Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

Recurring cleanup round over the code since round 7 (bc688f3). The
issue now also asks to fix bugs and small inconsistencies found on the
way, so unlike the rounds before, this one changes behaviour in a few
places. Duplicated code in api went from 23 clones with 228 lines to
none (jscpd, at least 50 tokens). In src it stays at 22 clones with
271 lines, the same before and after.

Bugs:
- nginx served project and snapshot files as they were, so anyone who
  knew a project id could read it without signing in. Every file the
  API writes now goes through AtomicFile (temp file, mode, rename).
  Projects, snapshots, releases, accounts and sessions are 0640, and
  nginx answers 403 for them.
- Any signed-in account could delete a shared image, font or sound,
  which projects of other accounts may wear. Deleting one is now for
  administrators only. The editor never deleted a file, so the
  client's delete is gone.
- Two saves of one project could run at once. The lock file was
  removed after each save, so a waiting save and the next one locked
  different files. The lock file now stays, and deleting a project
  takes the lock as well.
- Bytes that are no picture got a 500 instead of a 422, because the
  error handler also threw for warnings silenced with @.
- A session file was rewritten in place. A request reading it at that
  moment found it empty and was signed out. It is replaced atomically.
- Delete did nothing for a shape picked in the vector art list. Delete
  now goes through removeSelection, one case per kind of selection,
  and a kind without a case fails the type check.

Inconsistencies:
- Escape on a question does what its Cancel does. Cancel on "Delete
  project?" and "Restore snapshot?" leads back to the picker or the
  list like the other questions did, and so does deleting a project.
- Editor texts use American spelling throughout, like the port names:
  48 British spellings in 45 lines (colour, centre, initialised).
- objectName and groupName replace eleven copies of "own name, else
  the asset's" and three of "Group". One copy fell back to the object
  id instead of "?".

Duplicates, dead code, comments:
- routeFiles serves images, fonts and sounds instead of three copies.
  HashedFileStore holds what the three stores shared: keeping a file
  under its hash with its name, listing and deleting. The stores keep
  only which bytes they take and what a record says.
- AtomicFile replaces nine copies of temp file plus rename.
- removeShapes is the one way the canvas, the inspector button and
  Delete take shapes out.
- GraphInterpreter.fire was called by tests only. The 54 calls use a
  helper in tests/helpers.ts now.
- FileStore.delete, HttpFileStore.delete and the PluginApi type were
  unused. A doc comment in actions.ts sat above the wrong function.

Checked and left as is:
- solidCells is used by tests only. It is the per-cell view before the
  merge into rectangles, the one place the largest-scale rule shows.
- An undo checker ran all 124 commands of the unit tests and compared
  the project before and after undo. The only differences are empty
  ports, groups and notes lists where there were none, which the file
  format drops anyway.

Docs:
- README: the check sum.
- Wiki, own commit: API (admin-only deletes, 422, file modes, lock
  file), Home (the "Not yet" list named three things that exist),
  Concepts, Keyboard, Vector art, Architecture and Development, and
  the 38 characters Gitea flagged as ambiguous on eight pages.
- .gitignore: the lock files, and pasted-*.png in any folder, which
  keeps the screenshot archive out.

Tests:
- ./check.sh: 195 files, 2817 tests, exit 0 (+2 for the name helpers).
- PHP: accounts 52 in the web container and 53 in the CI image with
  the race test (+2), snapshots 15 (+1), releases 20.
- Full e2e run: ALL PASSED, 1586 checks (+6 in 12, 47, 49 and 50).
- Smokes jumprun, tetris, actor: 24, 19 and 21 checks. The example
  project files were restored byte for byte afterwards.
- The file stores of HEAD and of this commit give byte-identical
  output for the live folders and for store, list and delete in a
  throwaway folder.
- Counter-checks, all fail as expected: a 500 for bad bytes fails 12,
  no admin check fails 49, removing the lock file again loses saves
  in 3 of 3 runs (151 to 170 of 321), Delete ignoring shapes fails 47,
  Escape that only closes fails 50, and dropping the shape case fails
  the type check (TS2366).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/e2e/12-textures.mjs

@@ -416,6 +416,15 @@ export async function textures(t) {
     (await json('__gm.state.notice')) === 'Added the image to the project.',
     JSON.stringify(await json('__gm.state.notice')),
   );
+  // Bytes that are no picture are the caller's mistake: a 422 that says so, not a server error.
+  const refusedUpload = await evaluate(`fetch('/game-maker/api/index.php?r=textures&name=x.png',
+    { method: 'POST', headers: { 'Content-Type': 'image/png' }, body: 'hello' })
+    .then(async (r) => ({ status: r.status, error: (await r.json()).error }))`);
+  check(
+    'bytes that are no picture are turned away with 422, not a server error',
+    refusedUpload.status === 422 && refusedUpload.error === 'Not a readable image',
+    JSON.stringify(refusedUpload),
+  );
 
   // Reusing a file already in the project must not make a second asset on it – two assets on one
   // picture would disagree about its filter.
@@ -486,4 +495,6 @@ export async function textures(t) {
       (await json("__gm.state.project.assets.filter((a) => a.type === 'sprite').length")) === spritesBefore,
     );
   }
+  // Saved before the next step: one that navigates would hang at the unsaved-changes prompt.
+  await t.saved();
 }

tools/e2e/47-vectorart.mjs

@@ -398,6 +398,24 @@ export async function vectorArt(t) {
     JSON.stringify({ cross, afterCross, selected: await json('__gm.vectorArt.selected()') }),
   );
 
+  // Delete takes a shape away however it was picked. A row of the list leaves nothing focused, so the
+  // key reaches the editor's shortcuts rather than the canvas.
+  await clickText('Add shape');
+  await settle();
+  const spare = (await shapeIds()).at(-1);
+  const spareRow = await json(`__gm.vectorArt.shapeRowAt(${JSON.stringify(spare)})`);
+  await click(spareRow.x + spareRow.w / 2, spareRow.y + spareRow.h / 2);
+  await settle();
+  const pickedSpare = await json('__gm.vectorArt.selected()');
+  await press('Delete');
+  await settle();
+  const afterDelete = await shapeIds();
+  check(
+    'Delete removes a shape picked in the list',
+    pickedSpare === spare && afterDelete.length === before47e && !afterDelete.includes(spare),
+    JSON.stringify({ spare, pickedSpare, afterDelete }),
+  );
+
   // 47e-ii. The duplicate mark puts a copy right above its shape and selects it; a double-click on
   //         a name edits it in the row. Both are undone again, the blocks after count on the shapes.
   const fieldName = (await shapeOf('va-field')).name;
@@ -883,7 +901,7 @@ export async function vectorArt(t) {
     JSON.stringify(addedPaint?.stops),
   );
 
-  const stopField = await json("__gm.inspectorField('Stop colour', true)");
+  const stopField = await json("__gm.inspectorField('Stop color', true)");
   await click(stopField.x, stopField.y);
   await press('a', { ctrl: true });
   await typeText('ff0000');
@@ -892,7 +910,7 @@ export async function vectorArt(t) {
   const reddened = (await sky())?.paint;
   const redMiddle = await tabPixel(128, 128);
   check(
-    'the Stop colour row recolours the picked stop, and the middle of the shape turns red',
+    'the Stop color row recolors the picked stop, and the middle of the shape turns red',
     reddened?.stops[2]?.color === 0xff0000 && colourDistance(redMiddle, '#ff0000') < 24,
     JSON.stringify({ stops: reddened?.stops, redMiddle }),
   );

tools/e2e/49-users.mjs

@@ -99,12 +99,23 @@ export async function users(t) {
       JSON.stringify(userMenu),
     );
     // A session of its own: step 45 changes the password of `e2e`, which ends the tools' cached one.
-    const refused = await call(await logIn(baseUrl, E2E_USER, await e2ePassword()), 'GET', 'users');
+    const userCookie = await logIn(baseUrl, E2E_USER, await e2ePassword());
+    const refused = await call(userCookie, 'GET', 'users');
     check(
       `the API answers ${E2E_USER} 403 on the accounts`,
       refused.status === 403 && (await refused.json()).error === 'Administrators only',
       String(refused.status),
     );
+    // An image, font or sound is shared, and a project of another account may wear it. The name is
+    // valid but nobody's, so nothing is deleted either way.
+    const nobodys = `textures/${'0'.repeat(64)}.png`;
+    const byUser = (await call(userCookie, 'DELETE', nobodys)).status;
+    const byAdmin = (await asAdmin('DELETE', nobodys)).status;
+    check(
+      'only an administrator may delete a shared file',
+      byUser === 403 && byAdmin === 404,
+      JSON.stringify({ byUser, byAdmin }),
+    );
 
     // 49b. Signed in as the administrator, the fixture – which belongs to `e2e` – opens all the
     //      same, and the menu has the user management before the plugins.

tools/e2e/50-snapshots.mjs

@@ -97,7 +97,27 @@ export async function snapshots(t) {
       revision: await json('__gm.state.revision'),
     };
 
-    // 50c. Restore puts the snapshot back, keeps the renamed stand as "Before restoring …", reloads
+    // 50c. Escape on the question is its Cancel: the list comes back and nothing is restored.
+    const cameBack = (expression, label) =>
+      waitUntil(expression, { label }).then(
+        () => true,
+        () => false,
+      );
+    await openSnapshots();
+    await clickLast('Clean start');
+    await clickLast('Restore');
+    await press('Escape');
+    const listBack = await cameBack('__gm.snapshots() !== null', 'the list came back');
+    check(
+      'Escape on "Restore snapshot?" leads back to the list and restores nothing',
+      listBack &&
+        (await json('__gm.state.project.name')) === RENAMED &&
+        (await json('__gm.state.revision')) === later.revision,
+      JSON.stringify({ listBack, name: await json('__gm.state.project.name') }),
+    );
+    if (listBack) await clickLast('Cancel');
+
+    //      Restore puts the snapshot back, keeps the renamed stand as "Before restoring …", reloads
     //      the project with an empty undo history, and tells so.
     await openSnapshots();
     await clickLast('Clean start');
@@ -159,8 +179,35 @@ export async function snapshots(t) {
     );
     await clickLast('Cancel');
 
-    // 50f. Deleting the project deletes its snapshots: the route answers 404 afterwards.
-    await api('DELETE', `projects/${made.id}`);
+    // 50f. The project goes by the picker. Its question stands in for the picker: Cancel leads back to
+    //      it, and so does the deletion, with the project gone from the list.
+    await clickToolbar('menu');
+    await clickText('Open project…');
+    await waitUntil('__gm.projectPicker() !== null', { label: 'the project picker opened' });
+    await clickLast('Delete');
+    await clickLast('Cancel');
+    const pickerBack = await cameBack('__gm.projectPicker() !== null', 'the picker came back');
+    check(
+      'Cancel on "Delete project?" leads back to the picker and keeps the project',
+      pickerBack && (await stored()).name === RENAMED,
+      JSON.stringify({ pickerBack, picker: await json('__gm.projectPicker()') }),
+    );
+    if (pickerBack) {
+      await clickLast('Delete');
+      await clickLast('Delete');
+    } else await api('DELETE', `projects/${made.id}`);
+    const pickerAgain = await cameBack(
+      `__gm.projectPicker() !== null && !__gm.projectPicker().names.includes(${JSON.stringify(RENAMED)})`,
+      'the picker came back without the project',
+    );
+    check(
+      'deleting from the picker leads back to it, without the project',
+      pickerAgain,
+      JSON.stringify(await json('__gm.projectPicker()')),
+    );
+    if (pickerAgain) await clickLast('Cancel');
+
+    // Deleting the project deletes its snapshots: the route answers 404 afterwards.
     const gone = await api('GET', `projects/${made.id}/snapshots`);
     check('deleting the project takes its snapshots along', gone.status === 404, String(gone.status));
   } finally {

tools/make-user.php

@@ -11,6 +11,7 @@ declare(strict_types=1);
  *        php tools/make-user.php --list
  */
 
+require __DIR__ . '/../api/lib/AtomicFile.php';
 require __DIR__ . '/../api/lib/UserStore.php';
 
 $file = dirname(__DIR__) . '/data/users.json';