[MP] Add optional authentication to SceneMultiplayer.

Add few methods to allow peers to exchange authentication information.

- `set_auth_callback(callback)`: Enable the authentication features.
  The callback is a `Callable` that accepts an `int` (the peer ID), and
  a `PackedByteArray` of data.
- The `peer_authenticating(id)` signal will be emitted instead of
  `peer_connected` when a new peer connects.
- Use `send_auth(id: int, data: PackedByteArray)` to exchange data.
- Call `complete_auth(id: int)` when the authentication process is
  complete and you expect to start receiving game data.
- The `peer_connected` signal will be emitted as soon as both parties
  complete the authentication.
- Use `disconnect_peer(id)` to disconnect a connected peer.
- If the `peer_connected` signal didn't fire for that peer (i.e. it was
  still in the authentication phase), the `peer_auth_failed` signal will
  be emitted instead of `peer_disconnected`.

1 files changed, 47 insertions, 0 deletions

diff --git a/modules/multiplayer/doc_classes/SceneMultiplayer.xml b/modules/multiplayer/doc_classes/SceneMultiplayer.xml
index a7b89f58ac..e4e2b4f631 100644
--- a/modules/multiplayer/doc_classes/SceneMultiplayer.xml
+++ b/modules/multiplayer/doc_classes/SceneMultiplayer.xml
@@ -19,6 +19,35 @@
 				Clears the current SceneMultiplayer network state (you shouldn't call this unless you know what you are doing).
 			</description>
 		</method>
+		<method name="complete_auth">
+			<return type="int" enum="Error" />
+			<param index="0" name="id" type="int" />
+			<description>
+				Mark the authentication step as completed for the remote peer identified by [param id]. The [signal MultiplayerAPI.peer_connected] signal will be emitted for this peer once the remote side also completes the authentication. No further authentication messages are expected to be received from this peer.
+				If a peer disconnects before completing authentication, either due to a network issue, the [member auth_timeout] expiring, or manually calling [method disconnect_peer], the [signal peer_authentication_failed] signal will be emitted instead of [signal MultiplayerAPI.peer_disconnected].
+			</description>
+		</method>
+		<method name="disconnect_peer">
+			<return type="void" />
+			<param index="0" name="id" type="int" />
+			<description>
+				Disconnects the peer identified by [param id], removing it from the list of connected peers, and closing the underlying connection with it.
+			</description>
+		</method>
+		<method name="get_authenticating_peers">
+			<return type="PackedInt32Array" />
+			<description>
+				Returns the IDs of the peers currently trying to authenticate with this [MultiplayerAPI].
+			</description>
+		</method>
+		<method name="send_auth">
+			<return type="int" enum="Error" />
+			<param index="0" name="id" type="int" />
+			<param index="1" name="data" type="PackedByteArray" />
+			<description>
+				Sends the specified [param data] to the remote peer identified by [param id] as part of an authentication message. This can be used to authenticate peers, and control when [signal MultiplayerAPI.peer_connected] is emitted (and the remote peer accepted as one of the connected peers).
+			</description>
+		</method>
 		<method name="send_bytes">
 			<return type="int" enum="Error" />
 			<param index="0" name="bytes" type="PackedByteArray" />
@@ -35,6 +64,12 @@
 			If [code]true[/code], the MultiplayerAPI will allow encoding and decoding of object during RPCs.
 			[b]Warning:[/b] Deserialized objects can contain code which gets executed. Do not use this option if the serialized object comes from untrusted sources to avoid potential security threat such as remote code execution.
 		</member>
+		<member name="auth_callback" type="Callable" setter="set_auth_callback" getter="get_auth_callback">
+			The callback to execute when when receiving authentication data sent via [method send_auth]. If the [Callable] is empty (default), peers will be automatically accepted as soon as they connect.
+		</member>
+		<member name="auth_timeout" type="float" setter="set_auth_timeout" getter="get_auth_timeout" default="3.0">
+			If set to a value greater than [code]0.0[/code], the maximum amount of time peers can stay in the authenticating state, after which the authentication will automatically fail. See the [signal peer_authenticating] and [signal peer_authentication_failed] signals.
+		</member>
 		<member name="refuse_new_connections" type="bool" setter="set_refuse_new_connections" getter="is_refusing_new_connections" default="false">
 			If [code]true[/code], the MultiplayerAPI's [member MultiplayerAPI.multiplayer_peer] refuses new incoming connections.
 		</member>
@@ -48,6 +83,18 @@
 		</member>
 	</members>
 	<signals>
+		<signal name="peer_authenticating">
+			<param index="0" name="id" type="int" />
+			<description>
+				Emitted when this MultiplayerAPI's [member MultiplayerAPI.multiplayer_peer] connects to a new peer and a valid [member auth_callback] is set. In this case, the [signal MultiplayerAPI.peer_connected] will not be emitted until [method complete_auth] is called with given peer [param id]. While in this state, the peer will not be included in the list returned by [method MultiplayerAPI.get_peers] (but in the one returned by [method get_authenticating_peers]), and only authentication data will be sent or received. See [method send_auth] for sending authentication data.
+			</description>
+		</signal>
+		<signal name="peer_authentication_failed">
+			<param index="0" name="id" type="int" />
+			<description>
+				Emitted when this MultiplayerAPI's [member MultiplayerAPI.multiplayer_peer] disconnects from a peer for which authentication had not yet completed. See [signal peer_authenticating].
+			</description>
+		</signal>
 		<signal name="peer_packet">
 			<param index="0" name="id" type="int" />
 			<param index="1" name="packet" type="PackedByteArray" />