stein2 should stop carrying the full e2e run. The new runner lives in
the WSL2 distro game-maker-ci on melektaus-atx and uses the same image
and fonts. Its GPU sits behind /dev/dxg and Mesa's d3d12 driver, which
headless chromium cannot reach, so the harness gets a second way to
start the browser.
- GAME_MAKER_BROWSER=wsl starts an invisible Xvfb and an X11 chromium
on ANGLE/GL. Without the variable, stein2 keeps the headless Vulkan
launch exactly as before.
- The harness logs the renderer and stops on software rendering.
Under WSL a missing d3d12 driver falls back to llvmpipe, which still
offers WebGL 2 and would pass unnoticed.
- The CI image gains xvfb. The font set is unchanged: fc-list gives
the same 149 fonts with the same hash.
- ci.yml runs both jobs on the new label game-maker-wsl. The stein2
runner keeps game-maker-ci, so moving back is one line per job.
Findings:
- Wayland on weston reached the GPU too, but drew at about 40 fps and
let the editor clock stall in long runs (GM_STEPS=1-17: 2 failed).
- Vulkan through a self-built dzn caps ANGLE at ES 2.0 because
VK_EXT_provoking_vertex is missing, so chromium drops the GPU.
- The flaky check in e2e 41 (#282) fails more often under WSL: two of
three solo runs were red.
Tests:
- ./check.sh: 195 files, 2823 tests passed
- WSL container, GM_STEPS=1-17: ALL PASSED, 553 checks
- WSL container, full run: 1589 of 1590, the one FAIL is #282
- WSL container, smokes: 24 / 19 / 21 checks
- stein2 headless, e2e 39+40: ALL PASSED, 100 checks
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Until now every account could do the same, and managing accounts
meant running make-user.php on the server. Accounts now carry a role,
and admins get a tab in the editor to create, rename, re-role, reset
and delete accounts. Both issues share the same server files, so they
land in one commit.
#180 Roles:
- Every account is admin or user. A missing or unknown role counts as
user, on the server and in the client.
- auth/session and auth/login return {user, role}.
- Auth::requireAdmin() answers everyone else with 403.
- make-user.php takes the role as a third argument. Without it an
existing account keeps its role, so a password reset from the CLI
never demotes an admin.
- Admins see and save other users' projects like their own. Saving
keeps the original owner.
#179 User management:
- The account menu gets "User management" (admins only) and "Plugins"
(everyone). Both open the same closable tab, accounts on top and
plugins below. The fixed Plugins tab is gone.
- Per account: Rename, Role, Password (no old password needed) and
Delete with a confirmation. "New user..." creates one.
- Each account lists its projects with an Open button.
- Delete is refused while the account still owns projects.
- Renaming moves the projects along and ends every session of the
account. transfer takes the same lock as save.
- On their own row an admin can only set the password. The last admin
cannot be demoted or deleted. The server enforces both.
- The account rules live in AccountRules.php and accountRules.ts as
pure functions, so they are testable without a server.
Findings:
- At 1280 px the Delete button reached past the column edge and was
not clickable. The name column is flexible now, and module 49 checks
the layout.
- The server lets an admin delete other users' projects, but the
editor has no button for it yet. Left open in the issue.
Tests:
- ./check.sh: 148 files, 2214 tests, exit 0 (was 147 / 2204).
- New tests/php/accounts.test.php, 51 checks, plain PHP. CI runs it
as its own step in the gate job, the host has no PHP.
- New e2e module 49 with 18 checks. CI creates the e2e-admin account
in serve.sh. Modules 14, 38, 46 and the scaffold follow the new tab.
- e2e 1-16,37,38,45,46,49: all passed, 581 checks.
- Counter-checks: owner on save, admin view, default role and self
delete in PHP fail 7, 5, 5 and 1 checks. Unchecked requireAdmin,
a wider column and the caller as owner each fail exactly their
e2e check.
- Check sum 1314 -> 1333 (+1 in 38, +18 in 49), computed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
game_maker_serve runs project-shells.mjs unconditionally, so running the CI
smoke runner on a development machine overwrote the four project documents
with empty shells: revision 1301 became 1, and the name became the key from
PROJECTS, because the seeders keep whatever name the server already holds.
"Jump and Run" came back as "jumpRun". The shells are only ever needed on a
fresh checkout, where the directory is empty, so an existing file is kept.
The job image (tools/ci/Dockerfile, label game-maker-ci) carries chromium with the Vulkan
drivers, php-cli and the host's fonts; the render device itself comes from the runner's
container.options, so a job container gets the Intel GPU instead of llvmpipe.
tools/ci/serve.sh puts the checkout behind /game-maker/ with php -S and writes the project
shells the seeders need; every tool now takes its server from GAME_MAKER_BASE_URL rather than
from a project id repeated in shell scripts.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
adminandClaude Opus 5.5