wtclaude
baffaa46c9
R1's identity link, site-side, and R13's first extension slot. A player types /link in game, the plugin hands them a six-character code privately, and they enter it here; the site records who owns which Steam account, and an operator sees that on core's own `/admin/users/:id` page. **The site is the author of record and the game holds nothing.** There is no per-account store in Rust that survives a wipe, and phase 7 needs the site authoritative anyway — it pushes permissions INTO the game keyed by Steam id. A copy in the game would be a second thing to reconcile every wipe, for no question it could answer better. ## D24 — a code is minted by ONE server, so every server is asked Nothing in six characters says where it came from. The fleet is asked in turn and the first `link.ok` wins; the others answer `unknown` and nothing happens there, because a code is only spent at the server that actually holds it. Asking the player to pick was rejected: a wrong pick would come back indistinguishable from a wrong code, and that is the one refusal which must not be ambiguous. **"Every reachable server refused" is not the same answer as "a server was unreachable."** Collapsing them tells a player whose server is down that their code is wrong — so they run /link again on that same server and are told the same thing for as long as it stays down. `unsure` is that case, and it says to try again rather than to fetch a new code. ## D23 — a Steam id another account holds is refused, never moved The primary key is `steam_id`, and it is load-bearing rather than tidy: phase 7 grants permissions against a link and phase 13 hangs entitlements off it, so a silent move is an account takeover performed by typing six characters. The refusal names the holder, because the advice is unusable without it. The INSERT is a plain INSERT for the same reason — `ON DUPLICATE KEY UPDATE` here would BE that move — and the duplicate-key error is the refusal for the race the check above cannot close. The way out is `/unlink` in game, which reaches the site off the ingest feed rather than through a route (the plugin has no link to delete). D25 adds the other way out: staff can sever a link from the admin panel, for a player who cannot reach that Steam account in game. ## The slot, and the hole it found in this repo's own generator `admin.users.detail` is declared in `module.json` AND registered in `index.js` AND filled by the chunk — three places, because the server half and the client half are different registrations that share one name. `swaggerFragment.js` knew only about tier routers, so the two routes under `/admin/users/:id` were generated by nothing: a fragment that was internally consistent and described two routes fewer than the module serves. A slot's mount is core's and cannot be derived here, so it is a fourth constant beside `TIER_BASE` — held to account by the frozen-manifest job, which was verified to catch exactly this by removing the two paths and watching it fail. ## Smaller things worth knowing - **Core's `useAsync` has no `refresh`.** A counter in the deps is how a page re-reads after its own write; it blanks while it re-reads, which is right here and is exactly what made it wrong for a poll. - **Every player-portal nav row needs an `icon`** — core draws one on every row, and the client suite says so. This module had no icons file until now, because the public header is text buttons. - The two new frame kinds are STAFF-only. Neither carries a code, but both name a Steam id beside a website account's activity, and that join is not a public fact about what happened on a server. - The link code route carries its own rate limiter rather than core's `accountChangeLimiter`: this is guessing somebody else's secret, not changing your own password, and a shared counter would let one policy set the other. Protocol 3 on all three declaration sites; 17 new tests, 136 green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM
72 lines
2.8 KiB
JavaScript
72 lines
2.8 KiB
JavaScript
// ── The `admin.users.detail` slot's handlers ──────────────────────────────
|
||
//
|
||
// What an operator can see and do about one website user's Rust identity. The
|
||
// user id is the PARENT's — `req.params.id` off core's `/admin/users/:id` — and
|
||
// every statement here is scoped by it, so a panel opened on one user cannot
|
||
// read or write another's rows by editing a path segment.
|
||
|
||
const core = require('../../core')
|
||
|
||
const links = require('../../model/links/links.model')
|
||
|
||
const log = core.logger('admin')
|
||
|
||
/**
|
||
* GET /admin/users/:id/rust/links
|
||
*
|
||
* The linked Steam accounts and, per server, what this module knows about the
|
||
* player behind them — all-time rather than this wipe's, because an operator
|
||
* looking at a user wants their history and the public leaderboard already
|
||
* answers the other question.
|
||
*
|
||
* **An empty array is an answer.** Most users have no Rust link at all, and the
|
||
* panel renders nothing rather than an error for them.
|
||
*/
|
||
async function listLinks(req, res) {
|
||
try {
|
||
res.json({ links: await links.forAdmin(req.params.id) })
|
||
} catch (err) {
|
||
log.error('failed to read a user’s Rust links', { error: err.message })
|
||
res.status(500).json({ error: 'Failed to read this user’s Rust accounts' })
|
||
}
|
||
}
|
||
|
||
/**
|
||
* DELETE /admin/users/:id/rust/links/:steamId — staff sever a link (D25).
|
||
*
|
||
* **This is the counterweight to D23.** The site refuses to move a Steam id that
|
||
* another website account already holds, and the player's own way out is
|
||
* `/unlink` in game — which is no way out at all for somebody who has lost access
|
||
* to that Steam account, or to the site account holding it. Staff are that route.
|
||
*
|
||
* Scoped by the parent user id in the statement rather than checked first: the
|
||
* ownership test and the deletion are one operation, and a link that belongs to a
|
||
* different user answers 404 from the page it was not on.
|
||
*/
|
||
async function removeLink(req, res) {
|
||
const { steamId } = req.params
|
||
const userId = req.params.id
|
||
|
||
try {
|
||
const removed = await links.unlinkOwned(steamId, userId)
|
||
|
||
if (!removed) return res.status(404).json({ error: 'That account is not linked to this user' })
|
||
|
||
// The one write this panel has, so it is the one thing here worth an audit
|
||
// row: after phase 7 a link is what permissions are granted against, and
|
||
// "who severed it" stops being a curiosity.
|
||
await core.activity.log({
|
||
req,
|
||
action: 'rust.account.unlink.staff',
|
||
detail: { steamId, userId: Number(userId) },
|
||
})
|
||
|
||
return res.json({ unlinked: true })
|
||
} catch (err) {
|
||
log.error('failed to unlink a Steam account', { error: err.message })
|
||
return res.status(500).json({ error: 'Failed to unlink that account' })
|
||
}
|
||
}
|
||
|
||
module.exports = { listLinks, removeLink }
|