Prevent get_me from causing desyncs

[oli-obk]

The get_me function is a footgun. If used in update it will cause desyncs in multiplayer. It's mainly meant to be used in render in order to render only the local player's view or in case all views are the same, possibly highlight the local player's character specially or sth.

• just make the function fail unconditionally if invoked from anyhwere but render
• remove the function entirely and pass the "me" Peer as an argument to render

[orsinium]

Thank you!

In the last release, I've introduced settings, like UI colors and interface language. The settings are device-specific and hence require passing a Peer as an argument. Typically, you don't need this info for "non-me" peers since it's a purely display info. And typically, you want to use this info in boot, at least to load fonts for the correct encoding but maybe also load mo files. All of that is still used only in render but should be preloaded once on boot.

Another problem is that most of the languages allow only primitive types in functions exposed to wasm and won't do magical conversion to the Peer type. And in most of the languages (everything but Go and C) users define the export directly, without a safe wrapper from the SDK.

Considering all of this, I plan to do the following steps:

1. Emit an error message if get_me is called from update
2. Rethink and expand the Multiplayer docs to better explain the right mental model of making multiplayer games for Firefly and the dangers of get_me.
3. Eventually, add multiplayer support into the test framework and built-in assertions for detecting a state drift.

[orsinium]

Oh, another thing I plan to do: see for every SDK if I can implement a marker to distinguish Peer obtained from list_peers and from get_me and forbid passing the latter into read_pad and read_input. Because the most common pitfall is using me for reading inputs.

[oli-obk]

If you want to enter cursed territory wrt wasm and get_me, it is possible to use wasm reference types to ensure this at runtime 😅 basically get_me produces interpreter-tagged values that can't be modified in user code.

Tho that may be a bit over the top for a non-security issue