adminandClaude Opus 5.5
ceaa44e5b8
Until now every account could do the same, and managing accounts meant running make-user.php on the server. Accounts now carry a role, and admins get a tab in the editor to create, rename, re-role, reset and delete accounts. Both issues share the same server files, so they land in one commit. #180 Roles: - Every account is admin or user. A missing or unknown role counts as user, on the server and in the client. - auth/session and auth/login return {user, role}. - Auth::requireAdmin() answers everyone else with 403. - make-user.php takes the role as a third argument. Without it an existing account keeps its role, so a password reset from the CLI never demotes an admin. - Admins see and save other users' projects like their own. Saving keeps the original owner. #179 User management: - The account menu gets "User management" (admins only) and "Plugins" (everyone). Both open the same closable tab, accounts on top and plugins below. The fixed Plugins tab is gone. - Per account: Rename, Role, Password (no old password needed) and Delete with a confirmation. "New user..." creates one. - Each account lists its projects with an Open button. - Delete is refused while the account still owns projects. - Renaming moves the projects along and ends every session of the account. transfer takes the same lock as save. - On their own row an admin can only set the password. The last admin cannot be demoted or deleted. The server enforces both. - The account rules live in AccountRules.php and accountRules.ts as pure functions, so they are testable without a server. Findings: - At 1280 px the Delete button reached past the column edge and was not clickable. The name column is flexible now, and module 49 checks the layout. - The server lets an admin delete other users' projects, but the editor has no button for it yet. Left open in the issue. Tests: - ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204). - New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it as its own step in the gate job, the host has no PHP. - New e2e module 49 with 18 checks. CI creates the e2e-admin account in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab. - e2e 1-16,37,38,45,46,49: all passed, 581 checks. - Counter-checks: owner on save, admin view, default role and self delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin, a wider column and the caller as owner each fail exactly their e2e check. - Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
# Runs the whole proof on the Gitea runner: gate, the editor suite and the three example games.
|
||
#
|
||
# `runs-on: game-maker-ci` picks the image built from tools/ci/Dockerfile. The render device and
|
||
# /dev/shm come from the runner's own container.options (/_stacks/git/runner/config.yaml), not
|
||
# from here – without them chromium falls back to software WebGL.
|
||
#
|
||
# Two jobs without `needs:`, so they start together and use both slots of the runner
|
||
# (`capacity: 2`, four cores). The gate no longer stands in front of the suite: a lint error used
|
||
# to cost the full e2e run before it was reported, and the run reported it after six minutes
|
||
# instead of one. Both still have to pass for the push to be green.
|
||
#
|
||
# The price is contention: while the gate runs, vitest and chromium share the four cores, and the
|
||
# suite measures text widths and frame counts. That is why the gate caps vitest at two workers
|
||
# (GM_TEST_WORKERS) – two cores stay free for the browser for the whole overlap.
|
||
name: game-maker
|
||
|
||
on:
|
||
push:
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
gate:
|
||
runs-on: game-maker-ci
|
||
timeout-minutes: 20
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Gate
|
||
run: ./check.sh
|
||
env:
|
||
GM_TEST_WORKERS: 2
|
||
|
||
# The API's own rules (#180, #179). Not part of check.sh: the host the editor is built on
|
||
# has no PHP, the image does.
|
||
- name: PHP tests
|
||
run: php tests/php/accounts.test.php
|
||
|
||
suite:
|
||
runs-on: game-maker-ci
|
||
timeout-minutes: 45
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Versions
|
||
run: |
|
||
node --version
|
||
chromium --version
|
||
php --version | head -1
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Build
|
||
run: npm run build
|
||
|
||
- name: Editor suite
|
||
run: tools/ci/run-e2e.sh
|
||
|
||
- name: Example games
|
||
run: tools/ci/run-smokes.sh
|