group. Expected result: It simply happens and no fee is tested or applied. Actual Result: Group created, no fee or comment.

2. Partial and Full Economy: For the operation of these tests, they are essentially the same thing. PriceUpload = 1 PriceGroupCreate = 10 and CurrencyAccount =

Test Set:

No money in user account. a. Upload a texture, a Linkset, and a mesh. Expected result: It fails due to lack of funds. Offers to buy more $. Actual Result: Texture: upload failed due to lack of funds. Only a message suggesting to buy $ for use. Passed Test: Expected result. Linkset: Linkset was imported. It had no textures and therefor no upload fee was charged. FAILED. It is supposed to charge the fee for the upload with or without textures. Mesh: When selecting Calculate weights & fee, it failed due to insufficent funds. Correct test applied here.

b. Create a Group. Expected result: It creates the new group and deducts the funds from users account. Actual Result: It posted the amount to charge for creating a group. Created the group and allowed it! FAILED. Group creation should have been disallowed for lack of funds.

User has enough $ to pay all fees. a. Upload a texture, a Linkset, and a mesh. Expected result: It does it and users account deducts the amount of the fee. Actual Result: Texture uploaded after testing for funds. Did not deduct from funds. Linkset: Uploaded linkset after checking for funds. Deducted fee for all textures uploaded. No charge for the prims. Mesh: Uploaded the mesh item, charged for the textures uploaded and something else, but the land impact was 33.94... only had two textures that arrived. Charged and deducted $8.

b. Create a Group. Expected result: It does it and users account deducts the amount of the fee Actual Result: Gave the price information to create the group. No funds were deducted from users account. FAILED. Group was created and roles applied. No fee was charged.

Conclusion: No fee is charged or tested for in group creation and only textures are charged for uploads for linksets and mesh is harder to figure out what is actually getting a fee applied to it or what it is calculated on.

appurist commented 6 years ago

Linkset: Linkset was imported. It had no textures and therefor no upload fee was charged. FAILED. It is supposed to charge the fee for the upload with or without textures.

There are no charges for prim creation or uploads. This is the expected result because there is no fee.

The viewer handles the texture uploads as a convenience feature. If it did not upload the textures when there was insufficient funds, that is also working as expected, although it would be nicer if the viewer reported a failure to upload the textures more prominently. (I think it does, depending on the viewer, but only if you look at the linkset upload results pane, and it's probably not clear why it failed. At any rate, any case of poor reporting of being unable to upload the associated textures due to insufficient funds would be a viewer issue.) I'm really just adding this comment to point out that prim creation is free.

The failure to charge for group creation is definitely a surprise though! Thanks for the report.

mdickson commented 6 years ago

Charges for uploading aren't implemented in a number of places. The Mesh upload process has a placeholder for it but there is no implementation that returns a cost. Similarly for textures though for those assets the assumption is a fixed cost so there's no mechanism to return a cost to the viewer, just success/fail. But as I said none of that is implemented afaik in the current code.

Vinhold commented 6 years ago

Correction to my definition of the problem: Correct on the process of uploading a linkset, as that is literally the same as manually creating anything using prims. The limitation should only apply to uploading textures. The texture upload tests had passed. Linkset without texture is allowed only if the user has build permission on the land. So all of that is correct. Only the process for creating a group without sufficient funds is a problem. :)

appurist commented 6 years ago

So to summarize again now with the latest info, only problem 2 (b) from the list above remains?

I took a quick look and I don't see any attempt at all to apply a group creation fee (under any circumstances). Halcyon should of course support this, but I think this comes down to a request to implement group creation fees (when configured).

Vinhold commented 6 years ago

Yes. I think that is it. Halcyon.ini has the option in [Economy] section for PriceGroupCreate which does not appear to be checking the price level if it is >0 allowing anyone to create a group even if they don't have the funds.

appurist commented 6 years ago

As I said above, there's no attempt in the group creation to check or apply a fee, this would be an enhancement to add some code to do so.

However, the underlying framework is already in place to test whether a fee applies and apply it, it's just not being invoked, so I should have a fix committed pretty quickly for this.

appurist commented 6 years ago

And bam, I've committed a changes to check for and apply a group creation fee. (Pull request #461.)