fix(golf): use server-generated UUID for WebSocket client identification

[aaylward]

Summary

Fixes a security vulnerability where WebSocket client IDs were derived from RemoteAddr, causing collisions when multiple clients connect through the same proxy. Clients are now identified by a server-generated UUID assigned at connection time.

What Changed

• hub.Client gains an ID string field populated with uuid.New().String() in ServeWs
• GolfHub.getClientID now prefers client.ID over client.Conn.RemoteAddr(), with the old behavior as fallback for backward compatibility
• hub/BUILD.bazel adds @com_github_google_uuid//:uuid dependency

Testing Done

• All games_ws_backend tests pass (bazel test //domains/games/apis/games_ws_backend/...)
• Added TestGetClientID_UsesIDFieldOverRemoteAddr covering the proxy collision scenario, ID field precedence, and fallback behavior

Diagram

sequenceDiagram
    participant P as Proxy
    participant S as Server (ServeWs)
    participant H as GolfHub

    Note over P,H: Before fix — both clients get RemoteAddr "10.0.0.1:443"
    P->>S: Client A connects
    S->>H: Register Client{Conn: RemoteAddr="10.0.0.1:443"}
    P->>S: Client B connects
    S->>H: Register Client{Conn: RemoteAddr="10.0.0.1:443"}
    Note over H: ⚠️ getClientID(A) == getClientID(B) — collision

    Note over P,H: After fix — each client gets a unique UUID
    P->>S: Client A connects
    S->>H: Register Client{ID: "uuid-a", Conn: ...}
    P->>S: Client B connects
    S->>H: Register Client{ID: "uuid-b", Conn: ...}
    Note over H: ✅ getClientID(A) != getClientID(B)

Loading

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	1d4-web	4625c74	Commit Preview URL Branch Preview URL	Mar 07 2026, 06:21 AM