Restrict public presence to staff + let admins view any character

Public "Online now" now lists only players whose game account is linked
to a STAFF website user (admin/editor/moderator) — linked players are no
longer exposed publicly with their name and location. listOnlineLinked
joins through to users and filters on role; the section is relabeled
"Staff online".

Character/roster/vendor reads gain an admin bypass: admins may view any
character's data, while players (and editor/moderator staff) stay limited
to accounts they have personally linked. The bypass lives in the shared
player controller and only ever widens access for genuine admins.

Also finalizes the uo-link character/vendor front end (player + admin
character sheets, VendorSales component, ShardChar removed) and
regenerates swagger-output.json.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018kj5s1QCKobuFPYmqxjy1q

server/src/router/v1/public/public.routes.js

@@ -165,7 +165,7 @@ publicRouter.get(
 publicRouter.get(
   '/shard/online',
   // #swagger.tags = ['Public · Shard']
-  // #swagger.summary = 'Players online now (name + serial + map only)'
+  // #swagger.summary = 'Staff online now (linked staff accounts; name + serial + map only)'
   /* #swagger.responses[200] = { description: 'Online players', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardOnlinePlayer" } } } } } */
   shard.getOnline,
 )
@@ -176,19 +176,6 @@ publicRouter.get(
   /* #swagger.responses[200] = { description: 'IDOC houses', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardHouse" } } } } } */
   shard.getIdoc,
 )
-publicRouter.get(
-  '/shard/char/:serial',
-  // #swagger.tags = ['Public · Shard']
-  // #swagger.summary = 'Live character sheet by serial (cached; degrades on shard restart)'
-  // #swagger.parameters['serial'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'Mobile serial, e.g. 0x24C.' }
-  /* #swagger.responses[200] = { description: 'Character profile', content: { "application/json": { schema: { type: "object", additionalProperties: true } } } } */
-  /* #swagger.responses[400] = { description: 'Invalid serial', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
-  /* #swagger.responses[404] = { description: 'Character not found', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
-  /* #swagger.responses[503] = { description: 'Shard restarting — retry', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
-  param('serial').matches(/^0x[0-9a-fA-F]+$/),
-  validate,
-  shard.getChar,
-)
 publicRouter.get(
   '/shard/stream',
   // #swagger.tags = ['Public · Shard']

server/src/router/v1/public/shard.controller.js

@@ -12,19 +12,10 @@
 const shardEvents = require('../../../model/shardEvents/shardEvents.model')
 const shardState = require('../../../model/shardState/shardState.model')
 const uoLinkConfig = require('../../../model/uoLinkConfig/uoLinkConfig.model')
-const uoLinkClient = require('../../../utils/uoLinkClient')
 const broadcast = require('../../../utils/shardBroadcast')
 
 const log = require('../../../utils/logger')('public-shard')
 
-// Serials are opaque hex keys like "0x24C" — validate before hitting the sidecar.
-const SERIAL_RE = /^0x[0-9a-fA-F]+$/
-
-// Tiny in-memory cache for live character sheets (the sidecar warns these hit the
-// live shard, so cache them). Keyed by serial; short TTL.
-const CHAR_TTL_MS = 20000
-const charCache = new Map()
-
 // GET /public/shard/status — connection state + online count + latest economy.
 async function getStatus(req, res) {
   try {
@@ -78,13 +69,13 @@ async function getEconomy(req, res) {
   }
 }
 
-// GET /public/shard/online — who is online now (redacted: name + serial + map,
-// no coordinates, vitals or account). Feeds the public "online now" list, which
-// links to the public character sheet.
+// GET /public/shard/online — players online now whose account is linked to a
+// STAFF website user (admin/editor/moderator). Shows name + location (map +
+// coordinates); no vitals or account. Non-staff players are never listed.
 async function getOnline(req, res) {
   try {
-    const rows = await shardState.listOnline()
-    return res.json(rows.map((r) => ({ serial: r.serial, name: r.name, map: r.map })))
+    const rows = await shardState.listOnlineLinked()
+    return res.json(rows.map((r) => ({ serial: r.serial, name: r.name, map: r.map, x: r.x, y: r.y, z: r.z })))
   } catch (err) {
     log.error('shard.getOnline', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -101,43 +92,9 @@ async function getIdoc(req, res) {
   }
 }
 
-// GET /public/shard/char/:serial — live character sheet (cached briefly). A 503
-// from the sidecar means the shard is restarting: report it as such so the UI
-// can show a retry banner instead of an error.
-async function getChar(req, res) {
-  const { serial } = req.params
-  if (!SERIAL_RE.test(serial)) {
-    return res.status(400).json({ message: 'Invalid serial.' })
-  }
-
-  const cached = charCache.get(serial)
-  if (cached && Date.now() - cached.at < CHAR_TTL_MS) {
-    return res.json(cached.data)
-  }
-
-  try {
-    const result = await uoLinkClient.getCharBySerial(serial)
-    if (result.ok) {
-      charCache.set(serial, { at: Date.now(), data: result.data })
-      return res.json(result.data)
-    }
-    if (result.status === 404) return res.status(404).json({ message: 'Character not found.' })
-    if (result.status === 503) {
-      // Serve a stale cache if we have one; otherwise the restart banner.
-      if (cached) return res.json(cached.data)
-      return res.status(503).json({ message: 'The game server is restarting — try again shortly.' })
-    }
-    if (result.status === 0) return res.status(503).json({ message: 'Shard data is unavailable right now.' })
-    return res.status(502).json({ message: 'Could not reach the shard.' })
-  } catch (err) {
-    log.error('shard.getChar', err)
-    return res.status(500).json({ message: 'Internal Server Error' })
-  }
-}
-
 // GET /public/shard/stream — public live-event SSE channel (safe kinds only).
 function stream(req, res) {
   broadcast.subscribe(req, res, 'public')
 }
 
-module.exports = { getStatus, getFeed, getEconomy, getOnline, getIdoc, getChar, stream }
+module.exports = { getStatus, getFeed, getEconomy, getOnline, getIdoc, stream }