Limit multiplayer WebSocket connections per IP address

[Copilot]

A single IP could open unlimited concurrent multiplayer WebSocket connections, enabling resource exhaustion or abuse.

Changes

• server/multiplayer/constants.js: Added MAX_CONNECTIONS_PER_IP = 50
• server/multiplayer/handle-wss-connection.js: Added a module-level connectionsByIp Map; rejects new connections from IPs at or above the limit with an error message; decrements the counter on close

const ipConnections = connectionsByIp.get(ip) ?? 0;
if (ipConnections >= MAX_CONNECTIONS_PER_IP) {
  ws.send(JSON.stringify({
    type: 'error',
    message: `Too many connections from your IP address. The limit is ${MAX_CONNECTIONS_PER_IP}.`
  }));
  return false;
}

connectionsByIp.set(ip, ipConnections + 1);
ws.on('close', () => {
  const current = connectionsByIp.get(ip) ?? 0;
  if (current <= 1) { connectionsByIp.delete(ip); }
  else { connectionsByIp.set(ip, current - 1); }
});

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add a limit to the number of multiplayer connections that can come from a single IP address</issue_title>
<issue_description></issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add a limit to the number of multiplayer connections that can come from a single IP address #455

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.