fix(rust): nothing names who is online by default #11

wtclaude · 2026-09-23T05:33:24Z

wtclaude commented

2026-09-23 05:33:24 +00:00

The org lead's rule, settled 2026-09-22 while answering phase 9's roster question: nothing tells who is online by default. The narrowest audience, staff, applies unless an operator deliberately widens it. A count is fine; names are not. Design of record: docs/modules/rust/PLAN.md §23 (docs PR alongside).

The public site had been breaking that rule since phase 4. This PR puts four surfaces behind one setting:

Surface	Below the audience
Online tab (`GET …/servers/:id/online`)	`{ players: [], hidden: true, count, audience }` (same shape, so an older client renders an empty list rather than breaking)
The feed: `player.connected`, `.disconnected`, `.respawned`, `.death`, `.chat`, `.tally`	withheld; `presenceHidden` says so, and the server's own story (wipe, start, shutdown) stays
Leaderboard `lastSeen`	absent (a gather tally refreshes it every minute a player is on)

Rungs staff · signed_in · public, with a fleet-wide default in a new rust_settings table and an optional per-server override (rust_servers.presence_audience, NULL = inherit). An unknown stored word narrows to staff.
The viewer is re-read from the users row (ctx.users.getById), not taken from the token, so a demotion or a ban takes effect on the next request.
Per-viewer answers are Cache-Control: private, no-store, Vary: Cookie, Authorization.
GET/PUT /admin/rust/visibility (requireRole('admin'), validated whole before anything is written, one activity-log row per save) and a new admin page, Rust visibility.

A defect four phases old, found by the walk

Every empty state in this module rendered as a blank box. Core's EmptyState renders its children only, and this module passed title/message (the Integration Kit template's shape), which React drops without a word. On the org lead's steer ("we do not want to break other integrations like the UO module") it's fixed module-side with a small Empty wrapper: nothing core or module-uo renders changes. A new client test refuses a titled EmptyState or a PageHeader subtitle, and it was proven by planting an offence and watching it fail. The kit's template is fixed in Integration-kit alongside this PR.

Verified

180 server tests, 40 client tests, check:imports, check:bundle, check:externals, the regenerated OpenAPI fragment and the frozen route manifest, the last generated against core at the pinned sha as CI does it.

Walked against that core with the module installed and a stand-in sidecar:

four viewers × three routes: anonymous and a player got count: 2 and no names, a feed of wipes only, and no lastSeen. A moderator and an admin got all of it.
the writes: a moderator's PUT → 403. An unknown audience → 400. One unknown server in the request → 404 and nothing written. Fleet → signed_in opened the names to a player and not to an anonymous visitor. A per-server public override opened them to anonymous on that server alone.
the demotion: a moderator demoted in the database mid-session lost the names on the same cookie.
the browser, signed out: "2 players online · Only this site's staff can see who they are", the feed note, and no Last-seen column.

Not walked in a browser: the admin page itself. The walk does not type a password into a browser. The page's API is proven above, and it's left for your review at /admin/rust/visibility.

AI disclosure

Written with Claude Code (Opus 5.5).

🤖 Generated with Claude Code

https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

The org lead's rule, settled 2026-09-22 while answering phase 9's roster question: **nothing tells who is online by default.** The narrowest audience, staff, applies unless an operator deliberately widens it. A count is fine; names are not. Design of record: `docs/modules/rust/PLAN.md` §23 (docs PR alongside). The public site had been breaking that rule since phase 4. This PR puts four surfaces behind one setting: | Surface | Below the audience | |---|---| | Online tab (`GET …/servers/:id/online`) | `{ players: [], hidden: true, count, audience }` (same shape, so an older client renders an empty list rather than breaking) | | The feed: `player.connected`, `.disconnected`, `.respawned`, `.death`, `.chat`, `.tally` | withheld; `presenceHidden` says so, and the server's own story (wipe, start, shutdown) stays | | Leaderboard `lastSeen` | absent (a gather tally refreshes it every minute a player is on) | * **Rungs `staff` · `signed_in` · `public`**, with a fleet-wide default in a new `rust_settings` table and an optional per-server override (`rust_servers.presence_audience`, NULL = inherit). An unknown stored word narrows to staff. * **The viewer is re-read from the `users` row** (`ctx.users.getById`), not taken from the token, so a demotion or a ban takes effect on the next request. * Per-viewer answers are `Cache-Control: private, no-store`, `Vary: Cookie, Authorization`. * `GET/PUT /admin/rust/visibility` (`requireRole('admin')`, validated whole before anything is written, one activity-log row per save) and a new admin page, **Rust visibility**. ### A defect four phases old, found by the walk Every empty state in this module rendered as a **blank box**. Core's `EmptyState` renders its children only, and this module passed `title`/`message` (the Integration Kit template's shape), which React drops without a word. On the org lead's steer ("we do not want to break other integrations like the UO module") it's fixed **module-side** with a small `Empty` wrapper: nothing core or module-uo renders changes. A new client test refuses a titled `EmptyState` or a `PageHeader subtitle`, and it was proven by planting an offence and watching it fail. The kit's template is fixed in Integration-kit alongside this PR. ### Verified 180 server tests, 40 client tests, `check:imports`, `check:bundle`, `check:externals`, the regenerated OpenAPI fragment and the frozen route manifest, the last generated against core at the pinned sha as CI does it. Walked against that core with the module installed and a stand-in sidecar: * **four viewers × three routes**: anonymous and a player got `count: 2` and no names, a feed of wipes only, and no `lastSeen`. A moderator and an admin got all of it. * **the writes**: a moderator's PUT → 403. An unknown audience → 400. One unknown server in the request → 404 and nothing written. Fleet → `signed_in` opened the names to a player and not to an anonymous visitor. A per-server `public` override opened them to anonymous on that server alone. * **the demotion**: a moderator demoted in the database mid-session lost the names on the same cookie. * **the browser**, signed out: "2 players online · Only this site's staff can see who they are", the feed note, and no Last-seen column. **Not walked in a browser: the admin page itself.** The walk does not type a password into a browser. The page's API is proven above, and it's left for your review at `/admin/rust/visibility`. ### AI disclosure Written with Claude Code (Opus 5.5). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

wtclaude added 1 commit 2026-09-23 05:33:27 +00:00

fix(rust): nothing names who is online by default

PR Checks / client-build (pull_request) Successful in 27s

Details

PR Checks / frozen-manifest (pull_request) Successful in 51s

Details

PR Checks / server-tests (pull_request) Successful in 8m6s

Details

be44839896

The org lead's rule, settled 2026-09-22: who is online is always the
narrowest audience - staff - unless an operator deliberately widens it,
and a count is fine where a list of names is not.

The public site broke that in three places since phase 4. The Online
tab named every player, the feed carried joins, respawns, deaths, chat
and tallies, and the leaderboard's lastSeen - refreshed every minute by
a gather tally - said who was on as plainly as either. All three now
sit behind one setting:

* PRESENCE_KINDS, a subset of the public allowlist, gated per request.
  Below the audience the feed keeps the server's own story (wipe, start,
  shutdown) and says presenceHidden rather than looking quiet.
* the Online route answers { players: [], hidden, count, audience } -
  same shape, so an older client renders empty rather than breaking.
* rungs staff / signed_in / public, fleet-wide default in a new
  rust_settings table with an optional per-server override on
  rust_servers; an unknown stored word narrows to staff.
* the viewer's standing is RE-READ from the users row (ctx.users.getById),
  not taken from the token, so a demotion or a ban applies on the next
  request. Walked: a moderator demoted mid-session lost the roll call on
  the same cookie.
* per-viewer answers are Cache-Control: private, no-store.
* GET/PUT /admin/rust/visibility (requireRole admin) and an admin page,
  Rust visibility; every save is one activity-log row.

The browser walk also found every empty state in this module rendering
as a blank box. Core's EmptyState renders children only; this module
passed title/message (the shape the Integration Kit template teaches)
and React dropped both without a word. Fixed module-side with a small
Empty wrapper - nothing core or module-uo renders changes - and a client
test that refuses a titled EmptyState or a PageHeader subtitle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

whitlocktech merged commit da1a393702 into edge

2026-09-23 05:36:24 +00:00

whitlocktech referenced this issue from a commit

2026-09-23 05:36:25 +00:00

Merge pull request 'fix(rust): nothing names who is online by default' (#11) from fix/presence-visibility into edge

whitlocktech deleted branch fix/presence-visibility

2026-09-23 05:36:25 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: RunicGateway/Module-Rust#11