drwily/Pete
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

adventure: a click-through page for every adventurer on the board

Browse Source 
Each roster name becomes /adventure/who/{token}. Anyone sees the public sheet —
stats and equipped gear, decoded from the detail_json gogobee now hangs on each
board entry — with a live JSON re-poll so an open tab tracks HP and room as they
move. The signed-in owner sees the same page enriched with their private
inventory, vault, house, and pets, unlocked by an ownership join in the new
player_self_detail table (localpart owns token) — Pete never reverses the
anonymous token to decide it. buyerLocalpart is extracted so the storefront and
the ownership check lowercase the session name the same way.
This commit is contained in:
prosolis
2026-07-14 22:22:52 -07:00
parent 2ac6ec6b91
commit 16711e13e6
13 changed files with 940 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
internal/web/mischief.go
View File

@@ -6,11 +6,22 @@ import (
"io"
"log/slog"
"net/http"
"strings"
"time"
"pete/internal/storage"
)
// buyerLocalpart normalises a session's Authentik username to the Matrix
// localpart gogobee keys everything on. Matrix localparts are lowercase; an
// Authentik display of the same name may not be, and gogobee pushes balances and
// resolves orders under the lowercase form. Lowercasing on both sides is what
// keeps the buyer's balance lookup and their order's identity pointing at the
// same person.
func buyerLocalpart(u *SessionUser) string {
return strings.ToLower(strings.TrimSpace(u.Username))
}
// The mischief storefront's web seam.
//
// Two audiences, two auth models, same file. Browsers hit the OIDC-gated buy
@@ -51,7 +62,8 @@ func (s *Server) handleMischiefOrder(w http.ResponseWriter, r *http.Request) {
// A session minted before the storefront existed carries no username, and
// without one gogobee can't name the buyer to its ledger. Send them back
// through sign-in to mint a fresh one rather than place an unfulfillable order.
if u.Username == "" {
buyer := buyerLocalpart(u)
if buyer == "" {
writeMischiefError(w, http.StatusConflict, "please sign in again")
return
}
@@ -100,13 +112,13 @@ func (s *Server) handleMischiefOrder(w http.ResponseWriter, r *http.Request) {
return
}
order, err := storage.InsertMischiefOrder(u.Sub, u.Username, mark.Token, mark.Name, tier.Key, req.Signed)
order, err := storage.InsertMischiefOrder(u.Sub, buyer, mark.Token, mark.Name, tier.Key, req.Signed)
if err != nil {
slog.Error("mischief: insert order", "err", err)
writeMischiefError(w, http.StatusInternalServerError, "internal error")
return
}
slog.Info("mischief: order placed", "guid", order.GUID, "buyer", u.Username, "tier", tier.Key, "signed", req.Signed)
slog.Info("mischief: order placed", "guid", order.GUID, "buyer", buyer, "tier", tier.Key, "signed", req.Signed)
w.Header().Set("Cache-Control", "no-store")
writeJSON(w, order)
}
@@ -159,8 +171,8 @@ func (s *Server) handleMischiefCatalog(w http.ResponseWriter, r *http.Request) {
tiers = []storage.MischiefTier{}
}
resp := mischiefCatalogResp{Tiers: tiers}
if u.Username != "" {
euro, has, err := storage.UserEuro(u.Username)
if lp := buyerLocalpart(u); lp != "" {
euro, has, err := storage.UserEuro(lp)
if err != nil {
slog.Error("mischief: balance", "err", err)
} else {