wtclaude
43147b796a
R2, and the first phase where this module WRITES to a game. Groups and grants are authored on the website and pushed into each server's own permission store, so every plugin that already calls `UserHasPermission` honours them with no adapter, and a wipe stops being a data-loss event. **Seven org-lead decisions (D28-D34).** A grant is keyed to the website USER and resolved to every Steam id they have linked at push time (D28); every authored row carries a scope — a server or `*` (D29); groups are mirrored as real groups rather than flattened (D30); a holder the site did not author is REPORTED, never undone, with adopt and revoke offered (D31); one verb, with the plugin diffing locally (D32); a permission no server has registered is reported unresolved and never self-registered (D33); authoring is people and groups by hand, with rules deferred (D34). **Three sets, and every interesting question is a difference between two.** `desired − pushed` is what to apply; `pushed − desired` is what to RETIRE, because the site put it there and has since withdrawn it; `present − desired` is drift. The middle one is why `rust_perm_pushed` exists: a name in the store that is not in the desired set is either something the site retired or something a human granted, and those two have opposite correct answers. **What lands is not what was sent.** A grant naming a permission the server has not registered did not land — `GrantUserPermission` no-ops silently — and a member the store has never seen could not be placed. Neither is recorded as pushed, so the site never believes it gave a privilege it did not. The loop asks a cheap question every thirty seconds — does the digest of the desired set still equal what this server last confirmed — and syncs on a change, a restart, a wipe, a drift hook, a failed attempt past its backoff, or the fifteen-minute audit that finds drift on a server nobody has touched. **This module's first admin page**, because a permission model is the first thing here that has to be composed rather than configured. What is on it is decided by what an operator can get wrong: four states are invisible from the game and from a list of grants, and each is a sentence rather than a number. Walked end to end against a real core at the pinned ref, the real sidecar, and a stand-in speaking protocol 4 — including a restart that emptied the store and was fully re-pushed. Four defects the browser found that 133 green tests did not. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM
51 lines
2.3 KiB
JSON
51 lines
2.3 KiB
JSON
{
|
|
"$comment": [
|
|
"What a release copies into the bundle, declared ONCE. Read by .gitea/workflows/release.yml when",
|
|
"it assembles the tarball, and by server/scripts/checkBundle.js when CI asks whether that list",
|
|
"still covers everything the module's entry point can reach.",
|
|
"",
|
|
"This is an INCLUDE list on purpose. An exclude list ships whatever it forgot: the day someone",
|
|
"adds server/tools/ with a scratch credential in it, an exclude list packs it and nobody finds",
|
|
"out. The cost of that choice is that a new top-level directory silently drops OUT of every",
|
|
"release instead — which is exactly what happened to Module-uo between v0.3.0 and v1.0.0, where",
|
|
"server/commands/ arrived with a cutover, the list did not learn about it, and the module",
|
|
"installed and then died at the register stage on the operator's box. checkBundle.js exists so",
|
|
"that cannot happen twice, and it runs on the PR that adds the directory.",
|
|
"",
|
|
"server[] entries are paths under server/; root[] and generated[] are paths under the module",
|
|
"root.",
|
|
"",
|
|
"node_modules is NOT here, and its absence is asserted rather than assumed: this module declares",
|
|
"no runtime dependencies (everything the shipped half needs arrives on ctx), so the release runs",
|
|
"no npm ci and packs no dependency tree. checkBundle.js fails the PR that adds a `dependencies`",
|
|
"entry to server/package.json without also teaching the release to pack it — because a module",
|
|
"whose bundle silently lacks its own dependency fails the same way the missing directory did.",
|
|
"",
|
|
"generated[] ships but is not copied — release.yml writes module.json through jq to stamp the",
|
|
"released version into it, since the committed one is a floor rather than a record of the last",
|
|
"release. It is listed because server/index.js requires it, and a check that did not know it",
|
|
"ships would report the module's own manifest as missing from the bundle."
|
|
],
|
|
"server": [
|
|
"boot.js",
|
|
"catalogue.js",
|
|
"core.js",
|
|
"db",
|
|
"index.js",
|
|
"ingest.js",
|
|
"model",
|
|
"package.json",
|
|
"permSync.js",
|
|
"router",
|
|
"sidecarClient.js"
|
|
],
|
|
"root": [
|
|
"swagger-fragment.json",
|
|
"LICENSE.md",
|
|
"README.md"
|
|
],
|
|
"generated": [
|
|
"module.json"
|
|
]
|
|
}
|