godotengine
Misleading documentation for SceneMultiplayer authentication
Your Godot version:
4.4.1
Issue description:
The SceneMultiplayer authentication docs (specifically the docs for peer_authenticating and complete_auth) seem to imply that any given peer does not receive the peer_connected signal for another peer until it has authenticated with that specific peer (by both of them calling complete_auth on each other's peer IDs), but that is not what is happening from what I can tell.
I can only see the authentication handshake happen between a client peer and the server, and once the authentication with the server has completed, peer_connected signals are emitted for all others peers on a peer, even though complete_auth was never called for those peers.
I'm not terribly familiar with the godot source code, but that also appears to be what is happening. _admit_peer checks if the server is calling the function, and if so, forwards peer IDs to other peers. Clients receive this message, check that they aren't the server, and that the message came from the server, and then add the peers. The comment in the code also indicates that these peer connection messages are just being relayed over the server (if relaying is enabled), and the clients automatically accept the peers, without authenticating first.
Edit: I forgot to mention, I'll happily create a PR with updated documentation, but I first wanted to check if I understood the authentication mechanism correctly 👍
URL to the documentation page: https://docs.godotengine.org/en/stable/classes/class_scenemultiplayer.html#class-scenemultiplayer-signal-peer-authenticating
https://docs.godotengine.org/en/stable/classes/class_scenemultiplayer.html#class-scenemultiplayer-method-complete-auth
Does:
- https://github.com/godotengine/godot-docs/pull/10719
Cover this?
Not entirely I think. While it does help make the the authentication mechanism more clear and discoverable (and indicates that it only happens between client and server, not between each peer), the documentation on complete_auth and peer_authenticating would still mislead readers to think that each peer authenticates with each other peer.