website

_helper.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9 )

2026-07-02 23:22:35 -05:00

adminTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

adminUserShard.test.js

feat(admin): view a user's shard footprint at /admin/users/:id

2026-07-12 09:36:43 -05:00

announceJobs.test.js

News post → town crier + Discord announcement pipeline

2026-07-11 16:25:25 -05:00

appeals.pure.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appeals.test.js

feat(moderation): appeals (6c) + Discord reversal on approve (6d)

2026-07-18 22:01:06 -05:00

appLinks.test.js

feat(mobile-sso): serve assetlinks.json + App Links redirect allowlist

2026-07-20 18:37:17 -05:00

authController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

authMe.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

authTrustedDevice.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

botInternalKey.test.js

Isolate internal bot-config route from the public listener (#33 )

2026-07-04 17:35:07 -05:00

botScore.test.js

Add Bot Activity admin panel: banned-IP view + recent events + emergency unban

2026-07-03 02:31:25 -05:00

csp.test.js

feat(security): soak the tightened CSP on report-only, with a same-origin sink

2026-07-27 15:19:26 -05:00

emailConfig.model.test.js

Modernize email: Gmail OAuth2 sending, configured under Settings

2026-07-07 22:29:27 -05:00

honeypot.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9 )

2026-07-02 23:22:35 -05:00

inviteController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

invites.test.js

feat(provisioning): game-account signup, admin email invites, unlink (2.0)

2026-07-17 15:50:49 -05:00

loginProtection.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9 )

2026-07-02 23:22:35 -05:00

mailer.test.js

Modernize email: Gmail OAuth2 sending, configured under Settings

2026-07-07 22:29:27 -05:00

mobileAuthBridge.model.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

mobileDeviceSessions.test.js

feat(auth): Active Devices — view/revoke mobile sessions

2026-07-20 17:01:47 -05:00

mobileSession.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

mobileSsoBridge.test.js

feat(auth): native SSO authorization bridge for the Android app

2026-07-20 16:55:06 -05:00

moderation.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

moderation.test.js

fix(moderation): windowValue must not fall back to the 30d total on a null column

2026-07-22 13:14:02 -05:00

newsGump.test.js

feat(news): auto-push published news to the in-game Town Cryer News gump (2.1)

2026-07-17 15:40:47 -05:00

notificationsRoutes.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pages.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

passwordResetController.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

passwordResets.test.js

feat(auth): self-service password reset (backend + web)

2026-07-19 03:57:13 -05:00

playerAccounts.test.js

Fix player getAccount has_password: read the raw row, not sanitized req.user

2026-07-06 05:11:36 -05:00

playerRouteAccess.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

providers.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

publicBrand.test.js

feat(settings): surface push.ntfyUrl in /public/settings for the app

2026-07-20 15:25:40 -05:00

publicController.test.js

test(server): unit-test auth, invite, password-reset, and public controllers

2026-07-21 00:33:01 -05:00

publicShardOnline.test.js

fix(shard): restrict staff in-game location to admins/moderators

2026-07-18 21:18:52 -05:00

publicVersion.test.js

refactor(server): split public, player and residual auth into capability routers (PR 5)

2026-07-27 20:52:14 -05:00

pushDispatch.test.js

feat(push): M7 backend — opt-in push notifications via self-hosted ntfy

2026-07-20 05:13:48 -05:00

recoveryCodes.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

registry.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

requireInternalKey.test.js

Isolate internal bot-config route from the public listener (#33 )

2026-07-04 17:35:07 -05:00

routeManifest.test.js

chore(server): freeze the URL surface with a generated route manifest

2026-07-27 14:55:38 -05:00

secretBox.test.js

Add session abstraction, mobile bearer auth, and pluggable SSO

2026-07-03 10:31:29 -05:00

selfTrustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

session.test.js

Fix SSO flow-token / session type confusion (#32 )

2026-07-04 21:54:58 -05:00

shardBroadcast.visibility.test.js

feat(shard): admin-configurable visibility for every shard surface

2026-07-28 10:04:48 -05:00

shardControllerPublic.test.js

feat(shard): ingest world.ruleset and publish it at /site/rules

2026-07-28 14:35:24 -05:00

shardIngest.champsPages.test.js

feat(push): M7 backend — opt-in push notifications via self-hosted ntfy

2026-07-20 05:13:48 -05:00

shardIngest.protocol2.test.js

feat(push): M7 backend — opt-in push notifications via self-hosted ntfy

2026-07-20 05:13:48 -05:00

shardIngest.ruleset.test.js

feat(shard): ingest world.ruleset and publish it at /site/rules

2026-07-28 14:35:24 -05:00

shardState.governorTerms.test.js

feat(shard): ingest Protocol 2.0 boards — guilds, governors, presence, houses

2026-07-17 12:28:54 -05:00

shardState.model.test.js

test(server): unit-test pages, shardState, and moderation model logic

2026-07-21 00:26:01 -05:00

shardVisibility.test.js

fix(shard): enforce visibility on the REST reads that bypassed it

2026-07-28 10:49:55 -05:00

spawnAtlas.parse.test.js

refactor(atlas): derive the atlas from the shard's tree on every boot

2026-07-28 16:41:33 -05:00

spawnAtlas.source.test.js

refactor(atlas): derive the atlas from the shard's tree on every boot

2026-07-28 16:41:33 -05:00

ssoCallback.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00

ssoState.test.js

Enforce TOTP second factor on SSO login (#31 )

2026-07-04 22:17:35 -05:00

ssoTrustedDevice.test.js

feat(auth): honor and establish trusted devices on the SSO login paths

2026-07-28 01:01:12 -05:00

totp.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9 )

2026-07-02 23:22:35 -05:00

trustedDevices.test.js

feat(auth): trusted devices, recovery codes, and admin MFA management

2026-07-21 23:38:48 -05:00

trustProxy.test.js

Harden admin login: RBAC-safe controls, 2FA, bot-scoring, rate limits (#9 )

2026-07-02 23:22:35 -05:00

uoLinkClient.test.js

fix(shard): stop an undecryptable uo-link token 500ing every live-shard route

2026-07-28 00:22:40 -05:00

usernamePolicy.test.js

Player accounts backend: schema, registration, self-service, SSO provision

2026-07-06 01:36:51 -05:00