wtclaude
845caef817
The site half of §11.2.2, on protocol 14:
- `rust.coins.pay` ("Pay coins"): irreversible, reversible none (D335). The
recipient modes of rust.kit.entitle including `linked`, one payment per
website user (D103's rule), an optional message with {amount}, a new
`rust.coins` budget. Refused with "Economics is not installed on this
server" in the dry run too (D199). Core's key goes to the plugin, so a
retried step answers `repeat` and pays nobody twice.
- `rust_player_wipe_stats.balance`: the tally's balance, written as a value.
A nameless balance frame (an offline player) moves nobody's last-seen.
`economics.wiped` clears the wipe's balances, except at a new save.
- The richest: a Coins leaderboard column on one wipe of a server that
reports Economics, `sort=balance`, and a `richest` title category
(Magnate); both rank only above the starting balance (D336).
- GET /player/rust/economics (live, falling back to the last known), and
GET/POST /admin/users/:id/rust/economics for staff — scoped to the user's
own links, keyed per submission, an activity row with before and after.
- Client: the account page's Coins, the admin user page's Coins panel with
its form, the leaderboard column, and Economics in the server's mod line
(saying when its config could not be read).
Server 535/535 (14 new in test/economics.test.js), client 74/74,
routes.manifest regenerated against the pinned core (87 routes), swagger
fragment regenerated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
142 lines
9.0 KiB
JavaScript
142 lines
9.0 KiB
JavaScript
// ── Player · Rust ─────────────────────────────────────────────────────────
|
||
//
|
||
// Mounted at `/api/v1/player/rust`. The tier's gate is already applied: `player`
|
||
// sits behind `noindex, requireAuth`, so every handler here has a signed-in user
|
||
// and none of them re-implements that check.
|
||
//
|
||
// ── Why this tier exists in phase 1, and what it holds now ────────────────
|
||
//
|
||
// R14 puts this module on all three tiers from the start, and the loader holds
|
||
// `module.json`'s `mounts` against what is actually registered in **both**
|
||
// directions — a declared prefix that never gets a router fails the load. So the
|
||
// declaration and the registration land together or not at all.
|
||
//
|
||
// Phase 1 said this tier would carry the signed-in view of a server — the
|
||
// viewer's own linked Steam identity, their own presence, their own entitlements
|
||
// — and that identity was a later phase. This is that phase: `/links`, `/link`
|
||
// and `DELETE /links/:steamId` are R1, and everything phases 7 and 13 hand out is
|
||
// hung off the row they write.
|
||
//
|
||
// `/servers` stays what it was: the same list the public tier serves, answered on
|
||
// the authenticated tier so per-player detail can be added without moving the
|
||
// address. It delegates to the same model, so the two cannot drift.
|
||
|
||
const core = require('../../core')
|
||
|
||
const express = core.express
|
||
const { body, param } = core.validator
|
||
|
||
const rust = require('./rust.controller')
|
||
const { validate, rateLimit } = core.middleware
|
||
|
||
const playerRustRouter = express.Router()
|
||
|
||
// A Steam id as the game states it — `BasePlayer.UserIDString`, a 17-digit
|
||
// SteamID64. Bounded rather than pinned at 17 because the column is a string and
|
||
// a test rig's ids are shorter; what matters is that nothing but digits reaches a
|
||
// `WHERE steam_id = ?`.
|
||
const STEAM_ID_RE = /^[0-9]{5,32}$/
|
||
|
||
/**
|
||
* R1 requires the link code be rate-limited, and this is where that lands.
|
||
*
|
||
* The code is six characters from a 32-glyph alphabet, so guessing one is a
|
||
* 1-in-10⁹ shot — but only while the guesser is made to pay for each attempt.
|
||
* Ten per quarter-hour per IP turns that into centuries; without it a script
|
||
* could work through the space in an afternoon, and phases 7 and 13 make the
|
||
* prize a set of in-game permissions and entitlements rather than a cosmetic
|
||
* badge.
|
||
*
|
||
* Its own limiter rather than core's `accountChangeLimiter`: this is guessing
|
||
* somebody else's secret, not changing your own password, and sharing a counter
|
||
* would mean one of the two silently sets the policy for the other.
|
||
*/
|
||
const linkLimiter = rateLimit({
|
||
windowMs: 15 * 60 * 1000,
|
||
max: 10,
|
||
label: 'rust-link-code',
|
||
message: 'Too many link attempts. Please try again later.',
|
||
})
|
||
|
||
playerRustRouter.get(
|
||
'/npc-kills',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'Your kills of each NPC profile'
|
||
// #swagger.description = 'The caller’s kills of RunicNPC’s NPCs, by server and profile, in each server’s current wipe, across every Steam account they have linked (docs/runicnpc/PLAN.md stage 4, D252). Empty with no linked account. Requires a session.'
|
||
/* #swagger.responses[200] = { description: 'The kills', content: { "application/json": { schema: { $ref: "#/components/schemas/RustNpcOwnKills" } } } } */
|
||
rust.ownNpcKills,
|
||
)
|
||
|
||
playerRustRouter.get(
|
||
'/economics',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'Your coin balances'
|
||
// #swagger.description = 'The caller’s Economics balance on every server, per linked Steam account (PLAN_REDESIGNS §11.2.2). Read live from each server; where a server does not answer, the last balance it reported (`source: last-known`), and null where neither knows. A server without Economics is listed with `economics: false` and the reason. `startingKnown: false` means the server’s Economics config could not be read and the starting balance shown is Economics’ default. Empty `accounts` with no linked account. Requires a session.'
|
||
// #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
|
||
/* #swagger.responses[200] = { description: 'The balances', content: { "application/json": { schema: { $ref: "#/components/schemas/RustEconomicsBalances" } } } } */
|
||
rust.ownEconomics,
|
||
)
|
||
|
||
playerRustRouter.get(
|
||
'/servers',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'The Rust servers, for a signed-in player'
|
||
// #swagger.description = 'The same servers the public list carries, answered on the authenticated tier. It is the address a signed-in client calls, so that per-player detail can be added here without moving it. Requires a session.'
|
||
/* #swagger.responses[200] = { description: 'The server list', content: { "application/json": { schema: { $ref: "#/components/schemas/RustServerList" } } } } */
|
||
rust.listServers,
|
||
)
|
||
|
||
playerRustRouter.get(
|
||
'/links',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'The Steam accounts the caller has linked'
|
||
// #swagger.description = 'Every Steam account linked to the signed-in user, newest first. A link is fleet-wide: it is keyed by Steam id, not by server, because a Steam account is one person across every server an operator runs.'
|
||
// #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
|
||
/* #swagger.responses[200] = { description: 'Linked accounts', content: { "application/json": { schema: { $ref: "#/components/schemas/RustLinkList" } } } } */
|
||
rust.listLinks,
|
||
)
|
||
|
||
playerRustRouter.get(
|
||
'/permissions',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'What the site has given the caller in game'
|
||
// #swagger.description = 'The groups and direct grants the site holds for the signed-in user, each resolved to the servers its scope reaches and marked with whether that server has it yet. Read-only: a grant a player could change would not be a grant. `live` is the pushed ledger rather than the authored row, so an entitlement that has not reached a game reads as waiting — which is also what an offline server, a permission no loaded plugin registered, and an account the store has never seen all look like from here.'
|
||
// #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
|
||
/* #swagger.responses[200] = { description: 'What the caller holds', content: { "application/json": { schema: { $ref: "#/components/schemas/RustPlayerPermissions" } } } } */
|
||
rust.listPermissions,
|
||
)
|
||
|
||
playerRustRouter.post(
|
||
'/link',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'Link a Steam account with a one-time code from /link in game'
|
||
// #swagger.description = 'The player types /link in game, the plugin hands them a six-character code privately, and they enter it here within five minutes. The site asks each configured server in turn until one recognises the code. A Steam account already linked to a different website account is refused rather than moved — the way out is /unlink in game.'
|
||
// #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
|
||
/* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/RustLinkRequest" } } } } */
|
||
/* #swagger.responses[200] = { description: 'Linked', content: { "application/json": { schema: { $ref: "#/components/schemas/RustLinkResult" } } } } */
|
||
/* #swagger.responses[400] = { description: 'Unknown or expired code', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
||
/* #swagger.responses[409] = { description: 'That Steam account is linked to another website account', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
||
/* #swagger.responses[429] = { description: 'Too many link attempts', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
||
/* #swagger.responses[503] = { description: 'A server could not be reached — the code is still good', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
||
linkLimiter,
|
||
body('code').isString().trim().isLength({ min: 4, max: 32 }),
|
||
validate,
|
||
rust.confirmLink,
|
||
)
|
||
|
||
playerRustRouter.delete(
|
||
'/links/:steamId',
|
||
// #swagger.tags = ['Player · Rust']
|
||
// #swagger.summary = 'Release a Steam account the caller has linked'
|
||
// #swagger.description = 'Removes the caller’s own link. Scoped to the caller in the statement, so a link belonging to somebody else answers the same 404 as one that does not exist.'
|
||
// #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
|
||
// #swagger.parameters['steamId'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'The Steam id to release.' }
|
||
/* #swagger.responses[200] = { description: 'Unlinked', content: { "application/json": { schema: { type: "object", properties: { unlinked: { type: "boolean", example: true } } } } } } */
|
||
/* #swagger.responses[404] = { description: 'Not linked to the caller', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
|
||
param('steamId').matches(STEAM_ID_RE),
|
||
validate,
|
||
rust.removeLink,
|
||
)
|
||
|
||
module.exports = playerRustRouter
|