2026-02-03 - 2026-08-03
Overview
101 Pull requests merged by 2 users
Merged
#118 feat(shard)!: Protocol 3.0 cutover — visibility framework, spawn atlas, marketplace
Merged
#119 fix(shard): answer with the instance name when the shard is unnamed
Merged
#117 feat(shard)!: declare wire protocol 3
Merged
#116 feat(shard): the player-vendor marketplace
Merged
#115 feat(shard): resolve cliloc names for items and reward titles
Merged
#114 feat(shard): ingest points.board and publish the leaderboards
Merged
#113 feat(atlas): serve the spawn atlas and give operators a panel for it
Merged
#112 feat(atlas): derive a spawn atlas from the shard tree on every boot
Merged
#111 feat(shard): ingest world.ruleset and publish it at /site/rules
Merged
#110 fix(shard): enforce visibility on the REST reads that bypassed it
Merged
#109 feat(shard): admin-configurable visibility for every shard surface
Merged
#108 feat(auth): honor and establish trusted devices on the SSO login paths
Merged
#107 fix(shard): stop an undecryptable uo-link token 500ing every live-shard route
Merged
#106 refactor(server): split public, player and residual auth into capability routers (PR 5)
Merged
#105 refactor(server): split admin shard, uo-link, email, discord-bot, settings and dashboard into capability routers (PR 4)
Merged
#104 refactor(server): split admin posts, uploads, wiki and pages into capability routers (PR 3)
Merged
#103 refactor(server): split admin moderation, bot-activity and activity into capability routers (PR 2)
Merged
#101 build(swagger): normalize and sort generated OpenAPI path keys
Merged
#102 refactor(server): split admin users, account, invites and auth providers into capability routers
Merged
#100 feat(security): soak the tightened CSP on report-only, with a same-origin sink
Merged
#99 chore(server): freeze the URL surface with a generated route manifest (PR 0)
Merged
#98 ci(docs): auto-sync PROJECT_TREE.md to the docs repo on push to main
Merged
#97 fix(moderation): windowValue must not fall back to the 30d total on a null column
Merged
#96 fix(admin): restore digit match in discordId route validation
Merged
#95 fix(ntfy): publish ntfy host port so the external reverse proxy can reach it
Merged
#94 fix(player): open the player self-service surface to staff
Merged
#93 feat(auth): trusted devices, recovery codes, and admin MFA management
Merged
#92 docs(readme): add architecture mermaid diagram
Merged
#91 chore(dev): stub OAuth IdP tooling for local mobile SSO testing
Merged
#90 fix(footer): point Shard Status link to /site/shard
Merged
#89 refactor(server): dedupe shard-state shaping, upsert builder, and config DB models
Merged
#88 chore(quality): resolve SonarQube code smells across website
Merged
#87 ci(sonarqube): populate the "Unit Tests" measure via a test-execution report
Merged
#86 test: meaningful unit tests for server models/controllers + client logic
Merged
#85 ci(sonarqube): generate and report server test coverage
Merged
#84 fix(security): add SPA CSP, drop x-powered-by, strengthen dedupe hash
Merged
#83 ci(sonarqube): non-blocking SonarQube analysis on push to main
Merged
#82 fix(db): strip inline -- comments before splitting schema statements
Merged
#81 feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist
Merged
#80 feat(auth): native SSO authorization bridge for the Android app (M9 Part 1)
Merged
#79 feat(settings): surface push.ntfyUrl in /public/settings for the app
Merged
#78 feat(push): M7 backend — opt-in push notifications via self-hosted ntfy
Merged
#77 feat(public): version/health surfacing + typed brand block
Merged
#76 feat(auth): role-agnostic self-service surface under /auth/me
Merged
#75 feat(auth): self-service password reset (backend + web)
Merged
#74 Moderation appeals (Phase 6c) + Discord auto-reversal (Phase 6d)
Merged
#73 docs: generalize deployment section to any reverse proxy
Merged
#72 fix(shard): restrict staff in-game location to admins/moderators
Merged
#71 chore: add open-source governance files (GPLv3 + contributing docs)
Merged
#70 fix(brand): link "Runic Gateway" footer badge to Gitea org
Merged
#69 feat(brand): default emblem — favicon, hero medallion, footer credit
Merged
#68 feat(brand): BRAND_* env scheme — instance branding without a rebuild
Merged
#67 docs: move design docs to RunicGateway/docs
Merged
#66 chore(org): retarget org paths to RunicGateway
Merged
#65 Protocol 2.0/2.1 uo-link integration — boards, cross-links, news gump, account provisioning
Merged
#64 ci(deploy): correct deploy runner label to uom-deploy-runner
Merged
#63 ci(deploy): auto-deploy prod stack after image build on merge to main
Merged
#62 fix(bot): retry boot-time config fetch so bot self-heals on cold start
Merged
#61 fix(public): always show real hero + drop nav from landing page
Merged
#58 feat(shard): admin write plane, help-page queue, and public champion board
Merged
#57 ci: gate PRs into main on server tests + client build
Merged
#56 feat(admin): view a user's shard footprint at /admin/users/:id
Merged
#55 deploy: split build into docker-compose.dev.yml (prod compose pulls only)
Merged
#54 deploy: pull prebuilt registry images in compose (IMAGE_TAG) + dev/prod split
Merged
#53 ci: build & publish app + bot images to Gitea registry on merge
Merged
#52 News post → town crier + Discord announcement pipeline
Merged
#51 Homepage teaser: rich text editor
Merged
#50 Frontend theme redo: player portal → Admin sidebar shell + stat-tile My Characters
Merged
#49 uo-link: staff-only public presence + admin character access
Merged
#47 CMS Page Builder (Wave 1): block-based Pages content type
Merged
#46 Modernize email: Gmail OAuth2 sending + admin sidebar redesign
Merged
#45 Redesign admin/staff sidebar: collapsible categories, icons, role-accurate nav
Merged
#44 Gate /admin to staff roles; role-aware login redirects for players
Merged
#43 Player accounts: self-service player role, registration, and portal
Merged
#42 Moderation dashboard: staff dashboard, user history, notes, event capture (Phase 6a + 6b)
Merged
#41 Fix bot container inheriting site PORT/LOG_FILE from shared .env
Merged
#40 Audit and fix Swagger/OpenAPI accuracy; regenerate served spec
Merged
#39 Enforce TOTP second factor on SSO login (#31)
Merged
#38 Fix SSO flow-token / session type confusion (#32)
Merged
#37 Implement web session/token revocation (#30)
Merged
#36 Isolate internal bot-config route from the public listener (#33)
Merged
#29 Add Discord bot: moderation, filters, scheduling, roles, invites, site integration
Merged
#28 Hero editor: fullscreen landing, remove two-card row, quick links into hero
Merged
#27 Add Swagger/OpenAPI API docs (swagger-ui + swagger-autogen)
Merged
#26 Hero editor: scale text-block fonts with the resize handle (#25)
Merged
#24 Add session abstraction, mobile bearer auth, and pluggable SSO (Google/Discord/OIDC)
Merged
#23 Add Bot Activity admin panel: banned-IP view + recent events + emergency unban
Merged
#22 Update README for today's security hardening and 2FA work
Merged
#21 Fail fast when JWT_SECRET is missing in production (closes #14)
Merged
#20 Make the hero Moon image configurable (src/alt), backwards-compatible
Merged
#19 Admin login hardening: RBAC-safe controls, optional TOTP, bot-scoring + IP ban (closes #9)
Merged
#18 Derive uploaded file extension from mimetype, not originalname (fixes #11)
Merged
#17 Validate and uniqueness-check username on user update (fixes #13)
Merged
#16 Re-validate JWT against the DB in isLoggedIn (fixes #12)
Merged
#15 Enforce role-based authorization on admin-only routes (fixes #10)
Merged
#8 Fix #6: larger RTE toolbar buttons + bigger, both-axis-scrolling editor
Merged
#7 RTE Posts upgrade: TipTap rich-text editing + sanitization for posts
Merged
#4 hero-feature
Merged
#3 Wiki upgrade: rich-text editing, categories, drafts, links/backlinks, tags, search, revisions
Merged
#2 Document full-stack setup; fix dev proxy; drop stray temp script
Merged
#1 Frontend update
15 Issues closed from 3 users
Closed
#59 hero page layout
Closed
#48 Homepage Teaser
Closed
#31 [SECURITY AUDIT] SSO login bypasses TOTP two-factor for accounts that have 2FA enabled
Closed
#32 [SECURITY AUDIT] SSO flow token (sso_tx) validates as a session — token-type confusion in sessionFromDecoded
Closed
#30 [SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs
Closed
#33 [SECURITY AUDIT] Decrypted Discord bot token served from an endpoint on the public API router, guarded only by a shared secret
Closed
#25 On the front page/hero page
Closed
#14 [Bug][Medium] Server boots with no JWT_SECRET (only a warning)
Closed
#5 Hero button bug
Closed
#9 Admin path security
Closed
#11 [Security][High] Uploaded file extension is attacker-controlled → stored XSS
Closed
#13 [Bug][Medium] username unvalidated and not uniqueness-checked on user update
Closed
#12 [Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry
Closed
#10 [Security][High] No role-based authorization — editor role is never enforced
Closed
#6 wiki editor.
18 Issues created by 2 users
Opened
#5 Hero button bug
Opened
#6 wiki editor.
Opened
#9 Admin path security
Opened
#10 [Security][High] No role-based authorization — editor role is never enforced
Opened
#11 [Security][High] Uploaded file extension is attacker-controlled → stored XSS
Opened
#12 [Security][Medium] Stale JWT: demoted/deleted users keep access until token expiry
Opened
#13 [Bug][Medium] username unvalidated and not uniqueness-checked on user update
Opened
#14 [Bug][Medium] Server boots with no JWT_SECRET (only a warning)
Opened
#25 On the front page/hero page
Opened
#30 [SECURITY AUDIT] Session/token revocation is a non-functional stub — logout and password change do not invalidate existing JWTs
Opened
#31 [SECURITY AUDIT] SSO login bypasses TOTP two-factor for accounts that have 2FA enabled
Opened
#32 [SECURITY AUDIT] SSO flow token (sso_tx) validates as a session — token-type confusion in sessionFromDecoded
Opened
#33 [SECURITY AUDIT] Decrypted Discord bot token served from an endpoint on the public API router, guarded only by a shared secret
Opened
#34 [SECURITY AUDIT] No Content-Security-Policy — stored-HTML XSS defense rests entirely on sanitization
Opened
#35 [SECURITY AUDIT] Username enumeration via login timing side-channel (bcrypt runs only for existing users)
Opened
#48 Homepage Teaser
Opened
#59 hero page layout
Opened
#60 side ways scrolling section on hero page.