adminandClaude Opus 5.5 edef2b6323 Serve the editor from feuerwerk.nockal.com as well ...

The subdomain proxies to the same folder, but the build had the path
/feuerwerk/ baked in. On feuerwerk.nockal.com the page loaded its
assets, the API and the data URLs from /feuerwerk/... and got 404. The
session cookie had Path=/feuerwerk/, so the browser would never have
sent it to /api/ there either.

- site.ts takes the base path from the folder of the open page:
  /feuerwerk/ on nockal.com, / on the subdomain. Release links point at
  the address you are working on.
- vite.config.ts builds with a relative base. The copy plugin rewrites
  the pages to ./dist/assets/ and stops the build if it finds nothing
  to rewrite. The dev server now runs at http://localhost:5175/.
- Auth.php sets the cookie without a Path, so it belongs to the API
  folder the browser sees. Sign-in and sign-out also clear the old
  /feuerwerk/ cookie, otherwise it would keep signing in after a
  logout. Existing sessions stay valid.
- README: the new dev server address.

Tests:
- curl on both addresses: pages, JS, CSS and API 200
- sign-in, session, sign-out on both addresses
- e2e 70 against both addresses: 13/13 each, no CSP violation
- tsc, lint, prettier clean, site and releases tests 14/14
- PHP tests 7 of 8 files green, videos.test.php fails only because
  the web-php-fpm container has no ffmpeg

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-16 08:40:18 +02:00

..

AccountRules.php

Add roles and a user management tab for admins (#180, #179)

2026-09-23 13:59:04 +02:00

AtomicFile.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

Auth.php

Serve the editor from feuerwerk.nockal.com as well

2026-10-16 08:40:18 +02:00

DemoFiles.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

FileUsage.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

FontStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

HashedFileStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

LoginThrottle.php

Prune old sign-in failures by their current time (#427)

2026-10-15 23:12:10 +02:00

OriginalName.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

PixelStore.php

Refactoring round 8: hide data files, safe saves, Esc as Cancel (#85)

2026-09-29 18:12:55 +02:00

PluginStore.php

Plugins belong to the project, and they load before it: the project file gained the field plugins: ["demo-plugin.js"] (default empty, no formatVersion bump), the Plugins tab's switch writes into it as an ordinary undo step (SetPluginActiveCommand) instead of into a server-wide plugins.json, and the start order is turned around - startPlugins only fetches the list of files, then editor.boot() runs and ProjectStore.load(id, prepare) hands the raw JSON through before it is deserialized, where pluginsOf(raw) reads the list and PluginManager.syncTo() activates exactly those; that is the point of the issue, because what a plugin registers has to stand there before normalizeGraph would throw it away as unknown (#126, #127), a project switch first stops what the new project does not name and then starts what it does, a file the server does not have is passed over silently, and after signing out the manager is dead so a late event cannot start anything in a torn-down session; on the server plugins.json, PluginStore::setActive, isActive, the route PUT ?r=plugins/{file} and the 403 for inactive modules are gone and GET ?r=plugins only answers {file,bytes,updatedAt}, which makes every plugin file fetchable - the consequence accepted in #117, written down in the wiki for #115 and #116; publishPlugins(root) only copies files now, the seeder switches the demo plugin on in the fixture project, and the Plugins tab carries a puzzle piece as its icon while only a plugin's own tab still goes without one (the knob and the socket are cubic curves, not arcs, which Pixi's parser draws as a spike after an L); 3 new e2e checks in module 38 and 5 new unit tests cover the project as the owner of the switch, its undo, the order, pluginsOf against crude input and an unknown file name (#119)

2026-09-20 14:24:27 +02:00

Quota.php

Lock the server down before the editor goes public (#427)

2026-10-15 23:05:32 +02:00

ReleaseStore.php

Let guests try a demo project without an account (#428)

2026-10-16 06:58:30 +02:00

Response.php

Add textures for sprites

2026-09-08 13:43:08 +02:00

SessionStore.php

Rename Game Maker to Feuerwerk and serve it at /feuerwerk/ (#422)

2026-10-13 13:27:43 +02:00

SnapshotStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

SoundStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

Store.php

Let only the owner delete a project, not an administrator (#272)

2026-09-30 21:13:20 +02:00

TextureStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

UserStore.php

Give each account its own folder of uploaded files to delete (#344)

2026-10-07 08:25:13 +02:00

VideoFormat.php

Give video posters the colours the video shows (#411)

2026-10-13 16:45:20 +02:00

VideoQueue.php

Move repo, CI and the video worker over to the name Feuerwerk (#422)

2026-10-13 13:42:52 +02:00

VideoStore.php

Choose size, rate and what follows when recording the editor

2026-10-12 17:01:55 +02:00

VideoWorker.php

Give video posters the colours the video shows (#411)

2026-10-13 16:45:20 +02:00