R1's identity link, site-side, and R13's first extension slot. A player types /link in game, the plugin hands them a six-character code privately, and they enter it here; the site records who owns which Steam account, and an operator sees that on core's own `/admin/users/:id` page. **The site is the author of record and the game holds nothing.** There is no per-account store in Rust that survives a wipe, and phase 7 needs the site authoritative anyway — it pushes permissions INTO the game keyed by Steam id. A copy in the game would be a second thing to reconcile every wipe, for no question it could answer better. ## D24 — a code is minted by ONE server, so every server is asked Nothing in six characters says where it came from. The fleet is asked in turn and the first `link.ok` wins; the others answer `unknown` and nothing happens there, because a code is only spent at the server that actually holds it. Asking the player to pick was rejected: a wrong pick would come back indistinguishable from a wrong code, and that is the one refusal which must not be ambiguous. **"Every reachable server refused" is not the same answer as "a server was unreachable."** Collapsing them tells a player whose server is down that their code is wrong — so they run /link again on that same server and are told the same thing for as long as it stays down. `unsure` is that case, and it says to try again rather than to fetch a new code. ## D23 — a Steam id another account holds is refused, never moved The primary key is `steam_id`, and it is load-bearing rather than tidy: phase 7 grants permissions against a link and phase 13 hangs entitlements off it, so a silent move is an account takeover performed by typing six characters. The refusal names the holder, because the advice is unusable without it. The INSERT is a plain INSERT for the same reason — `ON DUPLICATE KEY UPDATE` here would BE that move — and the duplicate-key error is the refusal for the race the check above cannot close. The way out is `/unlink` in game, which reaches the site off the ingest feed rather than through a route (the plugin has no link to delete). D25 adds the other way out: staff can sever a link from the admin panel, for a player who cannot reach that Steam account in game. ## The slot, and the hole it found in this repo's own generator `admin.users.detail` is declared in `module.json` AND registered in `index.js` AND filled by the chunk — three places, because the server half and the client half are different registrations that share one name. `swaggerFragment.js` knew only about tier routers, so the two routes under `/admin/users/:id` were generated by nothing: a fragment that was internally consistent and described two routes fewer than the module serves. A slot's mount is core's and cannot be derived here, so it is a fourth constant beside `TIER_BASE` — held to account by the frozen-manifest job, which was verified to catch exactly this by removing the two paths and watching it fail. ## Smaller things worth knowing - **Core's `useAsync` has no `refresh`.** A counter in the deps is how a page re-reads after its own write; it blanks while it re-reads, which is right here and is exactly what made it wrong for a poll. - **Every player-portal nav row needs an `icon`** — core draws one on every row, and the client suite says so. This module had no icons file until now, because the public header is text buttons. - The two new frame kinds are STAFF-only. Neither carries a code, but both name a Steam id beside a website account's activity, and that join is not a public fact about what happened on a server. - The link code route carries its own rate limiter rather than core's `accountChangeLimiter`: this is guessing somebody else's secret, not changing your own password, and a shared counter would let one policy set the other. Protocol 3 on all three declaration sites; 17 new tests, 136 green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PMH6bw1jXMgbyF3ZWGEzSM
138 lines
7.6 KiB
JavaScript
138 lines
7.6 KiB
JavaScript
// ── The client entry point ────────────────────────────────────────────────
|
|
//
|
|
// Core serves `dist/entry.js` from this module's directory and injects it into
|
|
// its own HTML as a same-origin `<script type="module" src>` before `</body>`.
|
|
// This file registers what the module has; core renders it. Normative:
|
|
// MODULE_API.md §3.3.
|
|
//
|
|
// **Registration is synchronous and happens at evaluation time.** Module scripts
|
|
// are deferred, so this runs after core's bundle — which is where `window.__rg`
|
|
// is published — and before core's first render. There is no subscription and no
|
|
// late registration: a module that registered asynchronously would register after
|
|
// the route table had been read, and the symptom is a page that redirects home
|
|
// with nothing logged anywhere.
|
|
//
|
|
// So everything below is a plain top-level call and every page is a STATIC
|
|
// import. Lazy-loading the routes is the natural instinct for a chunk that grows,
|
|
// and it is the one thing this seam cannot have.
|
|
|
|
import { registry, coreApiVersion } from './core.js'
|
|
|
|
import Servers from './routes/public/Servers.jsx'
|
|
import ServerDetail from './routes/public/ServerDetail.jsx'
|
|
import Account from './routes/player/Account.jsx'
|
|
import UserRustSections from './routes/admin/UserRustSections.jsx'
|
|
import FooterStatus from './components/FooterStatus.jsx'
|
|
import { IconLink } from './icons.jsx'
|
|
|
|
// The module id, exactly as `module.json` spells it. Core keys the registry by it
|
|
// and prefixes every route path with it.
|
|
const ID = 'rust'
|
|
|
|
// ── Routes ────────────────────────────────────────────────────────────────
|
|
//
|
|
// Paths are relative to the module's namespace and core prefixes them. Whatever
|
|
// is written here, a public route lands at `/<id>/<path>`, an admin route at
|
|
// `/admin/<id>/<path>` and a player route at `/player/<id>/<path>`. A module
|
|
// cannot write the segment its routes hang under, which is the point: two modules
|
|
// installed side by side cannot collide, and an operator can see from a URL which
|
|
// module served it.
|
|
//
|
|
// So the list below is at `/rust` and the detail page at `/rust/servers/:id`.
|
|
//
|
|
// **Note what is NOT here: an auth wrapper.** `gate: { roles: [...] }` is
|
|
// available and core applies it as its own `RoleGate`; supplying your own is not
|
|
// possible, because the sidebar and the route table have to agree about who may
|
|
// see what, and they only do if one thing decides.
|
|
//
|
|
// R8's landing page is the server list, and `/rust/servers/:id` hangs beneath it.
|
|
//
|
|
// **The list is registered with an EMPTY path**, which core renders as the
|
|
// module's namespace root: `/rust`. The prefixing code strips the separator it
|
|
// would otherwise leave behind (`registry.js`: `${id}/${path}` with trailing
|
|
// slashes trimmed), so a module can own its own root without being able to spell
|
|
// its way out of it. Phase 1 served this page at `/rust/servers` and left `/rust`
|
|
// to core's CMS catch-all; the org lead settled it at `/rust` in phase 4, so the
|
|
// address an operator links to is the module's name.
|
|
//
|
|
// React Router ranks a static segment above a dynamic one, so `/rust` wins
|
|
// against core's `/:slug` CMS route without depending on registration order.
|
|
//
|
|
// The player route is registered with an empty path for the same reason the
|
|
// public list is: `/player/rust` is the whole of what this module asks a player
|
|
// to do, and a landing page above one page is a page nobody wants. Core applies
|
|
// its own portal chrome and its own auth gate to the tier, so the component
|
|
// renders no layout and re-implements no check.
|
|
registry.registerRoutes(ID, {
|
|
public: [
|
|
{ path: '', element: <Servers /> },
|
|
{ path: 'servers/:id', element: <ServerDetail /> },
|
|
],
|
|
player: [{ path: '', element: <Account /> }],
|
|
})
|
|
|
|
// ── Nav ───────────────────────────────────────────────────────────────────
|
|
//
|
|
// A registered row is an ORDINARY row from here on. It interleaves into core's
|
|
// own navigation, and an operator can reorder it, relabel it or hide it from the
|
|
// admin nav editor exactly as they can core's — because the interleave happens
|
|
// before the override merge, and the override layer is keyed by `to`.
|
|
//
|
|
// Three fields worth knowing before you need them:
|
|
//
|
|
// • `order` places the row among core's, which are keyed by their index. A row
|
|
// with NO order appends after them, rather than defaulting to 0 — otherwise
|
|
// "I didn't ask for a position" would mean "put me first".
|
|
// • `group` (admin sidebar) names an existing core group; an unknown name
|
|
// appends a new group at the end rather than dropping the row.
|
|
// • `icon` is a component, and core supplies no fallback. Public header rows
|
|
// carry no icons, so there is none here — but an admin or player row without
|
|
// one is the only row in its sidebar with no glyph, which reads as breakage.
|
|
registry.registerNav(ID, {
|
|
area: 'public',
|
|
items: [{ label: 'Servers', to: '/rust' }],
|
|
})
|
|
|
|
// The player portal's row. It carries an `icon` because core draws one on every
|
|
// portal row — a row without one is the only text in a column of glyphs, and
|
|
// core used to render `<n.icon />` unguarded, which blanked the whole portal.
|
|
//
|
|
// No `order`: an unordered row appends after core's own rather than claiming a
|
|
// position it was not given. Account, appeals and notifications are what a player
|
|
// came to the portal for; linking a game account is what they do once.
|
|
registry.registerNav(ID, {
|
|
area: 'player',
|
|
items: [{ label: 'Rust', to: '/player/rust', icon: IconLink }],
|
|
})
|
|
|
|
// ── Extension slots ───────────────────────────────────────────────────────
|
|
//
|
|
// Core declares a slot, only core may declare one, and at most one module may
|
|
// fill it (§3.7). `site.footer.status` is the status-ish spot in core's footer
|
|
// info row: core owns the position and passes `linkStyle`; the label, the
|
|
// destination, the data and whether anything renders at all are the module's.
|
|
//
|
|
// It is a CLIENT slot and cannot be named in `module.json`'s `extensions` —
|
|
// that array is validated against the SERVER registry, and naming a client slot
|
|
// there fails the load outright with `unknown extension slot`. Phase 1 found
|
|
// that the hard way; the two halves of R13 are declared in different places on
|
|
// purpose.
|
|
registry.registerExtension(ID, 'site.footer.status', FooterStatus)
|
|
|
|
// R13's other slot, and the one that IS named in `module.json` — because it has
|
|
// a server half too (`server/router/admin/usersRust.router.js`). The two halves
|
|
// carry one name on purpose: a module that adds routes under
|
|
// `/api/v1/admin/users/:id` is the module with something to show on that page.
|
|
//
|
|
// Core passes `userId` and nothing else, so the component builds its own client
|
|
// for the routes the server half registered. It renders NOTHING for a user with
|
|
// no linked Steam account, which is most of them.
|
|
registry.registerExtension(ID, 'admin.users.detail', UserRustSections)
|
|
|
|
// `module.json`'s `coreApi` range was checked by the loader before this file was
|
|
// ever served, so there is nothing to re-check here. Log it anyway: a mismatch
|
|
// between the core that validated the manifest and the core that published this
|
|
// global is otherwise invisible from the browser, which is where the client half
|
|
// actually fails.
|
|
console.info(`[${ID}] registered against core API ${coreApiVersion}`)
|