adminandClaude Opus 5.5 cfd6d7a8df
feuerwerk / gate (push) Failing after 5m1s
feuerwerk / suite (push) Canceled after 4m52s
Lock the server down before the editor goes public (#427)
The editor is about to be opened to strangers: a post on Reddit and a
guest access (#428). nginx served the whole workspace and ran every PHP
file in it, the API let anybody guess passwords as fast as they liked,
and one account could fill the disk.

- nginx (shared web stack, outside this repo, backup in
  /root/config-backup-20261015/) hands out only the two pages, dist/,
  public/brand/, the uploads by kind and ending, and api/index.php.
  Everything else under /feuerwerk/ is a 404.
- PHP behind it has display_errors off and no X-Powered-By. Plain HTTP
  forwards to HTTPS, the API refuses it.
- Headers: a Content-Security-Policy without inline code or eval,
  nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP.
- vite.config.ts writes the same policy into the built pages, so CI
  runs the whole suite under it. Pixi gets by without eval through
  pixi.js/unsafe-eval. The page CSS left its inline style for a file.
- The harness fails a module for anything the policy refuses, from
  Chrome's log and from the page's securitypolicyviolation event.
- LoginThrottle: five wrong passwords from one address within 15
  minutes, and it gets 429 until 15 minutes after the last of them.
  The address is the last X-Forwarded-For entry, the Brandmauer's own.
- Quota: 1 GB per account for uploads, projects and snapshots. Only a
  write that grows the account is refused (413). Admins have no limit.
- A write whose Sec-Fetch-Site says another site is refused (403).
- The session cookie carries Secure, nginx passes HTTPS on.
- showFailure puts the message in as text, not as HTML.
- Every PHP script outside api/ stops unless it runs on the command
  line.
- The video worker sees the checkout read-only and can only write
  data/videos. No capabilities, 2 GB and 256 processes at most.
- tests/php/rights.test.php runs the API under php -S on a scratch
  directory and asks every route as signed out, owner, stranger and
  admin. A route named in api/index.php but missing in the matrix
  fails it. limits.test.php covers the brake and the quota.

Findings:

- tmp/ was readable from outside, with 79 copies of project files.
  Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10.
  shows only our own requests.
- Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the
  Brandmauer. Left as it is: the web stack is not this project's.
- npm audit finds nothing in what is shipped. Dev tools (vitest,
  brace-expansion, source-map-js) have advisories, not touched here.

Tests: check 313 files / 4843 tests. PHP limits 21, rights 60,
accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no
ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41
197/198, the one red check (a click in 41) passes with 41 alone,
27/27. 67 misses frames at 1080p on stein2 with and without this.
Path list from outside: 10 served, 26 refused. ZAP baseline against
the live site: nothing High or Medium under /feuerwerk/.
Counter-checks: rights.test.php without the cross-site guard, the
quota, the brake, the admin check of users, or with an undocumented
route fails each time. A policy without wasm-unsafe-eval fails e2e 41
with the harness's own CSP line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-15 23:05:32 +02:00
2026-09-13 10:35:16 +02:00

Feuerwerk

feuerwerk

A browser-based tool "one step before a game engine": create assets (scenes, cameras, sprites), place them into scenes, tweak their properties in an inspector and press Play, all in one program, all drawn inside a single WebGL canvas.

Live: https://nockal.com/feuerwerk/ · Widget playground: https://nockal.com/feuerwerk/?playground

The documentation is the wiki: https://git.nockal.com/meleki/feuerwerk/wiki: every concept, node, tab and shortcut, plus the architecture and the development workflow. This file is the short way in.

In one screen

  • An asset is a named, typed thing (scene, camera, sprite, text, behavior, variables, struct, collider, rigidbody, joint, container, clip area, texture, vector art, pixel art, palette, animation, curve, tile, tilemap, state machine, shader, shader function, font, sound, sound FX, instrument, pattern, song, bus, video, composition, particles) with properties and no position.
  • A scene object places an asset: position, sparse overrides of its properties, an optional parent. Only what differs from the asset is stored; the inspector paints it gold and offers ↺ / ↑.
  • A container is a reusable group edited once and placed many times; its content is resolved from the template on every read. A screen is a container switched on and off.
  • A behavior is logic as a node graph, placed like anything else and parented to the object it acts on. Play has no built-in behaviour: everything that happens is a graph.
  • An account owns projects: the editor asks for a user name and a password first, and each account sees only its own projects. The Account menu at the far right of the toolbar changes the password and signs out.
  • Play runs a throwaway copy of the project; every panel stays usable and Stop brings back exactly what was saved. Release… shares a link that plays the saved game on its own, without the editor and without signing in.

Quick start

Node 22 is required.

npm install
npm run dev          # http://localhost:5175/feuerwerk/dist/; API calls are proxied to production
npm run check        # typecheck + lint + format:check + unit tests; the gate CI runs too
npm run build        # writes dist/ and regenerates index.html; the folder is what nginx serves

The browser suite and the three example games need a machine with a GPU:

node tools/seed-e2e.mjs && node tools/e2e.mjs      # the editor, 2090 checks (GM_STEPS=20 for one step)
                                                   #   every tool signs in first; see the Accounts page
node tools/seed-jumprun.mjs && node tools/smoke-jumprun.mjs
node tools/seed-tetris.mjs && node tools/smoke-tetris.mjs
node tools/seed-actor.mjs && node tools/smoke-actor.mjs

Every push runs all of it on the Gitea runners: the gate as one job, build and suite as another beside it. So locally take the gate plus the step your change touches and leave the full run to CI. Details, the GPU requirement and the detached runner are in Development.

Documentation

Page What it covers
Concepts Assets, scene objects, overrides, play mode, the camera, the console
Accounts Signing in and out, the accounts, who a project belongs to, what the check tools need
Scenes The edited scene, the start scene, and switching scenes from a graph
Scene editing Placing, z-order, hierarchy, the editor offset
Behaviors Node graphs: variables, the node set, structs and lists, loops, nesting, editing
Structs Struct assets: a named shape that struct variables, fields and Pack/Expand follow
Colliders Shapes (box, circle, capsule, polygon), collision events, blocking movement, one-way colliders and raycasts
Physics Rigidbodies, the collider material, gravity, the fixed step, joints
Textures Images, frames, nine-slice, the filter, upload limits
Vector art Pictures drawn from shapes: the pen, curves, gradients and texture fills, combining shapes
Pixel art Pictures painted pixel by pixel: the palette, the tools, layers and frames
Fonts Font assets, the picker, what a text falls back to
Sounds Sound assets and clips, Play sound, buses and the Master routing, sound FX
Instruments Instruments as node graphs, Chips and presets, the keys of the Instrument tab, Play note
Patterns Patterns and the piano roll, playing one in a loop or from a game
Songs Songs, their tracks and items, routing, recording, playing one from a game
Videos Video assets and clips, wearing one on a sprite, recording the game view or the editor
Animations Animation assets and the Animation tab
Curves Easings drawn by hand, the Curve tab, using one on a key or a Lerp
Shaders Shader graphs that sprites, texts, particle fields and cameras wear, their node set, passes, shader functions
Particles Particle graphs: a particle as a function of its age
State machines The asset, named transitions, State branch, Set state and State transition
Containers Templates, instances, screens
Compositions Objects, videos and sounds laid out in time, the Composition tab, playing one in a game
Tiles The tile asset, plain tiles and the two autotile kinds, the pictures as animation steps, the Tile tab
Tilemaps The tilemap asset, painting in the scene view, layers, what it looks like in the game
Plugins Extending the editor: the plugin file, how it is loaded, switching one on and off, API v1
Keyboard Every shortcut
Architecture Stack, source layout, the rules that keep it organised
Development Commands, the e2e suite, the example games, CI
API The PHP JSON API and the project document

Ideas, gaps and bugs

They live in the issue tracker: https://git.nockal.com/meleki/feuerwerk/issues. What is not there yet is listed on the wiki's Home page.

S
Description
Browser game maker: Pixi v8 canvas editor with visual behavior graphs, PHP API
Readme
11 MiB
0 Stars 1 Watchers 0 Forks
Languages
TypeScript 80.5%
JavaScript 17.1%
PHP 2.3%