7 Commits

Include renames

Author	SHA1	Message	Date
adminandClaude Opus 5.5	6b49a0bea7	Give each account its own folder of uploaded files to delete (#344) ... Uploaded images, fonts and sounds belonged to nobody. Every account saw every file in the pickers, and only an administrator could delete one, through the API alone. Now every account uploads into a folder of its own, sees its own files and nobody's, and can delete a file of its own that no project uses. - Files are stored as data/<kind>/<folder>/<sha256>.<ext>, and the folder is part of asset.file. A name without a folder belongs to nobody. - The folder is a random 12-character name kept in users.json and given with the first upload. Renaming an account moves no file, and a released game's URLs carry no account name. - The list shows the caller's own files and nobody's. An administrator sees all, each with owner and deletable. - DELETE takes the name with its folder. It answers 403 unless the file is the caller's or the caller is an administrator, and 409 while a project, snapshot or release of any account names it (FileUsage). The 409 names the caller's own projects only. - The pickers have a Delete button. The first press asks, the second deletes, and a refusal shows the server's reason. - A deleted account's folder stays and only administrators see it. - tools/migrate-file-owners.php moved every used file into the folder of the account using it (a copy each for two accounts) and rewrote projects, snapshots and releases. A project's revision goes up, so an open editor gets a conflict instead of saving old names back. - Font families are named after the hash alone, so a folder never ends up in a CSS family name. Run on stein2 on 2026-10-07, backup in /root/config-backup-20261007/data-before-344: 25 files used, 27 copies, 8 projects, 53 snapshots and 1 release rewritten, 30 unused files stay nobody's. Afterwards all 600 references resolve to a file in their owner's folder. Found while building: the Delete button cut its new label to "Del…" because a button does not measure itself again on a new text. The picker now lays its button row out again. Tests: - PHP files.test.php (new): 46 checks, counter-check 3 red - Unit core + editor: 220 files, 3403 tests - e2e 34 (melektaus-atx): ALL PASSED - 67 checks (2 new) - Gate (melektaus-atx): CHECK EXIT 0, 256 files, 3977 tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 08:25:13 +02:00
adminandClaude Opus 5.5	14972d057f	Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85) ... Recurring cleanup round over the code since round 7 (bc688f3). The issue now also asks to fix bugs and small inconsistencies found on the way, so unlike the rounds before, this one changes behaviour in a few places. Duplicated code in api went from 23 clones with 228 lines to none (jscpd, at least 50 tokens). In src it stays at 22 clones with 271 lines, the same before and after. Bugs: - nginx served project and snapshot files as they were, so anyone who knew a project id could read it without signing in. Every file the API writes now goes through AtomicFile (temp file, mode, rename). Projects, snapshots, releases, accounts and sessions are 0640, and nginx answers 403 for them. - Any signed-in account could delete a shared image, font or sound, which projects of other accounts may wear. Deleting one is now for administrators only. The editor never deleted a file, so the client's delete is gone. - Two saves of one project could run at once. The lock file was removed after each save, so a waiting save and the next one locked different files. The lock file now stays, and deleting a project takes the lock as well. - Bytes that are no picture got a 500 instead of a 422, because the error handler also threw for warnings silenced with @. - A session file was rewritten in place. A request reading it at that moment found it empty and was signed out. It is replaced atomically. - Delete did nothing for a shape picked in the vector art list. Delete now goes through removeSelection, one case per kind of selection, and a kind without a case fails the type check. Inconsistencies: - Escape on a question does what its Cancel does. Cancel on "Delete project?" and "Restore snapshot?" leads back to the picker or the list like the other questions did, and so does deleting a project. - Editor texts use American spelling throughout, like the port names: 48 British spellings in 45 lines (colour, centre, initialised). - objectName and groupName replace eleven copies of "own name, else the asset's" and three of "Group". One copy fell back to the object id instead of "?". Duplicates, dead code, comments: - routeFiles serves images, fonts and sounds instead of three copies. HashedFileStore holds what the three stores shared: keeping a file under its hash with its name, listing and deleting. The stores keep only which bytes they take and what a record says. - AtomicFile replaces nine copies of temp file plus rename. - removeShapes is the one way the canvas, the inspector button and Delete take shapes out. - GraphInterpreter.fire was called by tests only. The 54 calls use a helper in tests/helpers.ts now. - FileStore.delete, HttpFileStore.delete and the PluginApi type were unused. A doc comment in actions.ts sat above the wrong function. Checked and left as is: - solidCells is used by tests only. It is the per-cell view before the merge into rectangles, the one place the largest-scale rule shows. - An undo checker ran all 124 commands of the unit tests and compared the project before and after undo. The only differences are empty ports, groups and notes lists where there were none, which the file format drops anyway. Docs: - README: the check sum. - Wiki, own commit: API (admin-only deletes, 422, file modes, lock file), Home (the "Not yet" list named three things that exist), Concepts, Keyboard, Vector art, Architecture and Development, and the 38 characters Gitea flagged as ambiguous on eight pages. - .gitignore: the lock files, and pasted-*.png in any folder, which keeps the screenshot archive out. Tests: - ./check.sh: 195 files, 2817 tests, exit 0 (+2 for the name helpers). - PHP: accounts 52 in the web container and 53 in the CI image with the race test (+2), snapshots 15 (+1), releases 20. - Full e2e run: ALL PASSED, 1586 checks (+6 in 12, 47, 49 and 50). - Smokes jumprun, tetris, actor: 24, 19 and 21 checks. The example project files were restored byte for byte afterwards. - The file stores of HEAD and of this commit give byte-identical output for the live folders and for store, list and delete in a throwaway folder. - Counter-checks, all fail as expected: a 500 for bad bytes fails 12, no admin check fails 49, removing the lock file again loses saves in 3 of 3 runs (151 to 170 of 321), Delete ignoring shapes fails 47, Escape that only closes fails 50, and dropping the shape case fails the type check (TS2366). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-09-29 18:12:55 +02:00
adminandClaude Opus 5	5ba796a2b6	Plugins belong to the project, and they load before it: the project file gained the field plugins: ["demo-plugin.js"] (default empty, no formatVersion bump), the Plugins tab's switch writes into it as an ordinary undo step (SetPluginActiveCommand) instead of into a server-wide plugins.json, and the start order is turned around - startPlugins only fetches the list of files, then editor.boot() runs and ProjectStore.load(id, prepare) hands the raw JSON through before it is deserialized, where pluginsOf(raw) reads the list and PluginManager.syncTo() activates exactly those; that is the point of the issue, because what a plugin registers has to stand there before normalizeGraph would throw it away as unknown (#126, #127), a project switch first stops what the new project does not name and then starts what it does, a file the server does not have is passed over silently, and after signing out the manager is dead so a late event cannot start anything in a torn-down session; on the server plugins.json, PluginStore::setActive, isActive, the route PUT ?r=plugins/{file} and the 403 for inactive modules are gone and GET ?r=plugins only answers {file,bytes,updatedAt}, which makes every plugin file fetchable - the consequence accepted in #117, written down in the wiki for #115 and #116; publishPlugins(root) only copies files now, the seeder switches the demo plugin on in the fixture project, and the Plugins tab carries a puzzle piece as its icon while only a plugin's own tab still goes without one (the knob and the socket are cubic curves, not arcs, which Pixi's parser draws as a spike after an L); 3 new e2e checks in module 38 and 5 new unit tests cover the project as the owner of the switch, its undo, the order, pluginsOf against crude input and an unknown file name (#119) ... Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-20 14:24:27 +02:00
adminandClaude Fable 5.1	cc6db5f350	Three stores, three importers and three pickers that differ only in their type are one of each (#85) ... Refactoring round one: HttpFontStore/HttpSoundStore/HttpTextureStore collapse into a generic HttpFileStore over a FileStore contract; fontImport/soundImport/textureImport share assetImport with an ImportKind per sort; ImagePicker/FontPicker/SoundPicker sit on FilePicker and describe only their row. The group/comment drag logic leaves GraphCanvas for annotationDrag.ts (with its own unit test), declaredRows.ts replaces the duplicated row build in particles.ts and shaders.ts, and dead code in font/sound/compile/emission/transform/actions is gone. README: asset list, check count 958, the two-job CI, the Scenes wiki page. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-16 17:38:54 +02:00
DeveloperandClaude Opus 5	99c5d2ad78	Uploads carry the name the file came with (#83) ... An upload sends its file name next to the raw bytes, and the server keeps it in a sidecar next to the content-addressed file. Both pickers caption every tile and row with it, and an asset made there is named after the file instead of "Texture" / "Font". Last upload of the same content wins. The API's own set_error_handler ignores error_reporting(), so @-silenced warnings still throw: a missing sidecar took the whole listing down with a 500. Existence is checked instead of suppressed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-13 20:32:45 +02:00
root	88ec367ab0	Offer the pictures the server already holds when adding a texture ... "+ → Texture" opened the machine's file dialog, so a picture that was uploaded once but lost its asset – an undone import, a deleted asset – was unreachable from the editor while still sitting on the server. Nothing collects those files, by design. It now opens a grid of every picture the server holds, with thumbnails: pick one and "Use image" makes a texture asset on that file, "Upload…" is the way in for bytes the server does not have yet and lands in the same import as a drop. A tile captioned with an asset name is one this project already wears – picking it selects that asset instead of making a second one, since two assets on one file would fight over `filter`. - `GET ?r=textures` now reports `width`/`height`; a texture asset holds the pixel size, and reading it off the GPU texture would tie the asset's correctness to load timing. - `TextureLibrary.load(file)` loads without touching `scaleMode` – a thumbnail must not restage the filter of a picture the scene is drawing with. - The grid geometry lives in `texture/imageGrid.ts` as pure functions; inside the widget no test could reach it. - The part after an upload is now one function shared by the drop import and the picker, so "one file = one asset" is stated in a single place. 12 new E2E checks; the strongest one undoes an import, leaving the file on the server with no asset naming it, and picks exactly that file back out of the dialog.	2026-09-09 15:55:15 +02:00
rootandClaude Opus 5	5a6af74e44	Add textures for sprites ... Images are uploaded to a content-addressed blob endpoint and stored as data/textures/<sha256>.<ext>; the project only keeps the file name. The sprite points at a texture asset through an ordinary property of the new kind `asset`, so instance overrides, "Apply to container", "Reset to asset", undo and `Set property` work without any extra code. The new kind also replaces the ad-hoc asset picker the graph nodes faked as an enum. Import goes through + -> Texture, drag & drop onto the canvas or Ctrl+V. Images wider than 2048px are downscaled client-side and re-encoded to WebP if needed, because nginx caps uploads at 1MB; an image that already fits is uploaded byte for byte so pixel art is never resampled. The sprite colour default changes from red to white, since colour tints the texture multiplicatively and a tint of white shows an image as it is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-09-08 13:43:08 +02:00