fix(shard): restrict staff in-game location to admins/moderators #72

wtclaude · 2026-07-19T02:19:49Z

wtclaude commented

2026-07-19 02:19:49 +00:00

Summary

The public Staff online list on the Shard page (/site/shard) exposed each staff member's in-game location (map + coordinates) to everyone — logged-in players and unauthenticated/public visitors alike. This restricts location to privileged viewers, enforced on both the client and the server.

Changes

Server — server/src/router/v1/public/shard.controller.js

getOnline now determines the caller's access level via the existing non-rejecting getUserFromRequest(req) helper (the same pattern siteMode uses on token-free public routes).
Location fields (map, x, y, z) are included only for admin/moderator callers. For players, editors, and anonymous requests they are omitted from the JSON entirely — not a placeholder — so location can't be read from the network tab. serial + name (online status) are still returned to everyone.

Client — client/src/routes/public/Shard.jsx

Reads the viewer's role from useAuth() (user.role), matching how RoleGate gates admin-only UI, and only renders the location <span> for admin/moderator viewers. Non-privileged viewers still see who is online, with no location field in the DOM.

Docs

Updated the /shard/online swagger summary and the stale JSX section comment.

Tests

New server/test/publicShardOnline.test.js (5 tests, all green), following the existing controller-unit-test style (stubs the model + getUserFromRequest):

admin sees location ✓
moderator sees location ✓
logged-in player does not (fields absent, not null) ✓
unauthenticated request does not ✓
editor (staff, but not admin/mod) does not ✓

Full server suite passes (198 tests); client builds clean.

Note

getUserFromRequest decodes the session without a per-request DB re-validation (unlike requireAuth), so a just-demoted admin could still see location until their token expires — consistent with the existing siteMode "admin preview" trust model, and avoids adding a DB hit to a hot public endpoint. Happy to switch to strict re-validation if preferred.

🤖 Generated with Claude Code

## Summary The public **Staff online** list on the Shard page (`/site/shard`) exposed each staff member's in-game **location** (map + coordinates) to *everyone* — logged-in players and unauthenticated/public visitors alike. This restricts location to privileged viewers, enforced on both the client and the server. ## Changes **Server — `server/src/router/v1/public/shard.controller.js`** - `getOnline` now determines the caller's access level via the existing non-rejecting `getUserFromRequest(req)` helper (the same pattern `siteMode` uses on token-free public routes). - Location fields (`map`, `x`, `y`, `z`) are included **only** for `admin`/`moderator` callers. For players, editors, and anonymous requests they are **omitted from the JSON entirely** — not a placeholder — so location can't be read from the network tab. `serial` + `name` (online status) are still returned to everyone. **Client — `client/src/routes/public/Shard.jsx`** - Reads the viewer's role from `useAuth()` (`user.role`), matching how `RoleGate` gates admin-only UI, and only renders the location `<span>` for admin/moderator viewers. Non-privileged viewers still see who is online, with no location field in the DOM. **Docs** - Updated the `/shard/online` swagger summary and the stale JSX section comment. ## Tests New `server/test/publicShardOnline.test.js` (5 tests, all green), following the existing controller-unit-test style (stubs the model + `getUserFromRequest`): - admin sees location ✓ - moderator sees location ✓ - logged-in player does **not** (fields absent, not null) ✓ - unauthenticated request does **not** ✓ - editor (staff, but not admin/mod) does **not** ✓ Full server suite passes (198 tests); client builds clean. ## Note `getUserFromRequest` decodes the session without a per-request DB re-validation (unlike `requireAuth`), so a just-demoted admin could still see location until their token expires — consistent with the existing `siteMode` "admin preview" trust model, and avoids adding a DB hit to a hot public endpoint. Happy to switch to strict re-validation if preferred. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

wtclaude added 1 commit 2026-07-19 02:19:50 +00:00

fix(shard): restrict staff in-game location to admins/moderators

PR Checks / client-build (pull_request) Successful in 9m23s

Details

PR Checks / server-tests (pull_request) Successful in 10m33s

Details

PR Checks / bot-install (pull_request) Successful in 9m18s

Details

aa2177715e

The public "Staff online" list on the Shard page exposed each staff
member's in-game location (map + coordinates) to everyone, including
logged-in players and unauthenticated visitors.

Location is now privileged data:
- Server: getOnline inspects the caller's role via getUserFromRequest
  (the same non-rejecting helper siteMode uses on public routes) and
  only includes map/x/y/z for admin/moderator callers. For everyone
  else the fields are omitted from the JSON entirely, so they can't be
  read from the network tab. serial + name (online status) still shown.
- Client: Shard.jsx gates the location span on the viewer's role from
  useAuth() (same pattern as RoleGate); non-privileged viewers see who
  is online but no location field is rendered.

Tests: publicShardOnline.test.js covers admin + moderator (location
included), player + unauthenticated + editor (location omitted).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmHdsbnLzDMAVQkAoTQSBe

wtclaude referenced this issue from a commit

2026-07-19 02:21:25 +00:00

docs(website): staff in-game location is admin/moderator-only

whitlocktech approved these changes 2026-07-19 02:21:35 +00:00

wtclaude referenced this pull request from RunicGateway/docs

2026-07-19 02:21:36 +00:00

docs(website): staff in-game location is admin/moderator-only #4

whitlocktech scheduled this pull request to auto merge when all checks succeed 2026-07-19 02:21:43 +00:00

whitlocktech merged commit b0549f5845 into main

2026-07-19 02:39:25 +00:00

whitlocktech deleted branch fix/staff-location-visibility

2026-07-19 02:39:26 +00:00