From 81d3d10a2675ae38eb26bae0af5e816996cdded5 Mon Sep 17 00:00:00 2001
From: Andrew Siegman <blerrnk@gmail.com>
Date: Tue, 9 Jul 2019 17:56:38 -0500
Subject: [PATCH 1/2] No payload should not be authentic player

---
 src/master/master.js      | 2 +-
 src/master/master.test.js | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/master/master.js b/src/master/master.js
index cca35a604..f0ac77738 100644
--- a/src/master/master.js
+++ b/src/master/master.js
@@ -69,7 +69,7 @@ export const isActionFromAuthenticPlayer = ({
   }
 
   if (!action.payload) {
-    return true;
+    return false;
   }
 
   const hasCredentials = Object.keys(gameMetadata.players).some(key => {
diff --git a/src/master/master.test.js b/src/master/master.test.js
index 64b7c8c3e..40692196b 100644
--- a/src/master/master.test.js
+++ b/src/master/master.test.js
@@ -444,14 +444,14 @@ describe('isActionFromAuthenticPlayer', () => {
       action = {};
     });
 
-    test('the action is authentic', async () => {
+    test('the action is not authentic', async () => {
       const result = isActionFromAuthenticPlayer({
         action,
         gameMetadata,
         playerID,
       });
 
-      expect(result).toBeTruthy();
+      expect(result).toBeFalsy();
     });
   });
 

From f9ba9c38c44a7249b334694b949a810d02ecef0e Mon Sep 17 00:00:00 2001
From: Andrew Siegman <blerrnk@gmail.com>
Date: Fri, 12 Jul 2019 00:11:48 -0500
Subject: [PATCH 2/2] unless no payload necessary

---
 src/master/master.js      |  8 ++++----
 src/master/master.test.js | 32 ++++++++++++++++----------------
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/master/master.js b/src/master/master.js
index f0ac77738..b14910a22 100644
--- a/src/master/master.js
+++ b/src/master/master.js
@@ -68,10 +68,6 @@ export const isActionFromAuthenticPlayer = ({
     return true;
   }
 
-  if (!action.payload) {
-    return false;
-  }
-
   const hasCredentials = Object.keys(gameMetadata.players).some(key => {
     return !!(
       gameMetadata.players[key] && gameMetadata.players[key].credentials
@@ -81,6 +77,10 @@ export const isActionFromAuthenticPlayer = ({
     return true;
   }
 
+  if (!action.payload) {
+    return false;
+  }
+
   if (!action.payload.credentials) {
     return false;
   }
diff --git a/src/master/master.test.js b/src/master/master.test.js
index 40692196b..7970246b7 100644
--- a/src/master/master.test.js
+++ b/src/master/master.test.js
@@ -439,22 +439,6 @@ describe('isActionFromAuthenticPlayer', () => {
     });
   });
 
-  describe('when action contains no payload', () => {
-    beforeEach(() => {
-      action = {};
-    });
-
-    test('the action is not authentic', async () => {
-      const result = isActionFromAuthenticPlayer({
-        action,
-        gameMetadata,
-        playerID,
-      });
-
-      expect(result).toBeFalsy();
-    });
-  });
-
   describe('when game has no credentials', () => {
     beforeEach(() => {
       gameMetadata = {
@@ -476,6 +460,22 @@ describe('isActionFromAuthenticPlayer', () => {
   });
 
   describe('when game has credentials', () => {
+    describe('when action contains no payload', () => {
+      beforeEach(() => {
+        action = {};
+      });
+
+      test('the action is not authentic', async () => {
+        const result = isActionFromAuthenticPlayer({
+          action,
+          gameMetadata,
+          playerID,
+        });
+
+        expect(result).toBeFalsy();
+      });
+    });
+
     describe('when action contains no credentials', () => {
       beforeEach(() => {
         action = {