RunicGateway/website
3
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Activity
Files
5e398d8acdce90cb003a023e5520d6329624aecb
website/server/test
History
wtclaude 5e398d8acd feat(auth): sign in with Steam (MODULE_API 1.17.0) 
Steam is a built-in provider beside Google and Discord (STEAM_SIGNIN.md,
D392-D396). OpenID 2.0: the assertion is verified server to server with
check_authentication, return_to must match byte for byte, and the claimed id
must be a 17-digit SteamID64. A Steam Web API key is required to enable it
(D394); persona name and avatar are stored on the identity and refreshed at
each sign-in, and a failed lookup never blocks one. Steam never signs anybody
up (D395), on the web or the mobile bridge. Several Steam accounts may be
linked; DELETE /auth/me/account/identities/:provider takes ?id= to unlink one.

MODULE_API 1.17.0: ctx.identities.list, api.onIdentityLinking (refuse-only,
fails closed, module text never shown) and api.onIdentityLinked. No unlink
hook (D393). Schema additive; OpenAPI, routes and engagement manifests
regenerated with no modules installed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY
2026-10-19 14:02:49 -05:00
..
_helper.js
fix(test): stop the suite reaching a real database, and make it exit
2026-08-10 21:27:47 -05:00
_setup.js
fix(test): stop the suite reaching a real database, and make it exit
2026-08-10 21:27:47 -05:00
adminModules.test.js
fix(modules): stop a module before purging its tables
2026-08-12 09:05:21 -05:00
adminTrustedDevices.test.js
feat(auth): trusted devices, recovery codes, and admin MFA management
2026-07-21 23:38:48 -05:00
adminUsers.test.js
feat(modules): the three de-entanglement registries, with core as the registrant
2026-08-10 17:47:59 -05:00
announceJobs.test.js
test: re-point core's suite at what core still owns
2026-08-11 12:08:26 -05:00
announceLegs.test.js
feat(modules): the three de-entanglement registries, with core as the registrant
2026-08-10 17:47:59 -05:00
appeals.pure.test.js
feat(moderation): appeals (6c) + Discord reversal on approve (6d)
2026-07-18 22:01:06 -05:00
appeals.test.js
feat(moderation): appeals (6c) + Discord reversal on approve (6d)
2026-07-18 22:01:06 -05:00
appLinks.test.js
feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist
2026-07-20 18:37:17 -05:00
authController.test.js
test(server): unit-test auth, invite, password-reset, and public controllers
2026-07-21 00:33:01 -05:00
authMe.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
authTrustedDevice.test.js
feat(auth): trusted devices, recovery codes, and admin MFA management
2026-07-21 23:38:48 -05:00
bootOrder.test.js
feat(modules): the declarative Docker path (phase 4, slice 3)
2026-08-12 07:57:08 -05:00
botInternalKey.test.js
Isolate internal bot-config route from the public listener (#33)
2026-07-04 17:35:07 -05:00
botScore.test.js
Add Bot Activity admin panel: banned-IP view + recent events + emergency unban
2026-07-03 02:31:25 -05:00
brandAssets.test.js
feat(theming): brand-asset overrides and a cached, settings-aware HTML shell
2026-08-07 20:09:56 -05:00
checkModuleIdentifiers.test.js
refactor(modules)!: de-UO core's copy, and enforce it (phase 3, slice 4)
2026-08-11 21:41:18 -05:00
checkNoExternalHosts.test.js
feat(engagement): templates — the email block family, renderer and seeded set (engagement Phase 5a)
2026-08-29 13:07:39 -05:00
contentReports.test.js
test(teams): phase 5's server surface, and the negative property under it
2026-08-18 12:58:15 -05:00
csp.test.js
feat(security): soak the tightened CSP on report-only, with a same-origin sink
2026-07-27 15:19:26 -05:00
emailCollisionSurfaces.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
emailConfig.model.test.js
feat(email): remove Gmail OAuth2, put SMTP behind a transport registry
2026-08-28 20:52:55 -05:00
emailTemplates.test.js
fix(modules): bump the CLIENT half of MODULE_API_VERSION to 1.9.0
2026-09-01 01:22:00 -05:00
emailUniqueness.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
emailVerification.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
engagementAdmin.test.js
feat(engagement): deliverability — suppression, bounces and the verification gate
2026-08-31 10:47:34 -05:00
engagementCeilings.test.js
feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)
2026-08-31 20:33:02 -05:00
engagementDeliverability.test.js
feat(engagement): deliverability — suppression, bounces and the verification gate
2026-08-31 10:47:34 -05:00
engagementEmail.test.js
fix(engagement): claim the seed guard atomically, and let a rule name a digest body
2026-09-01 14:29:21 -05:00
engagementEngine.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
engagementEngineSql.test.js
feat(engagement): the rules engine, cooldowns and outbox (engagement Phase 4a)
2026-08-29 08:07:27 -05:00
engagementInapp.test.js
feat(engagement): the in-app channel, core and web (engagement Phase 7)
2026-08-31 02:07:10 -05:00
engagementManifest.test.js
fix(engagement): the trigger manifest was stale, and its check was crying wolf
2026-09-04 02:43:53 -05:00
engagementRetention.test.js
feat(engagement): retention — three sweeps and one recorded refusal
2026-09-01 15:40:53 -05:00
engagementRetentionSql.test.js
feat(engagement): retention — three sweeps and one recorded refusal
2026-09-01 15:40:53 -05:00
engagementTemplatesAdmin.test.js
feat(engagement): the template editor, the trigger catalog and the send log (engagement Phase 5b)
2026-08-29 18:13:57 -05:00
engagementTriggers.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
eventActionRegistry.test.js
feat(events): an event action's progress() on a live run's public page (MODULE_API 1.12.0)
2026-10-06 02:47:00 -05:00
eventAnnounce.test.js
fix(events): midnight in an announcement is 12:00 am on the Node we ship
2026-09-09 19:20:31 -05:00
eventAuthorize.test.js
feat(events): open the event contract to modules (Phase 7)
2026-09-03 14:15:04 -05:00
eventCleanup.test.js
fix(events): settle a finished run whose last resource expired while it ran
2026-09-26 22:19:17 -05:00
eventGates.test.js
feat(events): conditions, phase advancement and the diagnosis panel (Phase 5)
2026-09-02 22:11:20 -05:00
eventIntegrations.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
eventLedger.test.js
feat(events): the resource ledger, leases and cleanup (Phase 8)
2026-09-03 21:19:27 -05:00
eventModuleContract.test.js
feat(auth): sign in with Steam (MODULE_API 1.17.0)
2026-10-19 14:02:49 -05:00
eventParamMultiple.test.js
feat(events): a param that holds several values (MODULE_API 1.14.0)
2026-10-12 15:40:30 -05:00
eventParticipants.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
eventPrice.test.js
feat(events): the authoring UI proper (Phase 13)
2026-09-07 16:34:03 -05:00
eventProgress.test.js
feat(events): an event action's progress() on a live run's public page (MODULE_API 1.12.0)
2026-10-06 02:47:00 -05:00
eventPublic.test.js
fix(events): the public phase label finds the phase by key (runicnpc D314)
2026-10-06 16:57:46 -05:00
eventRecurrence.test.js
feat(events): schedule, recurrence and the calendar (Phase 4)
2026-09-02 16:10:16 -05:00
eventRunControls.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
eventRunner.test.js
feat(events): a failed step may say when to retry (MODULE_API 1.15.0)
2026-10-15 02:39:43 -05:00
eventRunnerSql.test.js
feat(events): a trigger can start a run
2026-10-16 01:51:55 -05:00
eventsAdmin.test.js
feat(events): a trigger can start a run
2026-10-16 01:51:55 -05:00
eventSchedule.test.js
feat(events): enablement, per-run caps and mayInvoke (Phase 6)
2026-09-03 05:50:58 -05:00
eventSeries.test.js
feat(events): schedule, recurrence and the calendar (Phase 4)
2026-09-02 16:10:16 -05:00
eventSpec.test.js
feat(events): conditions, phase advancement and the diagnosis panel (Phase 5)
2026-09-02 22:11:20 -05:00
eventsRoles.test.js
feat(events): the authoring UI proper (Phase 13)
2026-09-07 16:34:03 -05:00
eventStarts.test.js
feat(events): a trigger can start a run
2026-10-16 01:51:55 -05:00
eventStepEditor.test.js
feat(events): the step editor reworked, and event templates (MODULE_API 1.13.0)
2026-10-12 02:08:04 -05:00
eventVerify.test.js
feat(events): a dry run carries a module's advice (MODULE_API 1.16.0)
2026-10-16 15:18:53 -05:00
honeypot.test.js
Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)
2026-07-02 23:22:35 -05:00
htmlShell.test.js
feat(modules): the client registry, window.__rg and the chunk's script injection
2026-08-10 22:54:16 -05:00
inviteController.test.js
test(server): unit-test auth, invite, password-reset, and public controllers
2026-07-21 00:33:01 -05:00
invites.test.js
feat(provisioning): game-account signup, admin email invites, unlink (2.0)
2026-07-17 15:50:49 -05:00
loginProtection.test.js
test(login): stop the backoff-guard test racing its own one-second lock
2026-08-12 08:16:59 -05:00
mailer.test.js
feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)
2026-08-29 20:11:54 -05:00
mailTransports.test.js
feat(email): remove Gmail OAuth2, put SMTP behind a transport registry
2026-08-28 20:52:55 -05:00
mobileAuthBridge.model.test.js
feat(auth): native SSO authorization bridge for the Android app
2026-07-20 16:55:06 -05:00
mobileDeviceSessions.test.js
refactor(api): collapse /admin/account and /player/account onto /auth/me/account
2026-08-29 00:49:25 -05:00
mobileSession.test.js
Add session abstraction, mobile bearer auth, and pluggable SSO
2026-07-03 10:31:29 -05:00
mobileSsoBridge.test.js
feat(auth): native SSO authorization bridge for the Android app
2026-07-20 16:55:06 -05:00
moderation.model.test.js
test(server): unit-test pages, shardState, and moderation model logic
2026-07-21 00:26:01 -05:00
moderation.test.js
fix(moderation): windowValue must not fall back to the 30d total on a null column
2026-07-22 13:14:02 -05:00
moduleArchive.test.js
feat(modules): install, uninstall, purge and restart (phase 4, slice 1)
2026-08-12 03:09:45 -05:00
moduleClientChunk.test.js
feat(modules): the client registry, window.__rg and the chunk's script injection
2026-08-10 22:54:16 -05:00
moduleDeclared.test.js
feat(modules): the declarative Docker path (phase 4, slice 3)
2026-08-12 07:57:08 -05:00
moduleDocsSpec.test.js
feat(modules): merge module OpenAPI fragments into /api/docs.json (phase 3, slice 5)
2026-08-11 22:57:37 -05:00
moduleEngagementSeeds.test.js
fix(engagement): claim the seed guard atomically, and let a rule name a digest body
2026-09-01 14:29:21 -05:00
moduleInstall.test.js
fix(modules): a site runs one module; the installer refuses a second
2026-09-23 01:26:52 -05:00
moduleLifecycle.test.js
feat(modules): install, uninstall, purge and restart (phase 4, slice 1)
2026-08-12 03:09:45 -05:00
moduleLoader.test.js
feat(auth): sign in with Steam (MODULE_API 1.17.0)
2026-10-19 14:02:49 -05:00
moduleRegistries.test.js
feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)
2026-09-04 13:06:46 -05:00
modules.model.test.js
fix(modules): three defects a real install exposed (phase 4, slice 1)
2026-08-12 03:48:27 -05:00
moduleSchema.test.js
feat(modules): install, uninstall, purge and restart (phase 4, slice 1)
2026-08-12 03:09:45 -05:00
navOverrides.test.js
feat(theming): dropdown sections and added links in the public header
2026-08-08 00:42:19 -05:00
newsNotify.test.js
feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)
2026-08-31 20:33:02 -05:00
notificationChannelPrefs.test.js
feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)
2026-08-31 20:33:02 -05:00
notificationsRoutes.test.js
test(teams): the refusals, which is most of what a notification feature is
2026-08-18 14:35:23 -05:00
pages.model.test.js
test(server): unit-test pages, shardState, and moderation model logic
2026-07-21 00:26:01 -05:00
passwordResetController.test.js
feat(auth): trusted devices, recovery codes, and admin MFA management
2026-07-21 23:38:48 -05:00
passwordResets.test.js
feat(auth): self-service password reset (backend + web)
2026-07-19 03:57:13 -05:00
playerAccounts.test.js
refactor(api): collapse /admin/account and /player/account onto /auth/me/account
2026-08-29 00:49:25 -05:00
playerRouteAccess.test.js
test: re-point core's suite at what core still owns
2026-08-11 12:08:26 -05:00
providers.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
publicBrand.test.js
feat(theming): server-resolved theme engine and admin appearance UI
2026-08-07 19:16:23 -05:00
publicController.test.js
test(server): unit-test auth, invite, password-reset, and public controllers
2026-07-21 00:33:01 -05:00
publicModules.test.js
feat(modules): publish the installed-module list at /api/v1/public/modules
2026-08-10 22:03:22 -05:00
publicVersion.test.js
refactor(server): split public, player and residual auth into capability routers (PR 5)
2026-07-27 20:52:14 -05:00
pushDispatch.test.js
test(teams): the refusals, which is most of what a notification feature is
2026-08-18 14:35:23 -05:00
recoveryCodes.test.js
feat(auth): trusted devices, recovery codes, and admin MFA management
2026-07-21 23:38:48 -05:00
registry.test.js
feat(auth): sign in with Steam (MODULE_API 1.17.0)
2026-10-19 14:02:49 -05:00
requireInternalKey.test.js
Isolate internal bot-config route from the public listener (#33)
2026-07-04 17:35:07 -05:00
reservedNames.test.js
feat(teams): reserved-name screening, auto-hide, and the admin-approval gate
2026-08-17 15:08:58 -05:00
routeManifest.test.js
test: re-point core's suite at what core still owns
2026-08-11 12:08:26 -05:00
secretBox.test.js
Add session abstraction, mobile bearer auth, and pluggable SSO
2026-07-03 10:31:29 -05:00
selfTrustedDevices.test.js
refactor(api): collapse /admin/account and /player/account onto /auth/me/account
2026-08-29 00:49:25 -05:00
session.test.js
Fix SSO flow-token / session type confusion (#32)
2026-07-04 21:54:58 -05:00
settingsGameSignup.test.js
refactor(client): delete the UO client half (phase 3, slice 3)
2026-08-11 18:39:55 -05:00
settingsTheming.test.js
feat(theming): wire the three navs and add the admin nav builder
2026-08-08 00:02:33 -05:00
slashCommands.test.js
feat(teams): the slash-command seam, and the first command through it
2026-08-18 18:53:34 -05:00
ssoCallback.test.js
feat(auth): sign in with Steam (MODULE_API 1.17.0)
2026-10-19 14:02:49 -05:00
ssoEmailVerified.test.js
feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)
2026-08-29 01:53:50 -05:00
ssoState.test.js
Enforce TOTP second factor on SSO login (#31)
2026-07-04 22:17:35 -05:00
ssoTrustedDevice.test.js
feat(auth): honor and establish trusted devices on the SSO login paths
2026-07-28 01:01:12 -05:00
steamSignin.test.js
feat(auth): sign in with Steam (MODULE_API 1.17.0)
2026-10-19 14:02:49 -05:00
teamAccess.test.js
feat(teams): the four-path access resolver and staff leadership overrides
2026-08-17 14:57:23 -05:00
teamActivity.test.js
feat(teams): the activity feed, its two writers and its retention
2026-08-17 20:15:18 -05:00
teamBridge.test.js
feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)
2026-08-29 20:11:54 -05:00
teamForum.test.js
test(teams): phase 5's server surface, and the negative property under it
2026-08-18 12:58:15 -05:00
teamIntegration.test.js
feat(teams): phase 8 — the notifications bridge, and the gate §7.2 could not check
2026-08-18 20:25:30 -05:00
teamModeration.test.js
feat(teams): reserved-name screening, auto-hide, and the admin-approval gate
2026-08-17 15:08:58 -05:00
teamNotify.test.js
feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)
2026-08-29 20:11:54 -05:00
teamNotifyDispatch.test.js
feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)
2026-08-29 20:11:54 -05:00
teamProvider.test.js
test(teams): the refusals, which is most of what a notification feature is
2026-08-18 14:35:23 -05:00
teamRoster.test.js
feat(teams): the roster's audience projection, and optionalAuth to resolve it
2026-08-17 20:15:36 -05:00
teamRoutes.test.js
fix(teams): let a post-moderation mistake reach the model that explains it
2026-08-18 13:25:21 -05:00
teamSync.test.js
test(teams): the refusals, which is most of what a notification feature is
2026-08-18 14:35:23 -05:00
teamVoice.test.js
fix(teams): the two defects the phase 9 rig walk found
2026-08-19 00:07:27 -05:00
teamVoiceSync.test.js
fix(teams): the two defects the phase 9 rig walk found
2026-08-19 00:07:27 -05:00
themeResolve.test.js
feat(theming): server-resolved theme engine and admin appearance UI
2026-08-07 19:16:23 -05:00
totp.test.js
Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)
2026-07-02 23:22:35 -05:00
trustedDevices.test.js
feat(auth): trusted devices, recovery codes, and admin MFA management
2026-07-21 23:38:48 -05:00
trustProxy.test.js
Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9)
2026-07-02 23:22:35 -05:00
usernamePolicy.test.js
Player accounts backend: schema, registration, self-service, SSO provision
2026-07-06 01:36:51 -05:00
userNotificationsSql.test.js
feat(engagement): the in-app channel, core and web (engagement Phase 7)
2026-08-31 02:07:10 -05:00