adminandClaude Opus 5.5
14972d057f
Recurring cleanup round over the code since round 7 (bc688f3). The
issue now also asks to fix bugs and small inconsistencies found on the
way, so unlike the rounds before, this one changes behaviour in a few
places. Duplicated code in api went from 23 clones with 228 lines to
none (jscpd, at least 50 tokens). In src it stays at 22 clones with
271 lines, the same before and after.
Bugs:
- nginx served project and snapshot files as they were, so anyone who
knew a project id could read it without signing in. Every file the
API writes now goes through AtomicFile (temp file, mode, rename).
Projects, snapshots, releases, accounts and sessions are 0640, and
nginx answers 403 for them.
- Any signed-in account could delete a shared image, font or sound,
which projects of other accounts may wear. Deleting one is now for
administrators only. The editor never deleted a file, so the
client's delete is gone.
- Two saves of one project could run at once. The lock file was
removed after each save, so a waiting save and the next one locked
different files. The lock file now stays, and deleting a project
takes the lock as well.
- Bytes that are no picture got a 500 instead of a 422, because the
error handler also threw for warnings silenced with @.
- A session file was rewritten in place. A request reading it at that
moment found it empty and was signed out. It is replaced atomically.
- Delete did nothing for a shape picked in the vector art list. Delete
now goes through removeSelection, one case per kind of selection,
and a kind without a case fails the type check.
Inconsistencies:
- Escape on a question does what its Cancel does. Cancel on "Delete
project?" and "Restore snapshot?" leads back to the picker or the
list like the other questions did, and so does deleting a project.
- Editor texts use American spelling throughout, like the port names:
48 British spellings in 45 lines (colour, centre, initialised).
- objectName and groupName replace eleven copies of "own name, else
the asset's" and three of "Group". One copy fell back to the object
id instead of "?".
Duplicates, dead code, comments:
- routeFiles serves images, fonts and sounds instead of three copies.
HashedFileStore holds what the three stores shared: keeping a file
under its hash with its name, listing and deleting. The stores keep
only which bytes they take and what a record says.
- AtomicFile replaces nine copies of temp file plus rename.
- removeShapes is the one way the canvas, the inspector button and
Delete take shapes out.
- GraphInterpreter.fire was called by tests only. The 54 calls use a
helper in tests/helpers.ts now.
- FileStore.delete, HttpFileStore.delete and the PluginApi type were
unused. A doc comment in actions.ts sat above the wrong function.
Checked and left as is:
- solidCells is used by tests only. It is the per-cell view before the
merge into rectangles, the one place the largest-scale rule shows.
- An undo checker ran all 124 commands of the unit tests and compared
the project before and after undo. The only differences are empty
ports, groups and notes lists where there were none, which the file
format drops anyway.
Docs:
- README: the check sum.
- Wiki, own commit: API (admin-only deletes, 422, file modes, lock
file), Home (the "Not yet" list named three things that exist),
Concepts, Keyboard, Vector art, Architecture and Development, and
the 38 characters Gitea flagged as ambiguous on eight pages.
- .gitignore: the lock files, and pasted-*.png in any folder, which
keeps the screenshot archive out.
Tests:
- ./check.sh: 195 files, 2817 tests, exit 0 (+2 for the name helpers).
- PHP: accounts 52 in the web container and 53 in the CI image with
the race test (+2), snapshots 15 (+1), releases 20.
- Full e2e run: ALL PASSED, 1586 checks (+6 in 12, 47, 49 and 50).
- Smokes jumprun, tetris, actor: 24, 19 and 21 checks. The example
project files were restored byte for byte afterwards.
- The file stores of HEAD and of this commit give byte-identical
output for the live folders and for store, list and delete in a
throwaway folder.
- Counter-checks, all fail as expected: a 500 for bad bytes fails 12,
no admin check fails 49, removing the lock file again loses saves
in 3 of 3 runs (151 to 170 of 321), Delete ignoring shapes fails 47,
Escape that only closes fails 50, and dropping the shape case fails
the type check (TS2366).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
6.8 KiB
6.8 KiB
Game Maker
A browser-based tool "one step before a game engine": create assets (scenes, cameras, sprites), place them into scenes, tweak their properties in an inspector and press Play – all in one program, all drawn inside a single WebGL canvas.
Live: https://nockal.com/game-maker/ · Widget playground: https://nockal.com/game-maker/?playground
The documentation is the wiki: https://git.nockal.com/meleki/game-maker/wiki – every concept, node, tab and shortcut, plus the architecture and the development workflow. This file is the short way in.
In one screen
- An asset is a named, typed thing (scene, camera, sprite, text, behavior, variables, struct, collider, rigidbody, container, clip area, texture, vector art, pixel art, palette, animation, curve, tile, tilemap, state machine, shader, font, sound, particles) with properties and no position.
- A scene object places an asset: position, sparse overrides of its properties, an optional parent. Only what differs from the asset is stored; the inspector paints it gold and offers ↺ / ↑.
- A container is a reusable group edited once and placed many times; its content is resolved from the template on every read. A screen is a container switched on and off.
- A behavior is logic as a node graph, placed like anything else and parented to the object it acts on. Play has no built-in behaviour – everything that happens is a graph.
- An account owns projects: the editor asks for a user name and a password first, and each account sees only its own projects. The Account menu at the far right of the toolbar changes the password and signs out.
- Play runs a throwaway copy of the project; every panel stays usable and Stop brings back exactly what was saved. Release… shares a link that plays the saved game on its own, without the editor and without signing in.
Quick start
Node 22 is required.
npm install
npm run dev # http://localhost:5175/game-maker/dist/ – API calls are proxied to production
npm run check # typecheck + lint + format:check + unit tests – the gate CI runs too
npm run build # writes dist/ and regenerates index.html; the folder is what nginx serves
The browser suite and the three example games need a machine with a GPU:
node tools/seed-e2e.mjs && node tools/e2e.mjs # the editor, 1586 checks (GM_STEPS=20 for one step)
# every tool signs in first – see the Accounts page
node tools/seed-jumprun.mjs && node tools/smoke-jumprun.mjs
node tools/seed-tetris.mjs && node tools/smoke-tetris.mjs
node tools/seed-actor.mjs && node tools/smoke-actor.mjs
Every push runs all of it on the Gitea runner – the gate as one job, build and suite as another beside it – so locally take the gate plus the step your change touches and leave the full run to CI. Details, the GPU requirement and the detached runner are in Development.
Documentation
| Page | What it covers |
|---|---|
| Concepts | Assets, scene objects, overrides, play mode, the camera, the console |
| Accounts | Signing in and out, the accounts, who a project belongs to, what the check tools need |
| Scenes | The edited scene, the start scene, and switching scenes from a graph |
| Scene editing | Placing, z-order, hierarchy, the editor offset |
| Behaviors | Node graphs: variables, the node set, structs and lists, loops, nesting, editing |
| Structs | Struct assets: a named shape that struct variables, fields and Pack/Expand follow |
| Colliders | Shapes (box, circle, capsule, polygon), collision events, blocking movement, one-way colliders and raycasts |
| Physics | Rigidbodies, the collider material, gravity, the fixed step |
| Textures | Images, frames, nine-slice, the filter, upload limits |
| Vector art | Pictures drawn from shapes: the pen, curves, gradients and texture fills, combining shapes |
| Pixel art | Pictures painted pixel by pixel: the palette, the tools, layers and frames |
| Fonts | Font assets, the picker, what a text falls back to |
| Sounds | Sound assets and Play sound |
| Animations | Animation assets and the Animation tab |
| Curves | Easings drawn by hand, the Curve tab, using one on a key or a Lerp |
| Shaders | Shader graphs a sprite wears, their node set, the properties they declare |
| Particles | Particle graphs: a particle as a function of its age |
| State machines | The asset, named transitions, State branch, Set state and State transition |
| Containers | Templates, instances, screens |
| Tiles | The tile asset, plain tiles and the two autotile kinds, the pictures as animation steps, the Tile tab |
| Tilemaps | The tilemap asset, painting in the scene view, layers, what it looks like in the game |
| Plugins | Extending the editor: the plugin file, how it is loaded, switching one on and off, API v1 |
| Keyboard | Every shortcut |
| Architecture | Stack, source layout, the rules that keep it organised |
| Development | Commands, the e2e suite, the example games, CI |
| API | The PHP JSON API and the project document |
Ideas, gaps and bugs
They live in the issue tracker: https://git.nockal.com/meleki/game-maker/issues. What is not there yet is listed on the wiki's Home page.