fix(rust): nothing names who is online by default

The org lead's rule, settled 2026-09-22: who is online is always the
narrowest audience - staff - unless an operator deliberately widens it,
and a count is fine where a list of names is not.

The public site broke that in three places since phase 4. The Online
tab named every player, the feed carried joins, respawns, deaths, chat
and tallies, and the leaderboard's lastSeen - refreshed every minute by
a gather tally - said who was on as plainly as either. All three now
sit behind one setting:

* PRESENCE_KINDS, a subset of the public allowlist, gated per request.
  Below the audience the feed keeps the server's own story (wipe, start,
  shutdown) and says presenceHidden rather than looking quiet.
* the Online route answers { players: [], hidden, count, audience } -
  same shape, so an older client renders empty rather than breaking.
* rungs staff / signed_in / public, fleet-wide default in a new
  rust_settings table with an optional per-server override on
  rust_servers; an unknown stored word narrows to staff.
* the viewer's standing is RE-READ from the users row (ctx.users.getById),
  not taken from the token, so a demotion or a ban applies on the next
  request. Walked: a moderator demoted mid-session lost the roll call on
  the same cookie.
* per-viewer answers are Cache-Control: private, no-store.
* GET/PUT /admin/rust/visibility (requireRole admin) and an admin page,
  Rust visibility; every save is one activity-log row.

The browser walk also found every empty state in this module rendering
as a blank box. Core's EmptyState renders children only; this module
passed title/message (the shape the Integration Kit template teaches)
and React dropped both without a word. Fixed module-side with a small
Empty wrapper - nothing core or module-uo renders changes - and a client
test that refuses a titled EmptyState or a PageHeader subtitle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/_fakes.js

@@ -53,6 +53,9 @@ function fakeCtx(overrides = {}) {
       return log
     },
     auth: { getUserFromRequest: spy(null) },
+    // One user by id. Null by default — an anonymous suite resolves nobody —
+    // and a test that needs a viewer installs its own.
+    users: { getById: spy(Promise.resolve(null)) },
     // The engagement seam (§2.3). One method, recording, because that is the
     // whole of what a module may do with it: fire a declared event and stop.
     // Core's own emit is fire-and-forget and returns nothing, so this does too —

server/test/catalogue.test.js

@@ -51,7 +51,12 @@ test('a viewer with no kinds asked for gets the allowlist, never everything', ()
   const asPublic = catalogue.kindsFor({})
   const asAdmin = catalogue.kindsFor({ admin: true })
 
-  assert.deepEqual(asPublic, [...catalogue.PUBLIC_KINDS])
+  // The public view with nothing said about presence is the kinds that name
+  // nobody — a wipe, a start, a shutdown.
+  assert.deepEqual(
+    asPublic,
+    catalogue.PUBLIC_KINDS.filter((k) => !catalogue.PRESENCE_KINDS.includes(k)),
+  )
   assert.equal(asAdmin.length, catalogue.ALL_KINDS.length)
 
   // The property that makes the route safe by construction: there is no argument
@@ -61,10 +66,13 @@ test('a viewer with no kinds asked for gets the allowlist, never everything', ()
 })
 
 test('a kind a viewer may not see is dropped, not refused', () => {
-  const asked = catalogue.kindsFor({ requested: ['player.death', 'player.banned'] })
+  const asked = catalogue.kindsFor({ presence: true, requested: ['player.death', 'player.banned'] })
 
   assert.deepEqual(asked, ['player.death'])
 
+  // Without the presence audience a death is dropped too.
+  assert.deepEqual(catalogue.kindsFor({ requested: ['player.death', 'server.wipe'] }), ['server.wipe'])
+
   // Asking for only forbidden kinds answers with nothing to select, which the
   // model turns into an empty list — the events are, as far as this viewer is
   // concerned, not there.
@@ -116,3 +124,26 @@ test('the classification covers exactly the kinds protocol 4 defines', () => {
 
   assert.deepEqual([...catalogue.ALL_KINDS].sort(), [...PROTOCOL_4].sort())
 })
+
+test('every kind that names a player who was on is behind the presence setting', () => {
+  // The org lead's rule (2026-09-22): nothing tells who is online by default.
+  // Each of these says a named player was on the server at a given moment.
+  for (const kind of [
+    'player.connected',
+    'player.disconnected',
+    'player.respawned',
+    'player.death',
+    'player.chat',
+    'player.tally',
+  ]) {
+    assert.ok(catalogue.isPresence(kind), `${kind} must be gated as presence`)
+    assert.ok(!catalogue.kindsFor({}).includes(kind), `${kind} must not reach a default public view`)
+    assert.ok(catalogue.kindsFor({ presence: true }).includes(kind))
+  }
+
+  // A presence kind is a subset of the public ones, never a staff kind widened.
+  for (const kind of catalogue.PRESENCE_KINDS) assert.ok(catalogue.PUBLIC_KINDS.includes(kind))
+
+  // And what is left names nobody.
+  assert.deepEqual(catalogue.kindsFor({}).sort(), ['server.initialized', 'server.shutdown', 'server.wipe'])
+})

server/test/events.test.js

@@ -60,7 +60,14 @@ test('a reader who does not say who they are gets the public view', async () =>
     await model.recent({ serverId: 'main' })
 
     assert.ok(!asked.kinds.includes('player.banned'), 'no IP-carrying kind by default')
-    assert.ok(asked.kinds.includes('player.death'))
+    // Nor anything naming a player who was on — the org lead's rule, and a caller
+    // that forgets to say what the viewer may see gets the narrowest answer.
+    assert.ok(!asked.kinds.includes('player.death'), 'no presence kind by default')
+    assert.ok(asked.kinds.includes('server.wipe'))
+
+    await model.recent({ serverId: 'main', presence: true })
+    assert.ok(asked.kinds.includes('player.death'), 'a viewer inside the presence audience gets the killfeed')
+    assert.ok(!asked.kinds.includes('player.banned'), 'presence never widens to staff kinds')
 
     await model.recent({ serverId: 'main', admin: true })
     assert.ok(asked.kinds.includes('player.banned'), 'an admin who says so gets them')
@@ -142,3 +149,24 @@ test('the leaderboard answers numbers, never nulls', async () => {
     db.leaderboard = original
   }
 })
+
+test('the leaderboard withholds lastSeen unless the viewer may see who is online', async () => {
+  withCore()
+
+  const db = require('../model/events/events.db')
+  const model = require('../model/events/events.model')
+  const original = db.leaderboard
+
+  db.leaderboard = async () => [{ steamId: '7656', name: 'A', kills: 3, lastSeen: '2026-09-22T10:00:00Z' }]
+
+  try {
+    const hidden = await model.leaderboard({ serverId: 'main' })
+    assert.equal('lastSeen' in hidden[0], false, 'absent, not null — null would read as "never seen"')
+    assert.equal(hidden[0].kills, 3)
+
+    const shown = await model.leaderboard({ serverId: 'main', presence: true })
+    assert.equal(shown[0].lastSeen, '2026-09-22T10:00:00Z')
+  } finally {
+    db.leaderboard = original
+  }
+})

server/test/visibility.test.js

@@ -0,0 +1,262 @@
+// ── Who may see who is online ─────────────────────────────────────────────
+//
+// The org lead's rule (2026-09-22): nothing tells who is online by default. The
+// suite holds the four properties that make that rule true rather than merely
+// intended:
+//
+//   • an install nobody has configured answers STAFF;
+//   • the viewer's standing comes from the ROW, not the token — a demotion or a
+//     ban takes effect on the next request;
+//   • anything unrecognised or unanswerable narrows, never widens;
+//   • the public routes answer the count and withhold the names.
+
+const test = require('node:test')
+const assert = require('node:assert')
+
+const { fakeCtx, spy } = require('./_fakes')
+
+/**
+ * The model with a stubbed db and a chosen viewer.
+ *
+ * `claimed` is what the token says; `row` is what the users table says now.
+ */
+function setup({ fleet = null, overrides = {}, claimed = null, row = null, usersThrow = false } = {}) {
+  require('../core')._reset()
+  require('../core').init(
+    fakeCtx({
+      auth: { getUserFromRequest: () => claimed },
+      users: {
+        getById: async () => {
+          if (usersThrow) throw new Error('pool exhausted')
+          return row
+        },
+      },
+    }),
+  )
+
+  const db = require('../model/visibility/visibility.db')
+  const model = require('../model/visibility/visibility.model')
+
+  const written = { settings: [], servers: [] }
+  const originals = { ...db }
+  db.getSetting = async () => fleet
+  db.setSetting = async (key, value, userId) => written.settings.push({ key, value, userId })
+  db.getServerPresence = async (id) => (id in overrides ? overrides[id] : undefined)
+  db.listServerPresence = async () =>
+    Object.entries(overrides).map(([id, presence]) => ({ id, name: id.toUpperCase(), enabled: 1, presence }))
+  db.setServerPresence = async (id, value) => written.servers.push({ id, value })
+
+  return { model, written, restore: () => Object.assign(db, originals) }
+}
+
+test('an install nobody has configured shows the roll call to staff and nobody else', async () => {
+  const { model, restore } = setup({ overrides: { main: null } })
+  try {
+    assert.equal(await model.fleetPresence(), 'staff')
+    assert.equal(await model.presenceFor('main'), 'staff')
+    assert.equal((await model.canSeePresence({}, 'main')).visible, false, 'anonymous')
+  } finally {
+    restore()
+  }
+})
+
+test('the standing comes from the row, not the token', async () => {
+  // The token says moderator; the row says they were demoted this morning.
+  const demoted = setup({ claimed: { id: 4, role: 'moderator' }, row: { id: 4, role: 'player', status: 'active' } })
+  try {
+    assert.equal(await demoted.model.viewerLevel({}), 'signed_in')
+  } finally {
+    demoted.restore()
+  }
+
+  // The token says admin; the account has been banned since.
+  const banned = setup({ claimed: { id: 4, role: 'admin' }, row: { id: 4, role: 'admin', status: 'banned' } })
+  try {
+    assert.equal(await banned.model.viewerLevel({}), 'public')
+  } finally {
+    banned.restore()
+  }
+
+  const moderator = setup({ claimed: { id: 5 }, row: { id: 5, role: 'moderator', status: 'active' } })
+  try {
+    assert.equal(await moderator.model.viewerLevel({}), 'staff')
+  } finally {
+    moderator.restore()
+  }
+})
+
+test('a viewer who cannot be resolved is anonymous', async () => {
+  const gone = setup({ claimed: { id: 9 }, row: null })
+  try {
+    assert.equal(await gone.model.viewerLevel({}), 'public')
+  } finally {
+    gone.restore()
+  }
+
+  const failing = setup({ claimed: { id: 9 }, usersThrow: true })
+  try {
+    assert.equal(await failing.model.viewerLevel({}), 'public')
+  } finally {
+    failing.restore()
+  }
+})
+
+test('a stored value this build does not recognise narrows to staff', async () => {
+  const { model, restore } = setup({ fleet: 'everyone', overrides: { main: 'PUBLIC', pvp: null } })
+  try {
+    assert.equal(await model.fleetPresence(), 'staff')
+    assert.equal(await model.presenceFor('main'), 'staff', 'a mis-cased word is not "public"')
+    assert.equal(await model.presenceFor('pvp'), 'staff', 'inherits the (narrowed) fleet default')
+  } finally {
+    restore()
+  }
+})
+
+test('a server override wins over the fleet, and null inherits it', async () => {
+  const { model, restore } = setup({
+    fleet: 'signed_in',
+    overrides: { main: 'public', pvp: 'staff', creative: null },
+    claimed: { id: 4 },
+    row: { id: 4, role: 'player', status: 'active' },
+  })
+  try {
+    assert.equal(await model.presenceFor('main'), 'public')
+    assert.equal(await model.presenceFor('pvp'), 'staff')
+    assert.equal(await model.presenceFor('creative'), 'signed_in')
+
+    // A signed-in player sees main and creative, not pvp.
+    assert.equal((await model.canSeePresence({}, 'main')).visible, true)
+    assert.equal((await model.canSeePresence({}, 'creative')).visible, true)
+    assert.equal((await model.canSeePresence({}, 'pvp')).visible, false)
+
+    const described = await model.describe()
+    const byId = Object.fromEntries(described.presence.servers.map((s) => [s.id, s]))
+    assert.equal(byId.creative.override, null)
+    assert.equal(byId.creative.effective, 'signed_in')
+    assert.equal(byId.pvp.effective, 'staff')
+  } finally {
+    restore()
+  }
+})
+
+test('an update naming an unknown audience or server writes nothing at all', async () => {
+  const { model, written, restore } = setup({ overrides: { main: null } })
+  try {
+    const badAudience = await model.update({ fleet: 'public', servers: { main: 'everyone' } })
+    assert.equal(badAudience.ok, false)
+    assert.equal(badAudience.status, 400)
+
+    const badServer = await model.update({ fleet: 'public', servers: { main: 'public', nope: 'public' } })
+    assert.equal(badServer.ok, false)
+    assert.equal(badServer.status, 404)
+    assert.match(badServer.message, /nope/)
+
+    assert.deepEqual(written, { settings: [], servers: [] }, 'validated whole before anything was written')
+
+    const ok = await model.update({ fleet: 'signed_in', servers: { main: null } }, { id: 1 })
+    assert.equal(ok.ok, true)
+    assert.deepEqual(written.settings, [{ key: 'presence.audience', value: 'signed_in', userId: 1 }])
+    assert.deepEqual(written.servers, [{ id: 'main', value: null }])
+    assert.deepEqual(ok.changed, { fleet: 'signed_in', servers: { main: 'inherit' } })
+  } finally {
+    restore()
+  }
+})
+
+// ── The public routes ─────────────────────────────────────────────────────
+
+/** A response double recording what a handler answered. */
+function fakeRes() {
+  const res = {
+    statusCode: 200,
+    headers: {},
+    varied: [],
+    body: undefined,
+    status(code) { this.statusCode = code; return this },
+    json(body) { this.body = body; return this },
+    set(name, value) { this.headers[name.toLowerCase()] = value; return this },
+    vary(name) { this.varied.push(name); return this },
+  }
+  return res
+}
+
+function withPresence(visible) {
+  const visibility = require('../model/visibility/visibility.model')
+  const events = require('../model/events/events.model')
+  const servers = require('../model/servers/servers.model')
+  const originals = {
+    canSeePresence: visibility.canSeePresence,
+    online: events.online,
+    getPublic: servers.getPublic,
+  }
+  visibility.canSeePresence = async () => ({ visible, level: visible ? 'staff' : 'public', required: 'staff' })
+  events.online = spy(Promise.resolve([{ steamId: '7656', name: 'Wanderer', sleeping: false, connectedAt: null }]))
+  servers.getPublic = async () => ({ id: 'main', players: 12 })
+  return {
+    events,
+    restore: () => {
+      visibility.canSeePresence = originals.canSeePresence
+      events.online = originals.online
+      servers.getPublic = originals.getPublic
+    },
+  }
+}
+
+test('below the audience, the Online list answers the count and never reads the names', async () => {
+  require('../core')._reset()
+  require('../core').init(fakeCtx())
+  const { events, restore } = withPresence(false)
+  try {
+    const controller = require('../router/public/rust.controller')
+    const res = fakeRes()
+    await controller.listOnline({ params: { id: 'main' } }, res)
+
+    assert.deepEqual(res.body, { players: [], hidden: true, count: 12, audience: 'staff' })
+    assert.equal(events.online.calls.length, 0, 'the names are not even read')
+    assert.equal(res.headers['cache-control'], 'private, no-store', 'a per-viewer answer must not be shared by a cache')
+  } finally {
+    restore()
+  }
+})
+
+test('inside the audience, the Online list names the players', async () => {
+  require('../core')._reset()
+  require('../core').init(fakeCtx())
+  const { restore } = withPresence(true)
+  try {
+    const controller = require('../router/public/rust.controller')
+    const res = fakeRes()
+    await controller.listOnline({ params: { id: 'main' } }, res)
+
+    assert.equal(res.body.hidden, false)
+    assert.equal(res.body.players[0].name, 'Wanderer')
+  } finally {
+    restore()
+  }
+})
+
+test('below the audience, the feed says it withheld the players rather than implying a quiet server', async () => {
+  require('../core')._reset()
+  require('../core').init(fakeCtx())
+  const { restore } = withPresence(false)
+  const events = require('../model/events/events.model')
+  const original = events.recent
+  let asked = null
+  events.recent = async (args) => {
+    asked = args
+    return []
+  }
+  try {
+    const controller = require('../router/public/rust.controller')
+    const res = fakeRes()
+    await controller.listEvents({ params: { id: 'main' }, query: {} }, res)
+
+    assert.equal(asked.presence, false)
+    assert.equal(asked.admin, undefined, 'the public route never passes admin')
+    assert.equal(res.body.presenceHidden, true)
+    assert.equal(res.body.presenceAudience, 'staff')
+  } finally {
+    events.recent = original
+    restore()
+  }
+})