a place to jot

    /**
     * @brief Generates a xchacha20poly1305 key
     * 
     * @return std::shared_ptr<std::array<uint8_t, PMO_KEY_SIZE>>
     */
    SharedUint8ArrayPtr Cryptor::GenerateKey() const
    {
        auto Key = std::make_shared<std::array<uint8_t, PMO_KEY_SIZE>>();
        crypto_aead_xchacha20poly1305_ietf_keygen(Key->data());
        return Key;
    }

    /**
     * @brief Encrypts a generated key using a public key of one user, and a secret key of another.
     * 
     * @param Nonce 
     * @param UsersPublicKey 
     * @param GeneratedKey 
     * @param OutputLen 
     * @return UniqueUCharPtr 
     */
    UniqueUCharPtr Cryptor::EncryptKey(std::array<unsigned char, crypto_box_NONCEBYTES> &Nonce, const unsigned char *UsersPublicKey, const SharedUint8ArrayPtr GeneratedKey, size_t &OutputLen) const
    {
        randombytes_buf(Nonce.data(), sizeof(Nonce));
        
        OutputLen = crypto_box_MACBYTES + KeySize();
        auto CipherText = std::make_unique<std::vector<unsigned char>>(OutputLen);

        if (crypto_box_easy(CipherText->data(), GeneratedKey->data(), KeySize(), Nonce.data(),
                            UsersPublicKey, TestGameServerPrivateKey.data()) != 0) 
        {
            return nullptr;
        }
        return CipherText;
    }

// Create our nested message type
auto Output = net::MessageBuilder::BuildClientCommand(1, 1, Commands, Orientations);
// Encrypt the nested message type details by getting the Output->data() buffer
std::array<unsigned char, NONCE_BYTES> Nonce{0};
auto Encrypted = Crypt.Encrypt(ExpectedUserId, Nonce, Output->data(), Output->size());

// Now we create our top level message
flatbuffers::FlatBufferBuilder Builder(1024);
auto EncryptedBuffer = Builder.CreateVector(std::move(Encrypted->data()), Encrypted->size());
auto NonceValue = Builder.CreateVector(Nonce.data(), NONCE_BYTES);
auto EncryptedData = CreateEncryptedData(Builder, EncryptedBuffer);
// Build the Message Header and apply our encrypted message type
Game::Message::MessageBuilder GameMessage(Builder);
GameMessage.add_user_id(ExpectedUserId);
GameMessage.add_message_type(Game::Message::MessageType_ClientCommand);
GameMessage.add_nonce(NonceValue);
GameMessage.add_message_data(EncryptedData.Union()); // note the union call!
GameMessage.add_message_data_type(Game::Message::MessageData_EncryptedData); // <-- DO NOT FORGET THIS

Builder.Finish(GameMessage.Finish());
// We can now access Builder.GetBufferPointer() and Builder.GetSize() to send over Sockets

// Get Packet from the Socket
auto Deserialized = GetMessage(Packet->data());
// Can access these fields directly as they are not encrypted
auto UserId = Deserialized->user_id();
// note the call here to treat the message as EncryptedData
auto DeserializedData = Deserialized->message_data_as_EncryptedData();

// Now we can decrypt the data from inside the Deserialized message
unsigned long long OutputLen{0};
auto Decrypted = Crypt.Decrypt(UserId, Deserialized->nonce()->data(), DeserializedData->encrypted()->data(), DeserializedData->encrypted()->size(), OutputLen);

// Since we have access to the message type, we can deserialize the encrypted data as a Flatbuffers message now.
auto Command = Game::Message::GetClientCommand(Decrypted->data());
// ... process commands

/**
     * @brief Decrypts a message intended for UserId, validates the UserId as part of the Authenticated Data (AD).
     * 
     * @param UserId 
     * @param Nonce 
     * @param CipherText 
     * @param CipherTextLen 
     * @param MessageLen 
     * @param OutputLen 
     * @return UniqueUCharPtr 
     */
    UniqueUCharPtr Cryptor::Decrypt(const uint32_t UserId, const unsigned char *Nonce, const unsigned char *CipherText, const unsigned long long CipherTextLen, unsigned long long &OutputLen)
    {
        auto UserKey = GetKey(UserId);
        if (!UserKey)
        {
            return nullptr;
        }

        auto AD = serialization::UInt32tToUChar(UserId);
        auto OutputBuffer = std::make_unique<std::vector<unsigned char>>(1024);
        auto ret = crypto_aead_xchacha20poly1305_ietf_decrypt(OutputBuffer->data(), &OutputLen,
                                               NULL,
                                               CipherText, CipherTextLen,
                                               *AD, sizeof(UserId),
                                               Nonce, UserKey->data());
        if (ret != 0) 
        {
            /* message forged! */
            return nullptr;
        }
        return OutputBuffer;
    }

GameWorld.system<NetworkComponent, NetworkClientComponent, AuthComponent>("Authenticate")
	.interval(.150)
	.each([&](flecs::iter& It, size_t Index, NetworkComponent &Network, NetworkClientComponent &Client, AuthComponent &Auth) {
		auto CurrentPlayer = It.entity(Index);
		if (Auth.RequestSent > 50)
		{
			// TODO handle properly
			fmt::print("Auth failed too many times\n");
			GameWorld.quit();
			return;
		}       
		auto Now = std::chrono::system_clock::now();
		fmt::print("Entity {} requires auth\n", CurrentPlayer);
		Client.Client->Authenticate();
		Auth.RequestSent++;
		Auth.TimeSent = Now;
	});

for (auto Packet = InQueue->Pop(); Packet != std::nullopt; Packet = InQueue->Pop())
{
	switch(Packet->get()->MessageType)
	{
		// Got key to encrypt or ClientCommands, remove the AuthComponent set Connected
		case Game::Message::MessageType::MessageType_GenKeyResponse:
		{
			newPlayer.remove<player::AuthComponent>();
			newPlayer.add<player::Connected>();
			break;
		}
		...
	}
}

// Create a cached query to match players who are trying to authenticate
auto AuthQuery = GameWorld.query<player::NetworkComponent, player::NetworkServerComponent, player::AuthComponent>();

// ... game loop ...
for (auto Packet = InQueue->Pop(); Packet != std::nullopt; Packet = InQueue->Pop())
{
	switch (Packet->get()->MessageType)
	{
		case Game::Message::MessageType_ClientCommand:
		{
			// This query matches all players who had an AuthComponent 
			// but now sent us their first ClientCommand
			// We can remove the AuthComponent and set them to Connected
			GameWorld.defer_begin();
			// Call auth query and set them as connected
			AuthQuery.each([](flecs::entity Player, 
			player::NetworkComponent&, player::NetworkServerComponent &, player::AuthComponent &) 
			{
				Player.remove<player::AuthComponent>();
				Player.add<player::Connected>();
			});

			GameWorld.defer_end();

			auto Command = Game::Message::GetClientCommand(Packet->get()->Message->data());
			if (!Command) { ... }