Replace Nginx basic auth with proper user accounts:
- Session cookies via itsdangerous (30-day expiry, httponly, secure)
- Password hashing with bcrypt via passlib
- Login page with AC-themed UI
- Admin page for user management (CRUD)
- AuthMiddleware exempts plugin WS and browser WS endpoints
- Issues/comments author auto-populated from session
- Sidebar shows logged-in username, admin link, and logout
- Seed users: erik (admin), alex, lundberg
- SECRET_KEY env var for cookie signing
Root "/" path doesn't match .html ending. Checking the response's
content-type header catches index.html served via html=True and is
more robust for any URL that returns HTML/JS/CSS/JSON.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The StaticFiles path is empty for root "/" which served index.html via
html=True. Include root/directory paths in the no-cache match.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
FastAPI StaticFiles sets Last-Modified/ETag but no Cache-Control, so
browsers use heuristic caching and can serve stale code after git pull.
Subclass StaticFiles to add 'Cache-Control: no-cache, must-revalidate'
on .html/.js/.css/.json files. ETag/Last-Modified still work, so
revalidation returns efficient 304 Not Modified when unchanged.
Other assets (images, fonts, tile textures) are unaffected and cache
normally.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- New PATCH /issues/{id} endpoint to toggle resolved flag
- Add resolved:false to new issues
- Frontend: click "✓ Resolve" marks issue green with strikethrough
- Resolved issues show "↺ Reopen" and "🗑 Delete" buttons
- Delete requires confirmation
- Sort: unresolved first, then resolved
- Issues persist until explicitly deleted
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Was stored at /app/openissues.json (ephemeral container filesystem).
Moved to /app/static/openissues.json which is bind-mounted to the
host at ./static/, persisting across container rebuilds.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Version: CalVer + git hash shown in top-right corner of main page.
Built via Docker ARG BUILD_VERSION at build time. Served via /api-version.
Issues Board: shared notepad window for tracking issues with plugin,
overlord, nav files, macros. Stored in openissues.json on server.
- GET/POST/DELETE /issues endpoints
- Draggable window matching Chat/Radar pattern
- Category tags (plugin, overlord, nav, macro, other) with colors
- Add/resolve issues through the UI
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Backend: dungeon_map event handler with permanent in-memory cache
by landblock ID, request_dungeon_map for late-joining browsers
- Frontend: render dungeon cells as colored rectangles when in dungeon,
multi-level Z support (current floor bright, others dimmed),
automatic overworld/dungeon switching based on is_dungeon flag,
raw physics coordinate positioning for dungeon objects
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Browser can open a radar window per character that streams nearby
monsters, players, NPCs, portals, and other objects in real-time.
On-demand activation via start_radar/stop_radar commands through
the existing WebSocket command channel.
- Backend: nearby_objects event handler with in-memory cache and broadcast
- Frontend: canvas mini-map + entity list table in draggable window
- Radar button added to player list alongside Chat/Stats/Inventory/Char
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
🧝♂️ Fix 1: The Mailman Story
Imagine you're a mailman delivering letters. Before, you had to
knock on every door and wait for someone to answer before you could
go back to your truck and get more letters.
But your truck keeps getting MORE letters dumped in it! And if
you're stuck waiting at grandma's door... your truck overflows
and letters fall everywhere! 📬💥
The fix: Now you have a magic helper elf! You hand the letters to
the elf and say "you go deliver these!" while you run back to the
truck to grab more. The elf handles the doors, you handle the truck.
Nobody waits! 🧝♂️✨🍕 Fix 2: The Pizza Party Story
Now let's talk about that elf. The elf had a problem too!
Imagine you have 5 friends at a pizza party and you're handing out
slices. Before, the elf would:
1. Give pizza to Tommy → wait for him to take a bite 🍕
2. Give pizza to Sally → wait for her to take a bite 🍕
3. Give pizza to Bobby → wait for him to take a bite 🍕
So boring! Everyone's just sitting there hungry!
The fix: Now the elf throws ALL the pizza slices at the same time!
🍕🍕🍕🍕🍕 Everyone gets their pizza at once and nobody has to
wait for Tommy to finish chewing!
Yay! 🎉
Technical details:
- Use asyncio.create_task() to fire-and-forget broadcasts
- Use asyncio.gather() to send to all browsers concurrently
- Plugin receive loop no longer blocks on slow browser clients
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Fix remaining f-string SQL injection in process_inventory (same pattern
as single-item endpoints: parameterized ANY(:ids) queries)
- Add null guard for item_id in backend delta remove handler
- Add response status logging for inventory service HTTP calls
- Fix frontend ID fallback consistency in updateInventoryLive
- Replace debug print() with logger.debug()
- Add comment for Decal Slot_Decal magic number
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the AC stone-themed single-scroll character window with a TreeStats-
style tabbed interface. Two side-by-side tab containers: left (Attributes,
Skills, Titles) and right (Augmentations, Ratings, Other), plus an Allegiance
section below. Exact TreeStats color palette (#000022 bg, #af7a30 gold
borders, purple specialized, teal trained). Backend accepts new properties
and titles fields in character_stats message for JSONB storage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Implement client-side sorting for all columns including spell_names
- Add computed_spell_names CTE for server-side sort fallback
- Add resizable columns with localStorage persistence
- Add Cloak slot detection by name pattern
- Increase items limit to 50000 for full inventory loading
- Increase proxy timeout to 60s for large queries
- Remove pagination (all items loaded at once for sorting)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
