chanora/poc/tsclientlib-query-spike/VERIFICATION.md

Verification record — tsclientlib-query-spike

Result

PASS. On 2026-05-25, the spike connected to kr.teamspeak.app, resolved the live EdisonJwa session, and recovered the requested profile, group, country, avatar, quota, and connection-stat fields from a normal TeamSpeak client session.

Environment

Field	Value
Date	2026-05-25
Host OS	Linux (x86_64)
Build profile	dev
Target server	kr.teamspeak.app

Command

cargo run --offline -- \
  --address kr.teamspeak.app \
  --nickname ChanoraPoC-Inspector \
  --target-nickname EdisonJwa

Observed output

• Live roster populated after subscription + event pumping.
• EdisonJwa was online and resolved as:
  • clid=18481
  • dbid=2
  • uid=QcnldW6Qnw/4im/t94j/FYIcVMU=
  • country=KR
  • description: test
  • avatar path: /avatar_ebmjofhfgojajpappiikgponphiippbficbmfemf
• clientgetvariables populated richer profile data:
  • version: 3.6.2 [Build: 1695203293]
  • platform: Windows
  • first connected: 2018-09-07T09:39:00Z
  • last connected: 2026-05-25T03:34:44Z
  • total connections: 3831
  • downloaded total: 102735429
  • uploaded total: 51249731
• Group names resolved from live state after servergrouplist / channelgrouplist:
  • server groups: Server Admin, Talkaholic
  • channel group: Channel Admin
• getconnectioninfo populated connection stats:
  • connection time: 27m 29s
  • idle time: 182 ms
  • ping: 42 ms
  • client address: hidden by server permissions
  • packet loss: 0.0000 in both directions
  • packets transferred: populated
  • bytes transferred: populated
  • filetransfer bandwidth: sent=0 recv=0
• clientdbinfo cldbid=2 still failed with PermissionsClientInsufficient, which confirms that the richer results above came from the full client session path rather than elevated query permissions.

Conclusion

This spike proves the following from a normal client connection:

• online roster discovery
• target user resolution by visible session data
• nickname / UID / DBID / country capture
• description, version, platform, first-connected, last-connected, and total connections retrieval
• server-group and channel-group name resolution
• avatar path derivation
• live connection-time, idle-time, ping, loss, packet, byte, and quota retrieval

Remaining limits

• clientdbinfo remains permission-gated for this target on this server.
• Client Address is correctly reported as hidden because the live session did not have permission to see it.