website

RunicGateway/website

Fork 0

Files

History

wtclaude 673701c91b

PR Checks / client-build (pull_request) Successful in 1m14s

Details

PR Checks / server-tests (pull_request) Successful in 6m4s

Details

PR Checks / bot-tests (pull_request) Successful in 56s

Details

fix(safety): team notifications skip members who block the author

#233 left this open: the forum hid a blocked author's posts from a
member, but the member was still pushed, put in the inbox and emailed
about them.

- teamNotify.forumPost excludes every member who blocks the post's
  author, or the member who started the thread (the forum 404s that
  thread for them). One recipient list, so push, the inbox and email
  skip the same people. userSafety.blockersOf answers it, and a staff
  author is blocked by nobody (S8). A failed lookup notifies without it.
- The daily digest applies each recipient's forumFilter at send time:
  blocked authors, blocked thread starters, hidden threads and posts.
  digestPostsSince now also returns the thread's created_by.
- A reply's notify payload carries threadAuthorUserId.

The Team activity feed needed nothing: forum posts are never written to
it (membership, renames and module game events only).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

2026-10-31 00:23:18 -05:00

_helper.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

_setup.js

fix(test): stop the suite reaching a real database, and make it exit

2026-08-10 21:27:47 -05:00

accountDeletion.test.js

feat(account): self-service account deletion, MODULE_API 1.20.0

2026-10-29 18:32:19 -05:00

adminModules.test.js

fix(modules): stop a module before purging its tables

2026-08-12 09:05:21 -05:00

adminTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

adminUsers.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

announceJobs.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

announceLegs.test.js

feat(modules): the three de-entanglement registries, with core as the registrant

2026-08-10 17:47:59 -05:00

appeals.pure.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appeals.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appLinks.test.js

feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist

2026-07-20 18:37:17 -05:00

authController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

authMe.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

authTrustedDevice.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

bootOrder.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

botInternalKey.test.js

…

botScore.test.js

…

brandAssets.test.js

feat(theming): brand-asset overrides and a cached, settings-aware HTML shell

2026-08-07 20:09:56 -05:00

checkModuleIdentifiers.test.js

refactor(modules)!: de-UO core's copy, and enforce it (phase 3, slice 4)

2026-08-11 21:41:18 -05:00

checkNoExternalHosts.test.js

feat(engagement): templates — the email block family, renderer and seeded set (engagement Phase 5a)

2026-08-29 13:07:39 -05:00

contentReports.test.js

feat(safety): report, block and hide, MODULE_API 1.21.0

2026-10-30 05:41:00 -05:00

csp.test.js

feat(security): soak the tightened CSP on report-only, with a same-origin sink

2026-07-27 15:19:26 -05:00

demoApp.test.js

feat(demo): refuse a data: URI in any write body (DM25)

2026-10-27 13:13:51 -05:00

demoAppOff.test.js

feat(demo): DEMO_MODE lock, seed:demo and the demo banner (MODULE_API 1.18.0)

2026-10-23 18:52:09 -05:00

demoLocks.test.js

feat(account): self-service account deletion, MODULE_API 1.20.0

2026-10-29 18:32:19 -05:00

demoModule.test.js

fix(demo): switch on the actions the seeded events use (DM28)

2026-10-28 04:44:25 -05:00

demoStepRefusal.test.js

feat(demo): refuse an event step at save with demoRefuses (MODULE_API 1.19.0)

2026-10-26 03:39:42 -05:00

displayAuthor.test.js

fix(safety): team notifications skip members who block the author

2026-10-31 00:23:18 -05:00

emailCollisionSurfaces.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

emailConfig.model.test.js

feat(email): remove Gmail OAuth2, put SMTP behind a transport registry

2026-08-28 20:52:55 -05:00

emailTemplates.test.js

feat(account): self-service account deletion, MODULE_API 1.20.0

2026-10-29 18:32:19 -05:00

emailUniqueness.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

emailVerification.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

engagementAdmin.test.js

feat(engagement): deliverability — suppression, bounces and the verification gate

2026-08-31 10:47:34 -05:00

engagementCeilings.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

engagementDeliverability.test.js

feat(engagement): deliverability — suppression, bounces and the verification gate

2026-08-31 10:47:34 -05:00

engagementEmail.test.js

fix(engagement): claim the seed guard atomically, and let a rule name a digest body

2026-09-01 14:29:21 -05:00

engagementEngine.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

engagementEngineSql.test.js

feat(engagement): the rules engine, cooldowns and outbox (engagement Phase 4a)

2026-08-29 08:07:27 -05:00

engagementInapp.test.js

feat(engagement): the in-app channel, core and web (engagement Phase 7)

2026-08-31 02:07:10 -05:00

engagementManifest.test.js

fix(engagement): the trigger manifest was stale, and its check was crying wolf

2026-09-04 02:43:53 -05:00

engagementRetention.test.js

feat(engagement): retention — three sweeps and one recorded refusal

2026-09-01 15:40:53 -05:00

engagementRetentionSql.test.js

feat(engagement): retention — three sweeps and one recorded refusal

2026-09-01 15:40:53 -05:00

engagementTemplatesAdmin.test.js

feat(engagement): the template editor, the trigger catalog and the send log (engagement Phase 5b)

2026-08-29 18:13:57 -05:00

engagementTriggers.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

eventActionRegistry.test.js

feat(events): an event action's progress() on a live run's public page (MODULE_API 1.12.0)

2026-10-06 02:47:00 -05:00

eventAnnounce.test.js

fix(events): midnight in an announcement is 12:00 am on the Node we ship

2026-09-09 19:20:31 -05:00

eventAuthorize.test.js

feat(events): open the event contract to modules (Phase 7)

2026-09-03 14:15:04 -05:00

eventCleanup.test.js

fix(core): the last fixes' core half (W1 W2 W5 W19)

2026-10-22 00:38:39 -05:00

eventGates.test.js

feat(events): conditions, phase advancement and the diagnosis panel (Phase 5)

2026-09-02 22:11:20 -05:00

eventIntegrations.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

eventLedger.test.js

feat(events): the resource ledger, leases and cleanup (Phase 8)

2026-09-03 21:19:27 -05:00

eventModuleContract.test.js

feat(safety): report, block and hide, MODULE_API 1.21.0

2026-10-30 05:41:00 -05:00

eventParamMultiple.test.js

feat(events): a param that holds several values (MODULE_API 1.14.0)

2026-10-12 15:40:30 -05:00

eventParticipants.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

eventPrice.test.js

feat(events): the authoring UI proper (Phase 13)

2026-09-07 16:34:03 -05:00

eventProgress.test.js

feat(events): an event action's progress() on a live run's public page (MODULE_API 1.12.0)

2026-10-06 02:47:00 -05:00

eventPublic.test.js

fix(events): the public phase label finds the phase by key (runicnpc D314)

2026-10-06 16:57:46 -05:00

eventRecurrence.test.js

feat(events): schedule, recurrence and the calendar (Phase 4)

2026-09-02 16:10:16 -05:00

eventRunControls.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

eventRunner.test.js

feat(events): a failed step may say when to retry (MODULE_API 1.15.0)

2026-10-15 02:39:43 -05:00

eventRunnerSql.test.js

feat(events): a trigger can start a run

2026-10-16 01:51:55 -05:00

eventsAdmin.test.js

fix(core): the last fixes' core half (W1 W2 W5 W19)

2026-10-22 00:38:39 -05:00

eventSchedule.test.js

feat(events): enablement, per-run caps and mayInvoke (Phase 6)

2026-09-03 05:50:58 -05:00

eventSeries.test.js

feat(events): schedule, recurrence and the calendar (Phase 4)

2026-09-02 16:10:16 -05:00

eventSpec.test.js

fix(core): the last fixes' core half (W1 W2 W5 W19)

2026-10-22 00:38:39 -05:00

eventsRoles.test.js

feat(events): the authoring UI proper (Phase 13)

2026-09-07 16:34:03 -05:00

eventStarts.test.js

feat(events): a trigger can start a run

2026-10-16 01:51:55 -05:00

eventStepEditor.test.js

feat(events): the step editor reworked, and event templates (MODULE_API 1.13.0)

2026-10-12 02:08:04 -05:00

eventVerify.test.js

feat(events): a dry run carries a module's advice (MODULE_API 1.16.0)

2026-10-16 15:18:53 -05:00

honeypot.test.js

…

htmlShell.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

inviteController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

invites.test.js

feat(provisioning): game-account signup, admin email invites, unlink (2.0)

2026-07-17 15:50:49 -05:00

loginProtection.test.js

test(login): stop the backoff-guard test racing its own one-second lock

2026-08-12 08:16:59 -05:00

mailer.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

mailTransports.test.js

feat(email): remove Gmail OAuth2, put SMTP behind a transport registry

2026-08-28 20:52:55 -05:00

mobileAuthBridge.model.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

mobileDeviceSessions.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

mobileSession.test.js

…

mobileSsoBridge.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

moderation.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

moderation.test.js

fix(moderation): windowValue must not fall back to the 30d total on a null column

2026-07-22 13:14:02 -05:00

moduleArchive.test.js

feat(modules): install, uninstall, purge and restart (phase 4, slice 1)

2026-08-12 03:09:45 -05:00

moduleClientChunk.test.js

feat(modules): the client registry, window.__rg and the chunk's script injection

2026-08-10 22:54:16 -05:00

moduleDeclared.test.js

feat(modules): the declarative Docker path (phase 4, slice 3)

2026-08-12 07:57:08 -05:00

moduleDocsSpec.test.js

feat(modules): merge module OpenAPI fragments into /api/docs.json (phase 3, slice 5)

2026-08-11 22:57:37 -05:00

moduleEngagementSeeds.test.js

fix(engagement): claim the seed guard atomically, and let a rule name a digest body

2026-09-01 14:29:21 -05:00

moduleInstall.test.js

fix(modules): a site runs one module; the installer refuses a second

2026-09-23 01:26:52 -05:00

moduleLifecycle.test.js

fix(core): the last fixes' core half (W1 W2 W5 W19)

2026-10-22 00:38:39 -05:00

moduleLoader.test.js

feat(safety): report, block and hide, MODULE_API 1.21.0

2026-10-30 05:41:00 -05:00

moduleRegistries.test.js

feat(events): the integrations — lifecycle triggers, participants, results (Phase 10)

2026-09-04 13:06:46 -05:00

modules.model.test.js

fix(modules): three defects a real install exposed (phase 4, slice 1)

2026-08-12 03:48:27 -05:00

moduleSchema.test.js

fix(core): the last fixes' core half (W1 W2 W5 W19)

2026-10-22 00:38:39 -05:00

navOverrides.test.js

feat(theming): dropdown sections and added links in the public header

2026-08-08 00:42:19 -05:00

newsNotify.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

notificationChannelPrefs.test.js

feat(engagement): the admin ceiling and core's news.post emitter (Phase 11a)

2026-08-31 20:33:02 -05:00

notificationsRoutes.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

pages.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

passwordResetController.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

passwordResets.test.js

feat(auth): self-service password reset (backend + web)

2026-07-19 03:57:13 -05:00

playerAccounts.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

playerRouteAccess.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

providers.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

publicBrand.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

publicController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

publicModules.test.js

feat(modules): publish the installed-module list at /api/v1/public/modules

2026-08-10 22:03:22 -05:00

publicVersion.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pushDispatch.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

recoveryCodes.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

registry.test.js

feat(auth): sign in with Steam (MODULE_API 1.17.0)

2026-10-19 14:02:49 -05:00

requireInternalKey.test.js

…

reservedNames.test.js

feat(teams): reserved-name screening, auto-hide, and the admin-approval gate

2026-08-17 15:08:58 -05:00

routeManifest.test.js

test: re-point core's suite at what core still owns

2026-08-11 12:08:26 -05:00

secretBox.test.js

…

selfTrustedDevices.test.js

refactor(api): collapse /admin/account and /player/account onto /auth/me/account

2026-08-29 00:49:25 -05:00

session.test.js

Fix SSO flow-token / session type confusion (#32 )

2026-07-04 21:54:58 -05:00

settingsGameSignup.test.js

refactor(client): delete the UO client half (phase 3, slice 3)

2026-08-11 18:39:55 -05:00

settingsTheming.test.js

feat(theming): wire the three navs and add the admin nav builder

2026-08-08 00:02:33 -05:00

slashCommands.test.js

feat(teams): the slash-command seam, and the first command through it

2026-08-18 18:53:34 -05:00

ssoCallback.test.js

feat(auth): sign in with Steam (MODULE_API 1.17.0)

2026-10-19 14:02:49 -05:00

ssoEmailVerified.test.js

feat(auth): unique, changeable, verifiable email addresses (engagement Phase 1b)

2026-08-29 01:53:50 -05:00

ssoState.test.js

Enforce TOTP second factor on SSO login (#31 )

2026-07-04 22:17:35 -05:00

ssoTrustedDevice.test.js

feat(auth): honor and establish trusted devices on the SSO login paths

2026-07-28 01:01:12 -05:00

steamSignin.test.js

test(auth): a linked Steam account signs in through the mobile bridge

2026-10-19 20:33:11 -05:00

teamAccess.test.js

feat(teams): the four-path access resolver and staff leadership overrides

2026-08-17 14:57:23 -05:00

teamActivity.test.js

feat(teams): the activity feed, its two writers and its retention

2026-08-17 20:15:18 -05:00

teamBridge.test.js

fix(safety): team notifications skip members who block the author

2026-10-31 00:23:18 -05:00

teamForum.test.js

feat(safety): report, block and hide, MODULE_API 1.21.0

2026-10-30 05:41:00 -05:00

teamIntegration.test.js

feat(teams): phase 8 — the notifications bridge, and the gate §7.2 could not check

2026-08-18 20:25:30 -05:00

teamModeration.test.js

feat(teams): reserved-name screening, auto-hide, and the admin-approval gate

2026-08-17 15:08:58 -05:00

teamNotify.test.js

feat(engagement): the email channel on the engine, and the Teams migration (engagement Phase 6)

2026-08-29 20:11:54 -05:00

teamNotifyDispatch.test.js

fix(safety): team notifications skip members who block the author

2026-10-31 00:23:18 -05:00

teamProvider.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

teamRoster.test.js

feat(teams): the roster's audience projection, and optionalAuth to resolve it

2026-08-17 20:15:36 -05:00

teamRoutes.test.js

feat(safety): report, block and hide, MODULE_API 1.21.0

2026-10-30 05:41:00 -05:00

teamSync.test.js

test(teams): the refusals, which is most of what a notification feature is

2026-08-18 14:35:23 -05:00

teamVoice.test.js

fix(teams): the two defects the phase 9 rig walk found

2026-08-19 00:07:27 -05:00

teamVoiceSync.test.js

fix(teams): the two defects the phase 9 rig walk found

2026-08-19 00:07:27 -05:00

themeResolve.test.js

feat(theming): server-resolved theme engine and admin appearance UI

2026-08-07 19:16:23 -05:00

totp.test.js

…

trustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

trustProxy.test.js

…

userDeletingHook.test.js

feat(account): self-service account deletion, MODULE_API 1.20.0

2026-10-29 18:32:19 -05:00

usernamePolicy.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00

userNotificationsSql.test.js

feat(engagement): the in-app channel, core and web (engagement Phase 7)

2026-08-31 02:07:10 -05:00

userSafety.test.js

fix(safety): team notifications skip members who block the author

2026-10-31 00:23:18 -05:00