Fix sceneDropId handling to prevent matching unintended assets

src/controllers/handleDropPiece.ts

@@ -17,7 +17,7 @@ import { DroppedAssetInterface } from "@rtsdk/topia";
 export const handleDropPiece = async (req: Request, res: Response) => {
   try {
     const credentials = req.credentials;
-    const { displayName, identityId, sceneDropId, urlSlug, visitorId } = credentials;
+    const { displayName, identityId, urlSlug, visitorId } = credentials;
     const { username } = req.body;
 
     let text = "",
@@ -27,7 +27,8 @@ export const handleDropPiece = async (req: Request, res: Response) => {
     const column = parseInt(req.params.column);
     if (isNaN(column)) throw "Column id is required.";
 
-    const { keyAsset } = await getDroppedAssetDataObject(credentials, false);
+    // Get the resolved sceneDropId from getDroppedAssetDataObject
+    const { keyAsset, sceneDropId } = await getDroppedAssetDataObject(credentials, false);
 
     let {
       columns,

src/controllers/handlePlayerSelection.ts

@@ -8,13 +8,15 @@ export const handlePlayerSelection = async (req: Request, res: Response) => {
     const playerId = req.params.player;
     const isPlayer2 = parseInt(playerId) === 2;
     const credentials = req.credentials;
-    const { profileId, sceneDropId, urlSlug, visitorId } = credentials;
+    const { profileId, urlSlug, visitorId } = credentials;
     const { username } = req.body;
 
     let text = "",
       shouldUpdateGame = true;
 
-    const { keyAsset } = await getDroppedAssetDataObject(credentials, false);
+    // Get the resolved sceneDropId from getDroppedAssetDataObject
+    // This ensures we use a valid sceneDropId even if credentials.sceneDropId is empty
+    const { keyAsset, sceneDropId } = await getDroppedAssetDataObject(credentials, false);
     const { keyAssetId, playerCount, player1, player2 } = keyAsset.dataObject as GameDataType;
 
     try {

src/controllers/handleResetBoard.ts

@@ -14,16 +14,18 @@ import { DroppedAssetInterface, VisitorInterface } from "@rtsdk/topia";
 export const handleResetBoard = async (req: Request, res: Response) => {
   try {
     const credentials = req.credentials;
-    const { assetId, sceneDropId, urlSlug, visitorId } = credentials;
+    const { assetId, urlSlug, visitorId } = credentials;
 
     const visitor: VisitorInterface = await Visitor.get(visitorId, urlSlug, { credentials });
     const isAdmin = visitor.isAdmin;
 
-    const { keyAsset, wasDataObjectInitialized } = await getDroppedAssetDataObject(credentials, false);
+    // Get the resolved sceneDropId from getDroppedAssetDataObject
+    // This ensures we use a valid sceneDropId even if credentials.sceneDropId is empty
+    const { keyAsset, wasDataObjectInitialized, sceneDropId } = await getDroppedAssetDataObject(credentials, false);
     const { lastInteraction, player1, player2, resetCount } = keyAsset.dataObject as GameDataType;
 
     if (wasDataObjectInitialized) {
-      await generateBoard(credentials);
+      await generateBoard({ ...credentials, sceneDropId });
       return res.status(200).send({ message: "Game created successfully" });
     }
 
@@ -32,6 +34,7 @@ export const handleResetBoard = async (req: Request, res: Response) => {
     const world = World.create(urlSlug, { credentials });
 
     // get all assets with matching sceneDropId for full board rebuild
+    // Using the resolved sceneDropId from getDroppedAssetDataObject, not from credentials
     droppedAssets = await world.fetchDroppedAssetsBySceneDropId({ sceneDropId });
     droppedAssets = droppedAssets.filter((item) => item.uniqueName !== "reset");
 
@@ -103,7 +106,7 @@ export const handleResetBoard = async (req: Request, res: Response) => {
         ),
       );
 
-      if (isAdmin) promises.push(generateBoard(credentials));
+      if (isAdmin) promises.push(generateBoard({ ...credentials, sceneDropId }));
 
       await Promise.all(promises);
 

src/utils/droppedAssets/getDroppedAssetDataObject.ts

@@ -23,8 +23,15 @@ export const getDroppedAssetDataObject = async (credentials: Credentials, isKeyA
       }
     }
 
+    // If sceneDropId is not provided, use keyAssetId as the sceneDropId
+    // This ensures we always have a valid sceneDropId for asset queries
     if (!sceneDropId) sceneDropId = keyAssetId;
 
+    // Validate that we have a valid sceneDropId before proceeding
+    if (!sceneDropId || sceneDropId.trim() === "") {
+      throw "Unable to determine a valid sceneDropId. This is required to safely query assets.";
+    }
+
     // store keyAssetId by sceneDropId in World data object so that it can be accessed by any clickable asset
     // this supports a scene being dropped with the board already created instead of just the Reset button
     if (!dataObject || Object.keys(dataObject).length === 0) {
@@ -41,7 +48,8 @@ export const getDroppedAssetDataObject = async (credentials: Credentials, isKeyA
 
     const wasDataObjectInitialized = await initializeDroppedAssetDataObject(keyAsset, sceneDropId);
 
-    return { keyAsset, wasDataObjectInitialized };
+    // Return the resolved sceneDropId so callers can use it for subsequent queries
+    return { keyAsset, wasDataObjectInitialized, sceneDropId };
   } catch (error) {
     return errorHandler({
       error,