Address review comments

docs/Server-configuration.md

@@ -36,6 +36,7 @@ Impostor has an Anticheat that makes it possible to kick cheaters from games aut
 | **EnableMustBeHostChecks**    | `true`        | Enables checks that check if players are the host before they can do actions that require them to be host of the game. This includes starting the game and spawning objects.                                        |
 | **EnableColorLimitChecks**    | `true`        | Enables checks that checks if players request colors that are already in use.                                                                                                                                       |
 | **EnableNameLimitChecks**     | `true`        | Enables checks that checks if player names have a length that is possible to set using the user interface.                                                                                                          |
+| **EnableItemLimitChecks**     | `true`        | Enables checks for iten counts that cannot be exceeded in the official clients.                                                                                                                                     |
 | **EnableOwnershipChecks**     | `true`        | Enables checks that check if players are allowed to perform a certain action on themself or another player.                                                                                                         |
 | **EnableRoleChecks**          | `true`        | Enables checks that check if players have the correct role when performing certain role abilities like venting or murdering.                                                                                        |
 | **EnableTargetChecks**        | `true`        | Enables checks that check if certain packets to everyone that should only have been sent to certain players or vice versa. This includes sending votes or network objects.                                          |

src/Impostor.Api/CheatCategory.cs

@@ -35,6 +35,9 @@ public enum CheatCategory
     /// <summary>A packet was sent that exceeded the maximum allowed RPC size.</summary>
     PacketSize,
 
+    /// <summary>A packet was sent with more items than possible in the game.</summary>
+    ItemLimits,
+
     /// <summary>Legacy category for unsorted anticheat checks.</summary>
     Other,
 }

src/Impostor.Api/Config/AntiCheatConfig.cs

@@ -22,6 +22,8 @@ namespace Impostor.Api.Config
 
         public bool EnableNameLimitChecks { get; set; } = true;
 
+        public bool EnableItemLimitChecks { get; set; } = true;
+
         public bool EnableOwnershipChecks { get; set; } = true;
 
         public bool EnableRoleChecks { get; set; } = true;

src/Impostor.Api/Innersloth/GameOptions/RoleOptions/SpiritGuideRoleOptions.cs

@@ -17,7 +17,7 @@ public class SpiritGuideRoleOptions : IRoleOptions
     {
         var options = new SpiritGuideRoleOptions(version);
 
-        options.SpiritGuideCooldownSeconds = (int)reader.ReadByte();
+        options.SpiritGuideCooldownSeconds = reader.ReadByte();
 
         return options;
     }

src/Impostor.Server/Net/Client.cs

@@ -87,6 +87,7 @@ namespace Impostor.Server.Net
                     _ => true,
                 },
                 CheatCategory.PacketSize => _antiCheatConfig.EnablePacketSizeChecks,
+                CheatCategory.ItemLimits => _antiCheatConfig.EnableItemLimitChecks,
                 CheatCategory.Other => true,
                 _ => LogUnknownCategory(category),
             };

src/Impostor.Server/Net/Inner/Objects/ShipStatus/InnerShipStatus.cs

@@ -109,6 +109,18 @@ namespace Impostor.Server.Net.Inner.Objects.ShipStatus
                     }
 
                     Rpc67SpiritGuideMessage.Deserialize(reader, out var images);
+
+                    if (images.Length == 0 || images.Length > 3)
+                    {
+                        if (await sender.Client.ReportCheatAsync(
+                            RpcCalls.SpiritGuideMessage,
+                            CheatCategory.ItemLimits,
+                            $"Client sent {images.Length} images (allowed: 1, 2 or 3)"))
+                        {
+                            return false;
+                        }
+                    }
+
                     break;
                 }