fix(player): open the player self-service surface to staff

Staff are a superset of players — every player ability plus their staff
tools on top — but the /player/* group ran requireRole('player'), so a
signed-in admin/editor/moderator got 403 on their own linked game
accounts (e.g. GET /player/shard/accounts). On the Android client this
hid "My characters" and greyed the personal notification streams for
staff accounts, even when they had linked characters.

Drop the role gate: the group is now requireAuth-only. Every handler is
already self-scoped to the caller by req.user.id (with the pre-existing
isAdmin bypass still letting a genuine admin read any character), so this
only ever widens access to the caller's OWN data. Staff also reach the
identical self-scoped handlers under /admin/shard/* (same controller).

- player.routes.js: requireRole('player') -> requireAuth; corrected the
  five stale "Player role required" 403 descriptions and regenerated
  swagger-output.json.
- New test/playerRouteAccess.test.js mounts the router and asserts
  player/admin/editor/moderator all reach the handler, anon still 401s,
  and a disabled account still 403s. Suite: 420 pass.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/router/v1/player/player.routes.js

@@ -1,10 +1,15 @@
-// ── Player self-service (role: 'player') ───────────────────────────────────
+// ── Player self-service (any authenticated account) ─────────────────────────
 //
-// The player-gated surface. Every route here requires an authenticated session
+// The player self-service surface: linked game accounts, character/vendor/house
-// whose fresh DB role is 'player' (staff use /admin/account for the same self-
+// reads, and account-credential changes, all self-scoped to the caller by
-// service). Handlers are shared with the admin account view (account.controller)
+// req.user.id. Staff are a *superset* of players — they have every player ability
-// — the same TOTP / identity logic, plus the net-new self-scoped credential
+// plus their staff tools on top — so this group is open to any authenticated
-// changes. Future player-only endpoints (profile, etc.) hang off this group.
+// account, not just role 'player'. Staff also reach the identical self-scoped
+// handlers under /admin/shard (they are the same controller); this group lets a
+// staff account use the player surface directly. Handlers are shared with the
+// admin account view (account.controller) — the same TOTP / identity logic, plus
+// the net-new self-scoped credential changes. Future self-service endpoints hang
+// off this group.
 
 const express = require('express')
 const { body, param } = require('express-validator')
@@ -12,17 +17,18 @@ const { body, param } = require('express-validator')
 const account = require('../admin/account.controller')
 const shard = require('./shard.controller')
 const appeals = require('./appeals.controller')
-const { requireAuth, requireRole } = require('../../../auth/session.middleware')
+const { requireAuth } = require('../../../auth/session.middleware')
 const noindex = require('../../../middleware/noindex')
 const validate = require('../../../middleware/validate')
 const { accountChangeLimiter } = require('../../../middleware/rateLimit')
 
 const playerRouter = express.Router()
 
-// Group gate: authenticated + fresh role must be 'player', and keep it out of
+// Group gate: authenticated only (no role restriction) — players and staff alike
-// search indexes. requireAuth also enforces the account status check (a
+// use this self-service surface; every read/write is scoped to the caller. Keep it
-// disabled/banned player is rejected here with 403 before any handler runs).
+// out of search indexes. requireAuth also enforces the account status check (a
-playerRouter.use(noindex, requireAuth, requireRole('player'))
+// disabled/banned account is rejected here with 403 before any handler runs).
+playerRouter.use(noindex, requireAuth)
 
 playerRouter.get(
   '/account',
@@ -31,7 +37,7 @@ playerRouter.get(
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
   /* #swagger.responses[200] = { description: 'The player account', content: { "application/json": { schema: { $ref: "#/components/schemas/PlayerAccount" } } } } */
   /* #swagger.responses[401] = { description: 'Not authenticated', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
-  /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   account.getAccount,
 )
 
@@ -43,7 +49,7 @@ playerRouter.patch(
   /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ChangeUsernameRequest" } } } } */
   /* #swagger.responses[200] = { description: 'Updated username (session cookie re-issued)', content: { "application/json": { schema: { type: "object", properties: { username: { type: "string" } } } } } } */
   /* #swagger.responses[400] = { description: 'Validation error or unavailable username', content: { "application/json": { schema: { $ref: "#/components/schemas/ValidationError" } } } } */
-  /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   /* #swagger.responses[409] = { description: 'Username already taken', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   /* #swagger.responses[429] = { description: 'Too many changes (rate limited)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   accountChangeLimiter,
@@ -61,7 +67,7 @@ playerRouter.patch(
   /* #swagger.requestBody = { required: true, content: { "application/json": { schema: { $ref: "#/components/schemas/ChangePasswordRequest" } } } } */
   /* #swagger.responses[200] = { description: 'Password changed', content: { "application/json": { schema: { $ref: "#/components/schemas/OkFlag" } } } } */
   /* #swagger.responses[400] = { description: 'Validation error or wrong current password', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
-  /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   /* #swagger.responses[429] = { description: 'Too many changes (rate limited)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   accountChangeLimiter,
   body('newPassword').isString().isLength({ min: 8, max: 64 }),
@@ -242,7 +248,7 @@ playerRouter.get(
   // #swagger.summary = 'List the caller’s moderation appeals'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
   /* #swagger.responses[200] = { description: 'The caller’s appeals', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/Appeal" } } } } } */
-  /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   appeals.listMine,
 )
 playerRouter.get(
@@ -252,7 +258,7 @@ playerRouter.get(
   // #swagger.description = 'The caller’s ban/mute mod_actions that have no active appeal. Returns an empty array when the caller has no linked Discord account (the UI shows a “link Discord” hint).'
   // #swagger.security = [{ "cookieAuth": [] }, { "bearerAuth": [] }]
   /* #swagger.responses[200] = { description: 'Appealable actions', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/AppealEligibleAction" } } } } } */
-  /* #swagger.responses[403] = { description: 'Player role required, or account not active', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
+  /* #swagger.responses[403] = { description: 'Account not active (disabled/banned)', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   appeals.listEligible,
 )
 playerRouter.post(

server/swagger/swagger-output.json

@@ -10147,7 +10147,7 @@
             }
           },
           "403": {
-            "description": "Player role required, or account not active",
+            "description": "Account not active (disabled/banned)",
             "content": {
               "application/json": {
                 "schema": {
@@ -10207,7 +10207,7 @@
             "description": "Unauthorized"
           },
           "403": {
-            "description": "Player role required, or account not active",
+            "description": "Account not active (disabled/banned)",
             "content": {
               "application/json": {
                 "schema": {
@@ -10292,7 +10292,7 @@
             "description": "Unauthorized"
           },
           "403": {
-            "description": "Player role required, or account not active",
+            "description": "Account not active (disabled/banned)",
             "content": {
               "application/json": {
                 "schema": {
@@ -11141,7 +11141,7 @@
             "description": "Unauthorized"
           },
           "403": {
-            "description": "Player role required, or account not active",
+            "description": "Account not active (disabled/banned)",
             "content": {
               "application/json": {
                 "schema": {
@@ -11272,7 +11272,7 @@
             "description": "Unauthorized"
           },
           "403": {
-            "description": "Player role required, or account not active",
+            "description": "Account not active (disabled/banned)",
             "content": {
               "application/json": {
                 "schema": {

server/test/playerRouteAccess.test.js

@@ -0,0 +1,84 @@
+// Point the DB at a closed port BEFORE requiring anything that builds the pool,
+// so any stray query fails fast instead of holding the process open. The session
+// service, users model, and shardLinks model are all stubbed, so no query runs.
+process.env.DB_HOST = '127.0.0.1'
+process.env.DB_PORT = '59999'
+
+const { test, after, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+
+const { startApp } = require('./_helper')
+const playerRouter = require('../src/router/v1/player/player.routes')
+const sessionService = require('../src/auth/session.service')
+const users = require('../src/model/users/users.model')
+const shardLinks = require('../src/model/shardLinks/shardLinks.model')
+const db = require('../src/utils/db')
+
+after(() => db.close())
+
+const originals = {
+  validateSession: sessionService.validateSession,
+  isSessionRevoked: sessionService.isSessionRevoked,
+  sessionMeta: sessionService.sessionMeta,
+  getById: users.getById,
+  listForUser: shardLinks.listForUser,
+}
+afterEach(() => {
+  sessionService.validateSession = originals.validateSession
+  sessionService.isSessionRevoked = originals.isSessionRevoked
+  sessionService.sessionMeta = originals.sessionMeta
+  users.getById = originals.getById
+  shardLinks.listForUser = originals.listForUser
+})
+
+// Sign every request in as the given DB user (role decides the gate outcome).
+function signInAs(user) {
+  sessionService.validateSession = () => ({ userId: user.id, sessionId: 's1', createdAt: Date.now(), authMethod: 'jwt' })
+  sessionService.isSessionRevoked = async () => false
+  sessionService.sessionMeta = () => ({})
+  users.getById = async () => user
+}
+
+// The player self-service group is intentionally role-agnostic (staff are a
+// superset of players): any authenticated, active account reaches the self-scoped
+// handlers. Regression guard for the fix that dropped requireRole('player') so a
+// staff/admin account is no longer 403'd out of its own characters.
+for (const role of ['player', 'admin', 'editor', 'moderator']) {
+  test(`GET /player/shard/accounts is reachable by an authenticated ${role}`, async () => {
+    signInAs({ id: 7, username: 'u', role, status: 'active' })
+    shardLinks.listForUser = async (id) => {
+      assert.equal(id, 7) // self-scoped to the caller regardless of role
+      return [{ account: 'acctA' }]
+    }
+    const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
+    try {
+      const res = await fetch(app.url + '/api/v1/player/shard/accounts')
+      assert.equal(res.status, 200, `${role} should reach the handler, got ${res.status}`)
+      assert.deepEqual(await res.json(), [{ account: 'acctA' }])
+    } finally {
+      await app.close()
+    }
+  })
+}
+
+test('GET /player/shard/accounts still rejects an unauthenticated caller with 401', async () => {
+  sessionService.validateSession = () => null
+  const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
+  try {
+    const res = await fetch(app.url + '/api/v1/player/shard/accounts')
+    assert.equal(res.status, 401)
+  } finally {
+    await app.close()
+  }
+})
+
+test('a disabled account is still rejected with 403 (status gate, not role)', async () => {
+  signInAs({ id: 8, username: 'banned', role: 'player', status: 'disabled' })
+  const app = await startApp((a) => a.use('/api/v1/player', playerRouter))
+  try {
+    const res = await fetch(app.url + '/api/v1/player/shard/accounts')
+    assert.equal(res.status, 403)
+  } finally {
+    await app.close()
+  }
+})