fix(shard): enforce visibility on the REST reads that bypassed it

Protocol 3.0 Part A follow-up, found by the live five-rung smoke test.

Part A implemented the visibility framework correctly on the SSE path
and on /guilds + /governors, but the remaining public REST reads never
called into it. The result was that one event was projected live and
served verbatim from history:

  * GET /public/shard/feed returned the stored payload as-is, so
    actor.acct and actor.webId were readable ANONYMOUSLY for every
    logged kind - player.death, player.murdered, mob.killed,
    quest.complete, skill.gain, fame/karma.change, mob.login/logout,
    guild.join. Broader than the guild-leader leak Part A set out to
    close, since it covers every player rather than board holders.

  * GET /public/shard/idoc returned ownerAcct - the house owner's game
    account - to anonymous callers.

  * The `houses` field rules (owner/price -> staff) were dead config:
    neither getIdoc nor getHouses projected, so an admin could set them
    in the panel and nothing happened.

  * /feed filtered on PUBLIC_KINDS, a module-load constant derived from
    the compiled DEFAULTS, so live audience changes did not reach it.
    With `guilds` moved to staff, /guilds 403'd while /feed happily
    served guild.join to anonymous.

Four fixes, all at the root rather than per-route:

1. Rule 1 now matches a field's MEANING, not one spelling. The wire
   nests actors (leader.acct) but the read models flatten them
   (shapeHouse -> ownerAcct, shapeGuild -> leaderWebId), and an
   exact-key check missed every flattened one. isLockedField() locks a
   key that is or ends in acct/webId, case-insensitively, so it fails
   closed for shapes not yet written. The admin PUT rejects those
   spellings too - `ownerAcct` is no longer configurable.

2. visibleKinds(level, config) resolves readable kinds from the LIVE
   config; getFeed uses it and projects each row against its own kind's
   feature. Deliberately independent of the `stream` flag, which governs
   SSE fan-out only - so market history stays readable with its firehose
   off. This makes the set a superset of PUBLIC_KINDS by exactly the two
   vendor kinds.

3. getIdoc/getHouses/getChamps/getPresence project, so every shard
   surface honours the same config.

4. shardEvents.db.list treats an EMPTY kinds array as "serve nothing".
   It previously fell through to the unfiltered query, so a fully-gated
   config would have dumped the whole event log, staff audit included.

Also fixes a bug introduced while wiring this up: projectValue recursed
into any object, so a Date column came back as {}. It now walks arrays
and plain objects only. The unit tests used JSON fixtures and could not
have caught it - the live /idoc read did.

Verified live against MariaDB + a stub sidecar, all five rungs: 13
routes x 5 rungs, defaults reproducing pre-v3 access exactly, zero
acct/webId below admin on any read, unmapped kinds (staff.command,
cheat.detect, login.attempt) reaching only admin on SSE, and audience /
enabled / stream changes taking effect live on an already-open stream.

Tests: 487 server (+9). Swagger regenerated; route manifest unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

server/src/model/shardEvents/shardEvents.db.js

@@ -16,6 +16,11 @@ async function insertIgnore({ kind, t, bootId, payload, dedupeKey }) {
 // `kinds` (IN clause) — the public feed uses the allowlist so it can never leak
 // staff/sensitive kinds. limit is clamped by the model.
 async function list({ kind, kinds, limit }) {
+  // An allowlist that resolved to NOTHING means "serve nothing" — never "serve
+  // everything". Falling through to the unfiltered query below would have turned
+  // a fully-gated visibility config into a full dump of the event log, staff
+  // audit and cheat detections included.
+  if (kinds && kinds.length === 0) return []
   if (kinds && kinds.length) {
     const placeholders = kinds.map(() => '?').join(', ')
     return query(

server/src/router/v1/admin/shardVisibility.controller.js

@@ -57,7 +57,10 @@ async function putVisibility(req, res) {
 
       const fieldRules = {}
       for (const [field, level] of Object.entries(patch.fieldRules || {})) {
-        if (Object.hasOwn(visibility.LOCKED_FIELDS, field)) {
+        // Matches flattened spellings too (`ownerAcct`, `leaderWebId`), so the
+        // rejection covers every way the field can be named rather than the two
+        // canonical keys.
+        if (visibility.isLockedField(field)) {
           return res.status(400).json({ message: `Field '${field}' is admin-only and cannot be configured` })
         }
         if (!visibility.isLevel(level)) {

server/src/router/v1/public/shard.controller.js

@@ -39,21 +39,49 @@ async function getStatus(req, res) {
   }
 }
 
-// GET /public/shard/feed?kind=&limit= — recent notable events from the log,
-// restricted to the public-safe allowlist so staff audit / cheat / link events
-// (which are stored for the admin channel) can never leak to the public.
+// GET /public/shard/feed?kind=&limit= — recent notable events from the log.
+//
+// This is the stored-history twin of the SSE stream, and it must reach the same
+// verdict the stream does about the same event. Two things are therefore resolved
+// against the LIVE config rather than the compiled defaults:
+//
+//   • which kinds this viewer may read at all — `visibleKinds`, not the static
+//     PUBLIC_KINDS set (which is fixed at module load, so an admin moving
+//     `guilds` to `staff` would gate /guilds while /feed kept serving
+//     guild.join to anonymous callers), and
+//   • the payload itself, projected per event against ITS OWN kind's feature —
+//     the rows are a mix of features, and without this the stored frames were
+//     returned verbatim, `acct`/`webId` and all, on an anonymous endpoint.
 async function getFeed(req, res) {
   try {
+    const config = await visibility.getConfig()
+    const level = req.viewerLevel || (await visibility.viewerLevel(req))
+    const allowed = new Set(visibility.visibleKinds(level, config))
+
     const { kind, limit } = req.query
+    // No readable kinds ⇒ nothing to serve. Returning early also keeps us clear
+    // of `list({ kinds: [] })`, which means "no filter", not "match nothing".
+    if (allowed.size === 0) return res.json([])
+
     let events
     if (kind) {
-      // A specific kind is only served if it is itself public-safe.
-      if (!broadcast.PUBLIC_KINDS.has(kind)) return res.json([])
+      if (!allowed.has(kind)) return res.json([])
       events = await shardEvents.list({ kind, limit })
     } else {
-      events = await shardEvents.list({ kinds: [...broadcast.PUBLIC_KINDS], limit })
+      events = await shardEvents.list({ kinds: [...allowed], limit })
     }
-    return res.json(events)
+
+    return res.json(
+      events.map((ev) => ({
+        ...ev,
+        payload: visibility.projectFeature(
+          visibility.KIND_FEATURE.get(ev.kind),
+          ev.payload,
+          level,
+          config,
+        ),
+      })),
+    )
   } catch (err) {
     log.error('shard.getFeed', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -106,9 +134,14 @@ async function getOnline(req, res) {
 }
 
 // GET /public/shard/idoc — houses currently in danger (stage IDOC).
+//
+// Projected: shapeHouse flattens the owner actor into `ownerSerial`/`ownerAcct`/
+// `ownerName`, so this endpoint used to hand an anonymous caller the house
+// owner's GAME ACCOUNT NAME. The public IDOC board only ever needed name, region
+// and location — which is all that survives projection below `staff`.
 async function getIdoc(req, res) {
   try {
-    return res.json(await shardState.listIdoc())
+    return res.json(await visibility.project('houses', await shardState.listIdoc(), req))
   } catch (err) {
     log.error('shard.getIdoc', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -120,7 +153,7 @@ async function getIdoc(req, res) {
 // the public SSE stream so the page can update in place.
 async function getChamps(req, res) {
   try {
-    return res.json(await shardState.listChamps())
+    return res.json(await visibility.project('champs', await shardState.listChamps(), req))
   } catch (err) {
     log.error('shard.getChamps', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -170,7 +203,7 @@ async function getGovernorHistory(req, res) {
 // + per-region). Live via presence.online on the public SSE stream.
 async function getPresence(req, res) {
   try {
-    return res.json(await shardState.latestPresence())
+    return res.json(await visibility.project('presence', await shardState.latestPresence(), req))
   } catch (err) {
     log.error('shard.getPresence', err)
     return res.status(500).json({ message: 'Internal Server Error' })
@@ -194,7 +227,10 @@ async function getHouses(req, res) {
       z: h.z,
       isIdoc: true,
     }))
-    return res.json(publicHouses)
+    // Already a hand-picked safe subset; projected anyway so an admin who
+    // tightens a `houses` field rule sees it honoured on every houses surface
+    // rather than on some of them.
+    return res.json(await visibility.project('houses', publicHouses, req))
   } catch (err) {
     log.error('shard.getHouses', err)
     return res.status(500).json({ message: 'Internal Server Error' })

server/src/router/v1/public/shard.router.js

@@ -42,7 +42,8 @@ shardRouter.get(
   requireFeature('activity'),
   // #swagger.tags = ['Public · Shard']
   // #swagger.summary = 'Recent notable shard events (from the ingested log)'
-  // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale.' }
+  // #swagger.description = 'The stored-history twin of /shard/stream, and it reaches the same verdict: which kinds are returned is resolved against the caller\'s audience rung under the live visibility config, and each event\'s payload is field-projected against its own kind\'s feature. Kinds the caller may not read are omitted (an explicit ?kind= for one of them returns []), and acct/webId never appear below admin.'
+  // #swagger.parameters['kind'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Filter to a single event kind, e.g. vendor.sale. Returns [] if the caller may not read that kind.' }
   // #swagger.parameters['limit'] = { in: 'query', required: false, schema: { type: 'integer' }, description: 'Max rows (default 100, max 1000).' }
   /* #swagger.responses[200] = { description: 'Events, newest first', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardEvent" } } } } } */
   query('kind').optional({ values: 'falsy' }).isString().isLength({ max: 48 }),
@@ -74,6 +75,7 @@ shardRouter.get(
   requireFeature('houses'),
   // #swagger.tags = ['Public · Shard']
   // #swagger.summary = 'Houses currently in danger (IDOC)'
+  // #swagger.description = 'Location-level board of the houses about to collapse. Owner identity and price are gated by the `houses` feature\'s field rules (default `staff`), and the owner\'s game account is admin-only always — so an anonymous caller sees name, region and coordinates only.'
   /* #swagger.responses[200] = { description: 'IDOC houses', content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/ShardHouse" } } } } } */
   shard.getIdoc,
 )

server/src/utils/shardVisibility.js

@@ -62,6 +62,23 @@ const rank = viewerRank
 
 const LOCKED_FIELDS = { acct: 'admin', webId: 'admin' }
 
+// Rule 1 matches on the FIELD'S MEANING, not on one exact spelling. The wire
+// frames nest actors (`leader.acct`), but several read models flatten them
+// instead (`shapeHouse` emits `ownerAcct`, `shapeGuild`'s fallback emits
+// `leaderAcct`/`leaderWebId`), and an exact-key check silently missed every
+// flattened one — which is how `GET /public/shard/idoc` served `ownerAcct` to
+// anonymous callers while the same account name was correctly stripped from the
+// live `house.decay` frame.
+//
+// So a key is locked when it IS `acct`/`webId` or ENDS in one, case-insensitively
+// (`ownerAcct`, `leaderWebId`, `governorAcct`). Suffix matching is what makes this
+// fail closed for shapes nobody has written yet.
+const LOCKED_SUFFIXES = ['acct', 'webid']
+const isLockedField = (key) => {
+  const k = String(key).toLowerCase()
+  return LOCKED_SUFFIXES.some((suffix) => k === suffix || k.endsWith(suffix))
+}
+
 const FEATURES = {
   // ── Shipped before v3. Defaults reproduce the previous hardcoded behavior. ──
   status: { audience: 'anonymous', fields: {} },
@@ -70,7 +87,14 @@ const FEATURES = {
   guilds: { audience: 'anonymous', fields: {} },
   governors: { audience: 'anonymous', fields: {} },
   // The public Houses page showed IDOC location only; owner/price were staff.
-  houses: { audience: 'anonymous', fields: { owner: 'staff', price: 'staff' } },
+  // `owner` is the actor object on the house.decay/house.update frames;
+  // `ownerName`/`ownerSerial` are the flattened spellings shapeHouse emits on the
+  // REST read models. Both are listed so one rule covers the wire and the read
+  // model — the flattened `ownerAcct` needs no entry, being locked by rule 1.
+  houses: {
+    audience: 'anonymous',
+    fields: { owner: 'staff', ownerName: 'staff', ownerSerial: 'staff', price: 'staff' },
+  },
   // /public/shard/online listed linked staff to everyone but gated location to
   // admin+moderator — which is exactly the `staff` rung.
   presence: { audience: 'anonymous', fields: { location: 'staff' } },
@@ -168,7 +192,7 @@ function applyRow(name, row) {
   const audience = isLevel(row?.audience) ? row.audience : base.audience
   const fields = { ...base.fields }
   for (const [field, level] of Object.entries(row?.fieldRules || {})) {
-    if (Object.hasOwn(LOCKED_FIELDS, field)) continue // rule 1: not configurable
+    if (isLockedField(field)) continue // rule 1: not configurable
     if (isLevel(level)) fields[field] = level
   }
   return {
@@ -286,12 +310,25 @@ function requireFeature(name) {
 // first (so acct/webId can never survive below admin), then the feature's
 // configured field rules. Recurses into arrays and nested objects because the
 // sensitive fields sit inside actor sub-objects (guild.leader, city.governor).
+// Only ARRAYS and PLAIN objects are walked. A Date, Buffer or other class
+// instance is a value, not a bag of fields: rebuilding one key-by-key would
+// return `{}` (a Date has no enumerable own properties), which is how the DB-
+// backed read models — whose rows carry real Date columns — differ from the
+// pure-JSON wire frames the projection was first written against.
+const isPlainObject = (v) => {
+  if (v === null || typeof v !== 'object') return false
+  const proto = Object.getPrototypeOf(v)
+  return proto === Object.prototype || proto === null
+}
+
 function projectValue(value, rules, level) {
   if (Array.isArray(value)) return value.map((v) => projectValue(v, rules, level))
-  if (!value || typeof value !== 'object') return value
+  if (!isPlainObject(value)) return value
   const out = {}
   for (const [key, v] of Object.entries(value)) {
-    const required = rules[key]
+    // Locked fields are checked by meaning first, so no configured rule (and no
+    // flattened spelling) can widen them past `admin`.
+    const required = isLockedField(key) ? 'admin' : rules[key]
     if (required && !meets(level, required)) continue
     out[key] = projectValue(v, rules, level)
   }
@@ -324,6 +361,23 @@ function kindVisibleTo(kind, level, config) {
   return meets(level, feature.audience)
 }
 
+// The event kinds a viewer at `level` may read under the CURRENT config. This is
+// the live counterpart of PUBLIC_KINDS, which is a module-load constant derived
+// from the compiled DEFAULTS and therefore cannot answer "may THIS viewer see
+// this kind, given what the admin has configured?".
+//
+// Deliberately ignores the `stream` flag: that governs SSE fan-out only, so a
+// feature whose live firehose is off (market) is still readable from the stored
+// history. Unmapped kinds are absent by construction (rule 2).
+function visibleKinds(level, config) {
+  return [...KIND_FEATURE.entries()]
+    .filter(([, name]) => {
+      const feature = config?.[name]
+      return !!feature && feature.enabled && meets(level, feature.audience)
+    })
+    .map(([kind]) => kind)
+}
+
 // The features a viewer at `level` can actually see — drives SPA nav so it never
 // renders a link that would 403.
 function visibleFeatures(level, config) {
@@ -343,6 +397,7 @@ module.exports = {
   DEFAULT_STREAM_OFF,
   isLevel,
   isFeature,
+  isLockedField,
   rank,
   meets,
   getConfig,
@@ -354,5 +409,6 @@ module.exports = {
   projectFeature,
   project,
   kindVisibleTo,
+  visibleKinds,
   visibleFeatures,
 }