- Go 100%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
ad321e6ee4
Mario Kart shows a flag next to each player. A console reads it from the Nintendo account record ; the emulator only knows a REGION (Europe, USA, Japan) and never a country, so nobody had a flag on Nextendo. The chain already existed on the BAAS side — it was missing its source. It is now complete: the player picks a country on the site, this server writes country_map.json, the BAAS server fills the "country" field of the user object (which was ""), and the game sends it to the other players. The table is keyed by PID, not by BAAS user id: the BAAS server mints a per-DEVICE identifier at registration, so the one stored on the account is not the one it handles at runtime — verified in its logs, where the account's id never appears. The PID is common to both. Only the ISO alpha-2 code is stored, never country names: the site renders those in the visitor's language. |
||
| .gitignore | ||
| admin.go | ||
| admin_api.go | ||
| ban.go | ||
| bcat_cache.go | ||
| bcat_cache_test.go | ||
| country.go | ||
| country_map.go | ||
| delete_account.go | ||
| discord.go | ||
| email.go | ||
| example.env | ||
| games.go | ||
| go.mod | ||
| go.sum | ||
| history.go | ||
| internal_guard.go | ||
| internal_guard_test.go | ||
| LICENSE.md | ||
| main.go | ||
| mod_favorites.go | ||
| npln_friends.go | ||
| nro_update.go | ||
| oauth.go | ||
| oauth_test.go | ||
| online_counts.go | ||
| online_presence.go | ||
| presence.go | ||
| ratelimit.go | ||
| README.md | ||
| reports.go | ||
| reports_test.go | ||
| revocation_test.go | ||
| rotation.go | ||
| s2_crypttab.go | ||
| s2_save.go | ||
| s2_save_verify_test.go | ||
| s2_weapon_icons.go | ||
| s2_weapons.go | ||
| save.go | ||
| save_parse.go | ||
| sessions.go | ||
| signing.go | ||
| turnstile.go | ||
nextendo-account
The Nextendo Network account server — identities, friends, presence, and BCAT.
What is this?
nextendo-account is the identity and social backend for Nextendo Network. It issues and validates the account tokens the game servers trust, and serves the website's account API. In one Go process it provides:
- Accounts — registration, e-mail verification, password reset, sign-in tokens (web + NEX).
- Friends & presence — the unified friend graph and online status shared across the games.
- BCAT — the schedule/data cache titles download (e.g. Splatoon 2's VS/Coop schedule).
- Sessions & security — active-session management, bans, rate limiting, an admin space.
- Signing — signs the
nx2.NEX login tokens the game servers verify.
It is stdlib-only apart from golang.org/x/crypto, and stores its state as JSON files under a
data directory.
Running
cp example.env .env # then edit .env
go run .
Everything is configured through environment variables — see example.env. No
secrets, keys, credentials, or personal data are baked into the source: the token-signing secret,
internal key, SMTP credentials, and admin list are all read from the environment (or files) at
startup, and the admin space is closed until you configure NEXTENDO_ADMIN_EMAILS.
Internal routes
/api/* routes are public; /internal/* routes (identity, login, presence) are a control plane that
must never be reachable from the internet. internal_guard.go enforces this in the application layer
by checking the real TCP source address (never a spoofable header) plus a shared internal key.
What this is not
Ships no Nintendo code, keys, or copyrighted assets, and no captured data. Independent reimplementation for a community-run service; not affiliated with, endorsed by, or associated with Nintendo.
License
Released under the PolyForm Shield License 1.0.0 — source-available: read, use, modify, and self-host, but do not use it to provide a product that competes with Nextendo Network.