The editor is about to be opened to strangers: a post on Reddit and a
guest access (#428). nginx served the whole workspace and ran every PHP
file in it, the API let anybody guess passwords as fast as they liked,
and one account could fill the disk.
- nginx (shared web stack, outside this repo, backup in
/root/config-backup-20261015/) hands out only the two pages, dist/,
public/brand/, the uploads by kind and ending, and api/index.php.
Everything else under /feuerwerk/ is a 404.
- PHP behind it has display_errors off and no X-Powered-By. Plain HTTP
forwards to HTTPS, the API refuses it.
- Headers: a Content-Security-Policy without inline code or eval,
nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP.
- vite.config.ts writes the same policy into the built pages, so CI
runs the whole suite under it. Pixi gets by without eval through
pixi.js/unsafe-eval. The page CSS left its inline style for a file.
- The harness fails a module for anything the policy refuses, from
Chrome's log and from the page's securitypolicyviolation event.
- LoginThrottle: five wrong passwords from one address within 15
minutes, and it gets 429 until 15 minutes after the last of them.
The address is the last X-Forwarded-For entry, the Brandmauer's own.
- Quota: 1 GB per account for uploads, projects and snapshots. Only a
write that grows the account is refused (413). Admins have no limit.
- A write whose Sec-Fetch-Site says another site is refused (403).
- The session cookie carries Secure, nginx passes HTTPS on.
- showFailure puts the message in as text, not as HTML.
- Every PHP script outside api/ stops unless it runs on the command
line.
- The video worker sees the checkout read-only and can only write
data/videos. No capabilities, 2 GB and 256 processes at most.
- tests/php/rights.test.php runs the API under php -S on a scratch
directory and asks every route as signed out, owner, stranger and
admin. A route named in api/index.php but missing in the matrix
fails it. limits.test.php covers the brake and the quota.
Findings:
- tmp/ was readable from outside, with 79 copies of project files.
Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10.
shows only our own requests.
- Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the
Brandmauer. Left as it is: the web stack is not this project's.
- npm audit finds nothing in what is shipped. Dev tools (vitest,
brace-expansion, source-map-js) have advisories, not touched here.
Tests: check 313 files / 4843 tests. PHP limits 21, rights 60,
accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no
ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41
197/198, the one red check (a click in 41) passes with 41 alone,
27/27. 67 misses frames at 1080p on stein2 with and without this.
Path list from outside: 10 served, 26 refused. ZAP baseline against
the live site: nothing High or Medium under /feuerwerk/.
Counter-checks: rights.test.php without the cross-site guard, the
quota, the brake, the admin check of users, or with an undocumented
route fails each time. A policy without wasm-unsafe-eval fails e2e 41
with the harness's own CSP line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The editor gets a name of its own that fits beside Brandmauer,
Glutspeicher and Feuerwehr. This is stage 1, 2 and 4 of #422: the
name, the URL and the stored state in the browser. Repository, CI
runners, containers and the GAME_MAKER_* variables follow in stage 3.
- All paths come from SITE_PATH in src/core/site.ts: the API endpoint,
the data folders, the play page and the base in vite.config.ts. A
later move is one line instead of fifteen.
- The window title, the sign-in screen, the playground and the README
say Feuerwerk. The package, __feuerwerkPlay, the take worklet and the
writing app in Ogg and Matroska follow.
- The session cookie is now feuerwerk_session, so everyone signs in
once more.
- localStorage keys are now feuerwerk.*. moveOldStoredKeys copies the
old game-maker.* keys over on the first start, so settings, panel
sizes and save games survive.
- tools/ci/serve.sh serves the build under /feuerwerk/. The variable
GAME_MAKER_BASE_URL keeps its name until stage 3.
Outside the repository, nockal.com/feuerwerk/ is a second symlink to
the same tree. nginx sends the bare /game-maker/ folder there with a
301. Everything else under /game-maker/ is still served directly, so
shared play links and the API keep working.
Finding: when nginx redirects a path without a trailing slash or with
a query, the Brandmauer answers with its own 307 to the same URL plus
a slash, placed after the query. A play link would lose its token that
way, which is why only the bare folder is redirected.
Tests:
- Gate on melektaus-atx: CHECK EXIT 0, 307 files, 4756 tests
(4 new in site.test.ts).
- Counter-check: when the migration misses the old prefix, 3 of the
4 new tests fail.
- e2e 60 under /feuerwerk/: ALL PASSED, 20 checks.
- From outside: /feuerwerk/ 200, /game-maker/ 301, an old play
link 200.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A project could only be played inside the editor, behind the login.
To show a game to someone else there was no way short of an account.
A release freezes the saved project under a random token and serves
it on a page that holds nothing but the game view.
- Menu -> Release... opens a dialog with the state of the release,
the link with Copy link and Open, Publish or Update release, and
Take down behind a confirmation.
- Publish saves first and refuses while anything is unsaved, like
snapshots. Updating keeps the link. Take down kills it, and a new
Publish hands out a new token.
- The link is play.html?game=<32 hex>. The page needs no session,
paints Theme.colors.background, zooms with Auto and waits for
"Click to play" so that sound and keyboard focus are allowed.
- The game always starts in the start scene. Persistent variables
are stored per link in the browser. Plugins are not loaded, and the
dialog warns about them and about a project without a scene.
- GET ?r=releases/{token} is the only route besides auth/* that works
without a login. The public answer carries the token as project.id,
so the project id stays hidden. Release files are written with 0640
and nginx does not serve them directly (measured 403).
- Starting, the frame and Load scene moved into runtime/GameRun.ts.
Play in the editor and the play page run through the same code.
- WorldViewport moved to src/viewport/ and no longer needs the
EditorState. Pointer forwarding (gamePointer.ts) and setting up
textures, fonts and sounds (projectFiles.ts) exist only once.
- Vite builds two pages. The play page loads 4 kB of its own code
plus the shared chunk (Pixi, runtime, drawing, 653 kB) and Rapier,
without the editor.
Found on the way, not fixed here: data/projects/<id>.json answers 200
without a login because the files are 0644.
Tests:
- ./check.sh: 194 files, 2808 tests, exit 0.
- tests/php/releases.test.php: 20 checks, also added to CI.
- New e2e module 60 with 10 checks, played in a browser without a
session. Module 46 counts the menu entries and was updated.
- Full e2e run: 1572 checks passed.
- Counter-checks: 3 unit, 2 PHP and 3 browser mutations all fail.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The workflow ran everything in one job: check.sh, then build, then the e2e suite and the smokes.
The runner has two job slots and four cores, so the second slot lay idle for the whole run, and a
lint error was reported only after the full suite had passed in front of it - six minutes instead
of one.
Now `gate` and `suite` are two jobs without `needs:`. They start together, both have to pass.
The price is contention: while the gate runs, vitest and chromium share four cores, and the suite
measures text widths and frame counts, which a loaded machine reports differently. The gate
therefore caps vitest at two workers via GM_TEST_WORKERS, so two cores stay free for the browser
over the whole overlap. Locally the variable is unset and nothing changes.
Measured before the push: the cap costs vitest 4.4s (16.6s -> 21.0s), check.sh exits 0 with it,
build ok. Whether the split is worth it is a question for the runner - the expected net gain is
about 50s, and the acceptance is a measurement over at least two runs.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Canvas-only 2D game editor/runtime built on PixiJS v8 + Vite + TypeScript.
- core: asset model (Scene/Camera/Sprite), scene objects with sparse
overrides, property schema + resolve, command stack (undo/redo),
serialization and project store interface (16 unit tests)
- ui: custom in-canvas widget toolkit (panels, fields, color picker,
list/scroll, popup) with a hidden <input> keyboard bridge
- editor: asset/hierarchy panels, schema-driven inspector, toolbar
- viewport: box rendering, camera frame, selection gizmo, drag/zoom/pan
- runtime: world/entity instantiation for play mode, input, camera follow
- api: PHP JSON project store with revision counter (409 on conflict)
- tools: CDP-based e2e smoke test
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
adminandClaude Opus 5.5