It could be good to add option to remove Cloud Script revision because I have currently 683 revisions and it still growing...
It could be good to add option to remove Cloud Script revision because I have currently 683 revisions and it still growing...
This amuses me because my revision history is also starting to stack up and it be nice to "invalidate" or "obliberate" revisions.
But I think the only reason why this would be a priority would be if a client could somehow call cloudscripts of an older revision (which is part of the client API) thus enabling some of the cheats that I wrote for testing purposes or seriously damage the integrity of player data due to such complications.
I do think its necessary to prevent the client from being able to do that.
Ah yes, this would be great! Not only might this shave off some of PlayFab's storage burden, but it would also make it much easier for humans to sort through the noise when searching through revisions that matter.
The fundamental issue here is that there is no concept of commit/checkin where experiments and tests, such as revisions that sprinkle debug logs everywhere are only of use to the current engineer who might be bumbling around and will never be deployed to a live environment.
Versions of this that might alleviate the issue would be:
And of course, the ability to delete revisions would be most welcome on top of any of this.
Client access to previous revisions of cloud scripts is also a huge security flaw. Removing revisions would help, but ideally we could disable client access to this functionality as well.
Yes, this the ability to call previous Cloud Code revision from the Client is a huge, possibly game-breaking security flaw.
What even is the intended use-case for this?
Kurt's idea of having an option to disable this functionality (calling deprecated cloud code revisions) in the Game Manager is a great temporary workaround, as it would probably not take that much effort to implement (as say, being able to delete previous revisions) and would effectively fix this massive security flaw.
I think the intended use case being to be able to update cloudscript without breaking existing clients (in case you change a function's return value or its parameters).
But without manual revision management this isn't usable at all, since by doing to you lock yourself out from being able to update the scripts remotely. Version control and "API version" should be two different things.
It is possible to use this, and we in fact use it. It's useful for not breaking older versions of the game, by calling specific versions of CloudScript. We have a custom versioning system and we NEVER call the "LIVE" revision, we just call the specific version in our configuration.
I absolutely agree only a week working with playfab and its the only annoying feature i've encountered yest. aside from a not so clear limit system. i want to buy an indie or pro liscense but the limits for each acount is not documented anywhere.
You can find all the info on the difference in limits between Essentials and Indie/Pro here: https://community.playfab.com/questions/13455/limits-for-pro-tier.htm.
This is a great idea. Because as far as I know, we can't test CloudScript offline because there isn't a local simulation for PlayFab API we have a lot of similar revisions as well, which were created while testing. The possibility for clients to call older revisions is a big security risk too, the only protection is never ever having had a cheat sensitive function in CloudScript, but even then game designs may change so a normal function now would be an exploit later.
So, having been released in the Game Manager, it looks great... Any plans for an update to the Admin API to match?
We will in a future release, but we wanted to get this in now, rather than wait on that update.
+1 We would greatly benefit from a way to do this via the API
Share your great idea, or help out by voting for other people's ideas.