wtclaude
6e61146678
Self-service account security had three URL surfaces onto one controller. All
three mounted the same `admin/account.controller.js` handlers; each of the three
router files carried a header comment apologising for the arrangement.
`/auth/me/account` was already a strict superset, which settles which to keep:
/admin/account 6 routes noindex, isLoggedIn, staffOnly
/player/account 8 routes noindex, requireAuth
/auth/me/account 10 routes noindex, requireAuth
Neither of the deleted surfaces carried recovery codes, and /admin/account
carried no username or password change at all — so client.js already called
/auth/me/account/recovery-codes/* for two operations on a screen it otherwise
served from /admin/account. The split was leaking before this change.
Gating is equivalent where it overlapped: /player and /auth/me apply identical
`noindex, requireAuth`, and `staffOnly` on /admin/account was strictly narrower
while buying nothing, since every handler is self-scoped to req.user.id. There
is no CSRF layer to differ.
- 14 routes deleted, 0 added, no handler changed.
- account.controller.js moves router/v1/admin/ -> router/v1/auth/, beside the
one router that still reaches it.
- Web client: 14 call sites move onto a root-level api.myAccount /
api.changeUsername / ... group, matching the /auth/me methods already there.
- Android app: no change. MeApi.kt was already 100% /auth/me/account/*.
- Two swagger tags, `Admin · Account` and `Player`, were declared only by the
deleted routes and go with them. The orphaned `AccountStatus` schema goes
too; `PlayerAccount` is re-described as the any-role /auth/me/account shape
(the name is kept so existing $refs resolve).
Breaking to the published OpenAPI surface, accepted deliberately: both consumers
are in this org, and deprecate-then-delete would leave the next phase deciding
whether to add routes to surfaces already marked for removal.
Verification: routes.manifest.json shows exactly 14 deletions and 0 additions.
The OpenAPI spec loses the same 14 paths with zero surviving path definitions
changed; its large textual diff is pure reordering, because removing the
first-mounted router shifts every later path. 1203 server tests, 288 client
tests, 53 bot tests green; check:modules, check:hosts and routes:manifest
--check all pass.
Design of record: docs/website/ENGAGEMENT.md Phase 1a. This lands ahead of
engagement Phase 1b, which adds a self-service email field — written once here
rather than three times.
Co-Authored-By: Claude <noreply@anthropic.com>
49 lines
2.3 KiB
JavaScript
49 lines
2.3 KiB
JavaScript
// /api/v1/player — the player self-service surface, assembled from
|
|
// per-capability routers.
|
|
//
|
|
// This file owns exactly two things: the gate every player route shares, and the
|
|
// mount table. No route is declared here. Each capability router mounts at the
|
|
// prefix it already owned inside the old monolithic player.routes.js.
|
|
//
|
|
// Self-service account security (`/player/account/*`) used to be mounted here. It
|
|
// is gone: `/auth/me/account/*` is the single canonical self surface for every
|
|
// role, and this group's copy was a strictly smaller duplicate of it.
|
|
//
|
|
// **Staff are a superset of players.** This group is open to any authenticated
|
|
// account, not just role 'player': every read/write is self-scoped to req.user.id,
|
|
// and a staff member has every player ability plus their staff tools on top.
|
|
// Adding a requireRole('player') here would 403 an admin off their own characters
|
|
// (it happened once — see docs/website/BACKEND_DESIGN.md). Staff also reach the
|
|
// identical self-scoped handlers under /admin/shard, which lives in module-uo now
|
|
// — that changes where they are defined and nothing about which URLs answer.
|
|
//
|
|
// See docs/website/API_V2_PLAN.md § Phase 2 for the split.
|
|
|
|
const express = require('express')
|
|
|
|
const { requireAuth } = require('../../../auth/session.middleware')
|
|
const noindex = require('../../../middleware/noindex')
|
|
|
|
const appealsRouter = require('./appeals.router')
|
|
const teamsRouter = require('./teams.router')
|
|
const teamForumRouter = require('./teamForum.router')
|
|
|
|
const playerRouter = express.Router()
|
|
|
|
// Group gate: authenticated only (no role restriction). Keep it out of search
|
|
// indexes. requireAuth also enforces the account status check (a disabled/banned
|
|
// account is rejected here with 403 before any handler runs).
|
|
//
|
|
// It lives here, ahead of every mount, so a capability router added later cannot
|
|
// silently ship without it.
|
|
playerRouter.use(noindex, requireAuth)
|
|
|
|
playerRouter.use('/appeals', appealsRouter)
|
|
playerRouter.use('/teams', teamsRouter)
|
|
// Same prefix, second router. The forum and the leader-exercised grant flow are a
|
|
// different capability from "the caller's own Teams", and splitting them keeps
|
|
// each file about one thing; no path in the two collides.
|
|
playerRouter.use('/teams', teamForumRouter)
|
|
|
|
module.exports = playerRouter
|