Safe Melee Combat with Hitbox, Animation, and Cooldown
Generate a professional melee combat implementation for Roblox with target detection through spatial hitbox using GetPartBoundsInBox and OverlapParams. The system correctly separates responsibilities between client and server: the client handles input and responsive animation, while the server validates attacks, range, cooldown, and applies damage to the Humanoid.
Ideal for developers who need a secure, extensible base ready to paste into Roblox Studio. The prompt requests a complete architecture with LocalScript, server Script, and configuration ModuleScript, including installation guidance, RemoteEvent, character filtering, and multiplayer testing instructions.
Act as a senior Roblox developer specialized in Luau, client-server architecture, performance, and exploit security. Generate a complete, functional, and ready-to-paste Roblox Studio system for melee combat, with hit detection by area using `Workspace:GetPartBoundsInBox()` and `OverlapParams`, damage to the `Humanoid`, attack animation, and cooldown. Do not deliver pseudocode, incomplete snippets, implicit dependencies, or generic code. Before writing the code, consider and adapt the solution to the context of my game below. If any information is missing, use the default values specified later and clearly state your assumptions, without interrupting the response with questions. MY GAME CONTEXT (I will fill in): - Character name/model and rig: [R6, R15, or custom] - Tool used for the attack, if any: [name and location] - Existing RemoteEvents/RemoteFunctions and their paths: [e.g., ReplicatedStorage.Remotes.MeleeAttack] - Attack animation IDs: [e.g., rbxassetid://0000000000] - Desired damage: [value] - Desired cooldown: [seconds] - Hitbox size (Vector3): [e.g., 5, 4, 6] - Hitbox distance in front of the character: [e.g., 3] - Parts that can be hit, teams, NPCs, PvP, and special rules: [details] - Relevant Explorer structure: [details] If I do not fill in the context, use these defaults: standard R15/R6 character, `ReplicatedStorage.Remotes.MeleeAttack` as the RemoteEvent, 20 damage, 0.65 second cooldown, `Vector3.new(5, 4, 6)` hitbox, 3-stud forward offset, PvP and NPCs enabled, no self-damage and no friendly fire only if `Player.Team` and `TargetPlayer.Team` exist and are equal. Implement the architecture below and explicitly state the type and location of each file in the Explorer: 1. A `ModuleScript` called `MeleeConfig` in `ReplicatedStorage`, containing centralized settings: damage, cooldown, hitbox size/offset, active hit window, distance limit, animation IDs, and debug options. 2. A `LocalScript` in `StarterPlayer > StarterPlayerScripts` (or inside the Tool, if the context indicates Tool) to detect click/tap input, prevent local spam only for responsiveness, load/play the animation via `Animator`, and request the attack from the server through the RemoteEvent. The client must never send damage, target, Humanoid, hit part, or currency amount. 3. A `Script` in `ServerScriptService` to safely create or locate the RemoteEvent, receive attack requests, enforce authoritative per-player rate limit/cooldown, validate character, living Humanoid, `HumanoidRootPart`, attacker state, plausible distance, and other conditions. Only the server should calculate the hitbox, identify targets, and apply `Humanoid:TakeDamage()`. On the server, calculate the attack box in front of the `HumanoidRootPart` using `CFrame` and `GetPartBoundsInBox`. Configure `OverlapParams` with `FilterType = Enum.RaycastFilterType.Exclude` to ignore the attacker's character and any other necessary instances. Iterate through the returned parts, find the ancestral `Model` with `Humanoid`, deduplicate victims so each Humanoid takes damage only once per swing, ignore dead Humanoids, and prevent self-attack. If applicable, apply the team rule on the server. Include an extra validation of the distance between the attacker's and victim's `HumanoidRootPart` to reduce RemoteEvent abuse or physical inconsistencies. Timing must be consistent: the animation starts locally for low latency, but the real damage window is controlled on the server by a small configurable delay (`HitDelay` or `ActiveWindowDelay`). Do not use legacy `Region3` as the main implementation; briefly mention that `OverlapParams` is the current approach. Do not use `wait()`; prefer `task.wait()`, `task.delay()`, and `os.clock()` or `time()` for cooldown control. Do not use `Touched` as the main damage method. Do not trust attributes, values, or signals sent by the client to decide damage/cooldown. Deliver the response in this order: (1) short technical summary of the architecture; (2) table with file, type, and location in the Explorer; (3) all complete scripts, each in its own markdown block labeled `lua`, with helpful comments in Portuguese; (4) exact steps to create/configure the RemoteEvent, insert the scripts, and replace the animation ID; (5) testing checklist in Roblox Studio, including Play Solo and Start Server with multiple players; (6) a short troubleshooting section for animation not playing, hitbox not detecting, and duplicate damage. Ensure the names used are consistent across all files and that the code is compatible with current Luau.