9 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	043c224cc3	Rename Game Maker to Feuerwerk and serve it at /feuerwerk/ (#422) ... The editor gets a name of its own that fits beside Brandmauer, Glutspeicher and Feuerwehr. This is stage 1, 2 and 4 of #422: the name, the URL and the stored state in the browser. Repository, CI runners, containers and the GAME_MAKER_* variables follow in stage 3. - All paths come from SITE_PATH in src/core/site.ts: the API endpoint, the data folders, the play page and the base in vite.config.ts. A later move is one line instead of fifteen. - The window title, the sign-in screen, the playground and the README say Feuerwerk. The package, __feuerwerkPlay, the take worklet and the writing app in Ogg and Matroska follow. - The session cookie is now feuerwerk_session, so everyone signs in once more. - localStorage keys are now feuerwerk.*. moveOldStoredKeys copies the old game-maker.* keys over on the first start, so settings, panel sizes and save games survive. - tools/ci/serve.sh serves the build under /feuerwerk/. The variable GAME_MAKER_BASE_URL keeps its name until stage 3. Outside the repository, nockal.com/feuerwerk/ is a second symlink to the same tree. nginx sends the bare /game-maker/ folder there with a 301. Everything else under /game-maker/ is still served directly, so shared play links and the API keep working. Finding: when nginx redirects a path without a trailing slash or with a query, the Brandmauer answers with its own 307 to the same URL plus a slash, placed after the query. A play link would lose its token that way, which is why only the bare folder is redirected. Tests: - Gate on melektaus-atx: CHECK EXIT 0, 307 files, 4756 tests (4 new in site.test.ts). - Counter-check: when the migration misses the old prefix, 3 of the 4 new tests fail. - e2e 60 under /feuerwerk/: ALL PASSED, 20 checks. - From outside: /feuerwerk/ 200, /game-maker/ 301, an old play link 200. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:27:43 +02:00
adminandClaude Opus 5.5	ba01d146e9	Choose size, rate and what follows when recording the editor ... The editor recording had fixed settings: the canvas size at 60 fps, always converted and imported. Recording in 4K needs a choice, and the server shrank every video to 1080p anyway. Start recording... now opens a dialog, and a recording always goes to the server as it is. - The dialog holds name, resolution (Screen, 1080p, 1440p, 4K), fps (60 or 30), mouse pointer, sound, Convert and Import after conversion. Import is greyed out while Convert is off. The browser keeps the last choice, not the name. - A larger resolution makes the editor draw finer while it records, so 4K is sharp, not stretched. It is never below the screen's own resolution and goes back after Stop. - Stop always uploads. Without Convert the file only stays on the server. Without Import it is converted but no asset is added. Both are found in the video picker. - The server keeps the original next to each MP4 for every upload, so Download in the video tab and the picker gives the original. Videos from before have none, they still download their MP4. - A file left unconverted shows in the picker as not converted, with a Convert button. POST videos/{file}/convert queues it, and upload takes convert=0. - The worker now caps a video at 3840x2160 instead of 1920x1080. Videos converted before stay as they are. Tests: - PHP videos.test.php: 81 checks green, with the original, convert=0, a later Convert and the 4K cap. - Unit recording: 5 new, green. Red without the rule that a recording is never below the screen's resolution. - e2e 67e-ii: the video tab downloads the .source.mkv, a Matroska file. 67f: 1440p from a 1280x800 window gives 2304x1440 at 30 fps without sound, kept and not imported, then converted in the picker. Both red with the MP4 download and without the finer drawing. - The README names 2045 e2e checks. - Gate on melektaus-atx: 304 files, 4699 tests green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 17:01:55 +02:00
adminandClaude Opus 5.5	d48f174caf	Play videos on sprites, converted on the server with clips (#402) ... A video becomes an asset like a sound: uploaded once, converted to one format by a worker of its own, cut into clips in its tab, and worn by a sprite through its Texture row. Only Chrome is a target, without alpha. - Server: POST ?r=videos queues the upload under the hash of its bytes, so the MP4's name is known at once. The worker (VideoWorker over VideoFormat) writes H.264/AAC, yuv420p, constant frame rate, a keyframe every 15 frames, at most 1920x1080, with a poster and the details beside it. A failed job says why and is tried again on the next upload. - An upload may be up to 2 GB. It is streamed from the request to disk and hashed there, so php-fpm holds none of it in memory. The other routes keep their 256 MB. - The worker runs in the container game-maker-video on stein2, a compose project of its own (tools/video/), and in CI beside the PHP server. The CI image has ffmpeg for it. - Model: asset type video with size, length, frame rate and sound, and clips like a sound's. The clip helpers and commands serve both. - A sprite's Texture row offers videos and clips after the pictures. resolvePicture names a playing video by a key, and the texture library hands it to a VideoLibrary with one player per key. - The editor shows a placed video as a quiet preview. Play starts it over at its clip's start and lets it be heard through the master bus, a pause holds it, Esc makes it quiet again. - Video tab: the picture, a ruler, the clip strip and a track on the Sound tab's time axis. A drag spans a clip, a handle moves an edge, Play plays the picked clip. - The picker shows a video on its way with its progress and adopts an upload from it once it is ready. Dropping a video file does the same. Decided on my own: - Two sprites wearing the same clip share one player and show the same picture. Control per instance belongs to the follow-up with nodes. - A video plays in real time, the game's time scale does not slow it. - The container may use 3 of the 4 cores of stein2. Findings: - The first real upload (279 MB) got 413: the API's own ceiling of 256 MB for every request, not nginx or the Brandmauer. - Chrome has no picture of a video that never played, and a Pixi VideoSource drawn before the first frame stays empty for good. The texture is made in the first frame callback (openVideo). - A player nobody asks for in 2 s is let go. The inspector's PREVIEW asked only on an edit, so with the sprite not on screen its texture was destroyed under it and the batcher threw on every frame. The preview now redraws every frame while it shows a video, like a Time shader. A let-go texture keeps an empty source instead of none. - VideoSource.load() reloads the element and cuts off an earlier play(). Playing starts after loadeddata. Tests: - PHP videos.test.php: 68 checks, with the real ffmpeg - 300 MB upload through Brandmauer and nginx: 201 in 21 s, php-fpm at 13.7 MB RSS at most - Unit videos.test.ts: 20 tests - e2e 66 (stein2, atx was off): ALL PASSED, 18 checks; e2e 04 with the new asset count green - Gate (atx): 294 files, 4520 tests. serialize.test.ts used video as its example of an unknown type and now uses a made-up one. - Counter-checks: a keyframe gap of 30 fails the PHP check, a key that keeps the video's end fails 2 unit tests, a clip without its end fails "plays only its stretch" in e2e 66 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 12:12:39 +02:00
adminandClaude Opus 5.5	6b49a0bea7	Give each account its own folder of uploaded files to delete (#344) ... Uploaded images, fonts and sounds belonged to nobody. Every account saw every file in the pickers, and only an administrator could delete one, through the API alone. Now every account uploads into a folder of its own, sees its own files and nobody's, and can delete a file of its own that no project uses. - Files are stored as data/<kind>/<folder>/<sha256>.<ext>, and the folder is part of asset.file. A name without a folder belongs to nobody. - The folder is a random 12-character name kept in users.json and given with the first upload. Renaming an account moves no file, and a released game's URLs carry no account name. - The list shows the caller's own files and nobody's. An administrator sees all, each with owner and deletable. - DELETE takes the name with its folder. It answers 403 unless the file is the caller's or the caller is an administrator, and 409 while a project, snapshot or release of any account names it (FileUsage). The 409 names the caller's own projects only. - The pickers have a Delete button. The first press asks, the second deletes, and a refusal shows the server's reason. - A deleted account's folder stays and only administrators see it. - tools/migrate-file-owners.php moved every used file into the folder of the account using it (a copy each for two accounts) and rewrote projects, snapshots and releases. A project's revision goes up, so an open editor gets a conflict instead of saving old names back. - Font families are named after the hash alone, so a folder never ends up in a CSS family name. Run on stein2 on 2026-10-07, backup in /root/config-backup-20261007/data-before-344: 25 files used, 27 copies, 8 projects, 53 snapshots and 1 release rewritten, 30 unused files stay nobody's. Afterwards all 600 references resolve to a file in their owner's folder. Found while building: the Delete button cut its new label to "Del…" because a button does not measure itself again on a new text. The picker now lays its button row out again. Tests: - PHP files.test.php (new): 46 checks, counter-check 3 red - Unit core + editor: 220 files, 3403 tests - e2e 34 (melektaus-atx): ALL PASSED - 67 checks (2 new) - Gate (melektaus-atx): CHECK EXIT 0, 256 files, 3977 tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 08:25:13 +02:00
adminandClaude Opus 5.5	cbda6d64a7	Let only the owner delete a project, not an administrator (#272) ... #179 decided that nobody deletes a project on someone else's behalf. The API still let an administrator do it, because the admin store treated every project as its own. Option A from the issue is now in place: opening, editing, snapshots and release stay open to the administrator, deleting stays with the owner. - Store::delete checks the owner under the save lock and throws NotOwnerException for anyone else. It follows the pattern of StaleRevisionException. - The route answers that with 403 "Only its owner may delete a project". A file without an owner is covered the same way. Non-admins still get 404 for a project that is not theirs. - The editor has no way to delete a foreign project, the project picker lists only one's own. Nothing changes there. - An account that owns projects can no longer be deleted by an administrator at all. Its owner has to delete them first. - e2e 49 deleted the throwaway projects as administrator, both in its sweep and in 49i. It now signs in as the owner for that. 49i checks both answers. Tests: - tests/php/accounts.test.php: 56 checks passed (was 52, one check turned around, five new) - e2e 49: 22 checks passed (was 21), deleteByAdmin 403, deleteByOwner 204 - Gate: 197 files, 2855 tests passed - Counter-checks: without the owner check 4 PHP checks and 49i fail - The e2e total of 1603 is computed (1602 + 1), not measured Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-30 21:13:20 +02:00
adminandClaude Opus 5.5	14972d057f	Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85) ... Recurring cleanup round over the code since round 7 (bc688f3). The issue now also asks to fix bugs and small inconsistencies found on the way, so unlike the rounds before, this one changes behaviour in a few places. Duplicated code in api went from 23 clones with 228 lines to none (jscpd, at least 50 tokens). In src it stays at 22 clones with 271 lines, the same before and after. Bugs: - nginx served project and snapshot files as they were, so anyone who knew a project id could read it without signing in. Every file the API writes now goes through AtomicFile (temp file, mode, rename). Projects, snapshots, releases, accounts and sessions are 0640, and nginx answers 403 for them. - Any signed-in account could delete a shared image, font or sound, which projects of other accounts may wear. Deleting one is now for administrators only. The editor never deleted a file, so the client's delete is gone. - Two saves of one project could run at once. The lock file was removed after each save, so a waiting save and the next one locked different files. The lock file now stays, and deleting a project takes the lock as well. - Bytes that are no picture got a 500 instead of a 422, because the error handler also threw for warnings silenced with @. - A session file was rewritten in place. A request reading it at that moment found it empty and was signed out. It is replaced atomically. - Delete did nothing for a shape picked in the vector art list. Delete now goes through removeSelection, one case per kind of selection, and a kind without a case fails the type check. Inconsistencies: - Escape on a question does what its Cancel does. Cancel on "Delete project?" and "Restore snapshot?" leads back to the picker or the list like the other questions did, and so does deleting a project. - Editor texts use American spelling throughout, like the port names: 48 British spellings in 45 lines (colour, centre, initialised). - objectName and groupName replace eleven copies of "own name, else the asset's" and three of "Group". One copy fell back to the object id instead of "?". Duplicates, dead code, comments: - routeFiles serves images, fonts and sounds instead of three copies. HashedFileStore holds what the three stores shared: keeping a file under its hash with its name, listing and deleting. The stores keep only which bytes they take and what a record says. - AtomicFile replaces nine copies of temp file plus rename. - removeShapes is the one way the canvas, the inspector button and Delete take shapes out. - GraphInterpreter.fire was called by tests only. The 54 calls use a helper in tests/helpers.ts now. - FileStore.delete, HttpFileStore.delete and the PluginApi type were unused. A doc comment in actions.ts sat above the wrong function. Checked and left as is: - solidCells is used by tests only. It is the per-cell view before the merge into rectangles, the one place the largest-scale rule shows. - An undo checker ran all 124 commands of the unit tests and compared the project before and after undo. The only differences are empty ports, groups and notes lists where there were none, which the file format drops anyway. Docs: - README: the check sum. - Wiki, own commit: API (admin-only deletes, 422, file modes, lock file), Home (the "Not yet" list named three things that exist), Concepts, Keyboard, Vector art, Architecture and Development, and the 38 characters Gitea flagged as ambiguous on eight pages. - .gitignore: the lock files, and pasted-*.png in any folder, which keeps the screenshot archive out. Tests: - ./check.sh: 195 files, 2817 tests, exit 0 (+2 for the name helpers). - PHP: accounts 52 in the web container and 53 in the CI image with the race test (+2), snapshots 15 (+1), releases 20. - Full e2e run: ALL PASSED, 1586 checks (+6 in 12, 47, 49 and 50). - Smokes jumprun, tetris, actor: 24, 19 and 21 checks. The example project files were restored byte for byte afterwards. - The file stores of HEAD and of this commit give byte-identical output for the live folders and for store, list and delete in a throwaway folder. - Counter-checks, all fail as expected: a 500 for bad bytes fails 12, no admin check fails 49, removing the lock file again loses saves in 3 of 3 runs (151 to 170 of 321), Delete ignoring shapes fails 47, Escape that only closes fails 50, and dropping the shape case fails the type check (TS2366). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 18:12:55 +02:00
adminandClaude Opus 5.5	4194f3e150	Share a link that plays the game without the editor (#266) ... A project could only be played inside the editor, behind the login. To show a game to someone else there was no way short of an account. A release freezes the saved project under a random token and serves it on a page that holds nothing but the game view. - Menu -> Release... opens a dialog with the state of the release, the link with Copy link and Open, Publish or Update release, and Take down behind a confirmation. - Publish saves first and refuses while anything is unsaved, like snapshots. Updating keeps the link. Take down kills it, and a new Publish hands out a new token. - The link is play.html?game=<32 hex>. The page needs no session, paints Theme.colors.background, zooms with Auto and waits for "Click to play" so that sound and keyboard focus are allowed. - The game always starts in the start scene. Persistent variables are stored per link in the browser. Plugins are not loaded, and the dialog warns about them and about a project without a scene. - GET ?r=releases/{token} is the only route besides auth/* that works without a login. The public answer carries the token as project.id, so the project id stays hidden. Release files are written with 0640 and nginx does not serve them directly (measured 403). - Starting, the frame and Load scene moved into runtime/GameRun.ts. Play in the editor and the play page run through the same code. - WorldViewport moved to src/viewport/ and no longer needs the EditorState. Pointer forwarding (gamePointer.ts) and setting up textures, fonts and sounds (projectFiles.ts) exist only once. - Vite builds two pages. The play page loads 4 kB of its own code plus the shared chunk (Pixi, runtime, drawing, 653 kB) and Rapier, without the editor. Found on the way, not fixed here: data/projects/<id>.json answers 200 without a login because the files are 0644. Tests: - ./check.sh: 194 files, 2808 tests, exit 0. - tests/php/releases.test.php: 20 checks, also added to CI. - New e2e module 60 with 10 checks, played in a browser without a session. Module 46 counts the menu entries and was updated. - Full e2e run: 1572 checks passed. - Counter-checks: 3 unit, 2 PHP and 3 browser mutations all fail. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 13:30:38 +02:00
adminandClaude Opus 5.5	94749b4f3e	Let a project keep named snapshots and restore them (#231) ... Autosave only keeps the latest revision. Before a risky change there was no way to put a known good state aside and go back to it later. The main menu now has "Snapshots..." to create, restore and delete named copies of the open project. - Server: SnapshotStore.php keeps each snapshot as a copy of the project JSON under data/snapshots/<project>/ (git-ignored). Four routes under projects/{id}/snapshots use the same owner check as the project, so an admin also sees foreign snapshots. - Create writes the autosave first. With unsaved edits (play with open edits, failed save, conflict) no snapshot is made and a message says why. The rule is the pure function in src/editor/snapshots.ts. - An empty name falls back to the local date and time. - Restore asks first, then keeps the current state as "Before restoring <name>". It writes the snapshot back as a new revision and reloads the project, so the undo list is empty. A restore can itself be undone by restoring that snapshot. - Deleting a project deletes its snapshots too. Images, sounds, fonts and pixel art are content-addressed and never deleted, so a snapshot can always reach them. - Client: SnapshotStore and HttpSnapshotStore in src/core/store, the SnapshotsDialog, and the flows in ProjectSession. A stale revision (409) becomes StaleRevisionError. - CI runs the new PHP test in the gate job next to accounts. Not covered by e2e: the lock during play and the conflict case. Both are unit tests only. Tests: - check.sh: 164 files, 2401 tests, CHECK EXIT 0. - tests/php/snapshots.test.php: 14 checks, all passed. - tests/editor/snapshots.test.ts: 5 tests for the time format, the blocker rule, the routes and 409. - New e2e module 50 on a throwaway project: create, rename, restore, undo the restore, delete, then delete the project and get 404 on its snapshots. 46b expects the new menu entry. e2e 46,50: 20 checks passed. The check sum goes from 1385 to 1393 (computed). - Counter-checks, originals restored and compared with cmp: blocker always allowed fails 1 unit test. No sorting fails 2 PHP checks. Restore without keeping the old state fails 50c and aborts 50d. - The first sort test with 2 snapshots passed by chance half the time because of random ids. It now uses 8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-25 18:21:52 +02:00
adminandClaude Opus 5.5	ceaa44e5b8	Add roles and a user management tab for admins (#180, #179) ... Until now every account could do the same, and managing accounts meant running make-user.php on the server. Accounts now carry a role, and admins get a tab in the editor to create, rename, re-role, reset and delete accounts. Both issues share the same server files, so they land in one commit. #180 Roles: - Every account is admin or user. A missing or unknown role counts as user, on the server and in the client. - auth/session and auth/login return {user, role}. - Auth::requireAdmin() answers everyone else with 403. - make-user.php takes the role as a third argument. Without it an existing account keeps its role, so a password reset from the CLI never demotes an admin. - Admins see and save other users' projects like their own. Saving keeps the original owner. #179 User management: - The account menu gets "User management" (admins only) and "Plugins" (everyone). Both open the same closable tab, accounts on top and plugins below. The fixed Plugins tab is gone. - Per account: Rename, Role, Password (no old password needed) and Delete with a confirmation. "New user..." creates one. - Each account lists its projects with an Open button. - Delete is refused while the account still owns projects. - Renaming moves the projects along and ends every session of the account. transfer takes the same lock as save. - On their own row an admin can only set the password. The last admin cannot be demoted or deleted. The server enforces both. - The account rules live in AccountRules.php and accountRules.ts as pure functions, so they are testable without a server. Findings: - At 1280 px the Delete button reached past the column edge and was not clickable. The name column is flexible now, and module 49 checks the layout. - The server lets an admin delete other users' projects, but the editor has no button for it yet. Left open in the issue. Tests: - ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204). - New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it as its own step in the gate job, the host has no PHP. - New e2e module 49 with 18 checks. CI creates the e2e-admin account in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab. - e2e 1-16,37,38,45,46,49: all passed, 581 checks. - Counter-checks: owner on save, admin view, default role and self delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin, a wider column and the caller as owner each fail exactly their e2e check. - Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-23 13:59:04 +02:00