drwily/Pete
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: drwily/Pete:mischief-m3
Branches Tags
drwily/Pete:main drwily/Pete:mischief-m3 drwily/Pete:adventure-news drwily/Pete:weather-fx
...
compare: drwily/Pete:5b071996313d3a7e4baa321c3b72b5b0a29eae64
Branches Tags
drwily/Pete:main drwily/Pete:mischief-m3 drwily/Pete:adventure-news drwily/Pete:weather-fx
45 Commits
mischief-m3 ... 5b07199631
Author SHA1 Message Date
prosolis 5b07199631 Merge party-known-flag: retire the party_known write-up, gogobee sets it now 2026-07-24 23:16:30 -07:00
prosolis a14859c5ee adventure: retire the party_known write-up, gogobee sets it now 
The flag was built and tested on this side first and the contract was left
in the tree for the game box to pick up. It has (gogobee 10d1e4a, set
unconditionally on every detail sheet), and a solo leader on a live
expedition has their abandon button back, so the note has nothing left to
ask for.
 2026-07-24 23:04:05 -07:00
prosolis aac6c3e127 adventure: work the five review findings the last pass left open 
The extract pre-check is gone. It read a snapshot up to two minutes behind and
still got the last word, so somebody who set out over Matrix during a lagging
roster push was told they weren't on an expedition for a run gogobee would
happily have ended. Same call abandon and leave already made: let it through and
let rejected_not_running be the answer.

The siege_join check stays, because whether a boss is camped outside town is
town-wide and runs on a day-or-longer clock, but it now reads one column through
SiegeIsCamped instead of loading every defender row and the whole history to
look at one flag.

The war-room history insert is OR REPLACE. boss_id is the primary key and it was
never settled whether gogobee means the siege instance or the boss type by it, so
a duplicate pair used to fail the transaction carrying the live boss and the
muster too and freeze the war room on the last good snapshot. A dropped history
row is the smaller failure; the open question is noted in the schema.

offersToUndo's guard didn't cover the case its comment claimed. A gogobee too old
to push seats sends a valid blob with no party key, which decodes to the same
empty slice as a solo run, and a party member got shown the button that throws
away everyone's day. That needs a new field, so whoDetail gains party_known and
the flag gates the empty-list branch alone; the branch that reads the viewer's
own seat is self-evidencing and keeps working against any sender. gogobee's half
is written up in adventure_party_known_flag.md.

And an empty offer list no longer claims "you're already out there", which Pete
can't actually know from a game box too old to push offers at all.
 2026-07-24 22:45:26 -07:00
prosolis c40ac1e673 adventure: write up the five review findings left for a follow-up 
Same review, the half not fixed in place: the extract pre-check treating a
stale snapshot as the last word, offersToUndo's party guard not covering the
case its comment claims, a duplicated boss_id failing the whole war-room
replace, an "already out there" that Pete can't actually know, and the
siege_join check loading the entire siege to read one flag.

Each one has the direction already decided and the edits and tests spelled
out, so the follow-up session doesn't have to re-derive any of it. Delete the
file when they're done.
 2026-07-24 22:36:42 -07:00
prosolis 556b9440b8 adventure: don't strand an order on a database blip, don't misroute a tap 
Two things a code review turned up in the W9 seams.

The verdict handler answered 400 for everything ResolveAdvOrder could fail
with, not just a bad verdict. gogobee's contract says a 400 means "park this
row for a human", so a SQLite busy or a disk hiccup permanently stranded an
extract or a bout that was perfectly resolvable. Split the two apart with
ErrBadAdvVerdict: a verdict outside the terminal set is still 400, because
gogobee will never send it successfully, and a genuine storage failure is now
500 and comes back on the next poll.

The push URL builders concatenated the guid and the run id raw, while every
other builder beside them path-escapes because these values arrive over a wire.
A guid carrying a slash sent the notification tap to a different page.
 2026-07-24 22:36:35 -07:00
prosolis b07abc1d13 adventure: let a player back out from the web, not only in Matrix 
Three verbs to match gogobee's: call off an expedition, turn back out of
somebody else's party, send the pet sitter home. Which one this page
offers is derived here rather than pushed — leadership is already legible
in the party seats and the sitter's standing is already in the babysit
offer, so nothing new crosses the wire.

Two things running it turned up that no test would have. An applied
abandon left "Pull out of the run" sitting under a verdict saying the
expedition was over, so an applied verb now also hides the other verbs it
just made untrue. And a party member was being offered that same button
in the first place, beside the one that actually works — Pete knows from
the seat it just read that gogobee would refuse it, so it is withheld.

Also: heal the Matrix handle onto push rows stored before the column
existed, on its own endpoint rather than through the subscribe upsert,
which resets both watermarks and would have silenced the digest for
anybody who reads the site regularly. And stack the board row below sm —
four flex columns that wrapped to six lines on a phone, pre-existing.
 2026-07-24 21:42:59 -07:00
prosolis 0d8dba90df web: make a purged CSS class fail the build instead of the page 
tailwind.config.js has input.css in its own content glob, so a hand-written
component class survives the purge only if its literal name can be extracted
from that file. A rule written solely as `.foo::before` cannot be, and Tailwind
drops it silently: no error, just an unstyled element on one page.

That has cost three phases. The mitigation everybody reached for — grep
output.css after `make css` — is the discipline that failed, and it is worse
than it looks, because Tailwind escapes class names in its output and a raw-name
grep reports a false negative that looks exactly like a purge failure.

So parse the `@layer components` blocks for declared class names and assert each
one reaches output.css as a selector, comparing escaped forms. No list to
maintain: the list is input.css. 220 classes covered today. Two self-tests pin
that the check catches a pseudo-only class and is not fooled by escaping.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 20:35:55 -07:00
prosolis c2a40dad64 adventure: show the party, the pets, and what you missed 
Four small surfaces the game has had all along and the web has never shown.

The party roster on the adventurer page is the one with a bug behind it. The
board resolved an expedition by owner id, so a player seated on somebody else's
run has been reading as "idle in town" while standing in a tier-4 dungeon.
Seats now ride the roster detail beside the supply and threat numbers, and an
opted-out player's seat is anonymised rather than dropped: a party of three
rendered as a pair contradicts everything printed next to it.

Pets show their levelling. They have earned XP from every won fight since that
wiring was fixed and the only place a level ever appeared was a Matrix line
that scrolled away. The threshold comes from the engine, in the engine's own
centi-XP, because a copy of the curve here would drift the first time a band
moved.

"While you were away" is the one panel on the site about the reader rather than
the realm. Two stamps behind it, not one: a single column would show the news,
move the clock, and render an empty box over the same events on the reader's
first refresh.

And the story permalink names its region, which has been hardcoded empty behind
a `// reserved` comment since the page shipped.
 2026-07-24 20:26:19 -07:00
prosolis 868a29e992 adventure: let a player leave town from the web, not only read about it 
W5a gave the web two verbs that cost nothing. These are the three that take
arguments and spend coins: set out for a zone with a supply loadout, walk back
into the run you extracted from, hire the pet sitter for a week or a month.
Between them they cover the most common thing anybody does in the game, which
until now could only be typed into Matrix.

Arguments are the new surface, so they are the thing to be careful with. Nothing
in a request is trusted: every zone, loadout and duration is looked up in the
offer list gogobee pushed onto that owner's own private row, and the order stores
what was found there rather than what was sent. A forged zone resolves to nothing
and never becomes an order. gogobee then re-resolves all of it anyway, because an
offer is a quote and a quote is not a permission.

The money confirm is the equip panel's, lifted: cost, balance, and the balance it
leaves. When it does not cover, it says so instead of printing a negative.

Verified in a browser rather than only in tests, which is where both real defects
came from: the confirm box was appending to the whole panel and so appeared at
the bottom of the section instead of under the button that raised it, and button
prices printed as EUR45000 above a dialog reading EUR45,000.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 19:47:26 -07:00
prosolis 6b0aae9f4a adventure: let a player act from the web, not just read about it 
The equip queue proved the reverse pipe works. This gives it verbs that
play the game: pull out of a run from the adventurer page, take today's
bout from the war room.

Its own table and its own poll, not more actions on equip_orders. Every
column of that table is equip vocabulary (item, slot, tier) and these
verbs act on the character rather than on something it is carrying.

Nothing in a request names an adventurer. The session maps to one
localpart and a localpart to one adventurer, so Pete resolves the
character itself and there is no id on the wire to forge.

The panel's copy is kept honest by the verdict: an applied action hides
the offer it has just spent, a refusal puts the button back. Watching it
run is what put that there, along with the strip's layout — gogobee
answers a bout with a whole sentence of damage, which the equip strip's
two-column row squeezed into a column and wrapped the verb.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 18:55:42 -07:00
prosolis b19ab5eff0 adventure: tell a player what happened while they were away 
The site could only reach somebody who was already looking at it. Push
existed and adventure used none of it, so the one communal event in the
game -- the Siege -- was invisible to anyone not sitting in Matrix, and a
player whose adventurer died found out whenever they next opened a tab.

Four opt-in categories, every one of them off until asked for: the Siege
(realm-wide, begins and ends), your expedition ending, your adventurer
wandering off, and a contract landing on you. Turning on news
notifications is not consent to be told about the game, so nothing here
enrolls anybody automatically.

No new wire. Every trigger is a dispatch already landing in
adventure_events, so this is Pete-side only and gogobee is untouched.

Two things it needed from storage. push_subscriptions now keeps the
Matrix localpart alongside the OIDC subject, because every ownership
join in the schema is keyed on the localpart and the sender runs on a
ticker with no session to read one from -- without it there is no way to
answer "whose adventurer is this". And the alerts carry their own
watermark, kept apart from the digest's: the two run on different clocks
and one column would let each consume the other's backlog.

The ownership join is re-read on every pass rather than trusted from the
subscription row, so an opt-out or a removal closes the channel at once.
It fails closed in both directions, and an unresolved owner can never
fall through to a broadcast -- a game alert naming somebody's adventurer,
delivered to the wrong phone, is a privacy leak dressed as a feature.

An existing subscription carries watermark 0, which read literally means
"has never been told anything" and would page every subscriber for the
whole history of the realm on the first tick after deploy. Those rows are
stamped to now and start from the next dispatch.

Verified against a running Pete with a real push service, real P-256
client keys and real encryption: the right person is notified, the wrong
one is not, a second pass is silent, and dropping the player from the
board takes the channel with it.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 18:22:34 -07:00
prosolis 1dfd3ac9fb adventure: give the realm a map, a board and a history 
Everything Pete published so far was either the present moment (the roster,
the Siege bar) or one thing that happened (a dispatch, a run report). None of
it said what this place IS — how many zones there are, which are harder, or
whether anybody has ever actually beaten them.

Three pages off one snapshot, because they are one question and every number
on all three comes off the same scan of the same run history upstream:

  /adventure/realm      the world, in difficulty order, with who is inside it
  /adventure/standings  the board, plus Pete's own duel record
  /adventure/firsts     the hall of firsts, as a dated history

The map is deliberately not who_map.go's layout engine. That lays out a graph,
and the realm has no edges — zones aren't connected, you pick one and go.
Forcing a graph onto a set would imply a topology the game doesn't have. What
it has is an order, so tier bands are what get drawn.

A zone nobody has ever cleared looks different rather than saying so in small
text, and that styling keys off the clear count, never off whether a name is
attached — otherwise an opt-out would silently redraw a conquered place as one
nobody has come out of.

The per-kind first dot goes through a custom property instead of a
.firsts-entry-zone::before rule: input.css is in Tailwind's content glob, so a
hand-written class survives the purge only if its literal name can be lifted
out of the file, and a name glued to ::before cannot. It failed silently.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 17:54:49 -07:00
prosolis b4a276da36 adventure: give a finished run a report worth sharing 
The liveblog answers "what is happening" — it is capped, it scrolls, and six
hours after a run ends it is gone, because the adventurer page is about now.
Nothing answered the question asked afterwards, usually by somebody who wasn't
watching: what WAS that run. So a dispatch announcing a clear or a death was a
paragraph about an outcome with no way back to what produced it.

The report is that way back. The whole log uncapped, the numbers rolled up, and
the single worst hit the party took pulled out of the middle where it otherwise
reads as one line among forty. It is stable for a fortnight, which is what makes
it a thing worth linking from a dispatch and worth sending to somebody.

It is assembled from the same beats through the same renderer as the liveblog.
A report that told a different story from the log it was built out of would be
the more convincing of the two and the less true.

The summary is the exception and the only prose on the channel: gogobee's model
reads the finished run back and says what it was about, which is a judgement no
template makes. It rides a summary beat rather than its own endpoint, so it
inherits the whole channel — idempotent, retried, impossible to attach to a run
that doesn't exist — and it passes the same class of guard a dispatch lede does
before it reaches a public page.

Visibility is the adventurer page's rule exactly, and that matters more here
than anywhere: the report outlives the log by a fortnight and is linked from a
public dispatch, so it is the surface most likely to still be reachable after
somebody opts out. Coming off the board closes it, including through links
minted days earlier.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 17:11:04 -07:00
prosolis 8c3f2b0d07 adventure: tell the story of a run, not just how it ended 
Pete only ever heard that an expedition happened once it was over — a zone
cleared, a retreat, a death. The run itself was narrated into one Matrix DM
and thrown away. The map on the adventurer page has always shown where
somebody is; this shows what happened there.

Beats arrive on their own channel, append-only and idempotent on
(run_id, seq). They are the one thing gogobee pushes that is history rather
than state, so they accumulate instead of replacing — and they stay off the
dispatch queue so a chatty run can never spend the retry budget a death
dispatch depends on.

The run header is derived from the beats rather than pushed: a run whose
start beat never arrived still gets a readable, unattributed log instead of
being dropped for want of a name.

An unknown beat kind renders as its own noun rather than 400ing. That is the
same lesson the dispatch ingest learned the hard way, and the regression test
covers the class, not the case.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 16:33:48 -07:00
prosolis 7051e8ffff adventure: give every dispatch a card that looks like what it is 
Every dispatch rendered the same image: one violet gradient, a swapped
emoji, a label. A death, a first-ever clear and a legendary hoard were
visually identical — and this image is not decoration. It is the
og:image on every link Pete puts in Matrix and the thumbnail on every
feed card. The most interesting thing that has ever happened in the
realm looked exactly like the most routine.

The card is now keyed on the dispatch GUID instead of the event type,
so the renderer can read the fact behind it and put the actual nouns on
it — the boss's name, the zone, the item, the level. Each family gets
its own palette, and treasure is tinted by the rarity gogobee already
computes and currently spends on an adjective in a sentence.

A realm-first gets visible ceremony. The priority/bulletin split is
already computed upstream and until now it only decided whether Matrix
got pinged; a thing nobody has ever done should also look different
from the ninth time somebody did it. It earns a ribbon on the card and
a badge and a heavier ring in the feed.

Siege cards carry the HP bar, which is the W1 deferral landing. The
siege fact has the boss and the defender count but never the HP, so the
bar comes from the war-room snapshot: the live row while that boss is
still camped, the history once it has closed. When neither has it yet —
the real two-minute window between a win being filed and the push that
explains it — the card renders barless rather than wrong, and caches
for five minutes instead of a day so the unfurl isn't pinned that way.

Nothing needs backfilling. A story with a type-keyed image_url still
serves, and a dispatch with no stored fact degrades to the old emblem.

Two things learned by looking at the rendered output rather than at the
tests, both of which unit tests would never have caught: the feed
thumbnail is a 16/10 crop of a 1200x630 card and was eating the chip
("EGENDARY"), hence advSafeX; and an empty bar under a victory headline
reads at a glance as a wipe, hence the event-aware caption.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 15:47:44 -07:00
prosolis 23563b6a6a adventure: give the Siege a war room instead of a Matrix-only rumour 
The Siege is the one mechanic where the whole town works on a single
object, and it existed exclusively in Matrix — so anybody not in the room
at the time never knew it happened. A communal event nobody can see is a
communal event that fails.

gogobee now pushes the war room on the roster tick and Pete replaces its
copy, the same snapshot contract the board has and for the same reason:
the shared pool is state, not history, and a retried snapshot would be a
lie about how much HP is left.

/adventure/siege draws it. The load-bearing detail is one CSS line — the
health bar has a width transition, so a poll that lands a lower pool
slides the bar down instead of snapping it. That is the difference
between watching the town chip a boss down and reading a report about it.
Alongside: a countdown to the window's close, past sieges with the bar
each one ended on, and the muster split into who took today's bout and
who still has one going spare — the mechanic is one fight per person per
day, so that second column is a hit the town hasn't taken yet.

The opt-out rule here deliberately differs from the board's. The board
omits an opted-out player outright, because class + level + zone
re-identifies them. A Siege contributor is anonymised instead: their
damage is part of what the town did to the boss, and deleting it would
understate the shared effort and stop the totals adding up. They keep
their rank, lose their name, and carry no token — so there is no link
back to a page that names them. An opted-out player who never fought is
still omitted; there is nothing to account for.

siege_start / siege_win / siege_loss are wired on the gogobee side; the
templates for all three have been sitting unused in renderAdventure
since the section shipped.
 2026-07-24 15:21:14 -07:00
prosolis 91d25e9da1 adventure: stop dropping dispatches Pete has no words for 
An event_type with no template was a 400 at ingest. That reads like caution
and behaves like deletion: gogobee retries a 400 to its cap and then parks the
row forever, so rejecting a type Pete hadn't learned to phrase didn't defer the
event, it destroyed it.

companion_hire went that way. It has been emitted from `!expedition hire` since
the combat-engine work landed and has never once reached the site — the game
logged a successful emit every time, and the queue row simply never sent. The
mitigation on the books was "always deploy Pete first", which is a thing a
person has to remember rather than a property of the system.

So invert it. An unknown type now warns, gets counted, and publishes on a
neutral fallback. 400 is kept for facts that are actually invalid: no guid, or
a name that failed the fact-guard. gogobee can ship a new event type any day of
the week now; the worst case is a thin card until Pete learns the words.

It is thinner than it sounds in practice. gogobee authors dispatch prose from
the fact's fields with no per-type switch, so an unrecognised type still
arrives with a real headline and lede and is allowed to use them. The fallback
only shows through when the model is off or the prose-guard refused the output.

Untemplated types never post live to Matrix, whatever tier they claim. A thin
card among cards is cheap and reversible; pinging everyone in the room with a
dispatch Pete couldn't phrase is neither. The daily digest still carries it,
one line among many, which is the right volume for something we don't
understand yet.

And give companion_hire its template. Pete is the one being hired, so it is
first-person like his duels — third-person Pete filling in as a cleric reads as
somebody else reporting on him.

The admin status page grows a "dispatches with no template" panel, so the next
one of these is a to-do list Pete can see rather than an archaeology dig.

Claude-Session: https://claude.ai/code/session_012bxpQQJDjC1mTtLN3VVtBQ
 2026-07-24 14:46:02 -07:00
prosolis 8aa3e762ca solitaire: let cards be dragged, not only tapped 
Tapping stays exactly as it was. A press that travels more than a few
pixels becomes a drag instead, and both paths go through the same pick()
and accepts(), so what lights up and what a move means never depends on
how you did it. The run follows the pointer as a copy while the real
cards stay on the felt, faded, and letting go over nothing keeps the run
in your hand with the targets still lit.

Capture happens when the press becomes a drag, not on pointerdown:
capturing early retargets the click that a tap ends with, and tapping
quietly stops working.
 2026-07-18 09:03:08 -07:00
prosolis 19255d933a solitaire: fly the cards home instead of blinking them there 
A foundation only ever draws its top card, so the FLIP diff had nothing to
animate for the fifty-one cards buried underneath: an auto-finish was every
card vanishing at once, four kings stranded in the tableau row, and the
foundation flashes firing on empty slots.

Cards bound for a foundation now fly as ghosts, lifted out of the old DOM
into a fixed layer so the board underneath can re-render in one go while
they are still in the air. The card that lands is held invisible until its
ghost arrives, so the destination doesn't show the ending first.

The home counter was jumping straight to 52/52 over a board with fifty-one
cards still travelling. It walks up behind them now, on the same step ladder
as the ghosts, the flashes and the sound.
 2026-07-17 23:41:26 -07:00
prosolis 2593b11112 adventure: fix owner gear regression and drop em-dashes from equip copy 
Show the public Gear panel whenever the owner's Equipment panel won't
render (no pushed Slots), so an owner whose detail predates ask 7 still
sees their standard gear instead of a blank. Replace em-dashes in the
equip feature's user-facing strings with plain commas.
 2026-07-17 20:48:02 -07:00
prosolis b0aeffd218 adventure: ask 7 — full equipment management from the web 
Extends equip-from-the-web (ask 5, magic-only) to all five standard gear
slots. Owners get an Equipment panel on their own who page with:
  - Take off for worn masterwork/arena pieces (round-trippable to pack)
  - Upgrade to the next shop tier (spends euros, confirm-gated)
  - Repair a damaged slot (spends euros, confirm-gated)
The public Gear panel is hidden for the owner since this supersedes it.

Wire: equip_orders gains a tier column; new actions upgrade/repair; new
verdicts rejected_downgrade / rejected_insufficient_funds / rejected_max_tier.
PlayerDetail carries Slots (EquipSlotView x5) + Balance for the confirm
dialogs. handleEquipOrder resolves take-off/upgrade/repair from pd.Slots
server-side and rejects a client-forged tier (409), same as ask 5 trusts
only Pete's own record.

Verified: full suite green, headless render of the panel + confirm dialog
in both day and night phases. gogobee ships the poll-apply half separately;
Pete deploys first so its ingest accepts the new verdicts before gogobee
emits them.
 2026-07-17 20:34:24 -07:00
prosolis 1159e64505 auth: clear session cookie under both host-only and parent-domain scope 
Logout emitted a single Set-Cookie scoped to the configured cookie domain
(parodia.dev). A browser holding the session under the older host-only scope
(news.parodia.dev, from before the cookie domain widened for the games site)
was never cleared, so logout looked like a no-op and stranded the user on a
stale session logout couldn't reach. Clear both scopes.

Also surface the who-page owner unlock's previously-silent misses: a genuine
lookup/decode error, and a signed-in session that carries no username. Both
used to fail with err discarded and no log, making a stuck owner undiagnosable.
 2026-07-17 18:57:01 -07:00
prosolis 9d9cfd9f9a adventure: fix three review findings on the who page 
- timelineLine named the viewer as their own rival on a lost duel: a
  rival_result arrives on the loser's page via the opponent column, so
  naming the opponent field pointed at themselves. Thread the page
  character's name through and name the other party.
- buildMapView drew a frontier room twice when two visited rooms both
  had a door to it (Nodes carried the id twice). Place each id once.
- proseGuard's board query ran before the IsGUIDSeen dedup, so a retried
  dispatch paid for it and threw it away. Check dedup first.
 2026-07-17 10:31:15 -07:00
prosolis 8a5fea78ba adventure: mark ask 6 shipped, record the one-ring correction 2026-07-17 10:05:04 -07:00
prosolis 6c6de56539 adventure: show whether a backpack item is an upgrade over what's worn 
On the owner's own page, each wearable backpack item now carries a compare
card: a verdict chip (upgrade / downgrade / sidegrade / new / inert / same),
the per-stat deltas, and the name of the worn item it's measured against.
gogobee computes all of it — the power math needs tempering and bond state,
which live in the engine — so Pete only colours the result and does no
arithmetic. It rides the owner-private inventory, so it never reaches the
public page; the item names are game-authored, so unlike the LLM dispatch
prose there's no injection surface.

The verdict chip is always visible (a phone has no hover to lean on) with
the deltas beside it. Chip colours mix a fixed hue into --ink for text and
--card for fill, so they land on the readable side of the card in all four
phases — the same by-construction contrast trick the dungeon map uses, not
a Tailwind dark: variant. Screenshot-verified day and night, all six
verdict states, including the purple 'new' chip that the theme-contrast
history warned about. output.css rebuilt and committed.
 2026-07-17 10:04:38 -07:00
prosolis 3230939c51 adventure: scope ask 6 (item upgrade comparison), verified both sides 2026-07-17 09:42:18 -07:00
prosolis 4f4bd9fbc1 adventure: mark spec 2 shipped, record the voice-doc/network resolution 2026-07-17 09:28:43 -07:00
prosolis eeeac08db7 adventure: publish gogobee's LLM prose, guarded, template as the net 
gogobee's LLM now authors a dispatch's headline and lede; Pete prefers them
over its template render when both are present and pass a prose-level guard,
and falls back to the template otherwise. factGuard only ever checked the
structured Subject/Opponent fields, which was the whole safety story while a
Pete template was the renderer — a template prints nothing Pete did not
interpolate. LLM prose breaks that: the guard would be validating fields that
are no longer what's rendered. proseGuard checks the rendered text itself,
rejecting a known adventurer named outside the fact's Actors (a live way to
put words in a real player's mouth) and anything past the length caps. The
templates stop being the renderer and become the safety net; they are not
deleted.
 2026-07-17 09:27:53 -07:00
prosolis 6219224ea9 adventure: count the treasures an adventurer has actually found 
A treasure_found fact turns loot into a trophy: a story-grade find lands on the
who page as a stat tile, a named row in a Treasures found showcase, and a trail
entry linking back to the dispatch. A realm-first hoard rides the priority tier
the way zone_first does, and gets the same star and callout.

The item name travels in the fact's stakes field, which the events log now keeps
(a new nullable column, backfilled to NULL for older rows). Counting is only ever
from the fact, never the vault snapshot, so a bought sword is never a trophy and a
history that predates the fact is a clean zero.

This is a new event_type, so Pete's ingest must be deployed before gogobee emits
one, or the first finds park forever on the retry ladder.
 2026-07-17 09:02:19 -07:00
prosolis 1589c36e96 adventure: let an owner equip and unequip from their own page 
The one adventure ask that carries intent back to the game box, built the
mischief way: no new network route, Pete records the equip/unequip and gogobee
polls it and files a verdict. The who page grows Equip / Take off buttons on the
owner's own worn and backpack panels, and a pending-changes strip that shows
'queued' until the verdict lands, never claiming a change it can't see.

The item handle is the inventory row id, sent only on wearable magic items, so a
non-zero id is also what gates the button. gogobee resolves the owner by
localpart, never a name.
 2026-07-17 08:44:28 -07:00
prosolis e90deda498 adventure: draw the dungeon as a fog-of-war map, not a room tally 2026-07-17 08:18:17 -07:00
prosolis dcd68ebdcd adventure: write down the text-colour lead before it evaporates 
Found while fixing the night-phase contrast, not fixed there. The evidence
points two ways — no such rule in the built CSS and a phase-ignoring computed
colour, but a screenshot showing that same text rendering correctly — and the
contradiction is the first thing to resolve, because it decides whether there
is a bug here at all. Recorded as a lead rather than dressed up as a finding.

Also records how the live-page measurement misleads, since every one of those
traps cost time and would cost it again.
 2026-07-17 07:43:38 -07:00
prosolis 7d2d9910cf web: make the night phase's text colours survive a dark card 
The adventure purple was unreadable on night, and measuring the family showed
it was not alone: every one of the eleven .text-theme-* colours lands between
1.08:1 (eu, effectively invisible) and 3.12:1 (finance) on night's #2d365a.
They were all picked against a light card and never checked against a dark
one. Same hue, lifted lightness, saturation floored so the dull ones stay a
colour instead of going grey — all now >=5.5:1.

Night only. Dusk and dawn are lit cards despite their names, so they keep
today's values exactly and the light phases are pixel-identical. Lego can't
stay pillar-box red and be legible on navy; a red light enough to pass reads
as salmon, which is the honest trade against a red nobody can see.

Also adds --warn as a phase variable for the new "inert" chip, for the same
reason --ink is one. Tailwind's dark: variant cannot do this job: darkMode is
unconfigured, so dark: follows the OS's prefers-color-scheme, which knows
nothing about which phase Pete is showing. That mismatch left the chip at
2.34:1 on a dark phase under a light OS, and 1.55:1 on a light phase under a
dark OS — half the combinations unreadable, decided by a setting outside the
page. Now 4.52-7.04 across all four phases, OS irrelevant.

Still open, and NOT fixed here: text-[color:var(--ink)]/NN appears not to
compile — there is no such rule in output.css, and the item description
computes to a fixed rgb(74,46,42) that ignores the phase entirely. If that
holds it is a pre-existing site-wide no-op, not confined to these panels.
Recorded rather than guessed at.
 2026-07-17 07:28:05 -07:00
prosolis 1425033047 adventure: correct the spec where building it proved it wrong 
Three claims in §4 were wrong, and each was only visible by reading both
repos together: equipped and inventory are disjoint sets (so the spec'd
attuned field was undefined, and the worn set it never asked for was the
actual gap); effects are modeled after all, by the engine's own summary
function; skill_source is dual-use and needs filtering, not forwarding.

Keeping the wrong text with the corrections above it — the pattern is worth
more than the fix. The spec was written a side at a time, so §§1-3 and 5
should be assumed to have the same class of error until checked.
 2026-07-17 06:45:51 -07:00
prosolis 4ce025a82c adventure: show the item, not just its name and price 
Renders what gogobee now sends: descriptions, the engine's own effect
summary, slot and skill tags, and a Worn panel with the bond count. One row
template for all three panels — worn, backpack, vault show the same facts and
only the frame differs.

The one distinction worth the wrapper struct: "inert" is a real problem state
— the item is on you doing nothing because all three bonds are spoken for.
The same item in a backpack isn't inert, it's just not worn yet. Rendering
both the same would invent a problem the player doesn't have, on the exact
panel they'd go to to fix it. An ItemView can't tell you which panel it's in,
so itemRow carries it, and TestWhoInertOnlyWhenWorn pins it.

Effect arrives resolved and Pete renders it as given. If it ever disagrees
with what an item does in a fight, that's a gogobee bug — deriving it here
from tier and slot would just be a second opinion that drifts.

No migration: detail rides as a JSON blob.
 2026-07-17 06:45:06 -07:00
prosolis cd84f64a22 adventure: write the handoff down where the next session will find it 
The spec says what the wire should look like. This says where the work
actually stands, which is the part that rots silently: two unpushed
commits, nothing deployed, and a trophy case that can only count
forward from a deploy that hasn't happened.

Also records the decisions already settled (room graph over
coordinates, server-side fog cut, mischief shape for equip, no faking
treasures from vault contents) so they don't get relitigated, and the
landmines that cost money to learn the first time.
 2026-07-17 06:29:33 -07:00
prosolis 5fac1630f6 adventure: pin the gogobee contract before Pete assumes it 
The five blocked asks all cross the gogobee seam, so spec the wire
before writing code against an imagined shape. Mapping both sides
first changed three answers:

- treasure_found is a gogobee feature, not a contract gap. No loot
  fact exists. But the story-grade filter already does, in the tier-5
  RoomAnnounce path.
- The room graph already exists, typed nodes and locked edges and all.
  pete_roster.go flattens it to "4 / 9" at the last moment, using a
  legacy index that isn't even persisted anymore.
- Item stat modifiers aren't modeled anywhere, so they can't be sent.
  Slot, SkillSource, Desc and Attunement can, today.

Deploy order is a data-loss rule, not a preference: an unknown
event_type 400s, gogobee retries to maxAttempts and parks the bulletin
forever. Pete's handler ships first or the first treasures are gone.

equip_orders copies mischief, not escrow. Mischief has no claimed
state because the poll loop is its own retry and the guid makes a
replay a no-op; an equip is a desired end state, not a delta, so it
converges the same way. Escrow needs claimed because money moves and
someone's watching a spinner. Neither is true here.
 2026-07-17 00:48:07 -07:00
prosolis cbe9e67b3e adventure: keep the facts, not just the sentence we made of them 
gogobee already sends boss/opponent/zone/outcome/level on every dispatch.
renderAdventure melted them into prose and only the prose was persisted, so
"how many bosses has she downed" was answerable only by parsing English back
out of a headline.

adventure_events keeps the fact as fact. It's the one adventure table that's a
log rather than a snapshot: the roster answers where Josie is now and is
replaced every tick; this answers what she has ever done, which no snapshot
can. INSERT OR IGNORE on the guid because gogobee retries a fact whose ack it
lost, and this is the only adventure store where a duplicate is permanently
wrong — the roster forgives one by replacing itself, a double-counted kill is
in the tally forever.

On top of it the who page grows two public sections, counted from dispatches
that were already public: the record (tallies, per-boss and per-zone, realm
firsts, milestones) and the trail (the last 40 facts, each linking to the
dispatch that told it). One read feeds both — the pool is MaxOpenConns(1), so
six COUNT queries would serialize for an answer that fits in memory.

Only the trail is capped. A limit on the read would truncate a *tally* rather
than a list, and a veteran's kill count frozen at 40 reads as a fact instead of
a missing page. Only the subject of a fact earns a trophy: a duel you lost
still names you, and it belongs on your trail but not in your record.

Trophies count forward only. Every adventurer's past is prose in the feed and
can't be counted back out, so they show no record until they next do something
— a clean absence rather than a wall of zeroes.

No treasures: there's no loot fact on the wire, and inventory is current-state
with no history, so counting the vault would score a bought sword as a trophy.
Needs a fact type upstream.
 2026-07-16 23:57:23 -07:00
prosolis b814f936a8 solitaire: detect a won board and finish it in one press 
A drained, all-face-up board is a guaranteed clear that auto() sweeps home
in a single cascade, but the only way to trigger it was double-clicking
thirty cards home by hand. Add State.Won(), surface it in the view, and
swap the ordinary controls for one pulsing finish button when it's true.
 2026-07-15 18:50:43 -07:00
prosolis 8504c4f47a games: burial send-offs, money rain on wins, and honest stack targeting 
Three front-end changes to the casino games:

- uno: a draw-card stack now names the seat it's actually pointed at
  ("+N on Beep") instead of always reading "+N on you". The bill reads
  v.turn, which the engine advances to the target when a draw card lands.

- uno: the No Mercy rule buries a seat with some ceremony now. bury()
  rolls one of four send-offs over the seat (or your hand, if it's you) —
  a rockslide that piles up, a tombstone, a coffin, or the Mega Man death
  burst — each with its own synth sound, and a static headstone under
  reduced motion. The "Buried on N" badge still rides alongside.

- all games: winning makes it rain. FX.moneyRain drops a curtain of bills
  and coins with a jackpot coin-cascade sound, gated by significance so it
  reads as a win and not as noise: hold'em keeps its light per-pot confetti
  and only rains on a real haul (>= 20bb), while the confetti stays the
  rare cherry (natural 21, full board clear, phrase solved outright).
 2026-07-15 18:37:19 -07:00
prosolis e0d90ff7cc pwa: serve static assets network-first so redeploys stop serving stale JS/CSS 
Asset URLs are not content-hashed, so the cache-first strategy pinned
whatever bytes were first cached and never noticed a redeployed file
changed — leaving stale weather-gl.js/output.css in place until a manual
CACHE_VERSION bump. Only a hard reload (which bypasses the SW) showed the
new assets. Switch /static/ to network-first (fall back to cache offline)
and bump CACHE_VERSION v4->v5 to flush the stale shell.
 2026-07-15 17:45:53 -07:00
prosolis 790a118273 games: widen foley pitch variance so takes are actually distinct 
vary was a per-step multiplier of ~0.05, capping the swing at a barely
audible +/-0.10. Redefine vary as the max deviation itself (chips +/-0.22,
cards +/-0.20) and spread it over seven pitch steps; give the single-take
shuffle a wobble too.
 2026-07-14 23:51:21 -07:00
prosolis 8df2212aad games: drop chipLay3, it clashed with the other two chip takes 2026-07-14 23:48:58 -07:00
prosolis 1ca794ea1a games: rotate through foley takes on every play, not just by v 
Take-selection was keyed only on the caller's v, but callers pass small
constants (chip is always v:0), so only the first take of each sound ever
played. Add a per-name cursor that advances every call: consecutive plays
now walk the takes, v just offsets simultaneous sounds and drives pitch.
 2026-07-14 23:44:24 -07:00
prosolis 30b0e8debb games: real recorded foley for cards and chips, synth for the rest 
The card and chip sounds never convinced as oscillators, so they're now
CC0 recordings (Kenney's casino pack) under /static/audio/casino, embedded
in the binary. Six names (card, deal, flip, shuffle, chip, sweep) play
several rotating takes with a little pitch jitter; everything melodic stays
synthesised. PeteSFX's API is unchanged and synthesis is the fallback while
an ogg is still decoding, so no caller changed and the table is never silent.
 2026-07-14 23:28:10 -07:00
108 changed files with 16924 additions and 231 deletions
Expand all files Collapse all files
adventure_ask7_equipment_mgmt.md
+347
View File
@@ -0,0 +1,347 @@
# Adventure ask 7 — full equipment management from the web (HANDOFF SPEC)
Status: **BUILT + TESTED + SCREENSHOT-VERIFIED, DEPLOY PENDING** (as of 2026-07-17).
Both sides compile, vet clean, and pass their suites. The owner Equipment panel was
rendered headless (Chrome) in BOTH day and night phases, and the euro confirm dialog
was exercised (upgrade €25,000 and repair €40) — cost + balance math and thousands
separators read right, no purple-on-night contrast issue, public Gear panel correctly
hidden for the owner. Next: commit Pete, commit gogobee, deploy Pete first, then
gogobee (see Build order step 8), then run the live prosolis probe. This doc is the
complete contract + file:line map. Companion to `adventure_expansion_spec.md`
(asks 1–6) and the memory `project_adventure_expansion.md`.
## What got built (deviations from the spec below, all intentional)
- Pete: `EquipOrder.Tier` + `tier` column (schema + migration); new actions
`upgrade`/`repair`; new verdicts `rejected_downgrade`/`rejected_insufficient_funds`/
`rejected_max_tier`. `EquipSlotView` + `Slots`/`Balance` on `PlayerDetail`.
`handleEquipOrder` resolves take-off/upgrade/repair from `pd.Slots` server-side and
rejects a client-forged tier (409). who.html gained an owner "Equipment" panel with
an in-DOM confirm (cost + balance) for the money actions; public Gear panel hidden
for the owner. output.css rebuilt. Tests in equip_test.go / who exercised via the
real template.
- gogobee: `peteclient` mirror types. New file `pete_equip_manage.go` holds the
headless mutators: `applyMasterworkEquip`/`applyMasterworkUnequip` (free funcs,
sentinel `errEquipDowngrade`), `purchaseEquipmentTier`/`repairSlot` (methods on
`*AdventurePlugin`, euro-idempotent), `buildEquipSlotViews`, `isEquipmentSlot`.
`applyEquipOrder` routes on item Type / slot vocabulary. `itemViews` now gives
masterwork/arena backpack rows an equip id. `buildDetailSnapshot` is now a METHOD
(`p.buildDetailSnapshot`) so it can read the euro balance (nil-guarded for tests).
Tests in pete_equip_manage_test.go.
- **DEVIATION 1 — downgrade block placement:** the masterwork-equip downgrade check
lives INSIDE `applyMasterworkEquip` (returns `errEquipDowngrade`), not in the
router. Behavior/verdict identical; keeps the rule next to the mutation and unit-
testable. Router maps the sentinel to `rejected_downgrade`.
- **DEVIATION 2 — no refund on save fault (both euro mutators):** the spec suggested
`CreditIdem` refund on a later DB error. That is UNSAFE with guid-idempotent retry:
a refund on a fresh id followed by a guid-guarded retry that no longer re-debits
hands the player both gear and money. Instead we return `retry=true` and let the
next poll re-run — the debit is guid-idempotent (skipped) and the slot write is
idempotent. This matches the casino escrow precedent exactly. Do NOT "fix" this by
adding a refund.
- **DEVIATION 3 — upgrades only over PLAIN slots:** `buildEquipSlotViews` offers
`NextTier` only when the slot is plain shop-tier (not masterwork/arena) and sub-max,
and `purchaseEquipmentTier` rejects an upgrade over special gear as
`rejected_downgrade` ("take it off first"). This honors "block downgrades" (buying a
plain tier over special strips its bonus) AND keeps the upgrade path free of the
non-idempotent eviction step, so the retry-safety above holds with no eviction to
reconcile.
Repos: Pete at `/home/reala-misaki/git/pete` (web mirror, deploys to parodia).
gogobee at `/home/reala-misaki/git/gogobee` (game engine, deploys to millenia
`reala@192.168.1.212`). One-way data flow gogobee→Pete; the only route back is the
poll-queue (Pete records intent, gogobee polls + applies + files a verdict).
## Why this exists
Ask 5 built "equip from the web" but scoped it to **magic items only**. The user's
worn gear is almost all the OTHER equipment systems, so the feature touched almost
nothing they own. Diagnosis of user "prosolis" / character "Rurina" (live prod):
- Worn (the 5 `adventure_equipment` slots): weapon **Vorpal Sword** T5 (shop, not mw),
armor **The Deepforged Carapace** T5 **masterwork**, helmet **Crown of the Fallen**
T5 (shop), boots **Ranger's Boots** T4 (shop), tool **Mithril Pickaxe** T4 (shop).
- Backpack (250 items): 1 `MasterworkGear` **The Wandering Sole** (boots, T3), 3 slotted
magic items (Wand of the War Mage off_hand, 2 Weapons main_hand), rest consumables/
materials. `equipped` magic count = 0 (magic slots empty).
So today prosolis gets 3 buried Equip buttons (magic) and nothing else. They want to
manage ALL five slots.
## The three equipment subsystems (do not conflate — this is where it breaks)
1. **Standard tiered gear** — the 5 `EquipmentSlot`s (weapon/armor/helmet/boots/tool),
power = integer `Tier` 0..5, raised by BUYING a tier in the shop (euros). No
inventory item; the slot's tier IS the gear. This is 4 of Rurina's 5 worn pieces.
2. **Masterwork / Arena gear** — special items that live in the backpack
(`adventure_inventory`, `item_type` = `MasterworkGear` / `ArenaGear`), equipped INTO
an `EquipmentSlot` (a swap), round-trippable to the pack.
3. **Magic items** — backpack `item_type='magic_item'`, equipped into DnD slots
(off_hand/main_hand/ring_1…), a DISJOINT slot namespace. Already handled by ask 5.
## User decisions (locked)
- **Scope:** full management incl. shop-tier gear (not just inventory items).
- **Sequencing:** build BOTH phases, deploy together (one drop).
- **Euro spend:** yes, upgrade/repair debit euros from the web, but behind a **confirm
step** showing cost + balance.
- **Downgrades:** BLOCK them (equip and upgrade).
---
# HANDOFF STATE (2026-07-17 — resume here next session)
Both repos build, vet clean, full suites green. **Uncommitted on purpose** — screenshot-
verify the Equipment panel FIRST, then commit each side, then deploy Pete→gogobee, then
the live prosolis probe.
**Order for next session:**
1. **Screenshot-verify** the owner Equipment panel (never rendered in a browser yet; the
`TestEquipPanelRenders` test drives the real template but is not a visual check).
Recipe (same as prior asks): a throwaway test calling `seedEquip`/`getWho` (both in
`internal/web/equip_test.go` / `who_test.go`) that writes the rendered body to an HTML
file, served with `python3 -m http.server` from a dir with a `static` symlink into
`internal/web/static`. `seedEquip` already seeds `Slots` (a masterwork weapon with
Take off + Repair, plain boots with an Upgrade offer) + `Balance` 100000, so the panel
and the confirm dialog both render. Check day AND night phase; confirm the euro
confirm box (cost + balance) pops on Upgrade/Repair click, and the `€` amounts read
right. Watch the [[pete_theme_contrast]] purple-on-night hazard.
2. **Commit Pete** — every changed file below is ask 7 (incl. this doc):
`internal/storage/{db,detail,equip,schema,equip_test}.go`,
`internal/web/{equip,equip_test}.go`, `internal/web/templates/who.html`,
`internal/web/static/css/output.css`, `adventure_ask7_equipment_mgmt.md`.
3. **Commit gogobee** — stage ONLY the ask-7 files (the `gogobee_*.md` plan files are
unrelated mid-flight postgame work — leave them):
`git add internal/peteclient/client.go internal/plugin/pete_detail_test.go internal/plugin/pete_equip.go internal/plugin/pete_roster.go internal/plugin/pete_equip_manage.go internal/plugin/pete_equip_manage_test.go`
4. **Deploy Pete first** (build-on-server-with-cgo per deploy_topology), then gogobee on
millenia. A gogobee verdict string Pete's `validEquipVerdict` rejected would 400+park
the order, so Pete's ingest must accept the new verdicts before gogobee emits them.
5. **Live prosolis probe** (see the Verification section at the bottom). Expected: Take
off on armor (Deepforged Carapace T5 masterwork), Upgrade offers on boots + tool
(T4→T5, €25000), Repair where condition<100, Equip on The Wandering Sole BLOCKED as a
downgrade vs worn T4 boots, + the 3 magic items.
Baseline unchanged: Pete tip `1159e64`, gogobee tip `b29dcf4`. Nothing committed yet.
---
# THE WIRE CONTRACT (both repos must agree)
## equip_orders (Pete `internal/storage/equip.go` + gogobee `peteclient.EquipOrder`)
- **New column** `tier INTEGER NOT NULL DEFAULT 0` on `equip_orders`
(Pete `schema.go` CREATE at :176-191 + `addColumnIfMissing(d,"equip_orders","tier",...)`
in `db.go`, following the existing pattern at db.go:81+). Add `Tier int` to the
`EquipOrder` struct (Pete storage + gogobee `peteclient/client.go:689-698`), plumb
through Insert/scan/Pending/ByOwner and the JSON.
- **Actions** (`Action` field): existing `equip`, `unequip`; NEW `upgrade`, `repair`.
- **Field use per action:**
- `equip` (magic OR masterwork/arena): `ItemID` = `adventure_inventory` row id,
`Slot` = the item's slot (DnD slot for magic, EquipmentSlot for masterwork).
- `unequip` / take-off: `Slot` only (DnD slot → magic path; EquipmentSlot → masterwork).
- `upgrade`: `Slot` = EquipmentSlot, `Tier` = target tier. `ItemID` unused.
- `repair`: `Slot` = EquipmentSlot. `Tier`/`ItemID` unused.
- **Verdicts** (add to Pete `validEquipVerdict` + gogobee return strings): existing
`applied`, `rejected_not_owned`, `rejected_not_worn`, `rejected_not_equippable`;
NEW `rejected_downgrade`, `rejected_insufficient_funds`, `rejected_max_tier`.
Give each a friendly message in Pete's who.html JS `verdict` map (who.html ~:430).
## Detail push (Pete `internal/storage/detail.go` PlayerDetail + gogobee peteclient)
Add to `PlayerDetail`:
- `Slots []EquipSlotView` — the 5 standard slots, owner-only, for the management panel.
- `Balance float64` (`json:"balance,omitempty"`) — the owner's euro balance, for the
confirm dialogs.
New type (both repos):
```go
type EquipSlotView struct {
Slot string `json:"slot"` // weapon|armor|helmet|boots|tool
Name string `json:"name"`
Tier int `json:"tier"`
Condition int `json:"condition"`
Masterwork bool `json:"masterwork,omitempty"`
ArenaTier int `json:"arena_tier,omitempty"`
CanTakeOff bool `json:"can_take_off,omitempty"` // masterwork/arena → round-trippable
NextTier int `json:"next_tier,omitempty"` // 0 = at max tier (5)
NextName string `json:"next_name,omitempty"`
NextPrice float64 `json:"next_price,omitempty"`
RepairCost int `json:"repair_cost,omitempty"` // 0 = full condition
}
```
Worn masterwork/arena pieces are represented HERE (via `CanTakeOff`), NOT duplicated
into `Equipped`. `Equipped` stays magic-only (the DnD slots). Backpack items
(`Inventory`) keep the ItemView shape; masterwork/arena backpack rows now also get an
equip `ID` (see gogobee itemViews change) so they render Equip buttons.
---
# PHASE A — equip / take off inventory gear (masterwork + arena + magic). No money.
### gogobee changes
1. **`itemViews`** (`pete_roster.go:222-263`): currently sets `ItemView.ID = it.ID`
only for slotted magic items (:242-255); masterwork/arena backpack rows fall to the
`else if it.Slot != ""` branch (:256-259) with no id. ALSO set `v.ID = it.ID` when
`it.Type == "MasterworkGear" || it.Type == "ArenaGear"` (they carry a slot). This is
the whole reason a masterwork backpack item currently has no Equip button.
2. **`attachInventoryCompares`** (`pete_roster.go:269-280`): it decorates any row with
`ID != 0` by calling `magicItemCompare`. Now that masterwork rows have ids, GUARD it
to magic-only (skip rows where `magicItemFromAdvItem` fails). Masterwork gets no
compare card for now (fine).
3. **`equippedViews`** stays magic-only (`pete_roster.go:408-431`). Worn masterwork/arena
are surfaced via `Slots`/`EquipSlotView` instead (see Phase-common detail build).
4. **Extract headless mutators** mirroring `applyMagicEquip`/`applyMagicUnequip`
(`magic_items_gameplay.go:592-654` / `:665-688`) and the DM confirm logic
(`adventure_masterwork.go:487-587`):
- `applyMasterworkEquip(uid id.UserID, it AdvItem) (mwEquipOutcome, error)`:
require `it.Slot != ""` and Type MasterworkGear/ArenaGear else `errItemNotEquippable`
(reuse the sentinel at `magic_items_gameplay.go:573`). Load `loadAdvEquipment`; if the
current occupant is special (`Masterwork || ArenaTier>0`) evict it back to inventory
as a MasterworkGear/ArenaGear `AdvItem` (see the confirm handler :530-545 for the
exact reconstruction, incl. `arenaGearByName(name).SetKey` at :563). **Anti-dup
ordering = magic's**: `removeAdvInventoryItem(it.ID)` FIRST, then `saveAdvEquipment`,
restore the inventory row on save failure. Set the new row fields exactly like the
confirm handler :547-571 (Tier, Condition=100, Name, ActionsUsed=0, and Masterwork+
SkillSource OR ArenaTier+ArenaSet).
- `applyMasterworkUnequip(uid id.UserID, slot EquipmentSlot) (mwUnequipOutcome, error)`:
load equip; if the slot is NOT special (`!Masterwork && ArenaTier==0`) → `errSlotEmpty`
(`:576`) → `rejected_not_worn` (there is nothing round-trippable to take off; plain
shop-tier reverts via Phase B, not here). Otherwise move the piece to inventory
(MasterworkGear/ArenaGear AdvItem) and RESET the slot row to its tier-0 default:
`tier=0, condition=100, name = equipmentTiers[slot][0].Name, actions_used=0,
arena_tier=0, arena_set='', masterwork=0, skill_source=''` (matches the creation
seed at `adventure_character.go:528-537`). Keep the row (do NOT delete — the 5 rows
are an invariant; PK user_id+slot).
5. **`applyEquipOrder`** (`pete_equip.go:124-173`) routing:
- `equip`: load the AdvItem by `order.ItemID` (as today, :126-152). Branch on Type:
`MasterworkGear`/`ArenaGear` → `applyMasterworkEquip` (with downgrade block, below);
else → `applyMagicEquip` (unchanged). Miss → `rejected_not_owned`.
- `unequip`: branch on `order.Slot`: if it's an EquipmentSlot value
(weapon/armor/helmet/boots/tool) → `applyMasterworkUnequip(EquipmentSlot)`;
else → `applyMagicUnequip(DnDSlot)`. (Slot vocabularies are DISJOINT —
`EquipmentSlot` vs `DnDSlot` — confirmed, so the string alone disambiguates.)
6. **Downgrade block** (masterwork equip): before applying, compare
`advEffectiveTier(incoming)` vs `advEffectiveTier(currentOccupant)`
(`adventure_character.go:421-432`: arena ×1.5, masterwork ×1.25, else ×1). If
`incoming <= current` return `rejected_downgrade`. Magic equip is NOT downgrade-blocked
(its target DnD slots are usually empty and the compare card already informs).
### Pete changes (Phase A)
- Buttons already render off `ID`/worn in `who.go itemRows` (:123-145) + the `itemrow`
template (who.html :8-47). Take-off for masterwork slots is rendered from `Slots`
(see Pete Phase-common UI). Add `rejected_downgrade` to `validEquipVerdict`
(`storage/equip.go:63`) + the JS verdict map.
- `handleEquipOrder` (`web/equip.go:47-134`) already resolves an equip item from
`pd.Inventory` by id and an unequip from `pd.Equipped` by slot. Take-off of a masterwork
slot comes from `Slots`, so add resolution of a take-off/upgrade/repair against
`pd.Slots` (see Phase B handler notes — same code path).
---
# PHASE B — upgrade / repair the 5 standard slots (web shop). Spends euros (confirm-gated).
### gogobee changes
1. **Extract `purchaseEquipmentTier(uid id.UserID, slot EquipmentSlot, tier int, guid string) (outcome, error)`**
from the body of `advBuyEquipment` (`adventure_shop.go:742-829`), MINUS flavor text:
- `def := equipmentTiers[slot][tier]` (`adventure_character.go:179-220`; 6 tiers 0..5;
`EquipmentDef{Name,Tier,Description,Price}` at :172-177). Guard `tier` in range;
`tier >= len` → `rejected_max_tier`.
- **Downgrade block** = existing shop rule: block if `float64(def.Tier) <= advEffectiveTier(current)`
for masterwork, `def.Tier <= current.ArenaTier` for arena, `current.Tier >= def.Tier`
for plain (see `adventure_shop.go:744` / :750-757) → `rejected_downgrade`.
- **Idempotent euro**: `if !p.euro.HasExternalTx(guid)` gate the affordability check,
then `p.euro.DebitIdem(uid, def.Price, "adventure_equip_upgrade", guid)`
(`euro.go:452-461`; balance/ok/err). Insufficient → `rejected_insufficient_funds`.
Refund on later DB error via `CreditIdem` (`:465-475`). DO NOT use `Debit`/`Credit`
(non-idempotent) — the euro header at `euro.go:434-446` says web-initiated MUST use
the Idem variants. Precedent: casino escrow `pete_games.go:101-130`.
- Move old special gear to inventory (like the shop does), then `saveAdvEquipment`
with the new tier row (Tier, Condition=100, Name=def.Name, ActionsUsed=0,
Masterwork=false, ArenaTier=0). Community-pot 5% cut is OPTIONAL for web — decide;
simplest to skip it or mirror `communityPotAdd` (`adventure_shop.go:564-567`).
- NOTE: shop charges FULL `def.Price` for the chosen tier (not incremental). The web
UI should offer upgrading to the NEXT tier only (NextTier/NextPrice in EquipSlotView)
to keep it simple; the order carries the explicit target `Tier`.
2. **Extract headless repair** from `executeRepair` (`adventure_blacksmith.go:262-333`)
— it already takes only `userID` + a confirm struct and is Matrix-free except the
trailing `SendDM`. `repair(uid, slot, guid)`: recompute `blacksmithRepairCost(eq)`
(`:17-40`, base rates `:15`), `HasExternalTx`-gate + `DebitIdem(uid, cost,
"adventure_repair", guid)`, set `eq.Condition=100`, `saveAdvEquipment`, refund on error.
Condition already full → `rejected_no_change` (or just `applied` no-op; pick one and add
to the verdict set if used).
3. **Poller routing** in `applyEquipOrder`: `upgrade` → `purchaseEquipmentTier(owner,
order.Slot, order.Tier, order.GUID)`; `repair` → `repair(owner, order.Slot, order.GUID)`.
The GUID is the idempotency key for BOTH the euro move (DebitIdem externalID) AND the
existing `equip_applied_orders` ledger (`pete_equip.go:213-240`) — belt and suspenders.
4. **Build `Slots` + `Balance` in the detail push** (`buildDetailSnapshot` /
PlayerDetail assembly `pete_roster.go:190-211`). For each `allSlots` slot read
`loadAdvEquipment` (already used for public gear at rosterDetail :136): fill Name/Tier/
Condition/Masterwork/ArenaTier; `CanTakeOff = Masterwork || ArenaTier>0`;
`NextTier/NextName/NextPrice` from `equipmentTiers[slot][Tier+1]` if `Tier < 5` and it
isn't a downgrade; `RepairCost = blacksmithRepairCost(eq)` if `Condition < 100`.
`Balance = p.euro.GetBalance(uid)` (`euro.go:408-417`).
### Pete changes (Phase B)
- `storage/equip.go`: add `Tier` to EquipOrder + Insert/scan/queries; add the three new
verdicts to `validEquipVerdict`; add `upgrade`/`repair` to `validEquipAction`.
- `web/equip.go handleEquipOrder`: accept `upgrade`/`repair` actions. Resolve the slot
from `pd.Slots` (verify it exists and, for upgrade, that `req.Tier == slot.NextTier`
and `NextTier != 0`; for repair that `RepairCost > 0`). Reject client-forged tiers —
trust only the pushed `EquipSlotView`, exactly as ask 5 resolves item facts server-side.
- `web/who.html` + `who.go`: build an owner "Equipment" panel from `.Slots` — per slot a
card showing Name (T{Tier}, {Condition}%), and buttons: **Take off** if `CanTakeOff`,
**Upgrade to {NextName} · €{NextPrice}** if `NextTier>0`, **Repair · €{RepairCost}** if
`RepairCost>0`. Magic worn + backpack panels stay as they are. **Hide the public "Gear"
panel (who.html :120-135) for the owner** (`{{if not .HasSelf}}`) since this panel
supersedes it. New CSS classes → rebuild + commit `output.css`
(`npx tailwindcss -i internal/web/static/css/input.css -o …/output.css --minify`).
- **Confirm step**: for `upgrade`/`repair` (euro-spending) the JS must pop a confirm
showing cost + `page.Balance` before POSTing the order (per user decision). `equip`/
`unequip`/take-off place directly (no money). Reuse the equip JS at who.html ~:416-490.
---
# Cross-cutting / gotchas
- **Deploy order**: Pete ingest + verdict handlers accept the new actions/verdicts BEFORE
gogobee emits them. New order actions are additive on Pete's side. New DETAIL fields are
`omitempty` → safe either order. But a new gogobee VERDICT string that Pete's
`validEquipVerdict` rejects would 400 and park the order — so ship Pete first. (Same rule
as ask 1's event_type.)
- **Pete builds WITH cgo ON the server** (sqlite). See `deploy_topology` memory. gogobee
builds on millenia. Deploy = push to gitea → server `git pull --ff-only` +
`CGO_ENABLED=1 go build -o pete.new .` → swap → restart screen `pete`.
- **output.css is a committed build artifact** — new Tailwind classes silently no-op in
prod if not rebuilt+committed (bit us on `sm:grid-cols-5`).
- **Euro debt limit** applies (`BLACKJACK_DEBT_LIMIT` default −1000). A web upgrade that
would breach it is refused by `DebitIdem` → `rejected_insufficient_funds`.
- **Idempotency is doubled**: the order GUID keys BOTH `DebitIdem`'s externalID AND the
`equip_applied_orders` ledger. A retried poll re-files the stored verdict and moves no
money. Verify a mid-apply crash can't double-charge (DebitIdem is the guard; record the
applied-order ledger AFTER a successful apply, as fulfilEquipOrder already does :104).
# Testing (both repos)
- gogobee: unit-test each headless mutator; assert downgrade block, max-tier, insufficient-
funds, idempotent replay (same guid twice → one debit), masterwork equip evicts special
occupant / overwrites plain, take-off resets to tier-0.
- Pete: seed a PlayerDetail with `Slots` + a masterwork worn piece + masterwork backpack
item and assert the who page renders Take off / Upgrade / Repair buttons and the confirm
data. Use the `seedWho`/`getWho` throwaway render pattern (see
`project_adventure_expansion` memory + prior sessions' scratch test). Assert
`handleEquipOrder` rejects a client-forged tier and a non-owner.
- Verify verdict strings round-trip; `TestClearCookie…`-style table tests fit.
# Verification against live data (prod probe scripts were in this session's scratchpad,
# which is EPHEMERAL — re-create as needed). Read prod detail via
# `ssh reala@www.parodia.dev 'cd /opt/pete && python3 -'` piping a small script that opens
# data/pete.db and json-loads player_self_detail.detail_json (localpart 'prosolis') or
# adventure_roster.detail_json (name 'rurina'). Expected post-ship for prosolis: Take off
# on armor (Deepforged Carapace), Upgrade offered on weapon→? (already T5 max → none),
# boots Upgrade T4→T5 (€25000) etc., Repair where condition<100, Equip on The Wandering
# Sole (BLOCKED as downgrade vs worn T4 boots) + 3 magic items.
# Deployed baseline at handoff
- Pete tip `1159e64` live on parodia. gogobee tip `b29dcf4` live on millenia (contains all
ask 1–6 commits). Nothing for ask 7 written yet. gogobee has unrelated uncommitted
postgame-zone work in its tree — keep ask-7 edits in separate commits, stage by name.
# Build order (tasks)
1. Wire contract types both repos (EquipOrder.Tier, EquipSlotView, verdicts, actions).
2. gogobee headless mutators (masterwork equip/unequip, purchaseEquipmentTier, repair).
3. gogobee detail push (Slots + Balance; itemViews masterwork id; compare guard).
4. gogobee poller routing + downgrade block.
5. Pete storage (tier column, actions, verdicts) + handlers.
6. Pete who.html/who.go equipment panel + confirm JS + hide public Gear for owner.
7. Tests both sides; rebuild+commit output.css; gofmt.
8. Deploy Pete first, then gogobee; verify live with prosolis.
adventure_expansion_progress.md
+168
View File
@@ -0,0 +1,168 @@
# Adventure expansion — progress & handoff
Last updated 2026-07-17. Companion to `adventure_expansion_spec.md` (the wire
contract). This file is the state of the work: what's done, what's next, and
what will bite whoever picks it up.
---
## Read this first
1. `adventure_expansion_spec.md` — payloads, endpoints, file:line refs into both
repos. It supersedes any older sketch of these asks.
2. This file — where the work actually stands.
The gogobee repo is at `/home/reala-misaki/git/gogobee`. It runs on millenia
(`reala@192.168.1.212`). Pete runs on `reala@www.parodia.dev` (bare `./pete` in
a screen session, built **on the server, with cgo**).
---
## Status of the five asks
| # | Ask | State |
|---|---|---|
| — | Trophy case / timeline ("The record" / "The trail") | **Built, tests green, committed, NOT pushed, NOT deployed** |
| — | Contract spec for the five | **Written** (`adventure_expansion_spec.md`) |
| 4 | Richer item view | **Next up.** Spec'd. Partly buildable — see below |
| 3 | Room graph → dungeon map + fog of war | Spec'd. Graph already exists in gogobee |
| 5 | `equip_orders` queue | Spec'd. Copies mischief |
| 1 | `treasure_found` → treasures | Spec'd, but **blocked on a gogobee feature** — no loot fact exists |
| 2 | LLM-authored dispatches | Spec'd. **Do last** — inverts a security guarantee |
Build order and the reasoning behind it are in the spec's last section.
---
## ⚠️ Unpushed and undeployed
Pete has **two unpushed commits on `main`**:
- `cbe9e67` — adventure: keep the facts, not just the sentence we made of them
(the trophy case / timeline feature — `adventure_events` table,
`internal/storage/adventure.go`, the who-page sections)
- `5fac163` — adventure: pin the gogobee contract before Pete assumes it
(the spec)
**Nothing is deployed.** The record/trail sections are live nowhere.
This is not a neutral delay. **Trophies are only countable going forward** —
they're built from `adventure_events`, which only starts filling once the
feature is deployed. Every fact gogobee emits between now and the deploy is
counted by nobody and cannot be counted back out later (the past is prose in the
story feed). The longer it sits, the more of every adventurer's history is
permanently uncountable. Deploy it soon, independent of where the expansion goes.
gogobee's tree has **unrelated uncommitted postgame-zone work** (combat engine,
expedition sim, plan docs). It's mid-flight and not part of this project — leave
it alone, and keep adventure-expansion edits in separate files and commits.
---
## Next: ask 4, richer items
Chosen because it's additive-only, has real sources, carries no deploy-order
hazard and no security surface, and is the smallest change that visibly improves
the who page.
**gogobee:** `itemViews` (`internal/plugin/pete_roster.go:210-225`) currently
sends five of `AdvItem`'s fields and drops two that already exist:
- `Slot` (`EquipmentSlot`, non-empty for MasterworkGear)
- `SkillSource` (string, non-empty for MasterworkGear)
Also worth sending, from adjacent structs:
- `Desc` — resolve **at the push site** from `MagicItem.Desc`
(`magic_items.go:35-46`) or `EquipmentDef.Description`
(`adventure_character.go:172-177`). `AdvItem` rows carry no description of
their own, which is why this is a push-site join and not a field copy.
- `Attunement` (does it need a bond) and `Attuned` (does it have one). Distinct,
and both matter to a player deciding what to wear — the bond cap is 3.
**Pete:** extend `ItemView` (`internal/storage/detail.go:23-29`) to match
`peteclient/client.go:356-362`, then surface it on the who page.
Rides the private `/api/ingest/detail` push, so **either side can deploy first**.
**Not buildable — do not spec it in:** stat modifiers and requirements are *not
modeled anywhere*, not merely unsent. No attack/AC/ability deltas exist on
`AdvItem` or `MagicItem`; effects derive from Tier/Slot/SkillSource in
`combat_stats.go:36` and `combat_bridge.go:396,489`. "+2 to hit" needs a gogobee
engine change first. Deriving a display-only approximation from Tier/Slot at the
push site is a lie the first time the engine and the display disagree.
---
## Landmines
Things that cost money to learn, or that will cost money if forgotten.
**Deploy order is a data-loss rule, not a preference.** An unknown `event_type`
is a 400 on Pete; gogobee retries with backoff to `maxAttempts=8` and then
**parks the bulletin forever** (`peteclient/client.go:79-86`,
`plugin/pete.go:279-281`). Pete's handler ships *before* gogobee emits
`treasure_found`, or the first treasures are gone permanently. Additive *fields*
on existing event types are safe in either order.
**A limit on the fetch truncates a tally, not a list.** `EventsBySubject(name, 0)`
means unlimited, and anything that *counts* must pass 0 and cap in the caller
(`storage/adventure.go:108-114`). A capped read would freeze a veteran's kill
count at 40 forever, reading as a fact rather than a missing page.
**`INSERT OR IGNORE` on the guid is load-bearing**, not defensive habit
(`storage/adventure.go:45-58`). gogobee retries facts whose ack it lost. This is
the only adventure store where a duplicate is *permanently* wrong — the roster
forgives one by replacing itself; a double-counted boss kill is in the tally
forever.
**Only `subject` earns a trophy, never `opponent`.** A duel Josie *lost* still
names her (as the opponent in the winner's dispatch). It belongs on her trail,
but crediting it would score a loss as a win. Pinned by
`TestTrophyCaseIgnoresOpponentCredit`.
**Events key on character name**, not roster token — that's what a fact carries;
gogobee puts no stable character id on the wire. A rename takes the history with
it.
**Snapshots are dropped on failure, never queued** (`peteclient/client.go:320-327`).
A retried snapshot is a lie about a moment that has passed, and the silence is
what makes Pete's 12-minute staleness timer honest. Asks 3 and 4 ride snapshots:
a dropped push means a stale map, not a wrong one.
**The who page's tests render the real template**, so a field slip 500s in the
suite — but only on paths the test data reaches. `HasHistory` false skips the
whole history block, which is why `TestWhoHistoryPanels` seeds facts through the
real ingest handler.
**`/api/mischief/claim` is misnamed.** It's a *verdict* endpoint; mischief has no
`claimed` state (`storage/mischief.go:37-42`). Don't repeat the name in
`equip_orders` — the spec calls it `/api/equip/verdict`.
**The LLM dispatch guard inversion (ask 2).** `factGuard` only checks the
*structured* `Subject`/`Opponent` fields, which is safe today only because Pete's
templates can print nothing Pete didn't interpolate. The moment gogobee's LLM
authors the prose, the guard is checking fields that are **no longer the thing
being rendered**, and character names are player-chosen. A prose-level guard is
required *in the same change* that accepts `headline`/`lede`, not as a
follow-up. **Templates stop being the renderer and become the safety net — do not
delete them.**
---
## Decisions already made (don't relitigate)
- **Room graph, not coordinates or a bare trail.** Rooms with exits, a real
graph. It already exists in gogobee (`zone_graph.go`); the wire throws it away.
- **Fog of war is a server-side cut**, not a CSS style. Send visited nodes plus a
one-hop ring with `kind: "unknown"`. The map is a public page; "view source to
find the boss room" is not fog of war.
- **`equip_orders` copies mischief, not escrow.** An equip is a desired end state,
not a delta, so a replay converges — mischief's precondition exactly. No
`claimed` state, no stale-reoffer window; the poll loop is its own retry.
- **Equip UI says "queued", never claims it landed.** It lands on gogobee's next
poll tick, up to 30s out. The order row's status is the truth.
- **"Treasures found" won't be faked from vault contents.** A *bought* sword is
not a trophy. Needs a real `treasure_found` fact.
- **Blank state over a wall of zeroes.** Adventurers predating `adventure_events`
render no record section at all. A clean absence, deliberate.
adventure_expansion_spec.md
+732
View File
@@ -0,0 +1,732 @@
# Adventure expansion — gogobee↔Pete contract spec
Status: **proposed**, nothing implemented. Written 2026-07-17.
Covers the five gogobee-blocked asks behind the Adventure expansion:
1. `treasure_found` fact → treasures on the trophy case
2. LLM-authored dispatches (`headline`/`lede` on the fact)
3. Room graph + current room → dungeon map with fog of war
4. Richer item view → item inspection
5. `equip_orders` queue → equipment management from the web
Pete is a read-only mirror of gogobee and stays one. Nothing here opens a route
from Pete into the game box's network; ask 5 uses the poll-queue pattern that
mischief and casino escrow already established, so the direction of travel
remains gogobee→Pete.
---
## 0. The constraints that shape all five
**Deploy Pete first, always.** An unknown `event_type` is a 400 on Pete
(`internal/web/adventure.go:83`, via `renderAdventure` returning `ok=false`).
gogobee's sender retries a 400 with backoff to `maxAttempts=8` and then **parks
the bulletin forever** (`internal/peteclient/client.go:79-86`, and the warning at
`internal/plugin/pete.go:279-281`). So for ask 1 the first treasures are lost
permanently if the order is reversed. This is not a style preference; it is the
one sequencing rule in this document that silently destroys data.
Additive *fields* on an existing fact type are safe in either order — Pete's
`AdvFact` decode ignores unknown JSON keys, and gogobee omits empty ones. Only
new `event_type` values carry the parking hazard.
**Snapshots are dropped on failure, never queued** (`client.go:320-327`). A
retried snapshot is a lie about a moment that has passed, and the silence is
what makes Pete's `rosterStaleAfter = 12 * time.Minute` timer honest. Asks 3
and 4 ride snapshots, so they inherit this: a dropped push means a stale map,
not a wrong one.
**Facts are a log; snapshots are current state.** `adventure_events` is the one
adventure table that is a log (`internal/storage/schema.go:75-93`). Anything
that needs to be *counted* must arrive as a fact. Anything that describes *now*
belongs on a snapshot. Ask 1 is a fact because "treasures found" is a tally;
asks 3 and 4 are snapshots because a map and an item sheet describe the present.
**`INSERT OR IGNORE` on the guid is the durable idempotency guarantee**
(`internal/storage/adventure.go:45-58`). The `IsGUIDSeen` check ahead of it is a
courtesy that can race. Any new fact type inherits both.
---
## 1. `treasure_found` fact
**This is a gogobee feature, not a contract gap.** No loot fact is emitted
anywhere today; loot is room-local narration. The contract below is the easy
half. The work is in gogobee.
### Emit site
`dropZoneLoot` (`internal/plugin/dnd_zone_loot.go:492`) is the single grant point
for monster/boss/elite drops and already has `userID`, `zoneID`, `monster`, and
`isBoss`/`isElite` in hand. `dropMagicItemLoot` (`:590`) is the magic-item branch
and additionally has the `MagicItem` and its `LootTier`.
Route it through `emitFact` (`pete.go:169-187`), **not** `peteclient.Emit`
directly — `emitFact` is what enforces the opt-out anonymization and derives
`Actors` from the final names. Pete's `factGuard` rejects a `Subject` absent
from `Actors`, so bypassing it produces a silent 400.
### Which finds are newsworthy
Not every copper piece is a bulletin. **The filter already exists**: the tier-5
treasure `RoomAnnounce` path (`internal/plugin/adventure.go:1377-1390`, strings
in `adventure_flavor_treasure.go:276-279`) fires only when a treasure def is
flagged story-grade. Reuse that flag as the emit condition rather than inventing
a second notion of "notable".
Suggested tiering, matching the existing `zone_first`/`zone_clear` pattern:
- `tier: "bulletin"` — a story-grade find.
- `tier: "priority"` — a realm-first hoard, via `claimRealmFirst(kind, target)`
(`pete.go:249-258`). The flavor file already exists
(`internal/flavor/zone_first_hoard_flavor.go`).
### Payload
New `event_type` on the existing `Fact` struct (`peteclient/client.go:33-51`).
No new fields — the existing ones carry it:
```json
{
"guid": "treasure_found:<token>:<ts>",
"event_type": "treasure_found",
"tier": "bulletin",
"actors": ["Josie"],
"subject": "Josie",
"zone": "The Ossuary",
"region": "...",
"level": 7,
"stakes": "Crown of the Drowned King",
"outcome": "legendary",
"occurred_at": 1752710400
}
```
- `guid` prefix **must** equal `event_type` (`client.go:34`) — it becomes a
public permalink path on Pete (`advPermalink`, `internal/web/adventure.go:351`).
- `subject` is the finder. Never populate `opponent` — Pete only credits
trophies where `Subject == name` (`storage/adventure.go:178`), pinned by
`TestTrophyCaseIgnoresOpponentCredit`.
- `stakes` carries the item name. This is a reuse of an existing free-text field
rather than a new `item` field; if that reads as a stretch, add `item` instead
and treat it as an additive field (safe in either deploy order).
- `outcome` carries the rarity/loot tier, so Pete can weight a legendary find
above a common one without parsing the name.
### Pete side
- `renderAdventure` gains a `treasure_found` case (`internal/web/adventure.go:377-491`).
- `storage.TrophyCase` (`storage/adventure.go:84`) gains a treasure tally. Note
the standing caveat at `storage/adventure.go:108-114`: **a limit on the fetch
truncates a tally, not a list.** The counter must read `EventsBySubject(name, 0)`.
- The who template's "The record" section (`templates/who.html:83-155`) gains a
fourth stat tile alongside BossKills/ZoneClears/Deaths/Retreats.
- The `storage/adventure.go:75-83` comment saying no loot fact exists on the
wire gets deleted, since it will no longer be true.
### Deliberately not doing
Counting the vault. A *bought* sword is not a trophy, and inventory is
current-state with no "found it in X on day 3". Treasures are only countable
going forward, same as every other trophy.
---
## 2. LLM-authored dispatches (`headline` / `lede`)
**SHIPPED 2026-07-17: Pete `eeeac08`, gogobee `22b7949`. All tests green both
sides, gofmt-clean, screenshot-verified (realistic + max-length prose both sit
cleanly on the card), NOT deployed.** Built as written below (additive
`headline`/`lede`, prose-guard, template fallback), with one architecture
decision the spec did not surface:
> **This section contradicts `pete_adventure_news_voice.md`**, the older
> foundational doc, which says *Pete* owns the voice and gogobee is "compute,
> not ghostwriter" — the flow there is Pete builds a voiced prompt and calls a
> generic gogobee inference endpoint. That needs a **Pete→gogobee route**, which
> `roster.go:23-25` forbids ("no route back into the game box's network"). The
> network constraint kills the voice-doc design, so §2's gogobee-authors-and-
> pushes model is the only one that fits one-way delivery. Confirmed with the
> owner before building. Cost: the warm-reporter voice now lives in gogobee's
> prompt (`pete_dispatch_voice.go`), softening "gogobee never sees Pete" — a
> deliberate, owner-approved trade, not an oversight.
The template-rendered dispatches are all identical and read as boilerplate.
gogobee's LLM writes the prose instead; Pete's templates stop being the renderer
and **become the safety net**.
### Payload
Two additive, optional fields on `Fact` (`peteclient/client.go:33-51`):
```json
{
"headline": "Josie went into the Ossuary alone and came back with the crown.",
"lede": "..."
}
```
Both `omitempty`. Additive fields on existing event types, so deploy order does
not matter.
### The security inversion — do not miss this
`internal/web/adventure.go:374-376` claims template-only output is "safe and
reproducible", and `factGuard` (`:358-372`) is what makes that true. **factGuard
only checks the structured `Subject`/`Opponent` fields.** That is safe today
only because Pete's own templates can print nothing Pete did not interpolate.
The moment gogobee's LLM authors the prose, factGuard is validating fields that
are **no longer the thing being rendered**. Character names are player-chosen,
so a hallucinated or injected name walks onto a public page. This is a live
injection surface, not a theoretical one.
**Required, in the same change that accepts `headline`/`lede` — not a
follow-up:**
- A **prose-level guard**. Pete holds the full roster. Reject any prose
containing a known character name that is absent from `Actors`, and fall back
to `renderAdventure` for that fact.
- The fallback is why **the templates must not be deleted**. They are the
degraded path for every fact the guard rejects, plus every fact from a gogobee
that sends no prose.
- Length caps on both fields, enforced before render. The 64 KiB body cap
(`adventure.go:79`) is not a prose cap.
- The guard runs at ingest, not render, so a rejected dispatch is rejected once
rather than on every page view.
A rejected dispatch should log loudly. It means either gogobee's LLM
hallucinated a name or someone found an injection path, and both are worth
seeing.
### Open question
Whether the LLM prose is persisted alongside the template output or replaces it
in `stories`. Persisting both costs a column and buys the ability to A/B the
voice and to re-render if the guard later tightens. Recommend persisting both.
---
## 3. Room graph + current room
**The graph already exists and is richer than the ask assumed.** This is mostly
"stop throwing the structure away."
### What exists in gogobee today
- `ZoneGraph` / `ZoneNode` / `ZoneEdge` — `internal/plugin/zone_graph.go:84,47,71`.
- `ZoneNodeKind` (`:17-29`): entry, exploration, trap, elite, boss, harvest,
rest_camp, secret, fork, merge.
- `ZoneEdge` (`:71-74`) carries `From`/`To`/`Lock`/`Weight`, with
`ZoneEdgeLockKind` (`:60-68`): none, perception_check, key_required,
level_min, region_clear, stat_check.
- `DungeonRun` (`dnd_zone_run.go:58-85`) tracks `CurrentNode` and
**`VisitedNodes`** — which is exactly the fog-of-war mask, already computed.
- Per-zone graphs in `zone_graph_*.go` (~14 zones), nav in `zone_graph_nav.go`.
### What the wire drops
`pete_roster.go:343-349` flattens all of it into a display string at the last
moment:
```go
Room: fmt.Sprintf("%d / %d", run.CurrentRoom+1, run.TotalRooms)
```
Worse, `CurrentRoom` is a **legacy linear path index derived from
`VisitedNodes`** and is no longer persisted (`dnd_zone_run.go:50-52, 433-442`).
`RoomsTraversed != CurrentRoom+1` once backtracking is involved (`:81-85`). So
the current string is a lossy projection of a graph onto a line that no longer
exists.
### Payload
Extend `RosterDetail` (`peteclient/client.go:260-272`), which lands in Pete's
`whoDetail` (`internal/web/who.go:25-44`). Keep the existing `room` string for
back-compat and add structure beside it:
```json
{
"room": "4 / 9",
"map": {
"zone_id": "ossuary",
"current_node": "n7",
"visited": ["n1", "n3", "n7"],
"nodes": [
{"id": "n1", "kind": "entry"},
{"id": "n3", "kind": "trap"},
{"id": "n7", "kind": "elite"},
{"id": "n9", "kind": "boss"}
],
"edges": [
{"from": "n1", "to": "n3", "lock": "none"},
{"from": "n3", "to": "n7", "lock": "perception_check"},
{"from": "n7", "to": "n9", "lock": "key_required"}
]
}
}
```
### Fog of war is a server-side cut, not a client-side style
**Send only what `VisitedNodes` justifies.** A node the adventurer has not
reached, plus edges leading out of visited nodes with the destination's `kind`
withheld. Do not send the full graph and grey it out in CSS — the map is a
public page, and "view source to find the boss room" is not fog of war.
Concretely: include a node if it is visited, or if it is one hop from a visited
node. For the one-hop ring, send `{"id": "n9", "kind": "unknown"}` — the player
knows a door is there, not what is behind it.
This means the payload is per-adventurer and cannot be shared or cached across
players, which is already true of `RosterDetail`.
### Cost
A zone graph is small (tens of nodes), and this rides the existing 2-minute
roster push (`pete_roster.go:32`), so no new request. The 1 MiB roster cap and
500-entry limit (`internal/web/roster.go:40`) are worth re-checking against 500
adventurers each carrying a subgraph — that is the one real risk here, and it
argues for the one-hop cut on size grounds as well as secrecy.
### Pete side
- `whoDetail` gains the `map` field; `decodeWhoDetail` (`who.go:252`) handles it.
- New map rendering on the who page. The 60s live poll
(`templates/who.html:305`) patches `#who-room` today; it would also patch the
map. Note the poll patches **public detail only** by design (`who.go:160-163`).
---
## 4. Richer item view
**SHIPPED 2026-07-17** — gogobee `b6d4e4c`, Pete `4ce025a`. Neither deployed.
The section below is kept as written, because three of its claims were wrong
and the corrections are the useful part. What actually shipped:
- **`Equipped []ItemView` on `PlayerDetail`, which this section never asked
for.** Equipping *moves* the row from `adventure_inventory` into
`magic_item_equipped` (`magic_items_gameplay.go:679-690`) — the two sets are
disjoint. So `attuned` on a backpack item, below, can never be true: bond
state there isn't false, it's *undefined*. The real gap was that worn items
weren't sent at all. `equippedViews` is where `Attuned` means something.
- **Stat modifiers ARE modeled** — see "What does not exist", which is wrong.
`magicItemEffectFor`/`magicItemEffectSummary` (`magic_items_gameplay.go:211`,
`:538`) produce a player-facing delta ("+15% damage, -8% damage taken"). The
fear below — that a display-only approximation lies the first time it and the
engine disagree — doesn't apply: this *is* the engine's summary, the same
function the game speaks with, so there's nothing to drift from. Sent as
`effect`. Raw per-stat numbers still aren't modeled and still aren't sent.
- **`skill_source` must be filtered, not forwarded.** The column is dual-use:
`"mining"` on masterwork gear, and the internal `"magic_item:<id>"` registry
pointer on magic-item rows (`magic_items_gameplay.go:521-533`). Sending it raw
puts gogobee IDs on a page, and Pete can't tell the two apart to filter them.
The push site sends only the skill name.
Pete-side note: an ItemView can't tell you which panel it's in, and that decides
whether an unbonded attunement item reads as "inert" (worn, doing nothing) or
"needs a bond" (just not worn yet). `internal/web/who.go`'s `itemRow` carries it.
Still open from this ask: **equipping from the web** is ask 5, not this one.
---
Partly buildable now, partly not. Being precise about which is which.
### What exists and is being dropped
`itemViews` (`pete_roster.go:210-225`) sends five of `AdvItem`'s fields
(`internal/plugin/adventure_character.go:150-159`) and drops two:
- **`Slot`** (`EquipmentSlot`, non-empty for MasterworkGear)
- **`SkillSource`** (string, non-empty for MasterworkGear)
Descriptions exist, on other structs:
- **`MagicItem.Desc`** (`magic_items.go:35-46`) — first-sentence SRD summary.
`MagicItem` also has `Kind`, `Rarity`, and **`Attunement bool`**.
- **`EquipmentDef.Description`** (`adventure_character.go:172-177`) — shop
equipment.
### What does not exist
**Stat modifiers and requirements are not modeled.** Not "not sent" — not
modeled. There are no attack/AC/ability deltas on `AdvItem` or `MagicItem`.
Effects are keyed off Tier/Slot/SkillSource and resolved at
`combat_stats.go:36` and `combat_bridge.go:396,489`.
So "+2 to hit" cannot be sent, because nothing computes it. Shipping it means
either inventing a modifier model in gogobee's engine first, or deriving a
display-only approximation from Tier/Slot at the push site — the latter is a
lie the first time the engine and the display disagree, and is not recommended.
**Requirements** likewise do not exist as data. Attunement is the closest real
thing (`MagicItem.Attunement`, with a bond cap of 3), and it is worth surfacing
on its own terms rather than dressed up as a generic requirement.
### Payload
Extend `ItemView` (`peteclient/client.go:356-362` → Pete's
`internal/storage/detail.go:23-29`) with fields that have a real source today:
```json
{
"name": "Crown of the Drowned King",
"type": "MasterworkGear",
"tier": 5,
"value": 4200,
"temper": "...",
"slot": "helmet",
"skill_source": "...",
"desc": "...",
"attunement": true,
"attuned": false
}
```
All additive and `omitempty`; rides the private `/api/ingest/detail` push
(`client.go:393-402`), so deploy order does not matter. `desc` is populated from
`MagicItem.Desc` or `EquipmentDef.Description` depending on the item's origin —
the push site resolves it, since `AdvItem` rows carry no description of their own.
`attunement` (does it need a bond) and `attuned` (does it have one) are distinct
and both matter to a player deciding what to wear, given the cap of 3.
### Deferred
Stat modifiers, until gogobee models them. Tracked as a gogobee engine change,
not a contract change.
---
## 5. `equip_orders` queue
The one ask that needs a write path. **No new network route**: Pete grows a
queue table and a pending/verdict endpoint pair, gogobee grows a poller. Same
shape as mischief.
### Which existing queue to copy: mischief, not escrow
The two existing queues solve the ladder **differently**, and the difference is
load-bearing.
**Escrow** (`storage/games.go:54-58`) has a real `claimed` state, a `claimed_at`,
and a stale-reoffer window (`PendingEscrow`, `:209`). It needs them because real
money moves, the claim response is the authoritative amount to move against, and
a player is watching a spinner (hence `Flush` at `pete_games.go:97` and a 3s
poll).
**Mischief** (`storage/mischief.go:37-42`) has **no `claimed` state at all**.
`/api/mischief/claim` is misleadingly named — it is a *verdict* endpoint. A
gogobee that dies mid-work leaves the row `pending`; it is re-offered next poll;
the guid makes the replay a no-op. **The poll loop is its own retry.** No
`claimed_at`, no stale window, no reconciliation.
An equip order has neither of escrow's forcing properties. Nobody watches a
spinner (the UI must say "queued" regardless), and no money moves. More
importantly an equip is **naturally idempotent** — "sword in weapon slot" is a
desired end state, not a delta, so a replay converges rather than double-applies.
That is exactly mischief's precondition.
**Copy mischief.** Do not inherit the misleading name: call the endpoint
`verdict`.
### Ladder
```
pending -> applied
-> rejected_slot_taken
-> rejected_not_owned
-> rejected_requirements
```
Terminal reasons are enumerated rather than free-text so the web UI can say
something specific. `detail` carries the prose.
### Table
`equip_orders`, modeled on `mischief_orders` (`internal/storage/schema.go:125-139`):
| column | notes |
|---|---|
| `guid` | PK. Pete mints it at insert, so the player sees a reference instantly. |
| `owner_sub` | OIDC subject. `json:"-"` — never crosses to gogobee, same as `MischiefOrder.BuyerSub`. |
| `owner_localpart` | Matrix localpart, via `buyerLocalpart` (`web/mischief.go:21-23`). |
| `character_name` | Who is being dressed. |
| `item_id` | `AdvItem.ID`. |
| `slot` | Target slot, or empty for unequip. |
| `action` | `equip` / `unequip`. |
| `status` | The ladder above. |
| `detail` | Verdict prose. |
| `created_at`, `updated_at` | |
Indexes `(status, created_at)` and `(owner_sub, created_at DESC)`, matching
mischief.
### Endpoints
Bearer-authed, outside the sign-in block, beside the mischief pair
(`server.go:255-256`):
- **`GET /api/equip/pending`** → `[]storage.EquipOrder`. Never `null` — return
`[]` (`web/mischief.go:204-205`). Cap at 50 (`mischiefPollLimit`).
- **`POST /api/equip/verdict`** → `{"guid":..., "status":..., "detail":...}`,
16 KiB cap. Response: the resolved row.
- Missing guid → 400. Unknown guid → 400 + loud `slog.Error`. Bad status → 400.
- **400 is contractual** (`web/mischief.go:222-225`): it parks the row on
gogobee's side rather than retrying forever.
Buyer-side (OIDC, registered only when `adv.Enabled`): an order endpoint plus a
"my orders" list, mirroring `handleMischiefOrder` / `handleMischiefOrders`.
Burst guard 20/hour keyed on OIDC sub, explicitly anti-spam only — the real
eligibility check is gogobee's at verdict time.
### The idempotency mechanic to copy verbatim
`ResolveMischiefOrder` (`storage/mischief.go:115-132`): the UPDATE is guarded
`WHERE guid = ? AND status = 'pending'`, then it **unconditionally reads the row
back**. A first verdict, a retried verdict, and a missing row all take one path,
and the read-back is the authoritative answer. This is the whole reason mischief
can skip the `claimed` state.
### gogobee side
A poller modeled on `pete_mischief.go`: 30s interval, 20s timeout, poll errors
at `Debug` (a Pete predating the feature 404s here, which is not an error).
Apply through the existing equip path so `reconcileMagicAttunements`
(`magic_items_gameplay.go`) still runs — bond capacity and the cap of 3 are that
code's business, not the queue's. Short-circuit on the stamped order guid the
way `placeWebMischief` does.
### Honest UI
An equip lands on gogobee's next poll tick, up to 30s out. **The UI shows
"queued" and never claims it landed.** The order row's status is the truth; the
page reflects the row.
---
## Suggested order of work
1. ~~**Ask 4 (items)**~~ — **done** (gogobee `b6d4e4c`, Pete `4ce025a`). Read the
corrections at the top of §4 before trusting any other section here: this spec
was written from one side at a time, and every claim it got wrong was one that
only breaks when you read both sides together. Assume the same of §§1-3, 5.
2. **Ask 3 (map)** — the graph exists; the work is the one-hop cut and the
rendering. Check the roster size cap.
3. **Ask 5 (equip)** — the architectural step, but a well-trodden one now.
4. **Ask 1 (treasures)** — gated on gogobee emitting loot at all. Pete's handler
deploys first.
5. **Ask 2 (LLM dispatches)** — last, because the prose guard is the only piece
here that fails *publicly* if it is wrong.
## 6. Item comparison — "is this backpack item an upgrade?" (SHIPPED 2026-07-17)
**SHIPPED 2026-07-17 (session 5):** gogobee `7e59697`, Pete `6c6de56`. All tests
green both sides, gofmt-clean, screenshot-verified day + night (all six verdict
chips, including the purple `new` chip the theme-contrast history warned about).
NOT deployed. Additive private `Compare` field → safe deploy order either way.
**The one both-sides error, and it overturned a settled design decision: the game
only ever wears one ring.** `DnDSlotRing2` is declared and looped over as a valid
slot, but nothing in live code assigns to it — every ring in the registry is
`Slot: ring_1`, and the only equip path (`applyMagicEquip`, the same one ask 5's
web button drives) equips to `mi.Slot`. So "weaker of the two worn rings" (the
verified-at-scope proposal below) describes a trade that can't happen. The shipped
behaviour: a backpack ring compares against the `ring_1` occupant — which collapses
the ring special-case entirely, since **every** item's compare target is just
`mi.Slot`. Even a section written after verifying both repos carried the class of
error the rest of the spec did; the ring-slot subtlety was flagged "confirm before
building" and the confirmation is what caught it. (Owner was asked; chose ring_1.)
Everything else below shipped as written: strict-dominance verdict, engine-computed
deltas over tempered effects (reusing `magicItemEffectFor`, no Pete-side math), the
inert override that counts bonds *after* the slot's occupant is evicted, always-
visible verdict chip (no hover — phones don't have one) with deltas beside it. Chip
colours mix a fixed hue into `--ink`/`--card` so they survive all four phases by
construction (the map's trick), NOT a `dark:` variant. The mobile hover→tap
disclosure the spec proposed was dropped: deltas are short (≤3 chips), so showing
them inline is simpler and needs no JS.
---
A sixth ask, scoped after all five shipped. On the owner's own page, hovering a
backpack magic item shows a **compare card**: the item currently worn in that
same slot and the per-stat deltas, so the player can answer "is this better than
what I've got on?" without scrolling between two panels and eyeballing two
opaque effect strings.
**This section was written AFTER verifying both repos** (unlike §§1-5, which were
written a side at a time and were wrong wherever the two sides disagreed). The
findings below are checked against the gogobee engine, not assumed — but treat
the *design decisions* (verdict semantics, ring handling) as proposals, not
settled, and re-confirm the file refs at build time.
### The load-bearing constraint (same one as §4)
**Pete must not compute the comparison.** The ask-4 lesson: a display-only power
approximation *lies the moment it disagrees with the engine*, and character math
lives in gogobee. That is doubly true here — the comparison depends on three
things Pete does not hold:
- **Tempering.** An item's effective power folds in its per-instance temper
(`EquippedMagicItem.Effective()` → `temperedItem`, `magic_items_gameplay.go:252`).
The worn item and the backpack item each temper differently; the diff must be
over *tempered* effects.
- **Bond availability.** An attunement item worn with no free bond is **inert** —
equipping it changes nothing. So the honest verdict for such an item is "would
sit inert until you free a bond," not "downgrade." Same distinction §4/ask 4
drew, resurfacing on the compare card. Bond state is engine-side.
- **Which slot it lands in** (rings — see below).
So gogobee computes the comparison and pushes it; Pete renders it. **Simple diff
arithmetic, engine-side inputs.**
### What the comparison is built from — this is the good news
The Worn-panel items are **magic items**, and their power is a *structured
numeric struct*, not just the opaque `Effect` string:
`magicItemEffect{DamageBonus float64, DamageReductMult float64, FlatDmgStart int,
InitiativeBias float64, MaxHP int}` (`magic_items_gameplay.go:179`), derived by
`magicItemEffectFor(mi)` (`:212`) keyed on Kind+Rarity with a per-item overlay.
So a real field-by-field diff exists. **Diff the structs, never parse the
`Effect` summary string** — the summary drops any field that is zero, so parsing
it back loses deltas.
Direction of "better" per field (the verdict logic needs this):
`DamageBonus` ↑, `FlatDmgStart` ↑, `InitiativeBias` ↑, `MaxHP` ↑ are gains;
`DamageReductMult` is a multiplier on damage taken in `(0,1]`, so **lower is
better** (0.90 = −10% damage taken).
### NOT the masterwork gear
There are two equip systems. This ask is the **magic-item** Worn/backpack panels
(`MagicItem` / `DnDSlot`, effects via `magicItemEffectFor`). The other is
masterwork `EquipmentSlot`/`AdvEquipment` gear feeding `DerivePlayerStats` →
`CombatStats` (`combat_stats.go`). Do **not** cross the streams — different
slots, different power model, scoped out in ask 5. A compare only ever pairs a
magic item against a magic item.
### Payload
Additive `Compare` sub-object on the backpack `ItemView` (`peteclient.ItemView`,
mirrored in Pete `storage.ItemView`). Owner-private — it rides the PlayerDetail
`detail_json` blob (**no migration**, no new endpoint, no public exposure), same
channel as §4. `omitempty` → safe deploy order either way. Item names are
game-authored (not player names), so **no prose-guard / injection surface** like
§2.
```json
"compare": {
"verdict": "upgrade | downgrade | sidegrade | same | new | inert",
"vs_name": "Ring of Protection", // worn item being replaced; "" when verdict=new
"vs_slot": "ring_2", // the slot it would land in (see rings)
"deltas": [
{"label": "damage", "better": true, "text": "+3% damage"},
{"label": "hp", "better": false, "text": "-4 HP"}
]
}
```
`deltas` is engine-rendered player-facing text (like `magicItemEffectSummary`),
one entry per changed field, each flagged `better`. Pete renders chips/arrows off
`better`; it does no math.
### Verdict semantics (proposal — confirm)
Different stats are **not fungible** — the engine cannot say +3% damage beats
−4 HP. So use **strict dominance**, and let the player judge the mixed case:
- **upgrade** — every delta a gain (≥), at least one strict.
- **downgrade** — every delta a loss (≤), at least one strict.
- **sidegrade** — mixed. *This is the case the string-only view could never
show, and the reason this ask exists.* Show all deltas; claim no winner.
- **same** — no field differs.
- **new** — the target slot is empty; frame as "equips into an empty <slot>,"
all-gain but labelled a fill, not a replacement.
- **inert** — attunement item, no free bond: overrides the stat verdict, because
wearing it does nothing until a bond frees.
### Rings are double-slot (the subtlety to decide)
`DnDSlotRing1` / `DnDSlotRing2` (`dnd_equipment.go:24-25`) — two ring slots. A
backpack ring has to compare against *something*. Proposal: compare against the
**weaker of the two worn rings** (the one a sensible player would replace); if
either ring slot is empty, verdict `new` (fills the empty slot). Flag: this is a
judgement call, not derivable — confirm before building.
### Integration points
- **gogobee:** `itemViews` (`pete_roster.go:219`) builds the backpack ItemViews
but does **not** currently know the equipped set (it is shared with the vault
call). The compare needs the equipped magic items in scope — pass them into a
backpack-only post-pass, or a new `itemViewsWithCompare(inv, equipped)`. Attach
`Compare` for backpack magic items only (vault rows carry an id today but no
button; compare follows the same "backpack only" rule). Reuse
`magicItemEffectFor` on `temperedItem(...)` for both sides; read bonds from
`loadEquippedMagicItems`/the attune cap.
- **Pete:** `itemRow` (`internal/web/who.go:111`) already carries per-panel state;
add the compare card to the backpack row template in `who.html`. Hover-tooltip
on desktop. **Mobile has no hover** — render an always-visible verdict chip
(⬆ upgrade / ⬇ downgrade / ⇄ sidegrade / ✦ new / ⚠ inert) and put the full
deltas behind a tap. New Tailwind classes → rebuild+commit `output.css` (the
committed-artifact trap from every prior ask). Screenshot-verify day + night.
### Cost / honest scope
The engine work is small (one diff function over an existing struct, plus the
ring/bond decisions). The UI is the bulk: a tooltip that also degrades to a
tap-target on touch, styled for both phases. No new table, no migration, no new
endpoint, no public surface. Deploy order free (additive private field).
---
## Follow-ups, not covered by any of the five
Both Pete-only.
### `text-[color:var(--ink)]/NN` may be a no-op — unresolved, verify first
Found while fixing the night-phase contrast (`7d2d991`), **not** fixed there.
The evidence points two ways and I could not reconcile it:
- No such rule exists in the built `output.css` — `grep 'text-\[color:var(--ink)\]/55'`
finds nothing, and all 21 `var(--ink)` references in the output come from
hand-written component CSS, not from these classes.
- The item description in the Worn panel computes to a **fixed `rgb(74,46,42)`
that does not change with the phase** — that is dawn's `--ink` as a literal,
from a source I never located.
- Tailwind v3 cannot apply an opacity modifier to an arbitrary `var()` colour,
which would explain all of the above.
- **But** a night-phase screenshot showed that same text rendering as readable
cream, which contradicts the computed value outright.
So: probably a pre-existing site-wide no-op, silently dropping the muted-text
styling wherever it appears — `who.html` uses `/45`, `/50`, `/55` throughout,
and it is not confined to the new item panels. Treat the above as a lead, not a
finding. **Start by explaining the screenshot/computed contradiction** — one of
the two observations is measuring the wrong thing, and which one decides whether
there is a bug here at all.
Measuring this in the live page is booby-trapped, and each of these cost time:
reading an element's own background returns its translucent chip fill rather
than its backdrop (walk up from `parentElement`); a page reload resets
`data-phase` to the server-rendered value (`data-phase-lock` in `layout.html:2`
stops the clock script, not a reload); and reading the card colour and the text
colour in different ticks silently mixes two phases. A screenshot was ground
truth every time a computed value was not.
If it is real, the fix is the same shape as `--warn`: a phase variable, or a
hand-written utility — not a Tailwind arbitrary-value class with an opacity
modifier. See the `pete_theme_contrast` note for why `dark:` is never the answer
here (`darkMode` is unconfigured, so it follows the OS, not Pete's phase —
`status.html` and `channel.html` still have that bug).
### Richer live sheet
The live sheet poll patches only HP/AC/room/supplies/threat
(`templates/who.html:287-290`).
internal/games/klondike/klondike.go
+25
View File
@@ -620,6 +620,31 @@ func (s State) Net() int64 {
// cleared reports whether every card is home. // cleared reports whether every card is home.
func (s State) cleared() bool { return s.Home() == FullDeck } func (s State) cleared() bool { return s.Home() == FullDeck }
// Won reports that the board is a guaranteed clear: nothing left in the stock or
// waste, and not a single face-down card under any column. From here every card
// is a face-up run and a single auto() drains the whole board to the foundations
// without a choice left to make — which is exactly the tedious tail the felt
// should offer to finish in one gesture instead of thirty double-clicks.
//
// It's deliberately narrower than "solvable": a draw-one board with cards still
// in the stock is winnable too, but auto() won't turn the stock over, so calling
// that won would light a finish button that then stalls. This is the state the
// finish button actually finishes.
func (s State) Won() bool {
if s.Phase == PhaseDone || s.cleared() {
return false
}
if len(s.Stock) > 0 || len(s.Waste) > 0 {
return false
}
for _, p := range s.Table {
if len(p.Down) > 0 {
return false
}
}
return true
}
// CanAuto reports whether anything can go home at all — which is what greys the // CanAuto reports whether anything can go home at all — which is what greys the
// finish button out rather than letting it be pressed at a board that has nothing // finish button out rather than letting it be pressed at a board that has nothing
// for it. // for it.
internal/games/klondike/klondike_test.go
+46
View File
@@ -423,6 +423,52 @@ func TestAutoSendsEverythingItCanHome(t *testing.T) {
refuses(t, next, Move{Kind: "auto"}, ErrNothingHome) refuses(t, next, Move{Kind: "auto"}, ErrNothingHome)
} }
// Won is the state the finish button finishes: every card face up, the stock and
// waste drained, so a single auto sweeps the lot home. The button is only honest
// if these two agree — Won lighting up on a board auto can't clear would stall.
func TestWonIsExactlyWhatAutoCanFinish(t *testing.T) {
s := board(patient(), 5200)
// A won board: three short face-up runs across the columns, nothing face down,
// nothing in the stock or waste. Every card is reachable.
s.Table[0].Up = []cards.Card{card(2, cards.Spades), card(cards.Ace, cards.Hearts)}
s.Table[1].Up = []cards.Card{card(2, cards.Hearts), card(cards.Ace, cards.Spades)}
s.Table[2].Up = []cards.Card{card(2, cards.Diamonds), card(cards.Ace, cards.Clubs)}
s.Table[3].Up = []cards.Card{card(2, cards.Clubs), card(cards.Ace, cards.Diamonds)}
if !s.Won() {
t.Fatalf("a board with everything face up and the piles empty is won")
}
next, _ := apply(t, s, Move{Kind: "auto"})
if next.Home() != 8 { // the eight cards laid out above
t.Fatalf("auto homed %d cards, want 8 — the whole won board", next.Home())
}
// Anything still hidden or still in a pile is not won: auto would stall on it.
withStock := s.clone()
withStock.Stock = cards.Deck{card(5, cards.Spades)}
if withStock.Won() {
t.Errorf("a board with a card still in the stock is not won — auto won't turn it over")
}
withWaste := s.clone()
withWaste.Waste = []cards.Card{card(5, cards.Spades)}
if withWaste.Won() {
t.Errorf("a board with a card still in the waste is not won")
}
withDown := s.clone()
withDown.Table[5].Down = []cards.Card{card(5, cards.Spades)}
if withDown.Won() {
t.Errorf("a board with a face-down card is not won")
}
// A finished board is never won: the button belongs to a game still in play.
cleared := s.clone()
cleared.Phase = PhaseDone
if cleared.Won() {
t.Errorf("a settled board reports won")
}
}
// ---- the money ------------------------------------------------------------- // ---- the money -------------------------------------------------------------
// The number the felt quotes while you play and the number settle() lands on are // The number the felt quotes while you play and the number settle() lands on are
internal/storage/adventure.go
+350
View File
@@ -0,0 +1,350 @@
package storage
import (
"database/sql"
"encoding/json"
"sort"
"strings"
)
// The durable record of what has actually happened in the realm.
//
// Every other adventure table is a snapshot gogobee replaces wholesale. This one
// accumulates, because the questions it answers are historical: what has this
// adventurer killed, where have they been, how many times have they died. The
// story feed technically holds the same information — but as English, inside a
// headline, which you cannot count.
//
// Pete still computes nothing about the *game*. It only counts facts gogobee
// already told it. No row here is ever authored by Pete or edited after insert.
// AdvEvent is one game fact, kept as fact rather than as the sentence it was
// rendered into. Mirrors web.AdvFact minus the transport-only fields (no_push,
// class_race) that describe delivery rather than the event. Stakes is the one
// former transport field kept here: for a treasure_found it carries the item's
// name, which is the fact, not the delivery.
type AdvEvent struct {
GUID string `json:"guid"`
EventType string `json:"event_type"`
Tier string `json:"tier"`
Subject string `json:"subject"`
Opponent string `json:"opponent"`
Boss string `json:"boss"`
Zone string `json:"zone"`
Region string `json:"region"`
Level int `json:"level"`
Tally int `json:"tally"`
Outcome string `json:"outcome"`
Milestone string `json:"milestone"`
Stakes string `json:"stakes"`
Actors []string `json:"actors"`
// RunID is set on the dispatches that are the *ending* of an expedition — a
// clear, a retreat, a death. It is the join from "how it went" to "what
// happened", and it is empty on every other kind of fact.
RunID string `json:"run_id,omitempty"`
OccurredAt int64 `json:"occurred_at"`
}
// InsertAdventureEvent records a fact. Idempotent on guid via INSERT OR IGNORE:
// gogobee retries a fact whose ack it lost, and a retried siege must not add a
// second kill to anybody's tally. The story insert upstream is guarded by
// IsGUIDSeen for the same reason; this is the same guarantee enforced by the
// table rather than by a check-then-act that a concurrent retry could race.
func InsertAdventureEvent(e *AdvEvent) error {
actors, err := json.Marshal(e.Actors)
if err != nil {
return err
}
_, err = Get().Exec(`
INSERT OR IGNORE INTO adventure_events
(guid, event_type, tier, subject, opponent, boss, zone, region,
level, tally, outcome, milestone, stakes, actors, run_id, occurred_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
e.GUID, e.EventType, e.Tier, e.Subject, e.Opponent, e.Boss, e.Zone,
e.Region, e.Level, e.Tally, e.Outcome, e.Milestone, e.Stakes, string(actors),
e.RunID, e.OccurredAt)
return err
}
// AdventureEventByGUID returns the stored fact behind one dispatch, or nil when
// there isn't one. Missing is normal, not an error: the story row is inserted
// first and the fact record is best-effort (see handleAdventureIngest), and every
// dispatch that predates the fact table has a story and no fact at all. Callers
// render the thinner event_type-only view in that case.
func AdventureEventByGUID(guid string) (*AdvEvent, error) {
if guid == "" {
return nil, nil
}
var e AdvEvent
var tier, subject, opponent, boss, zone, region, outcome, milestone, stakes, actors, runID sql.NullString
err := Get().QueryRow(`
SELECT guid, event_type, tier, subject, opponent, boss, zone, region,
level, tally, outcome, milestone, stakes, actors, run_id, occurred_at
FROM adventure_events WHERE guid = ?`, guid).Scan(
&e.GUID, &e.EventType, &tier, &subject, &opponent, &boss, &zone, &region,
&e.Level, &e.Tally, &outcome, &milestone, &stakes, &actors, &runID, &e.OccurredAt)
if err == sql.ErrNoRows {
return nil, nil
}
if err != nil {
return nil, err
}
e.Tier, e.Subject, e.Opponent = tier.String, subject.String, opponent.String
e.Boss, e.Zone, e.Region = boss.String, zone.String, region.String
e.Outcome, e.Milestone, e.Stakes = outcome.String, milestone.String, stakes.String
e.RunID = runID.String
if actors.String != "" {
_ = json.Unmarshal([]byte(actors.String), &e.Actors)
}
return &e, nil
}
// AdventureEventFacets returns the (event_type, tier, outcome) of many dispatches
// in one read, keyed by guid. It exists so a feed page can tint two dozen cards
// by what they actually are without paying a query per card — the pool is
// MaxOpenConns(1), so N round trips would serialize behind each other.
//
// Guids absent from the map are dispatches with no fact row; the caller leaves
// those untinted rather than guessing.
func AdventureEventFacets(guids []string) map[string]AdvEvent {
out := make(map[string]AdvEvent, len(guids))
if len(guids) == 0 {
return out
}
q := `SELECT guid, event_type, tier, outcome FROM adventure_events WHERE guid IN (?` +
strings.Repeat(`,?`, len(guids)-1) + `)`
args := make([]any, len(guids))
for i, g := range guids {
args[i] = g
}
rows, err := Get().Query(q, args...)
if err != nil {
return out
}
defer rows.Close()
for rows.Next() {
var e AdvEvent
var tier, outcome sql.NullString
if err := rows.Scan(&e.GUID, &e.EventType, &tier, &outcome); err != nil {
return out
}
e.Tier, e.Outcome = tier.String, outcome.String
out[e.GUID] = e
}
return out
}
// BossTally is one monster and how many times this adventurer has put it down.
type BossTally struct {
Boss string `json:"boss"`
Kills int `json:"kills"`
First bool `json:"first"` // they were the first in the realm to ever clear it
}
// ZoneTally is one zone and how many times this adventurer has cleared it.
type ZoneTally struct {
Zone string `json:"zone"`
Region string `json:"region"`
Clears int `json:"clears"`
First bool `json:"first"`
}
// TrophyCase is an adventurer's whole history, counted.
//
// Treasure is counted only from the treasure_found fact, never from the vault
// snapshot: a bought sword is not a trophy, and the snapshot is current-state
// with no "found it in X on day 3". So a treasure tally that predates the first
// treasure_found is a clean zero, not a back-derivation.
type TrophyCase struct {
Name string `json:"name"`
Bosses []BossTally `json:"bosses,omitempty"`
Zones []ZoneTally `json:"zones,omitempty"`
Treasures []TreasureTally `json:"treasures,omitempty"`
BossKills int `json:"boss_kills"` // total, including firsts
BossFirsts int `json:"boss_firsts"` // realm-firsts among them
ZoneClears int `json:"zone_clears"`
ZoneFirsts int `json:"zone_firsts"`
TreasuresFound int `json:"treasures_found"` // story-grade finds, total
TreasureFirsts int `json:"treasure_firsts"` // realm-first hoards among them
Deaths int `json:"deaths"`
Retreats int `json:"retreats"`
RivalWins int `json:"rival_wins"`
Milestones []string `json:"milestones,omitempty"`
Survived int `json:"survived"` // mischief contracts walked away from
Downed int `json:"downed"` // mischief contracts that landed
Events int `json:"events"` // total facts on file
FirstSeen int64 `json:"first_seen"`
LastSeen int64 `json:"last_seen"`
}
// TreasureTally is one story-grade find: the item's name, the zone it came out
// of, and whether it was a realm-first hoard. Unlike bosses and zones there is no
// repeat count — a named treasure is found once, so each is its own row.
type TreasureTally struct {
Item string `json:"item"`
Zone string `json:"zone"`
First bool `json:"first"` // first in the realm to pull this hoard
}
// EventsBySubject returns every fact about a character, newest first. This is the
// timeline *and* the trophy source: one read, aggregated in Go, because the pool
// is MaxOpenConns(1) and six COUNT queries against it would serialize behind each
// other for an answer that fits comfortably in memory (a busy adventurer
// accumulates tens of facts, not millions).
//
// limit <= 0 means no limit, and callers who count should use it. A limit here
// silently truncates a *tally*, not just a list: read 40 facts for a display cap
// and a veteran's kill count quietly stops at 40 and stays wrong forever. Cap the
// trail in the caller, after the counting is done.
//
// Facts where the character is the *opponent* are included: a duel they lost is
// part of their history, and only the subject field would otherwise carry it.
func EventsBySubject(name string, limit int) ([]AdvEvent, error) {
if name == "" {
return nil, nil
}
q := `
SELECT guid, event_type, tier, subject, opponent, boss, zone, region,
level, tally, outcome, milestone, stakes, actors, occurred_at
FROM adventure_events
WHERE subject = ? OR opponent = ?
ORDER BY occurred_at DESC`
args := []any{name, name}
if limit > 0 {
q += ` LIMIT ?`
args = append(args, limit)
}
rows, err := Get().Query(q, args...)
if err != nil {
return nil, err
}
defer rows.Close()
var out []AdvEvent
for rows.Next() {
var e AdvEvent
var tier, subject, opponent, boss, zone, region, outcome, milestone, stakes, actors sql.NullString
if err := rows.Scan(&e.GUID, &e.EventType, &tier, &subject, &opponent,
&boss, &zone, &region, &e.Level, &e.Tally, &outcome, &milestone,
&stakes, &actors, &e.OccurredAt); err != nil {
return nil, err
}
e.Tier, e.Subject, e.Opponent = tier.String, subject.String, opponent.String
e.Boss, e.Zone, e.Region = boss.String, zone.String, region.String
e.Outcome, e.Milestone, e.Stakes = outcome.String, milestone.String, stakes.String
if actors.String != "" {
_ = json.Unmarshal([]byte(actors.String), &e.Actors)
}
out = append(out, e)
}
return out, rows.Err()
}
// BuildTrophyCase counts a character's history out of their facts. Pure: it takes
// the rows EventsBySubject already read rather than querying again, so the who
// page pays for one database read and gets both the timeline and the trophies.
//
// Only facts where the character is the *subject* count toward trophies. They
// appear in an ally's dispatch as an opponent too, and crediting those would let
// a duel someone lost show up as a kill in their own case.
func BuildTrophyCase(name string, events []AdvEvent) TrophyCase {
tc := TrophyCase{Name: name}
bosses := map[string]*BossTally{}
zones := map[string]*ZoneTally{}
for _, e := range events {
if tc.LastSeen == 0 || e.OccurredAt > tc.LastSeen {
tc.LastSeen = e.OccurredAt
}
if tc.FirstSeen == 0 || e.OccurredAt < tc.FirstSeen {
tc.FirstSeen = e.OccurredAt
}
tc.Events++
if e.Subject != name {
continue // they're the other party in someone else's dispatch
}
switch e.EventType {
case "boss_kill", "boss_first":
tc.BossKills++
if e.Boss != "" {
b := bosses[e.Boss]
if b == nil {
b = &BossTally{Boss: e.Boss}
bosses[e.Boss] = b
}
b.Kills++
if e.EventType == "boss_first" {
b.First = true
}
}
if e.EventType == "boss_first" {
tc.BossFirsts++
}
case "zone_clear", "zone_first":
tc.ZoneClears++
if e.Zone != "" {
z := zones[e.Zone]
if z == nil {
z = &ZoneTally{Zone: e.Zone, Region: e.Region}
zones[e.Zone] = z
}
z.Clears++
if e.EventType == "zone_first" {
z.First = true
}
}
if e.EventType == "zone_first" {
tc.ZoneFirsts++
}
case "treasure_found":
tc.TreasuresFound++
// A realm-first hoard rides the priority tier, the same way zone_first
// does; a plain story-grade find is a bulletin.
first := e.Tier == "priority"
if first {
tc.TreasureFirsts++
}
if e.Stakes != "" {
tc.Treasures = append(tc.Treasures, TreasureTally{Item: e.Stakes, Zone: e.Zone, First: first})
}
case "death":
tc.Deaths++
case "retreat":
tc.Retreats++
case "rival_result":
tc.RivalWins++ // the fact's subject is the winner; see renderAdventure
case "milestone":
if e.Milestone != "" {
tc.Milestones = append(tc.Milestones, e.Milestone)
}
case "mischief_survived":
tc.Survived++
case "mischief_downed":
tc.Downed++
}
}
for _, b := range bosses {
tc.Bosses = append(tc.Bosses, *b)
}
for _, z := range zones {
tc.Zones = append(tc.Zones, *z)
}
// Deterministic order: most-fought first, then alphabetical. The tiebreak is
// not cosmetic — map iteration is randomized in Go, so without it the panel
// reshuffles on every request and a cached page and a live one disagree.
sort.Slice(tc.Bosses, func(i, j int) bool {
if tc.Bosses[i].Kills != tc.Bosses[j].Kills {
return tc.Bosses[i].Kills > tc.Bosses[j].Kills
}
return tc.Bosses[i].Boss < tc.Bosses[j].Boss
})
sort.Slice(tc.Zones, func(i, j int) bool {
if tc.Zones[i].Clears != tc.Zones[j].Clears {
return tc.Zones[i].Clears > tc.Zones[j].Clears
}
return tc.Zones[i].Zone < tc.Zones[j].Zone
})
return tc
}
internal/storage/adventure_test.go
+164
View File
@@ -0,0 +1,164 @@
package storage
import "testing"
// adventure_events is the only adventure store that accumulates, so it is the
// only one where a duplicate delivery is permanently wrong: the roster forgives
// a double push by replacing itself, a double-counted boss kill is in the tally
// forever. These tests pin that, and pin what the trophy case will and won't
// credit an adventurer for.
func ev(guid, typ, subject string, at int64) *AdvEvent {
return &AdvEvent{GUID: guid, EventType: typ, Subject: subject, OccurredAt: at}
}
// TestInsertAdventureEventIdempotent: gogobee retries a fact whose ack it lost.
// The retry must be a no-op, not a second kill.
func TestInsertAdventureEventIdempotent(t *testing.T) {
setupTestDB(t)
e := ev("boss_kill:abc:1", "boss_kill", "Josie", 1000)
e.Boss = "The Rotmother"
for i := 0; i < 3; i++ {
if err := InsertAdventureEvent(e); err != nil {
t.Fatalf("insert %d: %v", i, err)
}
}
events, err := EventsBySubject("Josie", 0)
if err != nil {
t.Fatalf("EventsBySubject: %v", err)
}
if len(events) != 1 {
t.Fatalf("after 3 deliveries of one fact: got %d rows, want 1", len(events))
}
if tc := BuildTrophyCase("Josie", events); tc.BossKills != 1 {
t.Fatalf("boss kills: got %d, want 1 — a retry inflated the tally", tc.BossKills)
}
}
// TestTrophyCaseCounts walks a full history and checks each tally.
func TestTrophyCaseCounts(t *testing.T) {
setupTestDB(t)
first := ev("boss_first:1:1", "boss_first", "Josie", 100)
first.Boss = "The Rotmother"
repeat := ev("boss_kill:2:2", "boss_kill", "Josie", 200)
repeat.Boss = "The Rotmother"
other := ev("boss_kill:3:3", "boss_kill", "Josie", 300)
other.Boss = "Gravebloom"
zone := ev("zone_clear:4:4", "zone_clear", "Josie", 400)
zone.Zone, zone.Region = "holymachina", "the Reach"
death := ev("death:5:5", "death", "Josie", 500)
mile := ev("milestone:6:6", "milestone", "Josie", 600)
mile.Milestone = "level 20"
for _, e := range []*AdvEvent{first, repeat, other, zone, death, mile} {
if err := InsertAdventureEvent(e); err != nil {
t.Fatalf("insert %s: %v", e.GUID, err)
}
}
events, err := EventsBySubject("Josie", 0)
if err != nil {
t.Fatalf("EventsBySubject: %v", err)
}
tc := BuildTrophyCase("Josie", events)
if tc.BossKills != 3 {
t.Errorf("boss kills: got %d, want 3 (a first is still a kill)", tc.BossKills)
}
if tc.BossFirsts != 1 {
t.Errorf("boss firsts: got %d, want 1", tc.BossFirsts)
}
if tc.ZoneClears != 1 || tc.Deaths != 1 {
t.Errorf("zones/deaths: got %d/%d, want 1/1", tc.ZoneClears, tc.Deaths)
}
if len(tc.Milestones) != 1 || tc.Milestones[0] != "level 20" {
t.Errorf("milestones: got %v, want [level 20]", tc.Milestones)
}
// Ordering is by kills desc: the twice-killed Rotmother outranks Gravebloom.
if len(tc.Bosses) != 2 || tc.Bosses[0].Boss != "The Rotmother" || tc.Bosses[0].Kills != 2 {
t.Fatalf("boss tallies: got %+v, want Rotmother×2 first", tc.Bosses)
}
if !tc.Bosses[0].First {
t.Error("Rotmother should be flagged as a realm-first")
}
if tc.FirstSeen != 100 || tc.LastSeen != 600 {
t.Errorf("span: got %d..%d, want 100..600", tc.FirstSeen, tc.LastSeen)
}
}
// TestTrophyCaseTreasures: story-grade finds count out of the treasure_found
// fact, the priority tier marks a realm-first hoard, and the item name rides the
// stakes field into a per-find row. A find with no name still counts but earns no
// showcase row.
func TestTrophyCaseTreasures(t *testing.T) {
setupTestDB(t)
hoard := ev("treasure_found:1:1", "treasure_found", "Josie", 100)
hoard.Tier, hoard.Stakes, hoard.Zone = "priority", "Crown of the Drowned King", "The Ossuary"
find := ev("treasure_found:2:2", "treasure_found", "Josie", 200)
find.Tier, find.Stakes, find.Zone = "bulletin", "Ring of Nine Sorrows", "The Sump"
nameless := ev("treasure_found:3:3", "treasure_found", "Josie", 300)
nameless.Tier = "bulletin" // a find gogobee sent without a stakes noun
for _, e := range []*AdvEvent{hoard, find, nameless} {
if err := InsertAdventureEvent(e); err != nil {
t.Fatalf("insert %s: %v", e.GUID, err)
}
}
events, err := EventsBySubject("Josie", 0)
if err != nil {
t.Fatalf("EventsBySubject: %v", err)
}
tc := BuildTrophyCase("Josie", events)
if tc.TreasuresFound != 3 {
t.Errorf("treasures found: got %d, want 3 (a nameless find still happened)", tc.TreasuresFound)
}
if tc.TreasureFirsts != 1 {
t.Errorf("treasure firsts: got %d, want 1 (only the priority hoard)", tc.TreasureFirsts)
}
// Only the two named finds earn a showcase row, newest first.
if len(tc.Treasures) != 2 {
t.Fatalf("treasure rows: got %d, want 2 (nameless earns no row)", len(tc.Treasures))
}
if tc.Treasures[0].Item != "Ring of Nine Sorrows" || tc.Treasures[0].First {
t.Errorf("newest row wrong: %+v", tc.Treasures[0])
}
if tc.Treasures[1].Item != "Crown of the Drowned King" || !tc.Treasures[1].First || tc.Treasures[1].Zone != "The Ossuary" {
t.Errorf("hoard row wrong: %+v", tc.Treasures[1])
}
}
// TestTrophyCaseIgnoresOpponentCredit is the one that matters for honesty. A
// duel Josie *lost* still names her, as the opponent in Quack's dispatch. It
// belongs on her timeline but must never be credited to her trophy case.
func TestTrophyCaseIgnoresOpponentCredit(t *testing.T) {
setupTestDB(t)
lost := ev("rival_result:1:1", "rival_result", "Quack", 100)
lost.Opponent = "Josie" // Quack won; Josie is the one who got beaten
won := ev("rival_result:2:2", "rival_result", "Josie", 200)
won.Opponent = "Quack"
for _, e := range []*AdvEvent{lost, won} {
if err := InsertAdventureEvent(e); err != nil {
t.Fatalf("insert: %v", err)
}
}
events, err := EventsBySubject("Josie", 0)
if err != nil {
t.Fatalf("EventsBySubject: %v", err)
}
// Both facts are hers to *see* — the loss is part of her story.
if len(events) != 2 {
t.Fatalf("timeline: got %d events, want 2 (a loss is still history)", len(events))
}
// But only the one she won is hers to *claim*.
if tc := BuildTrophyCase("Josie", events); tc.RivalWins != 1 {
t.Fatalf("rival wins: got %d, want 1 — a loss was credited as a win", tc.RivalWins)
}
}
internal/storage/db.go
+42
View File
@@ -101,6 +101,39 @@ func runMigrations(d *sql.DB) error {
// click-through page. Rides the roster snapshot; NULL on rows pushed by a // click-through page. Rides the roster snapshot; NULL on rows pushed by a
// gogobee build that predates the detail page. // gogobee build that predates the detail page.
addColumnIfMissing(d, "adventure_roster", "detail_json", "TEXT") addColumnIfMissing(d, "adventure_roster", "detail_json", "TEXT")
// The noun a fact is about (a mischief bounty, a found treasure's name). Facts
// recorded before the treasure_found event existed carry NULL, which is right:
// they had no such noun to keep.
addColumnIfMissing(d, "adventure_events", "stakes", "TEXT")
// The run behind a dispatch that *ended* one. NULL on every fact filed before
// the run report existed and on every fact that isn't the end of an
// expedition; both simply render without the "read the run" link.
addColumnIfMissing(d, "adventure_events", "run_id", "TEXT")
// The liveblog's late-arriving prose and the column that carries it. Both are
// in their tables' CREATE TABLE — those tables have never shipped — so these
// two adds exist only for a database that already ran an earlier build of the
// run-liveblog branch.
addColumnIfMissing(d, "adventure_run", "summary", "TEXT NOT NULL DEFAULT ''")
addColumnIfMissing(d, "adventure_run_beat", "prose", "TEXT NOT NULL DEFAULT ''")
// Ask 7: upgrade orders carry a target tier for the 5 standard equipment slots.
addColumnIfMissing(d, "equip_orders", "tier", "INTEGER NOT NULL DEFAULT 0")
// W5b: the three verbs that take arguments (which zone, which loadout, how
// many days of sitting) carry them as one small JSON object. W5a's two verbs
// take none, so an existing row gets '' and reads back as no params — which is
// exactly what extract and siege_join mean.
addColumnIfMissing(d, "adventure_orders", "params", "TEXT NOT NULL DEFAULT ''")
// Adventure alerts. A subscription made before they existed knows only the OIDC
// subject, and the adventure ownership join needs the Matrix localpart — so an
// existing row gets "" here and is skipped for owner-scoped alerts until the
// browser re-subscribes, which it does on every page load that has push on.
// Realm-wide alerts (the Siege) need no localpart and work immediately.
addColumnIfMissing(d, "push_subscriptions", "user_localpart", "TEXT NOT NULL DEFAULT ''")
// The adventure watermark is deliberately separate from last_notified_at: the
// digest and the alerts run on different clocks (6 hours vs 2 minutes), and
// sharing one column would let whichever ran last decide what the other had
// already seen. 0 on a pre-existing row is corrected to "now" on the first
// pass rather than replaying every dispatch Pete has ever stored.
addColumnIfMissing(d, "push_subscriptions", "last_adv_notified_at", "INTEGER NOT NULL DEFAULT 0")
// FTS5 virtual tables don't support IF NOT EXISTS reliably. // FTS5 virtual tables don't support IF NOT EXISTS reliably.
// Check sqlite_master before creating. // Check sqlite_master before creating.
@@ -146,6 +179,15 @@ func RunMaintenance() {
exec("prune old daily_visitors", exec("prune old daily_visitors",
`DELETE FROM daily_visitors WHERE day < ?`, unixDay()-30) `DELETE FROM daily_visitors WHERE day < ?`, unixDay()-30)
// Finished expedition logs. Kept for longer than the page shows them (the
// adventurer page hides a run six hours after it ends) because the dispatch
// that announced the run outlives the run, and a dead link from a story to
// its own log is worse than a log nobody reads. A run still walking is never
// pruned however old it looks — see PruneRuns for why.
if err := PruneRuns(nowUnix() - int64(14*86400)); err != nil {
slog.Error("db exec failed", "op", "prune finished runs", "err", err)
}
exec("wal checkpoint", "PRAGMA wal_checkpoint(TRUNCATE)") exec("wal checkpoint", "PRAGMA wal_checkpoint(TRUNCATE)")
exec("optimize", "PRAGMA optimize") exec("optimize", "PRAGMA optimize")
} }
internal/storage/detail.go
+137 -1
View File
@@ -15,17 +15,146 @@ type PlayerDetail struct {
Token string `json:"token"` Token string `json:"token"`
Inventory []ItemView `json:"inventory,omitempty"` Inventory []ItemView `json:"inventory,omitempty"`
Vault []ItemView `json:"vault,omitempty"` Vault []ItemView `json:"vault,omitempty"`
Equipped []ItemView `json:"equipped,omitempty"`
House HouseView `json:"house"` House HouseView `json:"house"`
Pets []PetView `json:"pets,omitempty"` Pets []PetView `json:"pets,omitempty"`
// Slots is the 5 standard equipment slots (weapon/armor/helmet/boots/tool) —
// owner-only, the input to the web equipment-management panel. Worn
// masterwork/arena pieces surface HERE (via CanTakeOff), not in Equipped, which
// stays magic-only (the DnD slots). See EquipSlotView.
Slots []EquipSlotView `json:"slots,omitempty"`
// Balance is the owner's euro balance, for the upgrade/repair confirm dialogs.
Balance float64 `json:"balance,omitempty"`
// Zones / Resume / Babysit are the W5b action offers: what this owner may ask
// for from the web right now, priced by gogobee. Pete renders these and does no
// arithmetic — every price and every gate is the game's, quoted at push time.
//
// An offer is NOT a permission. It is up to two minutes stale, so gogobee
// re-resolves the zone, the price and the fee when the order lands. What the
// list buys is a page that does not offer a button certain to be refused.
Zones []ZoneOffer `json:"zones,omitempty"`
Resume *ResumeOffer `json:"resume,omitempty"`
Babysit *BabysitOffer `json:"babysit,omitempty"`
} }
// ItemView is one backpack or vault item. // ZoneOffer is one place the owner may set out for. Absent entirely while they
// are already out, so an empty list means "not right now" rather than "nowhere".
type ZoneOffer struct {
ID string `json:"id"`
Display string `json:"display"`
Tier int `json:"tier"`
Hook string `json:"hook,omitempty"`
Postgame bool `json:"postgame,omitempty"`
Loadouts []LoadoutOffer `json:"loadouts,omitempty"`
}
// LoadoutOffer is one supply preset: what it is called, what it costs, and how
// many days of provisions it buys. Key is what the order carries back.
type LoadoutOffer struct {
Key string `json:"key"` // lean|balanced|heavy
Name string `json:"name"`
Blurb string `json:"blurb,omitempty"`
Cost int `json:"cost"`
Days int `json:"days"`
}
// ResumeOffer is the extracted expedition still waiting to be walked back into.
// ExpiresAt is the end of the seven-day window, so the page can say how long is
// left rather than only that there is a way back.
type ResumeOffer struct {
ZoneID string `json:"zone_id"`
Display string `json:"display"`
Tier int `json:"tier"`
Day int `json:"day"`
ExpiresAt int64 `json:"expires_at,omitempty"`
Loadouts []LoadoutOffer `json:"loadouts,omitempty"`
}
// BabysitOffer is the pet sitter's standing and the two prices they charge. It
// is pushed even when a sitter is engaged: "looked after until Tuesday" is what
// the page should say instead of a buy button.
type BabysitOffer struct {
Active bool `json:"active"`
ExpiresAt int64 `json:"expires_at,omitempty"`
WeekCost int `json:"week_cost"`
MonthCost int `json:"month_cost"`
}
// EquipSlotView is one of the 5 standard equipment slots as gogobee pushed it,
// carrying everything the management panel needs to render its controls: what is
// worn now, whether it can be taken off (masterwork/arena round-trip to the pack),
// the next tier's name and price for an upgrade offer, and a repair cost when the
// piece is damaged. Pete renders it verbatim and trusts only these facts — a
// client-forged tier or price is ignored, resolved back against this view.
type EquipSlotView struct {
Slot string `json:"slot"` // weapon|armor|helmet|boots|tool
Name string `json:"name"`
Tier int `json:"tier"`
Condition int `json:"condition"`
Masterwork bool `json:"masterwork,omitempty"`
ArenaTier int `json:"arena_tier,omitempty"`
CanTakeOff bool `json:"can_take_off,omitempty"` // masterwork/arena → round-trippable to the pack
NextTier int `json:"next_tier,omitempty"` // 0 = at max tier (5), no upgrade offered
NextName string `json:"next_name,omitempty"`
NextPrice float64 `json:"next_price,omitempty"`
RepairCost int `json:"repair_cost,omitempty"` // 0 = full condition, nothing to repair
}
// ItemView is one item in a private panel — backpack, vault, or worn.
//
// Desc and Effect arrive already resolved: gogobee's inventory rows carry no
// description, and the combat delta is computed from the item rather than
// stored. Effect is the game engine's own summary, not Pete's guess at one — if
// it ever disagrees with what the item does in a fight, that is a gogobee bug
// and not something Pete can paper over here.
//
// Attunement means the item wants a bond; Attuned means it has one. Only worn
// items can be Attuned — equipping moves the row out of gogobee's inventory
// table entirely, so a backpack item's bond state isn't false, it's undefined.
type ItemView struct { type ItemView struct {
// ID is the adventure_inventory row id, sent only for a backpack item that can
// be worn through the magic-item path — so a non-zero ID doubles as "this item
// has an Equip button." Worn items carry none: unequip keys on Slot. The id is
// the handle an equip order round-trips back to gogobee to name the item.
ID int64 `json:"id,omitempty"`
Name string `json:"name"` Name string `json:"name"`
Type string `json:"type"` Type string `json:"type"`
Tier int `json:"tier"` Tier int `json:"tier"`
Value int64 `json:"value"` Value int64 `json:"value"`
Temper int `json:"temper,omitempty"` Temper int `json:"temper,omitempty"`
Slot string `json:"slot,omitempty"`
SkillSource string `json:"skill_source,omitempty"`
Desc string `json:"desc,omitempty"`
Effect string `json:"effect,omitempty"`
Attunement bool `json:"attunement,omitempty"`
Attuned bool `json:"attuned,omitempty"`
// Compare, set only on backpack magic items (the ones carrying an equip ID),
// pairs this item against what is worn in the slot it would equip into. gogobee
// computes the verdict and per-stat deltas (the power math needs tempering and
// bond state, which live in the engine); Pete only renders it. Owner-private,
// rides detail_json — no public exposure. Item names here are game-authored, so
// there is no injection surface like the LLM dispatch prose.
Compare *ItemCompare `json:"compare,omitempty"`
}
// ItemCompare is gogobee's verdict for equipping a backpack magic item over what
// is currently worn in its slot. Pete renders it verbatim and does no arithmetic.
type ItemCompare struct {
// Verdict: upgrade, downgrade, sidegrade, same, new, or inert.
Verdict string `json:"verdict"`
// VsName is the worn item being replaced; "" when Verdict is new (empty slot).
VsName string `json:"vs_name,omitempty"`
// VsSlot is the slot the item would land in (e.g. "ring_1").
VsSlot string `json:"vs_slot,omitempty"`
// Deltas is one entry per changed stat, each pre-flagged better/worse.
Deltas []ItemDelta `json:"deltas,omitempty"`
}
// ItemDelta is one stat's change between the candidate and the worn item.
type ItemDelta struct {
Label string `json:"label"`
Better bool `json:"better"`
Text string `json:"text"`
} }
// HouseView is the owner's housing summary. // HouseView is the owner's housing summary.
@@ -37,11 +166,18 @@ type HouseView struct {
} }
// PetView is one pet slot. // PetView is one pet slot.
//
// XP and XPNeeded are both **centi-XP**, the game's own unit: a pet earns 1.5
// points per action and the stored ledger is an integer, so everything is kept
// times a hundred. Divide by 100 to show a number to a human; do nothing else
// with either. XPNeeded is the engine's per-band curve and is 0 at the level cap,
// which is the only way to tell "full" from "nothing left to earn".
type PetView struct { type PetView struct {
Type string `json:"type"` Type string `json:"type"`
Name string `json:"name"` Name string `json:"name"`
Level int `json:"level"` Level int `json:"level"`
XP int `json:"xp,omitempty"` XP int `json:"xp,omitempty"`
XPNeeded int `json:"xp_needed,omitempty"`
ArmorTier int `json:"armor_tier,omitempty"` ArmorTier int `json:"armor_tier,omitempty"`
} }
internal/storage/equip.go
+233
View File
@@ -0,0 +1,233 @@
package storage
import (
"database/sql"
"errors"
"fmt"
)
// The equip queue: the one adventure feature that carries intent *back* to the
// game box, and it does it the same way mischief does — no new network route.
//
// A signed-in owner, on their own detail page, asks to wear an item they own or
// take one off. Pete records only the *intent*; it never touches the game's
// equipment tables. gogobee's poll loop drains the pending orders, runs the real
// equip through its own rules (slot eviction, the 3-bond attunement cap,
// reconcile), and hands back a verdict Pete files against the order. The guid is
// the idempotency key end to end.
//
// Unlike mischief the underlying game action is NOT naturally idempotent —
// equipping consumes an inventory row and regenerates it on unequip, so replaying
// the flow would double-move items. gogobee therefore short-circuits on the order
// guid before it mutates anything (see its poller). On Pete's side the mechanic
// is mischief's exactly: a verdict only moves a still-pending order, so a retried
// verdict is a no-op.
// EquipOrder is one wear/remove request and its current standing.
type EquipOrder struct {
GUID string `json:"guid"`
OwnerSub string `json:"-"` // OIDC subject; keys "my orders", never sent to gogobee
OwnerLocalpart string `json:"owner_localpart"` // Matrix localpart gogobee turns into an MXID — the character to dress
CharacterName string `json:"character_name,omitempty"` // display copy, frozen at order time; gogobee ignores it
ItemID int64 `json:"item_id,omitempty"` // adventure_inventory row id, for an equip; unused for unequip
ItemName string `json:"item_name"` // display copy
Slot string `json:"slot"` // the magic-item slot to fill or clear
Action string `json:"action"` // equip / unequip / upgrade / repair
Tier int `json:"tier,omitempty"` // upgrade target tier (an EquipmentSlot tier); unused by the other actions
Status string `json:"status"`
Detail string `json:"detail,omitempty"`
CreatedAt int64 `json:"created_at"`
UpdatedAt int64 `json:"updated_at,omitempty"`
}
// Actions. These cross the wire to gogobee, so they are part of the contract.
// equip/unequip move an inventory item (magic) or a masterwork/arena piece; a
// take-off of a standard slot rides unequip too (the slot vocabularies are
// disjoint, so the string alone tells gogobee which path to run). upgrade and
// repair act on the 5 standard EquipmentSlots and spend euros on the game box.
const (
EquipActionEquip = "equip"
EquipActionUnequip = "unequip"
EquipActionUpgrade = "upgrade"
EquipActionRepair = "repair"
)
// Order states. Terminal states are enumerated, not free-text, so the page can
// say something specific; detail carries the prose. The rejection set is honest
// to what gogobee's equip path can actually return: it auto-evicts a slot's
// current occupant (so there is no "slot taken") and equips over the bond cap as
// inert rather than refusing (so there is no "requirements" bounce). What is left
// is the item having moved out from under the order, or not being wearable.
const (
EquipPending = "pending" // placed; gogobee hasn't acted yet
EquipApplied = "applied" // worn/removed; detail says how (bonded, inert, ...)
EquipRejectedNotOwned = "rejected_not_owned" // the item is no longer in the pack (stale page)
EquipRejectedNotWorn = "rejected_not_worn" // unequip of a slot that's already empty
EquipRejectedNotEquipp = "rejected_not_equippable" // the item has no slot to fill
// Ask 7 additions. A downgrade equip/upgrade is blocked by user decision; the
// euro-spending actions can bounce on funds or top out at the max tier.
EquipRejectedDowngrade = "rejected_downgrade" // equipping/upgrading to something no better than what's worn
EquipRejectedNoFunds = "rejected_insufficient_funds" // the euro debit would breach the debt limit
EquipRejectedMaxTier = "rejected_max_tier" // already at the top standard tier, nothing to buy
)
// validEquipVerdict is the set of terminal states gogobee may hand back.
func validEquipVerdict(status string) bool {
switch status {
case EquipApplied, EquipRejectedNotOwned, EquipRejectedNotWorn, EquipRejectedNotEquipp,
EquipRejectedDowngrade, EquipRejectedNoFunds, EquipRejectedMaxTier:
return true
}
return false
}
func validEquipAction(action string) bool {
switch action {
case EquipActionEquip, EquipActionUnequip, EquipActionUpgrade, EquipActionRepair:
return true
}
return false
}
var ErrNoSuchEquipOrder = errors.New("equip: no such order")
// InsertEquipOrder records a fresh, pending order and returns it with a new guid.
// The guid is minted here so the owner sees a stable reference the instant they
// click, before gogobee has heard of it. The caller has already checked the owner
// is signed in and owns the page; eligibility (still-owned, wearable, bond cap) is
// gogobee's, at verdict time.
func InsertEquipOrder(ownerSub, ownerLocalpart, characterName string, itemID int64, itemName, slot, action string, tier int) (EquipOrder, error) {
if !validEquipAction(action) {
return EquipOrder{}, fmt.Errorf("equip: bad action %q", action)
}
guid, err := newGUID()
if err != nil {
return EquipOrder{}, err
}
now := nowUnix()
if _, err := Get().Exec(
`INSERT INTO equip_orders
(guid, owner_sub, owner_localpart, character_name, item_id, item_name, slot, action, tier, status, created_at, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
guid, ownerSub, ownerLocalpart, characterName, itemID, itemName, slot, action, tier, EquipPending, now, now,
); err != nil {
return EquipOrder{}, fmt.Errorf("equip: insert order: %w", err)
}
return EquipOrder{
GUID: guid, OwnerSub: ownerSub, OwnerLocalpart: ownerLocalpart,
CharacterName: characterName, ItemID: itemID, ItemName: itemName,
Slot: slot, Action: action, Tier: tier, Status: EquipPending, CreatedAt: now, UpdatedAt: now,
}, nil
}
// PendingEquipOrders is gogobee's poll: every order still waiting. Like mischief
// there is no claimed-but-stale window — a gogobee that dies mid-apply leaves the
// order pending to be offered again, and gogobee's own guid guard makes the replay
// a no-op.
func PendingEquipOrders(limit int) ([]EquipOrder, error) {
if limit <= 0 {
limit = 100
}
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, character_name, item_id, item_name, slot, action, tier, status, COALESCE(detail, ''), created_at, updated_at
FROM equip_orders
WHERE status = ?
ORDER BY created_at
LIMIT ?`,
EquipPending, limit,
)
if err != nil {
return nil, fmt.Errorf("equip: pending orders: %w", err)
}
defer rows.Close()
return scanEquipOrders(rows)
}
// ResolveEquipOrder files gogobee's verdict against a pending order. Idempotent by
// exactly mischief's mechanic: the UPDATE only moves a still-pending row, and the
// row is read back unconditionally so a first verdict, a retried verdict, and a
// missing row all take one path.
func ResolveEquipOrder(guid, status, detail string) (EquipOrder, error) {
if !validEquipVerdict(status) {
return EquipOrder{}, fmt.Errorf("equip: bad verdict %q", status)
}
now := nowUnix()
if _, err := Get().Exec(
`UPDATE equip_orders SET status = ?, detail = ?, updated_at = ?
WHERE guid = ? AND status = ?`,
status, detail, now, guid, EquipPending,
); err != nil {
return EquipOrder{}, fmt.Errorf("equip: resolve order: %w", err)
}
return EquipOrderByGUID(guid)
}
// EquipOrderByGUID reads one order.
func EquipOrderByGUID(guid string) (EquipOrder, error) {
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, character_name, item_id, item_name, slot, action, tier, status, COALESCE(detail, ''), created_at, updated_at
FROM equip_orders WHERE guid = ?`, guid,
)
if err != nil {
return EquipOrder{}, fmt.Errorf("equip: read order: %w", err)
}
defer rows.Close()
out, err := scanEquipOrders(rows)
if err != nil {
return EquipOrder{}, err
}
if len(out) == 0 {
return EquipOrder{}, ErrNoSuchEquipOrder
}
return out[0], nil
}
// EquipOrdersByOwner returns an owner's own recent orders, newest first, for the
// status strip on the detail page. Keyed on the OIDC subject so a username change
// doesn't strand history.
func EquipOrdersByOwner(ownerSub string, limit int) ([]EquipOrder, error) {
if limit <= 0 {
limit = 20
}
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, character_name, item_id, item_name, slot, action, tier, status, COALESCE(detail, ''), created_at, updated_at
FROM equip_orders
WHERE owner_sub = ?
ORDER BY created_at DESC
LIMIT ?`,
ownerSub, limit,
)
if err != nil {
return nil, fmt.Errorf("equip: orders by owner: %w", err)
}
defer rows.Close()
return scanEquipOrders(rows)
}
// CountEquipOrdersSince backs the web anti-spam guard — the real eligibility check
// is gogobee's at verdict time; this only blunts a stuck mouse button.
func CountEquipOrdersSince(ownerSub string, since int64) (int, error) {
var n int
err := Get().QueryRow(
`SELECT COUNT(*) FROM equip_orders WHERE owner_sub = ? AND created_at >= ?`,
ownerSub, since,
).Scan(&n)
if err != nil {
return 0, fmt.Errorf("equip: count recent orders: %w", err)
}
return n, nil
}
func scanEquipOrders(rows *sql.Rows) ([]EquipOrder, error) {
var out []EquipOrder
for rows.Next() {
var o EquipOrder
if err := rows.Scan(&o.GUID, &o.OwnerSub, &o.OwnerLocalpart, &o.CharacterName,
&o.ItemID, &o.ItemName, &o.Slot, &o.Action, &o.Tier, &o.Status, &o.Detail,
&o.CreatedAt, &o.UpdatedAt); err != nil {
return nil, fmt.Errorf("equip: scan order: %w", err)
}
out = append(out, o)
}
return out, rows.Err()
}
internal/storage/equip_test.go
+135
View File
@@ -0,0 +1,135 @@
package storage
import (
"errors"
"testing"
"time"
)
func TestEquipOrderLifecycle(t *testing.T) {
setupTestDB(t)
o, err := InsertEquipOrder("sub-1", "josie", "Josie", 42, "Cloak of Elvenkind", "cloak", EquipActionEquip, 0)
if err != nil {
t.Fatal(err)
}
if o.Status != EquipPending {
t.Fatalf("fresh order status = %q, want pending", o.Status)
}
if o.ItemID != 42 || o.Slot != "cloak" || o.Action != EquipActionEquip {
t.Fatalf("order fields lost through insert: %+v", o)
}
pending, err := PendingEquipOrders(10)
if err != nil {
t.Fatal(err)
}
if len(pending) != 1 || pending[0].GUID != o.GUID {
t.Fatalf("pending = %+v, want the one order we just placed", pending)
}
got, err := ResolveEquipOrder(o.GUID, EquipApplied, "worn and bonded")
if err != nil {
t.Fatal(err)
}
if got.Status != EquipApplied || got.Detail != "worn and bonded" {
t.Fatalf("resolved order = %+v, want applied with detail", got)
}
if pending, _ := PendingEquipOrders(10); len(pending) != 0 {
t.Fatalf("applied order still pending: %+v", pending)
}
}
// TestEquipResolveIsIdempotent: gogobee's poll loop retries, so a verdict can
// arrive twice — the second must not overwrite the first. This is the whole
// reason Pete can copy mischief's mechanic even though the game action underneath
// is not itself idempotent (gogobee guards that separately, on the order guid).
func TestEquipResolveIsIdempotent(t *testing.T) {
setupTestDB(t)
o, err := InsertEquipOrder("sub-1", "josie", "Josie", 7, "Ring of Protection", "ring_1", EquipActionEquip, 0)
if err != nil {
t.Fatal(err)
}
if _, err := ResolveEquipOrder(o.GUID, EquipApplied, "first"); err != nil {
t.Fatal(err)
}
got, err := ResolveEquipOrder(o.GUID, EquipRejectedNotOwned, "second")
if err != nil {
t.Fatalf("re-resolve errored: %v", err)
}
if got.Status != EquipApplied || got.Detail != "first" {
t.Fatalf("idempotency broken: order became %+v", got)
}
}
func TestEquipResolveUnknownAndBadVerdict(t *testing.T) {
setupTestDB(t)
if _, err := ResolveEquipOrder("nope", EquipApplied, ""); !errors.Is(err, ErrNoSuchEquipOrder) {
t.Fatalf("unknown guid err = %v, want ErrNoSuchEquipOrder", err)
}
o, _ := InsertEquipOrder("sub-1", "josie", "Josie", 1, "Boots", "feet", EquipActionEquip, 0)
if _, err := ResolveEquipOrder(o.GUID, "exploded", ""); err == nil {
t.Error("a bogus verdict status was accepted")
}
if got, _ := EquipOrderByGUID(o.GUID); got.Status != EquipPending {
t.Fatalf("order moved off pending on a bad verdict: %q", got.Status)
}
}
// TestEquipInsertRejectsBadAction: the action is part of the contract, so a value
// that isn't equip/unequip must not reach the table.
func TestEquipInsertRejectsBadAction(t *testing.T) {
setupTestDB(t)
if _, err := InsertEquipOrder("sub-1", "josie", "Josie", 1, "Thing", "cloak", "wield", 0); err == nil {
t.Fatal("a bogus action was accepted")
}
}
// TestEquipUnequipCarriesSlotNotItem: an unequip has no live inventory row to name,
// so it rides on the slot alone — item_id 0 is expected, not a bug.
func TestEquipUnequipCarriesSlotNotItem(t *testing.T) {
setupTestDB(t)
o, err := InsertEquipOrder("sub-1", "josie", "Josie", 0, "Cloak of Elvenkind", "cloak", EquipActionUnequip, 0)
if err != nil {
t.Fatal(err)
}
got, _ := EquipOrderByGUID(o.GUID)
if got.Action != EquipActionUnequip || got.Slot != "cloak" || got.ItemID != 0 {
t.Fatalf("unequip order = %+v, want slot-keyed with no item id", got)
}
}
func TestEquipOrdersByOwnerAndCount(t *testing.T) {
setupTestDB(t)
for i := 0; i < 3; i++ {
if _, err := InsertEquipOrder("sub-A", "alice", "Alice", int64(i+1), "Item", "cloak", EquipActionEquip, 0); err != nil {
t.Fatal(err)
}
}
if _, err := InsertEquipOrder("sub-B", "bob", "Bob", 9, "Item", "cloak", EquipActionEquip, 0); err != nil {
t.Fatal(err)
}
mine, err := EquipOrdersByOwner("sub-A", 20)
if err != nil {
t.Fatal(err)
}
if len(mine) != 3 {
t.Fatalf("alice sees %d orders, want 3 (and none of bob's)", len(mine))
}
n, err := CountEquipOrdersSince("sub-A", time.Now().Add(-time.Hour).Unix())
if err != nil {
t.Fatal(err)
}
if n != 3 {
t.Fatalf("count since an hour ago = %d, want 3", n)
}
if n, _ := CountEquipOrdersSince("sub-A", time.Now().Add(time.Hour).Unix()); n != 0 {
t.Fatalf("count since the future = %d, want 0", n)
}
}
internal/storage/orders.go
+336
View File
@@ -0,0 +1,336 @@
package storage
import (
"database/sql"
"encoding/json"
"errors"
"fmt"
)
// The action queue: the second channel that carries intent back to the game box,
// and the first one that acts on the adventurer rather than on their kit.
//
// Same shape as the equip queue, deliberately — a signed-in owner asks for
// something on a page they own, Pete records only the intent, gogobee polls,
// runs the real rule against its own tables, and files a verdict Pete renders.
// Pete never ends an expedition and never swings at a boss; it records that
// somebody asked to.
//
// The reason this is its own table rather than more actions on equip_orders is
// vocabulary: an equip order is about an item in a slot at a tier, and none of
// those columns mean anything to "leave the dungeon". See the schema comment.
//
// Neither verb is naturally idempotent — an extract ends a run, a bout spends
// the day's only swing — so gogobee guards on the order guid before it mutates,
// exactly as the equip poller does. On Pete's side the mechanic is the equip
// queue's: a verdict only moves a still-pending row, so a retried verdict is a
// no-op.
// AdvOrder is one requested action and its current standing.
type AdvOrder struct {
GUID string `json:"guid"`
OwnerSub string `json:"-"` // OIDC subject; keys "my orders", never sent to gogobee
OwnerLocalpart string `json:"owner_localpart"` // Matrix localpart gogobee turns into an MXID — whose adventurer acts
Token string `json:"token,omitempty"` // the roster token ownership was proven against; display/audit only
CharacterName string `json:"character_name,omitempty"` // display copy, frozen at order time; gogobee ignores it
Action string `json:"action"`
Status string `json:"status"`
Detail string `json:"detail,omitempty"`
CreatedAt int64 `json:"created_at"`
UpdatedAt int64 `json:"updated_at,omitempty"`
// Params is the verb's arguments, and only the three verbs that take any carry
// it. It never names an adventurer — that still comes from the session — and
// nothing in it is trusted: Pete resolves every field against the owner's own
// pushed offer list before storing it, and gogobee resolves it again against
// the game's tables before it means anything.
Params *AdvOrderParams `json:"params,omitempty"`
}
// AdvOrderParams is the union of every verb's arguments, flat rather than
// per-verb because there are three of them and each reads one or two fields.
// A field a verb does not read is ignored rather than rejected.
type AdvOrderParams struct {
Zone string `json:"zone,omitempty"` // zone id, for expedition_start
Loadout string `json:"loadout,omitempty"` // lean|balanced|heavy
Days int `json:"days,omitempty"` // 7 or 30, for babysit
}
// Actions. These cross the wire to gogobee, so they are part of the contract.
//
// extract pull out of a running expedition, keeping loot/XP, resumable for a
// week — the game's `!extract`. Leader-only, which gogobee enforces.
// siege_join take today's one bout against the world boss — `!adventure
// worldboss fight`. The narration still lands in Matrix; the web gets
// the damage line as the verdict.
// W5b adds the three that take arguments and spend coins:
//
// expedition_start leave town for a zone with a supply loadout — `!expedition
// start <zone> <loadout>`. The most common action in the game
// and, until now, Matrix-only.
// expedition_resume walk back into the run you extracted from, re-outfitted —
// `!resume`. The other half of W5a's extract: that verb's own
// verdict tells people to type !resume, and this is the door.
// babysit engage the pet sitter for a week or a month — `!adventure
// babysit week|month`.
//
// W9 adds the three that undo the ones above. Each was already named inside a
// refusal or a confirm this page shows — "`!expedition abandon` first",
// "`!expedition leave` to walk out alone", "no refund if you cancel early" — so
// until now the web told people to go and type a command it could have offered.
// None takes an argument and none spends a euro:
//
// expedition_abandon end the expedition outright, for the whole party. Leader
// only, which gogobee enforces. Also the way to close an
// extracted run without paying to walk back into it first.
// expedition_leave walk out of somebody else's party alone, supplies left in
// the pool. Member only — the leader's row IS the expedition.
// babysit_cancel dismiss the sitter early. No refund, by the game's design.
const (
AdvActionExtract = "extract"
AdvActionSiegeJoin = "siege_join"
AdvActionExpedition = "expedition_start"
AdvActionResume = "expedition_resume"
AdvActionBabysit = "babysit"
AdvActionAbandon = "expedition_abandon"
AdvActionLeave = "expedition_leave"
AdvActionBabysitCancel = "babysit_cancel"
)
// Order states. Terminal states are enumerated rather than free-text so the page
// can say something specific about each; detail carries gogobee's prose. The
// rejection set is honest to what the game paths can actually answer.
const (
AdvOrderPending = "pending" // placed; gogobee hasn't acted yet
AdvOrderApplied = "applied" // it happened; detail says what
AdvRejectedNotRunning = "rejected_not_running" // extract: no active expedition
AdvRejectedNotLeader = "rejected_not_leader" // extract: a party member can't call the extraction
AdvRejectedNoSiege = "rejected_no_siege" // siege_join: nothing camped outside town
AdvRejectedAlreadyFought = "rejected_already_fought" // siege_join: today's bout is spent
AdvRejectedUnavailable = "rejected_unavailable" // no character, dead, or an argument the game does not sell
// W5b's three verbs.
AdvRejectedBusy = "rejected_busy" // already out, already seated, or already has a sitter
AdvRejectedInsufficientFunds = "rejected_insufficient_funds" // could not cover the cost
AdvRejectedZoneLocked = "rejected_zone_locked" // that zone is not open at this level
AdvRejectedNothingToResume = "rejected_nothing_to_resume" // nothing extracted, or its window closed
// W9's two. rejected_is_leader is deliberately not rejected_not_leader read
// backwards: they are opposite facts about the same person, and collapsing
// them would answer a leader who tried to walk out by telling them they are
// not the leader.
AdvRejectedIsLeader = "rejected_is_leader" // expedition_leave: the leader's row is the expedition
AdvRejectedNothingToCancel = "rejected_nothing_to_cancel" // babysit_cancel: no sitter is engaged
)
func validAdvAction(action string) bool {
switch action {
case AdvActionExtract, AdvActionSiegeJoin,
AdvActionExpedition, AdvActionResume, AdvActionBabysit,
AdvActionAbandon, AdvActionLeave, AdvActionBabysitCancel:
return true
}
return false
}
// validAdvVerdict is the set of terminal states gogobee may hand back.
func validAdvVerdict(status string) bool {
switch status {
case AdvOrderApplied, AdvRejectedNotRunning, AdvRejectedNotLeader,
AdvRejectedNoSiege, AdvRejectedAlreadyFought, AdvRejectedUnavailable,
AdvRejectedBusy, AdvRejectedInsufficientFunds, AdvRejectedZoneLocked,
AdvRejectedNothingToResume, AdvRejectedIsLeader, AdvRejectedNothingToCancel:
return true
}
return false
}
var ErrNoSuchAdvOrder = errors.New("orders: no such order")
// ErrBadAdvVerdict is a verdict outside the terminal set. It is kept distinct
// from a storage failure so the web seam can answer 400 (gogobee sent something
// it will never be able to send successfully) rather than parking a perfectly
// resolvable order on a transient database error.
var ErrBadAdvVerdict = errors.New("orders: bad verdict")
// InsertAdvOrder records a fresh, pending order and returns it with a new guid.
// The guid is minted here so the owner has a stable reference the instant they
// click, before gogobee has heard of it. The caller has already proved the signed-
// in viewer owns this adventurer; whether the action is *legal right now* is
// gogobee's answer, at verdict time.
func InsertAdvOrder(ownerSub, ownerLocalpart, token, characterName, action string, params *AdvOrderParams) (AdvOrder, error) {
if !validAdvAction(action) {
return AdvOrder{}, fmt.Errorf("orders: bad action %q", action)
}
// Store the canonical re-serialised form, never the client's bytes: the caller
// has already resolved every field against the owner's own offer list, so what
// goes in the row is Pete's understanding of the request rather than the
// request itself.
paramsJSON := ""
if params != nil {
b, err := json.Marshal(params)
if err != nil {
return AdvOrder{}, fmt.Errorf("orders: marshal params: %w", err)
}
paramsJSON = string(b)
}
guid, err := newGUID()
if err != nil {
return AdvOrder{}, err
}
now := nowUnix()
if _, err := Get().Exec(
`INSERT INTO adventure_orders
(guid, owner_sub, owner_localpart, token, character_name, action, status, params, created_at, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
guid, ownerSub, ownerLocalpart, token, characterName, action, AdvOrderPending, paramsJSON, now, now,
); err != nil {
return AdvOrder{}, fmt.Errorf("orders: insert order: %w", err)
}
return AdvOrder{
GUID: guid, OwnerSub: ownerSub, OwnerLocalpart: ownerLocalpart,
Token: token, CharacterName: characterName, Action: action,
Status: AdvOrderPending, Params: params, CreatedAt: now, UpdatedAt: now,
}, nil
}
// PendingAdvOrders is gogobee's poll: every order still waiting. Like the equip
// queue there is no claimed-but-stale window — a gogobee that dies mid-apply
// leaves the order pending to be offered again, and its own guid ledger makes the
// replay a no-op.
func PendingAdvOrders(limit int) ([]AdvOrder, error) {
if limit <= 0 {
limit = 100
}
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, token, character_name, action, status, COALESCE(detail, ''), COALESCE(params, ''), created_at, updated_at
FROM adventure_orders
WHERE status = ?
ORDER BY created_at
LIMIT ?`,
AdvOrderPending, limit,
)
if err != nil {
return nil, fmt.Errorf("orders: pending orders: %w", err)
}
defer rows.Close()
return scanAdvOrders(rows)
}
// ResolveAdvOrder files gogobee's verdict against a pending order. Idempotent by
// the equip queue's mechanic: the UPDATE only moves a still-pending row, and the
// row is read back unconditionally so a first verdict, a retried verdict, and a
// missing row all take one path.
func ResolveAdvOrder(guid, status, detail string) (AdvOrder, error) {
if !validAdvVerdict(status) {
return AdvOrder{}, fmt.Errorf("%w %q", ErrBadAdvVerdict, status)
}
now := nowUnix()
if _, err := Get().Exec(
`UPDATE adventure_orders SET status = ?, detail = ?, updated_at = ?
WHERE guid = ? AND status = ?`,
status, detail, now, guid, AdvOrderPending,
); err != nil {
return AdvOrder{}, fmt.Errorf("orders: resolve order: %w", err)
}
return AdvOrderByGUID(guid)
}
// AdvOrderByGUID reads one order.
func AdvOrderByGUID(guid string) (AdvOrder, error) {
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, token, character_name, action, status, COALESCE(detail, ''), COALESCE(params, ''), created_at, updated_at
FROM adventure_orders WHERE guid = ?`, guid,
)
if err != nil {
return AdvOrder{}, fmt.Errorf("orders: read order: %w", err)
}
defer rows.Close()
out, err := scanAdvOrders(rows)
if err != nil {
return AdvOrder{}, err
}
if len(out) == 0 {
return AdvOrder{}, ErrNoSuchAdvOrder
}
return out[0], nil
}
// AdvOrdersByOwner returns an owner's own recent orders, newest first, for the
// status strip. Keyed on the OIDC subject so a rename doesn't strand history.
func AdvOrdersByOwner(ownerSub string, limit int) ([]AdvOrder, error) {
if limit <= 0 {
limit = 20
}
rows, err := Get().Query(
`SELECT guid, owner_sub, owner_localpart, token, character_name, action, status, COALESCE(detail, ''), COALESCE(params, ''), created_at, updated_at
FROM adventure_orders
WHERE owner_sub = ?
ORDER BY created_at DESC
LIMIT ?`,
ownerSub, limit,
)
if err != nil {
return nil, fmt.Errorf("orders: orders by owner: %w", err)
}
defer rows.Close()
return scanAdvOrders(rows)
}
// HasPendingAdvOrder reports whether this owner already has an unanswered order
// of this action outstanding. Unlike the equip queue's burst counter this is a
// correctness guard, not anti-spam: two queued extracts would apply in sequence
// and the second would come back "no expedition to leave", which reads as a
// failure for something that in fact worked.
func HasPendingAdvOrder(ownerSub, action string) (bool, error) {
var n int
err := Get().QueryRow(
`SELECT COUNT(*) FROM adventure_orders WHERE owner_sub = ? AND action = ? AND status = ?`,
ownerSub, action, AdvOrderPending,
).Scan(&n)
if err != nil {
return false, fmt.Errorf("orders: pending lookup: %w", err)
}
return n > 0, nil
}
// CountAdvOrdersSince backs the web anti-spam guard, same role as the equip
// queue's: the real eligibility is gogobee's at verdict time, this only blunts a
// stuck mouse button.
func CountAdvOrdersSince(ownerSub string, since int64) (int, error) {
var n int
err := Get().QueryRow(
`SELECT COUNT(*) FROM adventure_orders WHERE owner_sub = ? AND created_at >= ?`,
ownerSub, since,
).Scan(&n)
if err != nil {
return 0, fmt.Errorf("orders: count recent orders: %w", err)
}
return n, nil
}
func scanAdvOrders(rows *sql.Rows) ([]AdvOrder, error) {
var out []AdvOrder
for rows.Next() {
var o AdvOrder
var params string
if err := rows.Scan(&o.GUID, &o.OwnerSub, &o.OwnerLocalpart, &o.Token,
&o.CharacterName, &o.Action, &o.Status, &o.Detail, &params,
&o.CreatedAt, &o.UpdatedAt); err != nil {
return nil, fmt.Errorf("orders: scan order: %w", err)
}
// Unparseable params are dropped rather than failing the read. The row is
// still a real order somebody placed, and a verb whose arguments went
// missing is refused honestly by gogobee ("that order didn't say where
// to") — which beats the whole poll erroring on one bad row.
if params != "" {
var pp AdvOrderParams
if err := json.Unmarshal([]byte(params), &pp); err == nil {
o.Params = &pp
}
}
out = append(out, o)
}
return out, rows.Err()
}
internal/storage/orders_test.go
+113
View File
@@ -0,0 +1,113 @@
package storage
import (
"errors"
"testing"
)
func TestAdvOrderRoundTrip(t *testing.T) {
setupTestDB(t)
o, err := InsertAdvOrder("sub-1", "josie", "tok-josie", "Josie", AdvActionExtract, nil)
if err != nil {
t.Fatalf("insert: %v", err)
}
if o.GUID == "" || o.Status != AdvOrderPending {
t.Fatalf("order = %+v, want a guid and pending", o)
}
pending, err := PendingAdvOrders(10)
if err != nil {
t.Fatalf("pending: %v", err)
}
if len(pending) != 1 || pending[0].GUID != o.GUID || pending[0].Action != AdvActionExtract {
t.Fatalf("pending = %+v", pending)
}
got, err := ResolveAdvOrder(o.GUID, AdvOrderApplied, "out on day 3")
if err != nil {
t.Fatalf("resolve: %v", err)
}
if got.Status != AdvOrderApplied || got.Detail != "out on day 3" {
t.Fatalf("resolved = %+v", got)
}
if left, _ := PendingAdvOrders(10); len(left) != 0 {
t.Fatalf("a resolved order is still pending: %+v", left)
}
}
// TestAdvOrderVerdictOnlyMovesAPendingRow is the idempotency mechanic: gogobee
// retries its verdict push, so the second one must be a read, not a write.
func TestAdvOrderVerdictOnlyMovesAPendingRow(t *testing.T) {
setupTestDB(t)
o, _ := InsertAdvOrder("sub-1", "josie", "tok-josie", "Josie", AdvActionSiegeJoin, nil)
if _, err := ResolveAdvOrder(o.GUID, AdvOrderApplied, "first"); err != nil {
t.Fatalf("first verdict: %v", err)
}
got, err := ResolveAdvOrder(o.GUID, AdvRejectedNoSiege, "second")
if err != nil {
t.Fatalf("second verdict: %v", err)
}
if got.Status != AdvOrderApplied || got.Detail != "first" {
t.Fatalf("order = %q/%q, want the first verdict to stand", got.Status, got.Detail)
}
}
func TestAdvOrderRejectsBadInput(t *testing.T) {
setupTestDB(t)
if _, err := InsertAdvOrder("sub-1", "josie", "tok", "Josie", "sell_house", nil); err == nil {
t.Fatal("an unknown action was accepted")
}
o, _ := InsertAdvOrder("sub-1", "josie", "tok", "Josie", AdvActionExtract, nil)
if _, err := ResolveAdvOrder(o.GUID, "exploded", ""); err == nil {
t.Fatal("an unknown verdict was accepted")
}
if _, err := AdvOrderByGUID("nope"); !errors.Is(err, ErrNoSuchAdvOrder) {
t.Fatalf("unknown guid err = %v, want ErrNoSuchAdvOrder", err)
}
}
// TestHasPendingAdvOrderIsPerVerb: the guard stops a double-click on one button,
// not the other button.
func TestHasPendingAdvOrderIsPerVerb(t *testing.T) {
setupTestDB(t)
o, _ := InsertAdvOrder("sub-1", "josie", "tok", "Josie", AdvActionExtract, nil)
if got, _ := HasPendingAdvOrder("sub-1", AdvActionExtract); !got {
t.Fatal("a pending extract wasn't seen")
}
if got, _ := HasPendingAdvOrder("sub-1", AdvActionSiegeJoin); got {
t.Fatal("a pending extract blocked a bout")
}
if got, _ := HasPendingAdvOrder("sub-2", AdvActionExtract); got {
t.Fatal("one owner's pending order was seen for another")
}
// A resolved order stops holding the verb.
if _, err := ResolveAdvOrder(o.GUID, AdvOrderApplied, ""); err != nil {
t.Fatalf("resolve: %v", err)
}
if got, _ := HasPendingAdvOrder("sub-1", AdvActionExtract); got {
t.Fatal("a resolved order still holds its verb")
}
}
func TestAdvOrdersByOwnerScopes(t *testing.T) {
setupTestDB(t)
if _, err := InsertAdvOrder("sub-A", "alice", "tok-a", "Alice", AdvActionExtract, nil); err != nil {
t.Fatalf("insert: %v", err)
}
if _, err := InsertAdvOrder("sub-B", "bob", "tok-b", "Bob", AdvActionExtract, nil); err != nil {
t.Fatalf("insert: %v", err)
}
got, err := AdvOrdersByOwner("sub-A", 10)
if err != nil {
t.Fatalf("by owner: %v", err)
}
if len(got) != 1 || got[0].OwnerLocalpart != "alice" {
t.Fatalf("orders = %+v, want only alice's", got)
}
if n, _ := CountAdvOrdersSince("sub-A", 0); n != 1 {
t.Fatalf("count = %d, want 1", n)
}
}
internal/storage/push.go
+62 -9
View File
@@ -7,33 +7,71 @@ import "fmt"
type PushSubscription struct { type PushSubscription struct {
Endpoint string Endpoint string
UserSub string UserSub string
Localpart string
P256dh string P256dh string
Auth string Auth string
CreatedAt int64 CreatedAt int64
LastNotifiedAt int64 LastNotifiedAt int64
LastAdvNotifiedAt int64
} }
// AddPushSubscription records (or refreshes) a push endpoint for a user. The // AddPushSubscription records (or refreshes) a push endpoint for a user. The
// endpoint is the primary key, so a re-subscribe from the same browser updates // endpoint is the primary key, so a re-subscribe from the same browser updates
// the keys and resets the digest watermark to now — the user shouldn't be // the keys and resets both watermarks to now — the user shouldn't be paged for
// paged for everything published before they opted in. // everything published before they opted in.
func AddPushSubscription(sub, endpoint, p256dh, auth string) error { //
// localpart is the session's Matrix handle, refreshed on every re-subscribe so a
// row stored by a build that predated adventure alerts heals itself the first
// time that browser subscribes again. It may legitimately be empty (a session
// minted before the game economy existed carries no username); such a row simply
// never matches an owner-scoped alert.
func AddPushSubscription(sub, localpart, endpoint, p256dh, auth string) error {
now := nowUnix() now := nowUnix()
_, err := Get().Exec(` _, err := Get().Exec(`
INSERT INTO push_subscriptions (endpoint, user_sub, p256dh, auth, created_at, last_notified_at) INSERT INTO push_subscriptions
VALUES (?, ?, ?, ?, ?, ?) (endpoint, user_sub, user_localpart, p256dh, auth, created_at, last_notified_at, last_adv_notified_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT(endpoint) DO UPDATE SET ON CONFLICT(endpoint) DO UPDATE SET
user_sub = excluded.user_sub, user_sub = excluded.user_sub,
user_localpart = excluded.user_localpart,
p256dh = excluded.p256dh, p256dh = excluded.p256dh,
auth = excluded.auth, auth = excluded.auth,
last_notified_at = excluded.last_notified_at`, last_notified_at = excluded.last_notified_at,
endpoint, sub, p256dh, auth, now, now) last_adv_notified_at = excluded.last_adv_notified_at`,
endpoint, sub, localpart, p256dh, auth, now, now, now)
if err != nil { if err != nil {
return fmt.Errorf("add push subscription: %w", err) return fmt.Errorf("add push subscription: %w", err)
} }
return nil return nil
} }
// HealPushSubscriptionLocalpart fills in the Matrix handle on a row that was
// stored before push_subscriptions had the column — the rows that can never match
// an owner-scoped adventure alert, and whose owners have no way to notice.
//
// It is deliberately NOT AddPushSubscription with the same arguments. That upsert
// resets both watermarks to now, which is right when somebody opts in and
// catastrophic on a heal: the browser would call it on every page load, so a
// reader who visits daily would silently never receive a digest or an alert
// again. This touches one column and no clock.
//
// Scoped to user_sub so presenting somebody else's endpoint rewrites nothing, and
// restricted to rows whose localpart is still empty — so it is a no-op after the
// first success, and it can never overwrite a good handle with a stale one.
func HealPushSubscriptionLocalpart(sub, endpoint, localpart string) error {
if localpart == "" {
return nil // nothing to heal with; see AddPushSubscription on empty handles
}
_, err := Get().Exec(
`UPDATE push_subscriptions SET user_localpart = ?
WHERE endpoint = ? AND user_sub = ? AND user_localpart = ''`,
localpart, endpoint, sub)
if err != nil {
return fmt.Errorf("heal push subscription: %w", err)
}
return nil
}
// RemovePushSubscription drops one endpoint regardless of owner. Reserved for // RemovePushSubscription drops one endpoint regardless of owner. Reserved for
// the digest sender's prune path, where a push service has reported the endpoint // the digest sender's prune path, where a push service has reported the endpoint
// gone (404/410) and there's no caller identity to scope by. User-initiated // gone (404/410) and there's no caller identity to scope by. User-initiated
@@ -61,7 +99,8 @@ func RemovePushSubscriptionForUser(sub, endpoint string) error {
// ListPushSubscriptions returns every stored subscription, for the digest sender. // ListPushSubscriptions returns every stored subscription, for the digest sender.
func ListPushSubscriptions() ([]PushSubscription, error) { func ListPushSubscriptions() ([]PushSubscription, error) {
rows, err := Get().Query( rows, err := Get().Query(
`SELECT endpoint, user_sub, p256dh, auth, created_at, last_notified_at `SELECT endpoint, user_sub, user_localpart, p256dh, auth,
created_at, last_notified_at, last_adv_notified_at
FROM push_subscriptions`) FROM push_subscriptions`)
if err != nil { if err != nil {
return nil, err return nil, err
@@ -70,7 +109,8 @@ func ListPushSubscriptions() ([]PushSubscription, error) {
var out []PushSubscription var out []PushSubscription
for rows.Next() { for rows.Next() {
var p PushSubscription var p PushSubscription
if err := rows.Scan(&p.Endpoint, &p.UserSub, &p.P256dh, &p.Auth, &p.CreatedAt, &p.LastNotifiedAt); err != nil { if err := rows.Scan(&p.Endpoint, &p.UserSub, &p.Localpart, &p.P256dh, &p.Auth,
&p.CreatedAt, &p.LastNotifiedAt, &p.LastAdvNotifiedAt); err != nil {
return nil, err return nil, err
} }
out = append(out, p) out = append(out, p)
@@ -78,6 +118,19 @@ func ListPushSubscriptions() ([]PushSubscription, error) {
return out, rows.Err() return out, rows.Err()
} }
// TouchAdvPushSubscription advances an endpoint's *adventure alert* watermark, so
// the next pass only considers dispatches that occurred after ts. Kept separate
// from TouchPushSubscription for the reason the schema gives: the digest and the
// alerts must not be able to consume each other's backlog.
func TouchAdvPushSubscription(endpoint string, ts int64) error {
_, err := Get().Exec(
`UPDATE push_subscriptions SET last_adv_notified_at = ? WHERE endpoint = ?`, ts, endpoint)
if err != nil {
return fmt.Errorf("touch adventure push watermark: %w", err)
}
return nil
}
// TouchPushSubscription advances an endpoint's digest watermark so its next // TouchPushSubscription advances an endpoint's digest watermark so its next
// digest only considers stories seen after ts. // digest only considers stories seen after ts.
func TouchPushSubscription(endpoint string, ts int64) error { func TouchPushSubscription(endpoint string, ts int64) error {
internal/storage/push_adventure.go
+86
View File
@@ -0,0 +1,86 @@
package storage
import (
"database/sql"
)
// The reads behind adventure push alerts. The alert sender needs two things the
// rest of the storage layer does not: dispatches ordered by when they *happened*
// rather than by subject, and a way to turn a signed-in identity into the
// character name a fact would carry.
// AdvEventsSince returns dispatches that occurred after sinceUnix, newest first,
// capped at limit.
//
// The clock is occurred_at, not an arrival time, and that choice has a
// consequence worth stating: a dispatch that reaches Pete late but describes
// something old — a queue row unparked months after the fact, which W0's
// inversion made possible — sorts behind the watermark and is never alerted on.
// That is the outcome we want. An alert is a claim that something is happening
// now, and a phone buzzing about a hire from March would be a lie told urgently.
func AdvEventsSince(sinceUnix int64, limit int) ([]AdvEvent, error) {
if limit <= 0 {
return nil, nil
}
rows, err := Get().Query(`
SELECT guid, event_type, tier, subject, opponent, boss, zone, region,
level, tally, outcome, milestone, stakes, run_id, occurred_at
FROM adventure_events
WHERE occurred_at > ?
ORDER BY occurred_at DESC
LIMIT ?`, sinceUnix, limit)
if err != nil {
return nil, err
}
defer rows.Close()
var out []AdvEvent
for rows.Next() {
var e AdvEvent
var tier, subject, opponent, boss, zone, region sql.NullString
var outcome, milestone, stakes, runID sql.NullString
if err := rows.Scan(&e.GUID, &e.EventType, &tier, &subject, &opponent,
&boss, &zone, &region, &e.Level, &e.Tally, &outcome, &milestone,
&stakes, &runID, &e.OccurredAt); err != nil {
return nil, err
}
e.Tier, e.Subject, e.Opponent = tier.String, subject.String, opponent.String
e.Boss, e.Zone, e.Region = boss.String, zone.String, region.String
e.Outcome, e.Milestone, e.Stakes = outcome.String, milestone.String, stakes.String
e.RunID = runID.String
out = append(out, e)
}
return out, rows.Err()
}
// AdvCharacterForOwner returns the character name currently on the board for a
// signed-in user's localpart, which is the join an owner-scoped alert needs: a
// fact carries a character *name*, a session carries a localpart, and the only
// thing that connects them is the owner-private (localpart -> token) row gogobee
// pushes alongside the public (token -> name) board.
//
// It fails closed, and every way it can fail is a way it should:
//
// - no self-detail row: gogobee has stopped pushing for this player, so Pete
// has no current basis to claim any name is theirs.
// - no roster row for the token: the player is off the board — removed, or
// opted out of the news entirely. An opted-out player's facts are anonymised
// on the wire anyway, so there is no name left to match even in principle.
//
// Both cases mean the caller sends nothing, which is the correct answer to "is
// this dispatch about you" when Pete cannot honestly tell.
func AdvCharacterForOwner(localpart string) (string, bool) {
if localpart == "" {
return "", false
}
var name string
err := Get().QueryRow(`
SELECT r.name
FROM player_self_detail d
JOIN adventure_roster r ON r.token = d.token
WHERE d.localpart = ?`, localpart).Scan(&name)
if err != nil || name == "" {
return "", false
}
return name, true
}
internal/storage/push_adventure_test.go
+155
View File
@@ -0,0 +1,155 @@
package storage
import "testing"
// seedOwnedCharacter puts a player on the board and gives them an owner, which
// is the two-row arrangement AdvCharacterForOwner has to walk: the public
// (token -> name) board plus the owner-private (localpart -> token) detail row.
func seedOwnedCharacter(t *testing.T, localpart, token, name string) {
t.Helper()
if err := ReplaceRoster([]RosterEntry{{
Token: token, Name: name, Level: 14, ClassRace: "Cleric", Status: "idle",
}}, 1000); err != nil {
t.Fatal(err)
}
if err := ReplacePlayerDetail([]PlayerDetail{{Localpart: localpart, Token: token}}, 1000); err != nil {
t.Fatal(err)
}
}
// TestAdvCharacterForOwnerNeedsBothHalves is the privacy contract behind every
// owner-scoped alert. The sender asks "which character is this subscriber's" and
// then compares that name against a dispatch's subject; if this function ever
// answered generously, somebody's phone would buzz about another player's death.
//
// Each half of the join is removed in turn, because each one goes missing for a
// real reason in production: the roster row disappears when a player opts out of
// the news or leaves the board, and the self-detail row disappears when gogobee
// stops pushing for them. Both must fail closed.
func TestAdvCharacterForOwnerNeedsBothHalves(t *testing.T) {
setupTestDB(t)
seedOwnedCharacter(t, "josie", "tok-josie", "Josie")
if name, ok := AdvCharacterForOwner("josie"); !ok || name != "Josie" {
t.Fatalf("owner lookup = %q/%v, want Josie/true", name, ok)
}
if _, ok := AdvCharacterForOwner("quack"); ok {
t.Error("a localpart with no self-detail row resolved to a character")
}
if _, ok := AdvCharacterForOwner(""); ok {
t.Error("an empty localpart resolved to a character")
}
// Off the board — opted out of the news, or removed. The self-detail row is
// still there and still points at tok-josie, so only the roster join stops
// this. An opted-out player's facts are anonymised on the wire anyway, so
// there would be no name left to match even if this leaked.
if err := ReplaceRoster(nil, 2000); err != nil {
t.Fatal(err)
}
if name, ok := AdvCharacterForOwner("josie"); ok {
t.Errorf("off-the-board player still resolved to %q; alerts must close with the board", name)
}
// And the mirror case: on the board, but gogobee has stopped pushing the
// owner-private half, so Pete has no basis to claim the name is theirs.
seedOwnedCharacter(t, "josie", "tok-josie", "Josie")
if err := ReplacePlayerDetail(nil, 3000); err != nil {
t.Fatal(err)
}
if name, ok := AdvCharacterForOwner("josie"); ok {
t.Errorf("resolved %q with no self-detail row; the ownership claim has no source", name)
}
}
// TestAdvEventsSinceIsOrderedNewestFirst pins the ordering the sender depends on
// twice over: it takes the first match as "the newest thing to tell you about",
// and it advances every watermark to events[0]. Reverse this and the alert names
// the oldest unseen dispatch while the watermark skips the rest.
func TestAdvEventsSinceIsOrderedNewestFirst(t *testing.T) {
setupTestDB(t)
for _, e := range []AdvEvent{
{GUID: "g1", EventType: "death", Subject: "Josie", OccurredAt: 100},
{GUID: "g2", EventType: "zone_clear", Subject: "Josie", OccurredAt: 300},
{GUID: "g3", EventType: "retreat", Subject: "Josie", OccurredAt: 200},
} {
if err := InsertAdventureEvent(&e); err != nil {
t.Fatal(err)
}
}
got, err := AdvEventsSince(150, 10)
if err != nil {
t.Fatal(err)
}
if len(got) != 2 {
t.Fatalf("got %d events after ts=150, want 2 (the ts=100 one is behind the watermark)", len(got))
}
if got[0].GUID != "g2" || got[1].GUID != "g3" {
t.Fatalf("order = %s,%s; want g2,g3 (newest first)", got[0].GUID, got[1].GUID)
}
// limit <= 0 means "nothing", not "everything": the sender treats the result
// as a bounded window and an unbounded read here would be a surprise.
if got, _ := AdvEventsSince(0, 0); len(got) != 0 {
t.Errorf("limit 0 returned %d events, want 0", len(got))
}
}
// TestAdvEventsSinceCarriesRunID pins that the run link survives the read. The
// alert for an ended expedition points at the run report when there is one, and
// that field is the only thing distinguishing it from the plain story permalink.
func TestAdvEventsSinceCarriesRunID(t *testing.T) {
setupTestDB(t)
if err := InsertAdventureEvent(&AdvEvent{
GUID: "g1", EventType: "zone_clear", Subject: "Josie",
RunID: "run-7", OccurredAt: 500,
}); err != nil {
t.Fatal(err)
}
got, err := AdvEventsSince(0, 10)
if err != nil || len(got) != 1 {
t.Fatalf("read back %d events (err %v), want 1", len(got), err)
}
if got[0].RunID != "run-7" {
t.Errorf("run id = %q, want run-7", got[0].RunID)
}
}
// TestAdvWatermarkIsIndependentOfTheDigest pins the schema note. The two senders
// run on different clocks; if they shared a column, whichever ran last would
// decide what the other had already seen, and one of the two channels would go
// permanently quiet in a way nobody would think to look for.
func TestAdvWatermarkIsIndependentOfTheDigest(t *testing.T) {
setupTestDB(t)
const ep = "https://push.example/ep"
if err := AddPushSubscription("sub-1", "josie", ep, "p", "a"); err != nil {
t.Fatal(err)
}
if err := TouchAdvPushSubscription(ep, 4242); err != nil {
t.Fatal(err)
}
subs, _ := ListPushSubscriptions()
if len(subs) != 1 {
t.Fatalf("got %d subscriptions, want 1", len(subs))
}
if subs[0].LastAdvNotifiedAt != 4242 {
t.Errorf("adventure watermark = %d, want 4242", subs[0].LastAdvNotifiedAt)
}
if subs[0].LastNotifiedAt == 4242 {
t.Error("touching the adventure watermark moved the digest watermark too")
}
if subs[0].Localpart != "josie" {
t.Errorf("localpart = %q, want josie; owner-scoped alerts have nothing to join on without it", subs[0].Localpart)
}
// The reverse direction, so neither can quietly consume the other's backlog.
if err := TouchPushSubscription(ep, 99); err != nil {
t.Fatal(err)
}
subs, _ = ListPushSubscriptions()
if subs[0].LastAdvNotifiedAt != 4242 {
t.Errorf("digest touch moved the adventure watermark to %d", subs[0].LastAdvNotifiedAt)
}
}
internal/storage/push_heal_test.go
+122
View File
@@ -0,0 +1,122 @@
package storage
import "testing"
// W9: healing the Matrix handle onto a subscription stored before the column
// existed. Those rows can never match an owner-scoped adventure alert, and their
// owners have no way to notice — the browser only re-subscribes on a click.
//
// The trap this exists to avoid is worth stating plainly, because the obvious
// implementation is a one-liner that reuses AddPushSubscription with the same
// arguments: that upsert resets BOTH watermarks to now. The heal runs from the
// page, so it would fire far more often than a subscribe does, and every run
// would push the digest's own "last told them about" stamp forward — a reader who
// visits daily would silently stop receiving digests and adventure alerts alike,
// from a change made to fix notifications.
func findSub(t *testing.T, endpoint string) PushSubscription {
t.Helper()
subs, err := ListPushSubscriptions()
if err != nil {
t.Fatal(err)
}
for _, s := range subs {
if s.Endpoint == endpoint {
return s
}
}
t.Fatalf("no subscription for %q", endpoint)
return PushSubscription{}
}
func TestHealFillsAnEmptyLocalpartAndNothingElse(t *testing.T) {
setupTestDB(t)
const ep = "https://push.example/ep-old"
// A row as a pre-W6 build left it: no Matrix handle.
if err := AddPushSubscription("sub-1", "", ep, "p256", "auth"); err != nil {
t.Fatal(err)
}
before := findSub(t, ep)
if before.Localpart != "" {
t.Fatalf("seed carries a localpart %q; the test isn't testing anything", before.Localpart)
}
// Move both watermarks off "now" so a reset would be visible rather than
// coincidentally equal.
if err := TouchPushSubscription(ep, 1000); err != nil {
t.Fatal(err)
}
if err := TouchAdvPushSubscription(ep, 2000); err != nil {
t.Fatal(err)
}
if err := HealPushSubscriptionLocalpart("sub-1", ep, "josie"); err != nil {
t.Fatal(err)
}
got := findSub(t, ep)
if got.Localpart != "josie" {
t.Fatalf("localpart = %q, want josie", got.Localpart)
}
// The whole point: the clocks did not move.
if got.LastNotifiedAt != 1000 {
t.Fatalf("digest watermark = %d, want 1000 — a heal that resets it silences the digest",
got.LastNotifiedAt)
}
if got.LastAdvNotifiedAt != 2000 {
t.Fatalf("adventure watermark = %d, want 2000 — a heal that resets it silences the alerts",
got.LastAdvNotifiedAt)
}
if got.P256dh != "p256" || got.Auth != "auth" {
t.Fatal("the heal rewrote the encryption keys; it must touch one column")
}
}
func TestHealNeverOverwritesAKnownHandle(t *testing.T) {
setupTestDB(t)
const ep = "https://push.example/ep-good"
if err := AddPushSubscription("sub-1", "josie", ep, "p256", "auth"); err != nil {
t.Fatal(err)
}
// A later session whose username resolved differently must not be able to
// rewrite a handle that is already good — the heal is for empty rows only, so
// it is a no-op the moment one has succeeded.
if err := HealPushSubscriptionLocalpart("sub-1", ep, "someone-else"); err != nil {
t.Fatal(err)
}
if got := findSub(t, ep); got.Localpart != "josie" {
t.Fatalf("localpart = %q, want the original josie", got.Localpart)
}
}
func TestHealIsScopedToTheCaller(t *testing.T) {
setupTestDB(t)
const ep = "https://push.example/ep-theirs"
if err := AddPushSubscription("sub-owner", "", ep, "p256", "auth"); err != nil {
t.Fatal(err)
}
// Somebody else presenting the endpoint string writes nothing. Endpoints are
// not secrets and the client hands one straight up, so this is the guard that
// stops a stranger attaching their own handle to another account's device.
if err := HealPushSubscriptionLocalpart("sub-attacker", ep, "attacker"); err != nil {
t.Fatal(err)
}
if got := findSub(t, ep); got.Localpart != "" {
t.Fatalf("localpart = %q; another account healed a row it does not own", got.Localpart)
}
}
func TestHealWithNoHandleIsANoOp(t *testing.T) {
setupTestDB(t)
const ep = "https://push.example/ep-nouser"
if err := AddPushSubscription("sub-1", "", ep, "p256", "auth"); err != nil {
t.Fatal(err)
}
// A session minted before the game economy existed carries no username. There
// is nothing to heal with, and writing "" over "" is not worth a statement.
if err := HealPushSubscriptionLocalpart("sub-1", ep, ""); err != nil {
t.Fatal(err)
}
if got := findSub(t, ep); got.Localpart != "" {
t.Fatalf("localpart = %q, want empty", got.Localpart)
}
}
internal/storage/push_test.go
+5 -5
View File
@@ -5,15 +5,15 @@ import "testing"
func TestPushSubscriptionLifecycle(t *testing.T) { func TestPushSubscriptionLifecycle(t *testing.T) {
setupTestDB(t) setupTestDB(t)
if err := AddPushSubscription("sub-1", "https://push.example/ep-a", "p256-a", "auth-a"); err != nil { if err := AddPushSubscription("sub-1", "josie", "https://push.example/ep-a", "p256-a", "auth-a"); err != nil {
t.Fatal(err) t.Fatal(err)
} }
// A second endpoint for the same user (e.g. a second device). // A second endpoint for the same user (e.g. a second device).
if err := AddPushSubscription("sub-1", "https://push.example/ep-b", "p256-b", "auth-b"); err != nil { if err := AddPushSubscription("sub-1", "josie", "https://push.example/ep-b", "p256-b", "auth-b"); err != nil {
t.Fatal(err) t.Fatal(err)
} }
// A different user. // A different user.
if err := AddPushSubscription("sub-2", "https://push.example/ep-c", "p256-c", "auth-c"); err != nil { if err := AddPushSubscription("sub-2", "quack", "https://push.example/ep-c", "p256-c", "auth-c"); err != nil {
t.Fatal(err) t.Fatal(err)
} }
@@ -26,7 +26,7 @@ func TestPushSubscriptionLifecycle(t *testing.T) {
} }
// Re-subscribing the same endpoint updates keys in place, not a new row. // Re-subscribing the same endpoint updates keys in place, not a new row.
if err := AddPushSubscription("sub-1", "https://push.example/ep-a", "p256-a2", "auth-a2"); err != nil { if err := AddPushSubscription("sub-1", "josie", "https://push.example/ep-a", "p256-a2", "auth-a2"); err != nil {
t.Fatal(err) t.Fatal(err)
} }
subs, _ = ListPushSubscriptions() subs, _ = ListPushSubscriptions()
@@ -54,7 +54,7 @@ func TestPushSubscriptionLifecycle(t *testing.T) {
func TestTouchPushSubscriptionAdvancesWatermark(t *testing.T) { func TestTouchPushSubscriptionAdvancesWatermark(t *testing.T) {
setupTestDB(t) setupTestDB(t)
if err := AddPushSubscription("sub-1", "https://push.example/ep", "p", "a"); err != nil { if err := AddPushSubscription("sub-1", "josie", "https://push.example/ep", "p", "a"); err != nil {
t.Fatal(err) t.Fatal(err)
} }
subs, _ := ListPushSubscriptions() subs, _ := ListPushSubscriptions()
internal/storage/realm.go
+369
View File
@@ -0,0 +1,369 @@
package storage
import (
"database/sql"
)
// The realm, as gogobee pushes it.
//
// Three pages ride one snapshot: the world map, the board, and the hall of
// firsts. They are one push rather than three because they are one *question* —
// "what is this place, and what has happened here" — and because every number in
// all three comes off the same scan of the same run history. Splitting them would
// mean three ways for the same fact to be a different number depending on which
// page you were looking at.
//
// Nothing here is an event. The events (a zone_first dispatch, a death) come down
// the dispatch queue like any other fact. This is the standing state of the world,
// which is the only kind of thing a map can honestly draw.
// RealmOccupant is somebody on an expedition in a zone right now. Token is the
// public board token and is EMPTY only in the sense that this row never exists
// for an opted-out player — unlike a siege contributor, presence is dropped
// outright upstream rather than anonymised, so every row here has a name and a
// link.
type RealmOccupant struct {
Token string `json:"token,omitempty"`
Name string `json:"name"`
Level int `json:"level,omitempty"`
Day int `json:"day,omitempty"`
}
// RealmZone is one place in the world: what it is, who first got through it, how
// many have since, and who is inside it.
//
// FirstBy with an empty FirstToken is the anonymised case — the zone HAS been
// cleared and the claim stands, but the clearer opted out and gets no name and no
// link. Clears > 0 with no FirstBy at all is the same state seen from the other
// side, and both render as "cleared, by somebody" rather than as never-cleared,
// which would be a false statement about the realm rather than a withheld one.
type RealmZone struct {
ID string `json:"id"`
Display string `json:"display"`
Tier int `json:"tier"`
LevelMin int `json:"level_min"`
LevelMax int `json:"level_max"`
Faction string `json:"faction,omitempty"`
Atmosphere string `json:"atmosphere,omitempty"`
Postgame bool `json:"postgame,omitempty"`
FirstClearBy string `json:"first_clear_by,omitempty"`
FirstClearToken string `json:"first_clear_token,omitempty"`
FirstClearAt int64 `json:"first_clear_at,omitempty"`
Clears int `json:"clears"`
Clearers int `json:"clearers"`
Occupants []RealmOccupant `json:"occupants,omitempty"`
}
// RealmFirst is one entry in the hall of firsts.
type RealmFirst struct {
Kind string `json:"kind"`
Target string `json:"target"`
Display string `json:"display"`
Tier int `json:"tier,omitempty"`
Holder string `json:"holder,omitempty"`
Token string `json:"token,omitempty"`
AtUnix int64 `json:"at_unix"`
}
// RealmStanding is one line on the board.
type RealmStanding struct {
Token string `json:"token,omitempty"`
Name string `json:"name"`
Level int `json:"level"`
ClassRace string `json:"class_race,omitempty"`
DeepestTier int `json:"deepest_tier"`
Clears int `json:"clears"`
Zones int `json:"zones"`
Firsts int `json:"firsts"`
SiegeDamage int `json:"siege_damage"`
SiegeFights int `json:"siege_fights"`
}
// Realm is the whole snapshot.
type Realm struct {
Zones []RealmZone `json:"zones,omitempty"`
Firsts []RealmFirst `json:"firsts,omitempty"`
Standings []RealmStanding `json:"standings,omitempty"`
SnapshotAt int64 `json:"snapshot_at"`
}
// ReplaceRealm swaps the whole realm for a new snapshot, in one transaction.
//
// Replace, never merge, for the reason the siege does it: a zone whose clear
// count was corrected upstream, a player who opted out, an occupant who came
// home — all of those are *removals*, and a merge has no way to express one. The
// transaction means a reader mid-swap sees the old realm or the new one, never a
// zone list with the previous board under it.
func ReplaceRealm(r Realm, snapshotAt int64) error {
tx, err := Get().Begin()
if err != nil {
return err
}
defer func() { _ = tx.Rollback() }()
for _, t := range []string{
"adventure_realm_zone",
"adventure_realm_occupant",
"adventure_realm_first",
"adventure_realm_standing",
} {
if _, err := tx.Exec(`DELETE FROM ` + t); err != nil {
return err
}
}
zstmt, err := tx.Prepare(`
INSERT INTO adventure_realm_zone
(pos, zone_id, display, tier, level_min, level_max, faction, atmosphere,
postgame, first_by, first_token, first_at, clears, clearers)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer zstmt.Close()
ostmt, err := tx.Prepare(`
INSERT INTO adventure_realm_occupant (pos, zone_id, token, name, level, day)
VALUES (?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer ostmt.Close()
opos := 0
for i, z := range r.Zones {
if _, err := zstmt.Exec(i, z.ID, z.Display, z.Tier, z.LevelMin, z.LevelMax,
z.Faction, z.Atmosphere, z.Postgame, z.FirstClearBy, z.FirstClearToken,
z.FirstClearAt, z.Clears, z.Clearers); err != nil {
return err
}
for _, o := range z.Occupants {
if _, err := ostmt.Exec(opos, z.ID, o.Token, o.Name, o.Level, o.Day); err != nil {
return err
}
opos++
}
}
fstmt, err := tx.Prepare(`
INSERT INTO adventure_realm_first (pos, kind, target, display, tier, holder, token, at_unix)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer fstmt.Close()
for i, f := range r.Firsts {
if _, err := fstmt.Exec(i, f.Kind, f.Target, f.Display, f.Tier, f.Holder, f.Token, f.AtUnix); err != nil {
return err
}
}
sstmt, err := tx.Prepare(`
INSERT INTO adventure_realm_standing
(pos, token, name, level, class_race, deepest_tier, clears, zones, firsts,
siege_damage, siege_fights)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer sstmt.Close()
for i, s := range r.Standings {
if _, err := sstmt.Exec(i, s.Token, s.Name, s.Level, s.ClassRace, s.DeepestTier,
s.Clears, s.Zones, s.Firsts, s.SiegeDamage, s.SiegeFights); err != nil {
return err
}
}
if _, err := tx.Exec(`
INSERT INTO adventure_realm_meta (id, snapshot_at) VALUES (1, ?)
ON CONFLICT(id) DO UPDATE SET snapshot_at = excluded.snapshot_at`, snapshotAt); err != nil {
return err
}
return tx.Commit()
}
// LoadRealm returns the realm as last pushed. ok is false when gogobee has never
// pushed one — distinct from a pushed snapshot that happens to be empty, which is
// a real answer (a realm with no living adventurers on the board is a thing that
// can be true) and which the pages render differently.
func LoadRealm() (Realm, bool, error) {
var r Realm
err := Get().QueryRow(`SELECT snapshot_at FROM adventure_realm_meta WHERE id = 1`).
Scan(&r.SnapshotAt)
if err == sql.ErrNoRows {
return Realm{}, false, nil
}
if err != nil {
return Realm{}, false, err
}
// Each cursor is drained fully before the next query opens. The pool is one
// connection wide, and a nested read is the deadlock the run-beat batch
// shipped with and then had to have cut out of it.
zones, err := loadRealmZones()
if err != nil {
return r, true, err
}
occ, err := loadRealmOccupants()
if err != nil {
return r, true, err
}
for i := range zones {
zones[i].Occupants = occ[zones[i].ID]
}
r.Zones = zones
if r.Firsts, err = loadRealmFirsts(); err != nil {
return r, true, err
}
if r.Standings, err = loadRealmStandings(); err != nil {
return r, true, err
}
return r, true, nil
}
func loadRealmZones() ([]RealmZone, error) {
rows, err := Get().Query(`
SELECT zone_id, display, tier, level_min, level_max, faction, atmosphere,
postgame, first_by, first_token, first_at, clears, clearers
FROM adventure_realm_zone ORDER BY pos ASC`)
if err != nil {
return nil, err
}
defer rows.Close()
var out []RealmZone
for rows.Next() {
var z RealmZone
if err := rows.Scan(&z.ID, &z.Display, &z.Tier, &z.LevelMin, &z.LevelMax,
&z.Faction, &z.Atmosphere, &z.Postgame, &z.FirstClearBy, &z.FirstClearToken,
&z.FirstClearAt, &z.Clears, &z.Clearers); err != nil {
return nil, err
}
out = append(out, z)
}
return out, rows.Err()
}
func loadRealmOccupants() (map[string][]RealmOccupant, error) {
rows, err := Get().Query(`
SELECT zone_id, token, name, level, day
FROM adventure_realm_occupant ORDER BY pos ASC`)
if err != nil {
return nil, err
}
defer rows.Close()
out := map[string][]RealmOccupant{}
for rows.Next() {
var zoneID string
var o RealmOccupant
if err := rows.Scan(&zoneID, &o.Token, &o.Name, &o.Level, &o.Day); err != nil {
return nil, err
}
out[zoneID] = append(out[zoneID], o)
}
return out, rows.Err()
}
func loadRealmFirsts() ([]RealmFirst, error) {
rows, err := Get().Query(`
SELECT kind, target, display, tier, holder, token, at_unix
FROM adventure_realm_first ORDER BY pos ASC`)
if err != nil {
return nil, err
}
defer rows.Close()
var out []RealmFirst
for rows.Next() {
var f RealmFirst
if err := rows.Scan(&f.Kind, &f.Target, &f.Display, &f.Tier, &f.Holder, &f.Token, &f.AtUnix); err != nil {
return nil, err
}
out = append(out, f)
}
return out, rows.Err()
}
func loadRealmStandings() ([]RealmStanding, error) {
rows, err := Get().Query(`
SELECT token, name, level, class_race, deepest_tier, clears, zones, firsts,
siege_damage, siege_fights
FROM adventure_realm_standing ORDER BY pos ASC`)
if err != nil {
return nil, err
}
defer rows.Close()
var out []RealmStanding
for rows.Next() {
var s RealmStanding
if err := rows.Scan(&s.Token, &s.Name, &s.Level, &s.ClassRace, &s.DeepestTier,
&s.Clears, &s.Zones, &s.Firsts, &s.SiegeDamage, &s.SiegeFights); err != nil {
return nil, err
}
out = append(out, s)
}
return out, rows.Err()
}
// DeathsBySubject counts the deaths Pete has reported for each named adventurer.
//
// This is the one standings number that does NOT come off the gogobee push, and
// the reason is that the game has nowhere to read it from: a character carries
// its most recent death (source, place, date) and no running total, so there is
// no lifetime count on the game box to send. Pete does have one — his own back
// catalogue of death dispatches, seeded at news launch by the backfill and
// complete since — so he counts them himself, which is a thing a newspaper is
// entitled to do about its own reporting.
//
// Keyed on the character name because that is the only join the fact table
// offers: a dispatch carries a name, never a token. Names are unique per realm in
// practice; a collision would merge two adventurers' death counts, which is why
// this is the only column derived this way and not, say, clears.
func DeathsBySubject() (map[string]int, error) {
rows, err := Get().Query(`
SELECT subject, COUNT(*) FROM adventure_events
WHERE event_type = 'death' AND subject IS NOT NULL AND subject <> ''
GROUP BY subject`)
if err != nil {
return nil, err
}
defer rows.Close()
out := map[string]int{}
for rows.Next() {
var name string
var n int
if err := rows.Scan(&name, &n); err != nil {
return nil, err
}
out[name] = n
}
return out, rows.Err()
}
// PeteDuelRecord is Pete's own won/lost tally, from the dispatches he filed about
// himself. He is a companion who can be hired onto an expedition and he has a
// record; keeping score on himself is in voice, and it is the one line on the
// board that is not about a player.
//
// Both types have had templates in the renderer since before anything emitted
// them, so this reads zero until gogobee starts filing them — and zero-zero is
// rendered as "no bouts yet" rather than as a 0% win rate.
func PeteDuelRecord() (wins, losses int, err error) {
err = Get().QueryRow(`
SELECT
COALESCE(SUM(CASE WHEN event_type = 'pete_duel_win' THEN 1 ELSE 0 END), 0),
COALESCE(SUM(CASE WHEN event_type = 'pete_duel_loss' THEN 1 ELSE 0 END), 0)
FROM adventure_events
WHERE event_type IN ('pete_duel_win', 'pete_duel_loss')`).Scan(&wins, &losses)
if err == sql.ErrNoRows {
return 0, 0, nil
}
return wins, losses, err
}
internal/storage/roster.go
+29
View File
@@ -4,6 +4,7 @@ import (
"database/sql" "database/sql"
"encoding/json" "encoding/json"
"log/slog" "log/slog"
"strings"
) )
// RosterEntry is one adventurer's currently-true state, as of the last snapshot // RosterEntry is one adventurer's currently-true state, as of the last snapshot
@@ -140,3 +141,31 @@ func RosterSnapshotAt() int64 {
} }
return at.Int64 return at.Int64
} }
// KnownCharacterNames returns the set of character names on the current board,
// lowercased, for the prose-guard. It is the answer to "is this a name of a real
// adventurer other than the one the fact is about" — a name Pete knows but that
// the fact did not authorize walking onto a public page.
//
// Best-effort: an empty set (query error, or gogobee has never pushed a board)
// disables only the name half of the guard, never the length caps. The board is
// a snapshot, so a character who has dropped off it is not covered — the guard's
// job is protecting people who are currently in the realm, not auditing history.
func KnownCharacterNames() map[string]bool {
rows, err := Get().Query(`SELECT name FROM adventure_roster WHERE name <> ''`)
if err != nil {
slog.Error("KnownCharacterNames query failed", "err", err)
return nil
}
defer rows.Close()
names := make(map[string]bool)
for rows.Next() {
var name string
if err := rows.Scan(&name); err != nil {
continue
}
names[strings.ToLower(name)] = true
}
return names
}
internal/storage/run.go
+269
View File
@@ -0,0 +1,269 @@
package storage
import (
"database/sql"
)
// The expedition liveblog, as gogobee beats it out room by room.
//
// Everything else the game pushes is a snapshot: the board, the war room, a
// player's own sheet. Those get replaced whole, because they describe what is
// currently true. Beats are the opposite kind of thing — each one is a moment
// that happened, and the only correction a later push can make to a moment is to
// add another one after it. So this is append-only, keyed on (run_id, seq), and
// a re-sent batch collapses on the primary key instead of duplicating a story.
//
// The run header is *derived*, not pushed. gogobee sends beats and nothing else;
// AppendRunBeats folds the identifying ones into adventure_run as they arrive.
// The upside is that a run missing its `start` beat still has a log — anonymous,
// but readable — rather than being discarded for want of a name to hang it on.
// RunBeat is one moment inside a run, exactly as gogobee filed it. Nouns and
// numbers only: Pete writes the sentence, the same split every dispatch fact
// already respects.
type RunBeat struct {
RunID string `json:"run_id"`
Seq int64 `json:"seq"`
Kind string `json:"kind"`
OccurredAt int64 `json:"occurred_at"`
Token string `json:"token,omitempty"`
Name string `json:"name,omitempty"`
Level int `json:"level,omitempty"`
Zone string `json:"zone,omitempty"`
Region string `json:"region,omitempty"`
Room int `json:"room,omitempty"`
TotalRooms int `json:"total_rooms,omitempty"`
RoomKind string `json:"room_kind,omitempty"`
Target string `json:"target,omitempty"`
Outcome string `json:"outcome,omitempty"`
Amount int `json:"amount,omitempty"`
Count int `json:"count,omitempty"`
HP int `json:"hp,omitempty"`
HPMax int `json:"hp_max,omitempty"`
Crits int `json:"crits,omitempty"`
Fumbles int `json:"fumbles,omitempty"`
// Prose is the single exception to "nouns and numbers only", and it is
// deliberately confined to one beat kind ("summary"). gogobee's LLM reads the
// finished run back and says what it was about; Pete guards that text at
// ingest exactly as it guards a dispatch lede, then folds it onto the run
// header. It is never rendered as a log line — see renderRunBeat.
Prose string `json:"prose,omitempty"`
}
// Run is the header: who walked, where, and how it ended (if it has).
type Run struct {
RunID string
Token string
Name string
Level int
Zone string
TotalRooms int
StartedAt int64
UpdatedAt int64
EndedAt int64 // 0 = still walking
Outcome string
Summary string // LLM run summary, empty until the summary beat lands (or forever)
}
// Live reports whether this run is still in progress.
func (r Run) Live() bool { return r.EndedAt == 0 }
// AppendRunBeats stores a batch and folds each beat into its run header, in one
// transaction so a reader never sees a header that has moved ahead of its beats.
//
// INSERT OR IGNORE, not upsert: a beat is immutable. If gogobee re-sends
// (run_id, seq) the stored copy wins, which makes a duplicated batch free and
// makes a *changed* beat impossible — the second is a bug upstream, and quietly
// rewriting history to match it would hide that.
func AppendRunBeats(beats []RunBeat) error {
if len(beats) == 0 {
return nil
}
tx, err := Get().Begin()
if err != nil {
return err
}
defer func() { _ = tx.Rollback() }()
bstmt, err := tx.Prepare(`
INSERT OR IGNORE INTO adventure_run_beat
(run_id, seq, kind, occurred_at, room, total_rooms, room_kind,
target, outcome, amount, qty, hp, hp_max, crits, fumbles, region, prose)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer bstmt.Close()
// The header is created by whichever beat arrives first and enriched by any
// later one that knows more. COALESCE(NULLIF(...)) is the whole trick: a beat
// that doesn't carry a field leaves the stored value alone, so the `start`
// beat's name and zone survive the forty beats after it that have neither.
hstmt, err := tx.Prepare(`
INSERT INTO adventure_run
(run_id, token, name, level, zone, total_rooms, started_at, updated_at, ended_at, outcome, summary)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT(run_id) DO UPDATE SET
token = COALESCE(NULLIF(excluded.token, ''), adventure_run.token),
name = COALESCE(NULLIF(excluded.name, ''), adventure_run.name),
level = COALESCE(NULLIF(excluded.level, 0), adventure_run.level),
zone = COALESCE(NULLIF(excluded.zone, ''), adventure_run.zone),
total_rooms = COALESCE(NULLIF(excluded.total_rooms, 0), adventure_run.total_rooms),
started_at = COALESCE(NULLIF(adventure_run.started_at, 0), excluded.started_at),
updated_at = MAX(adventure_run.updated_at, excluded.updated_at),
ended_at = COALESCE(NULLIF(adventure_run.ended_at, 0), excluded.ended_at),
outcome = COALESCE(NULLIF(adventure_run.outcome, ''), excluded.outcome),
summary = COALESCE(NULLIF(adventure_run.summary, ''), excluded.summary)`)
if err != nil {
return err
}
defer hstmt.Close()
for _, b := range beats {
if b.RunID == "" {
continue
}
if _, err := bstmt.Exec(b.RunID, b.Seq, b.Kind, b.OccurredAt, b.Room, b.TotalRooms,
b.RoomKind, b.Target, b.Outcome, b.Amount, b.Count, b.HP, b.HPMax,
b.Crits, b.Fumbles, b.Region, b.Prose); err != nil {
return err
}
// A run ends once. First close wins here for the same reason it does on
// the game side: the specific outcome ("died") is filed before the generic
// one ("abandoned") that follows it down the same drain.
var endedAt int64
var outcome string
if b.Kind == "end" {
endedAt = b.OccurredAt
outcome = b.Outcome
}
started := int64(0)
if b.Kind == "start" {
started = b.OccurredAt
}
// Only the summary beat may set the summary. Any other kind carrying prose
// is upstream noise, and letting it through would put unguarded text on the
// header — the guard at ingest only inspects the kind it knows about.
summary := ""
if b.Kind == "summary" {
summary = b.Prose
}
if _, err := hstmt.Exec(b.RunID, b.Token, b.Name, b.Level, b.Zone,
b.TotalRooms, started, b.OccurredAt, endedAt, outcome, summary); err != nil {
return err
}
}
return tx.Commit()
}
// LatestRunForToken returns the run worth showing on one adventurer's page.
//
// A LIVE run always wins, and only then does recency decide. That ordering is
// load-bearing at exactly one moment and it is a moment that happens on every
// multi-region expedition: crossing a border closes one run and opens the next
// in the same breath, so the outgoing run's `end` beat and the incoming run's
// `start` beat carry the same second. Ordering on the clock alone would leave
// the page showing the log of a region the party has already left, with a
// "cleared" chip on it, while they walk on in the next one.
//
// Recency is updated_at rather than started_at for the same reason: the run
// still moving is the one still being written to.
func LatestRunForToken(token string) (Run, bool, error) {
if token == "" {
return Run{}, false, nil
}
var r Run
err := Get().QueryRow(`
SELECT run_id, token, name, level, zone, total_rooms,
started_at, updated_at, ended_at, outcome, summary
FROM adventure_run
WHERE token = ?
ORDER BY (ended_at = 0) DESC, updated_at DESC, started_at DESC
LIMIT 1`, token).Scan(
&r.RunID, &r.Token, &r.Name, &r.Level, &r.Zone, &r.TotalRooms,
&r.StartedAt, &r.UpdatedAt, &r.EndedAt, &r.Outcome, &r.Summary)
if err == sql.ErrNoRows {
return Run{}, false, nil
}
if err != nil {
return Run{}, false, err
}
return r, true, nil
}
// RunByID returns one run header.
func RunByID(runID string) (Run, bool, error) {
var r Run
err := Get().QueryRow(`
SELECT run_id, token, name, level, zone, total_rooms,
started_at, updated_at, ended_at, outcome, summary
FROM adventure_run WHERE run_id = ?`, runID).Scan(
&r.RunID, &r.Token, &r.Name, &r.Level, &r.Zone, &r.TotalRooms,
&r.StartedAt, &r.UpdatedAt, &r.EndedAt, &r.Outcome, &r.Summary)
if err == sql.ErrNoRows {
return Run{}, false, nil
}
if err != nil {
return Run{}, false, err
}
return r, true, nil
}
// RunBeats returns a run's beats in the order they happened.
//
// limit caps from the END, not the start: a log is read for what just happened,
// and a run deep into its third region would otherwise show its first forty
// beats forever. The returned slice is still oldest-first.
func RunBeats(runID string, limit int) ([]RunBeat, error) {
if runID == "" {
return nil, nil
}
q := `SELECT run_id, seq, kind, occurred_at, room, total_rooms, room_kind,
target, outcome, amount, qty, hp, hp_max, crits, fumbles, region, prose
FROM adventure_run_beat WHERE run_id = ? ORDER BY seq ASC`
args := []any{runID}
if limit > 0 {
// Innermost query takes the tail, the wrapper puts it back in order.
q = `SELECT * FROM (
SELECT run_id, seq, kind, occurred_at, room, total_rooms, room_kind,
target, outcome, amount, qty, hp, hp_max, crits, fumbles, region, prose
FROM adventure_run_beat WHERE run_id = ? ORDER BY seq DESC LIMIT ?
) ORDER BY seq ASC`
args = append(args, limit)
}
rows, err := Get().Query(q, args...)
if err != nil {
return nil, err
}
defer rows.Close()
var out []RunBeat
for rows.Next() {
var b RunBeat
if err := rows.Scan(&b.RunID, &b.Seq, &b.Kind, &b.OccurredAt, &b.Room, &b.TotalRooms,
&b.RoomKind, &b.Target, &b.Outcome, &b.Amount, &b.Count, &b.HP, &b.HPMax,
&b.Crits, &b.Fumbles, &b.Region, &b.Prose); err != nil {
return nil, err
}
out = append(out, b)
}
return out, rows.Err()
}
// PruneRuns drops runs (and their beats) that ended before cutoff. Live runs are
// never touched however old they look — a run that has been walking for a week
// is a stuck expedition, and deleting its log is exactly the wrong response to
// the one case where somebody wants to read it.
func PruneRuns(cutoff int64) error {
if _, err := Get().Exec(`
DELETE FROM adventure_run_beat
WHERE run_id IN (SELECT run_id FROM adventure_run WHERE ended_at > 0 AND ended_at < ?)`,
cutoff); err != nil {
return err
}
_, err := Get().Exec(`DELETE FROM adventure_run WHERE ended_at > 0 AND ended_at < ?`, cutoff)
return err
}
internal/storage/schema.go
+362 -1
View File
@@ -52,6 +52,256 @@ CREATE TABLE IF NOT EXISTS adventure_roster_meta (
snapshot_at INTEGER NOT NULL DEFAULT 0 snapshot_at INTEGER NOT NULL DEFAULT 0
); );
-- adventure_events is the structured residue of a dispatch, and it is the one
-- adventure table that is a *log* rather than a snapshot. That inversion is the
-- point. The roster answers "where is Josie now" and is replaced every tick;
-- this answers "what has Josie ever done", which no snapshot can, because each
-- push throws the last one away.
--
-- It exists because the facts were already arriving and we were burning them.
-- gogobee sends boss/opponent/zone/outcome on every fact; renderAdventure melted
-- them into a sentence and only the sentence was kept, so "how many bosses has
-- she downed" was answerable only by parsing English back out of a headline.
-- These rows are that fact, kept as fact. The story row remains the thing people
-- read; this is the thing we can count.
--
-- Keyed on guid, the same idempotency key as stories: a gogobee retry must not
-- double-count a kill. subject/opponent are *character names*, not roster tokens,
-- because that is what a fact carries and what the feed already prints in public.
-- Names are therefore the join back to a board row (roster.name -> token), which
-- is weaker than an id: a renamed or recycled character takes their history with
-- them. gogobee doesn't put a stable character id on the wire today, and inventing
-- one Pete-side would only be a guess at which two names were the same person.
CREATE TABLE IF NOT EXISTS adventure_events (
guid TEXT PRIMARY KEY, -- == stories.guid; the dispatch this fact rendered into
event_type TEXT NOT NULL,
tier TEXT, -- "priority" | "bulletin"
subject TEXT, -- character name: the one it happened to
opponent TEXT, -- character name: the other player, when there is one
boss TEXT, -- game-authored monster name, not player-controlled
zone TEXT,
region TEXT,
level INTEGER NOT NULL DEFAULT 0,
tally INTEGER NOT NULL DEFAULT 0, -- the fact's Count: defenders, days in, ...
outcome TEXT,
milestone TEXT,
stakes TEXT, -- free-text noun the fact is about: a bounty, a found treasure's name
actors TEXT, -- JSON array; the fact-guard allow-list, kept for audit
-- The expedition this dispatch is the ending of, when it is the ending of one
-- (a clear, a retreat, a death). It is the join from "how it went" to "what
-- happened", and it is the reason Pete keeps a finished run's beats for two
-- weeks while only *showing* them for six hours: the dispatch outlives the run
-- it announced, and a story that can't reach its own log is the whole point
-- of the log going missing.
run_id TEXT,
occurred_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS idx_adv_events_subject ON adventure_events(subject, occurred_at DESC);
CREATE INDEX IF NOT EXISTS idx_adv_events_opponent ON adventure_events(opponent, occurred_at DESC) WHERE opponent IS NOT NULL AND opponent <> '';
CREATE INDEX IF NOT EXISTS idx_adv_events_type ON adventure_events(event_type, occurred_at DESC);
-- The Siege. Three tables, all fed by one gogobee push and all replaced whole,
-- because the Siege is state, not history — the same contract as the roster.
--
-- The split is by lifetime, not by convenience. adventure_siege is the single
-- live boss (a CHECK-pinned one-row table, like adventure_roster_meta, so "no
-- Siege camped" is a row saying active=0 rather than an ambiguous empty table).
-- adventure_siege_defenders is the muster for that one boss and dies with it.
-- adventure_siege_history outlives both, and is the reason the current Siege
-- feels like it counts: a health bar with nothing behind it is a progress bar.
CREATE TABLE IF NOT EXISTS adventure_siege (
id INTEGER PRIMARY KEY CHECK (id = 1),
active INTEGER NOT NULL DEFAULT 0,
boss_id INTEGER NOT NULL DEFAULT 0,
boss_name TEXT NOT NULL DEFAULT '',
tier INTEGER NOT NULL DEFAULT 0,
hp_current INTEGER NOT NULL DEFAULT 0,
hp_max INTEGER NOT NULL DEFAULT 0,
starts_at INTEGER NOT NULL DEFAULT 0,
ends_at INTEGER NOT NULL DEFAULT 0,
bouts_today INTEGER NOT NULL DEFAULT 0,
snapshot_at INTEGER NOT NULL DEFAULT 0
);
-- pos is the push order, which is gogobee's ranking (damage desc). Kept as the
-- key rather than the token because an opted-out defender carries NO token — the
-- board shows their rank and their damage as "an adventurer" and offers no link,
-- so several rows can legitimately be tokenless and they must not collide.
CREATE TABLE IF NOT EXISTS adventure_siege_defenders (
pos INTEGER PRIMARY KEY,
token TEXT NOT NULL DEFAULT '',
name TEXT NOT NULL,
level INTEGER NOT NULL DEFAULT 0,
fights INTEGER NOT NULL DEFAULT 0,
damage INTEGER NOT NULL DEFAULT 0,
fought_today INTEGER NOT NULL DEFAULT 0
);
-- Open question, never confirmed with gogobee: whether boss_id identifies the
-- siege instance or the boss TYPE. SiegeBarForBoss matches history on boss_name
-- plus the nearest ended_at and its comment says "the same boss comes back month
-- after month", which reads like a type — in which case this key collides on the
-- second visit. ReplaceSiege inserts OR REPLACE so a collision costs one history
-- row instead of the whole push; settle the meaning before relying on the key.
CREATE TABLE IF NOT EXISTS adventure_siege_history (
boss_id INTEGER PRIMARY KEY,
boss_name TEXT NOT NULL,
tier INTEGER NOT NULL DEFAULT 0,
outcome TEXT NOT NULL, -- "defeated" | "survived"
hp_remaining INTEGER NOT NULL DEFAULT 0,
hp_max INTEGER NOT NULL DEFAULT 0,
defenders INTEGER NOT NULL DEFAULT 0,
mvp TEXT NOT NULL DEFAULT '',
mvp_fights INTEGER NOT NULL DEFAULT 0,
ended_at INTEGER NOT NULL DEFAULT 0
);
-- The expedition liveblog. Two tables, and — unlike everything else gogobee
-- pushes — these are append-only history, not a replaceable snapshot. A beat is
-- something that HAPPENED; there is no later truth that corrects it, only more
-- of it.
--
-- adventure_run is the header, assembled from the run's beats rather than pushed
-- as its own object: the "start" beat opens it and the "end" beat closes it.
-- That means a run whose start beat never arrived still gets a row (created by
-- whatever beat did arrive) and is simply unattributed — the log survives
-- nameless instead of being dropped for want of a name.
--
-- summary is the one piece of PROSE anywhere in the liveblog. Every log line is
-- assembled by Pete out of a beat's own nouns and numbers; this is gogobee's LLM
-- reading the finished run back and saying what it was *about*, which is a
-- judgement no template can make. It arrives late — its own beat, a tick or two
-- after the run ends — and it is optional forever: with the model off, the report
-- is the log plus the numbers, which is still the report.
CREATE TABLE IF NOT EXISTS adventure_run (
run_id TEXT PRIMARY KEY,
token TEXT NOT NULL DEFAULT '', -- public board token; '' = unattributed
name TEXT NOT NULL DEFAULT '',
level INTEGER NOT NULL DEFAULT 0,
zone TEXT NOT NULL DEFAULT '',
total_rooms INTEGER NOT NULL DEFAULT 0,
started_at INTEGER NOT NULL DEFAULT 0,
updated_at INTEGER NOT NULL DEFAULT 0,
ended_at INTEGER NOT NULL DEFAULT 0, -- 0 = still walking
outcome TEXT NOT NULL DEFAULT '', -- cleared|died|retreated|abandoned
summary TEXT NOT NULL DEFAULT '' -- LLM run summary, post prose-guard
);
CREATE INDEX IF NOT EXISTS idx_adv_run_token ON adventure_run(token, started_at DESC);
-- (run_id, seq) is the identity, so a re-sent batch collapses on the primary key
-- and needs no content comparison. seq is gogobee's monotonic counter, which is
-- also the render order — beats can arrive out of order across two batches and
-- still read correctly.
CREATE TABLE IF NOT EXISTS adventure_run_beat (
run_id TEXT NOT NULL,
seq INTEGER NOT NULL,
kind TEXT NOT NULL,
occurred_at INTEGER NOT NULL DEFAULT 0,
room INTEGER NOT NULL DEFAULT 0,
total_rooms INTEGER NOT NULL DEFAULT 0,
room_kind TEXT NOT NULL DEFAULT '',
target TEXT NOT NULL DEFAULT '',
outcome TEXT NOT NULL DEFAULT '',
amount INTEGER NOT NULL DEFAULT 0,
qty INTEGER NOT NULL DEFAULT 0,
hp INTEGER NOT NULL DEFAULT 0,
hp_max INTEGER NOT NULL DEFAULT 0,
crits INTEGER NOT NULL DEFAULT 0,
fumbles INTEGER NOT NULL DEFAULT 0,
region TEXT NOT NULL DEFAULT '',
-- prose is carried by exactly one beat kind ("summary") and is never rendered
-- as a log line. It lives on the beat rather than on its own endpoint so the
-- summary inherits the whole channel: idempotent on (run_id, seq), retried
-- until delivered, and impossible to attach to a run that doesn't exist.
prose TEXT NOT NULL DEFAULT '',
PRIMARY KEY (run_id, seq)
);
-- The realm: the world map, the hall of firsts, and the board. Four tables from
-- one gogobee push, all replaced whole — the same contract as the roster and the
-- Siege, and for the same reason. Every row here is a *derived* answer (how many
-- clears, who was first, who is inside right now) recomputed on the game box from
-- its own run history. Pete keeping a stale one and merging into it would let a
-- correction upstream leave a wrong number here permanently.
--
-- Unlike the Siege there is no live/history lifetime split, because none of this
-- has a lifetime: a zone does not end. What varies is only how often it changes,
-- and that is handled on the gogobee side by pushing every ten minutes instead of
-- every two.
--
-- pos is the push order throughout, kept as the key for the same reason the siege
-- muster does: an opted-out player carries NO token, so several rows can
-- legitimately be tokenless and must not collide on one.
CREATE TABLE IF NOT EXISTS adventure_realm_zone (
pos INTEGER PRIMARY KEY, -- gogobee's design-doc zone order
zone_id TEXT NOT NULL,
display TEXT NOT NULL,
tier INTEGER NOT NULL DEFAULT 0,
level_min INTEGER NOT NULL DEFAULT 0,
level_max INTEGER NOT NULL DEFAULT 0,
faction TEXT NOT NULL DEFAULT '',
atmosphere TEXT NOT NULL DEFAULT '',
postgame INTEGER NOT NULL DEFAULT 0,
first_by TEXT NOT NULL DEFAULT '',
first_token TEXT NOT NULL DEFAULT '',
first_at INTEGER NOT NULL DEFAULT 0,
clears INTEGER NOT NULL DEFAULT 0,
clearers INTEGER NOT NULL DEFAULT 0
);
-- Who is standing in a zone right now. Its own table rather than a JSON blob on
-- the zone row so the map can be drawn with one join and "there are people in
-- there" is a count, not a parse.
CREATE TABLE IF NOT EXISTS adventure_realm_occupant (
pos INTEGER PRIMARY KEY,
zone_id TEXT NOT NULL,
token TEXT NOT NULL DEFAULT '',
name TEXT NOT NULL,
level INTEGER NOT NULL DEFAULT 0,
day INTEGER NOT NULL DEFAULT 0
);
CREATE INDEX IF NOT EXISTS idx_adv_realm_occ_zone ON adventure_realm_occupant(zone_id);
-- The hall of firsts: every thing that has happened in the realm exactly once.
-- holder is empty when the game can no longer say who did it (a treasure found
-- and later discarded leaves no owner anywhere) — an unattributed first is still
-- a first and is rendered as one.
CREATE TABLE IF NOT EXISTS adventure_realm_first (
pos INTEGER PRIMARY KEY, -- gogobee's order: oldest first
kind TEXT NOT NULL, -- "zone" | "treasure" | whatever comes next
target TEXT NOT NULL,
display TEXT NOT NULL,
tier INTEGER NOT NULL DEFAULT 0,
holder TEXT NOT NULL DEFAULT '',
token TEXT NOT NULL DEFAULT '',
at_unix INTEGER NOT NULL DEFAULT 0
);
-- The board. pos IS the rank, and the ranking is gogobee's — the ordering is a
-- statement about what the game values, and the game gets to make it.
CREATE TABLE IF NOT EXISTS adventure_realm_standing (
pos INTEGER PRIMARY KEY,
token TEXT NOT NULL DEFAULT '',
name TEXT NOT NULL,
level INTEGER NOT NULL DEFAULT 0,
class_race TEXT NOT NULL DEFAULT '',
deepest_tier INTEGER NOT NULL DEFAULT 0,
clears INTEGER NOT NULL DEFAULT 0,
zones INTEGER NOT NULL DEFAULT 0,
firsts INTEGER NOT NULL DEFAULT 0,
siege_damage INTEGER NOT NULL DEFAULT 0,
siege_fights INTEGER NOT NULL DEFAULT 0
);
-- One row, like adventure_siege: when the realm last arrived. Its own table
-- because "gogobee has never pushed a realm" and "gogobee pushed a realm that is
-- empty" are different states, and the page says different things about them.
CREATE TABLE IF NOT EXISTS adventure_realm_meta (
id INTEGER PRIMARY KEY CHECK (id = 1),
snapshot_at INTEGER NOT NULL DEFAULT 0
);
-- A signed-in buyer's own euro balance, as of the last snapshot gogobee pushed. -- A signed-in buyer's own euro balance, as of the last snapshot gogobee pushed.
-- Keyed by localpart (== Authentik preferred_username == the session's Username), -- Keyed by localpart (== Authentik preferred_username == the session's Username),
-- a *separate keyspace* from the anonymous roster tokens on purpose: it is only -- a *separate keyspace* from the anonymous roster tokens on purpose: it is only
@@ -111,6 +361,88 @@ CREATE TABLE IF NOT EXISTS mischief_tiers (
ordinal INTEGER NOT NULL DEFAULT 0 ordinal INTEGER NOT NULL DEFAULT 0
); );
-- An equip/unequip an owner asked for from their own detail page, on its way to
-- gogobee. This is the one adventure feature that carries intent *back* to the
-- game box; it does it the mischief way, with no new network route — Pete records
-- the intent, gogobee polls and applies it against its own equipment tables, and
-- pushes back a verdict. The status ladder:
--
-- pending -> applied (worn or removed; detail says how)
-- -> rejected_not_owned (the item left the pack before gogobee got here)
-- -> rejected_not_worn (unequip of an already-empty slot)
-- -> rejected_not_equippable (the item has no slot to fill)
--
-- guid is the idempotency key end to end. Note the game action is NOT naturally
-- idempotent (equipping consumes an inventory row), so gogobee short-circuits on
-- this guid before it mutates — unlike mischief, whose action converges on its
-- own. owner_sub is the OIDC subject (stable across renames) and keys "my orders";
-- owner_localpart is the Matrix localpart gogobee turns into the MXID of the
-- character to dress. item_id is the adventure_inventory row id for an equip (the
-- table is AUTOINCREMENT, so a stale id misses cleanly rather than hitting the
-- wrong item); an unequip keys on slot alone. character_name and item_name are
-- frozen display copy gogobee ignores.
CREATE TABLE IF NOT EXISTS equip_orders (
guid TEXT PRIMARY KEY,
owner_sub TEXT NOT NULL,
owner_localpart TEXT NOT NULL,
character_name TEXT NOT NULL DEFAULT '',
item_id INTEGER NOT NULL DEFAULT 0,
item_name TEXT NOT NULL DEFAULT '',
slot TEXT NOT NULL DEFAULT '',
action TEXT NOT NULL, -- equip / unequip / upgrade / repair
tier INTEGER NOT NULL DEFAULT 0, -- upgrade target tier; unused by the other actions
status TEXT NOT NULL, -- see the ladder above
detail TEXT, -- gogobee's human note on the verdict
created_at INTEGER NOT NULL,
updated_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS idx_equip_orders_pending ON equip_orders(status, created_at);
CREATE INDEX IF NOT EXISTS idx_equip_orders_owner ON equip_orders(owner_sub, created_at DESC);
-- An action an owner asked for from the web — pull out of a run, take today's
-- swing at the Siege — on its way to gogobee. Same reverse-pipe shape as
-- equip_orders and the same guid-as-idempotency-key contract, but a SEPARATE
-- table on purpose: every column of equip_orders is equip vocabulary (item, slot,
-- tier), and these verbs act on the character rather than on something it is
-- carrying. Sharing the table would have meant rows where most columns are
-- meaningless and an action set nobody could read.
--
-- The status ladder:
--
-- pending -> applied (it happened; detail says what)
-- -> rejected_not_running (extract/abandon/leave: no expedition)
-- -> rejected_not_leader (extract/abandon: a member can't call it)
-- -> rejected_is_leader (leave: the leader's row IS the expedition)
-- -> rejected_no_siege (siege_join: nothing camped outside town)
-- -> rejected_already_fought (siege_join: today's bout is already spent)
-- -> rejected_busy (already out, seated, or has a sitter)
-- -> rejected_insufficient_funds (could not cover the cost)
-- -> rejected_zone_locked (expedition_start: not open at this level)
-- -> rejected_nothing_to_resume (nothing extracted, or the window closed)
-- -> rejected_nothing_to_cancel (babysit_cancel: no sitter is engaged)
-- -> rejected_unavailable (no character, dead, or an unsold argument)
--
-- Like the equip queue, the underlying game action is NOT idempotent — an extract
-- ends an expedition and a bout spends a day — so gogobee short-circuits on the
-- guid before it mutates anything. token is the roster token the order was placed
-- from; gogobee ignores it (the localpart names the character) but it is what
-- Pete proved ownership against, and it keeps the row self-describing.
CREATE TABLE IF NOT EXISTS adventure_orders (
guid TEXT PRIMARY KEY,
owner_sub TEXT NOT NULL,
owner_localpart TEXT NOT NULL,
token TEXT NOT NULL DEFAULT '',
character_name TEXT NOT NULL DEFAULT '',
action TEXT NOT NULL, -- see the AdvAction* set
status TEXT NOT NULL, -- see the ladder above
detail TEXT, -- gogobee's human note on the verdict
params TEXT NOT NULL DEFAULT '', -- the verb's arguments as JSON; '' for the verbs that take none
created_at INTEGER NOT NULL,
updated_at INTEGER NOT NULL
);
CREATE INDEX IF NOT EXISTS idx_adventure_orders_pending ON adventure_orders(status, created_at);
CREATE INDEX IF NOT EXISTS idx_adventure_orders_owner ON adventure_orders(owner_sub, created_at DESC);
-- A player's private, owner-only expansion — inventory, vault, house, pets — -- A player's private, owner-only expansion — inventory, vault, house, pets —
-- pushed whole by gogobee on the roster tick. Keyed by localpart (== session -- pushed whole by gogobee on the roster tick. Keyed by localpart (== session
-- Username), a *separate keyspace* from the anonymous roster tokens on purpose: -- Username), a *separate keyspace* from the anonymous roster tokens on purpose:
@@ -129,6 +461,22 @@ CREATE TABLE IF NOT EXISTS player_self_detail (
); );
CREATE INDEX IF NOT EXISTS idx_player_self_detail_token ON player_self_detail(token); CREATE INDEX IF NOT EXISTS idx_player_self_detail_token ON player_self_detail(token);
-- Per-user visit clock for the adventure section's "while you were away" panel,
-- keyed by OIDC subject like every other per-user table.
--
-- TWO stamps, and the second one is the whole trick. window_from is where the
-- panel reads from; last_seen_at is a heartbeat written on every page load. One
-- column would make the panel a one-shot: it would show what happened, move the
-- stamp to now, and a refresh five seconds later would render an empty box over
-- the same news. So window_from advances only when a genuinely new visit begins
-- (see AdvVisitWindow), which keeps the panel stable for as long as somebody is
-- actually reading it.
CREATE TABLE IF NOT EXISTS adventure_visit (
user_sub TEXT PRIMARY KEY,
window_from INTEGER NOT NULL,
last_seen_at INTEGER NOT NULL
);
CREATE TABLE IF NOT EXISTS post_log ( CREATE TABLE IF NOT EXISTS post_log (
id INTEGER PRIMARY KEY AUTOINCREMENT, id INTEGER PRIMARY KEY AUTOINCREMENT,
guid TEXT NOT NULL, guid TEXT NOT NULL,
@@ -205,13 +553,26 @@ CREATE TABLE IF NOT EXISTS source_health (
-- server needs them to encrypt each push. last_notified_at is the per-endpoint -- server needs them to encrypt each push. last_notified_at is the per-endpoint
-- digest watermark: the sender only counts stories seen after it. A user can -- digest watermark: the sender only counts stories seen after it. A user can
-- have several endpoints (phone, desktop) — each is notified independently. -- have several endpoints (phone, desktop) — each is notified independently.
--
-- user_localpart is the same identity one level down: user_sub is the OIDC
-- subject, but every adventure ownership join in this schema is keyed on the
-- Matrix localpart (see player_self_detail), and nothing else persists that
-- mapping outside a live session. It is captured at subscribe time so the
-- adventure alert sender — which runs on a ticker with no request to read a
-- session from — can answer "whose adventurer is this" at all.
--
-- last_adv_notified_at is the adventure alerts' own watermark, kept apart from
-- the digest's on purpose: the two senders run on different clocks and one
-- column would let each silently consume the other's backlog.
CREATE TABLE IF NOT EXISTS push_subscriptions ( CREATE TABLE IF NOT EXISTS push_subscriptions (
endpoint TEXT PRIMARY KEY, endpoint TEXT PRIMARY KEY,
user_sub TEXT NOT NULL, user_sub TEXT NOT NULL,
user_localpart TEXT NOT NULL DEFAULT '',
p256dh TEXT NOT NULL, p256dh TEXT NOT NULL,
auth TEXT NOT NULL, auth TEXT NOT NULL,
created_at INTEGER NOT NULL, created_at INTEGER NOT NULL,
last_notified_at INTEGER NOT NULL last_notified_at INTEGER NOT NULL,
last_adv_notified_at INTEGER NOT NULL DEFAULT 0
); );
-- Privacy-preserving daily unique estimate. visitor is a salted hash of -- Privacy-preserving daily unique estimate. visitor is a salted hash of
internal/storage/siege.go
+254
View File
@@ -0,0 +1,254 @@
package storage
import (
"database/sql"
)
// The Siege, as gogobee pushes it.
//
// Same shape of thing as the roster and stored the same way: a whole snapshot
// that replaces whatever we had. Nothing here is an event — the *events*
// (siege_start / siege_win / siege_loss) come down the dispatch queue like any
// other fact. This is the thing that is currently true, which is the only kind
// of thing a health bar can honestly draw.
// SiegeDefender is one adventurer's standing in the current muster.
//
// Token is the same public roster token the board uses, so the defender board
// can link a name to their page — and it is EMPTY for an opted-out player. That
// is the whole opt-out story here: their damage still counts and still holds its
// rank (the town's effort is the town's), but there is no name and no link. Name
// carries gogobee's anonymised label in that case.
type SiegeDefender struct {
Token string `json:"token,omitempty"`
Name string `json:"name"`
Level int `json:"level,omitempty"`
Fights int `json:"fights"`
Damage int `json:"damage"`
FoughtToday bool `json:"fought_today"`
}
// SiegePast is one closed-out Siege: what came, whether the town held, and who
// turned up most. The history is what makes the live bar mean anything.
type SiegePast struct {
BossID int64 `json:"boss_id"`
BossName string `json:"boss_name"`
Tier int `json:"tier"`
Outcome string `json:"outcome"` // "defeated" | "survived"
HPRemaining int `json:"hp_remaining"`
HPMax int `json:"hp_max"`
Defenders int `json:"defenders"`
MVP string `json:"mvp,omitempty"`
MVPFights int `json:"mvp_fights,omitempty"`
EndedAt int64 `json:"ended_at"`
}
// Siege is the complete war-room state: the live boss (if any), its muster, and
// every Siege that came before.
type Siege struct {
Active bool `json:"active"`
BossID int64 `json:"boss_id,omitempty"`
BossName string `json:"boss_name,omitempty"`
Tier int `json:"tier,omitempty"`
HPCurrent int `json:"hp_current"`
HPMax int `json:"hp_max"`
StartsAt int64 `json:"starts_at,omitempty"`
EndsAt int64 `json:"ends_at,omitempty"`
BoutsToday int `json:"bouts_today"`
Defenders []SiegeDefender `json:"defenders,omitempty"`
History []SiegePast `json:"history,omitempty"`
SnapshotAt int64 `json:"snapshot_at"`
}
// ReplaceSiege swaps the whole war room for a new snapshot, in one transaction.
//
// Replace, never merge — for the same reason the roster does it. A defender who
// dropped out of the payload (opted out, deleted character) has to leave the
// board, and a Siege that ended has to stop showing a live bar. The transaction
// means a reader mid-swap sees the old Siege or the new one, never a boss with
// somebody else's muster under it.
//
// History is replaced too, not appended: gogobee is the authority on what has
// happened, and rebuilding from its list each tick means a corrected or purged
// row upstream can't leave a ghost siege on Pete forever.
func ReplaceSiege(s Siege, snapshotAt int64) error {
tx, err := Get().Begin()
if err != nil {
return err
}
defer func() { _ = tx.Rollback() }()
if _, err := tx.Exec(`DELETE FROM adventure_siege_defenders`); err != nil {
return err
}
if _, err := tx.Exec(`DELETE FROM adventure_siege_history`); err != nil {
return err
}
if _, err := tx.Exec(`
INSERT INTO adventure_siege
(id, active, boss_id, boss_name, tier, hp_current, hp_max,
starts_at, ends_at, bouts_today, snapshot_at)
VALUES (1, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT(id) DO UPDATE SET
active = excluded.active, boss_id = excluded.boss_id,
boss_name = excluded.boss_name, tier = excluded.tier,
hp_current = excluded.hp_current, hp_max = excluded.hp_max,
starts_at = excluded.starts_at, ends_at = excluded.ends_at,
bouts_today = excluded.bouts_today, snapshot_at = excluded.snapshot_at`,
s.Active, s.BossID, s.BossName, s.Tier, s.HPCurrent, s.HPMax,
s.StartsAt, s.EndsAt, s.BoutsToday, snapshotAt); err != nil {
return err
}
dstmt, err := tx.Prepare(`
INSERT INTO adventure_siege_defenders
(pos, token, name, level, fights, damage, fought_today)
VALUES (?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer dstmt.Close()
for i, d := range s.Defenders {
if _, err := dstmt.Exec(i, d.Token, d.Name, d.Level, d.Fights, d.Damage, d.FoughtToday); err != nil {
return err
}
}
// OR REPLACE, because boss_id is the primary key and a duplicate in gogobee's
// list would otherwise fail this whole transaction — the live boss and the
// muster with it, freezing the war room on the previous snapshot indefinitely.
// The table is deleted and rebuilt from the pushed list every time, so a
// collision is a wire quirk rather than data loss, and keeping the last of a
// colliding pair is a far smaller failure than a war room that stops moving.
hstmt, err := tx.Prepare(`
INSERT OR REPLACE INTO adventure_siege_history
(boss_id, boss_name, tier, outcome, hp_remaining, hp_max, defenders, mvp, mvp_fights, ended_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`)
if err != nil {
return err
}
defer hstmt.Close()
for _, h := range s.History {
if _, err := hstmt.Exec(h.BossID, h.BossName, h.Tier, h.Outcome, h.HPRemaining,
h.HPMax, h.Defenders, h.MVP, h.MVPFights, h.EndedAt); err != nil {
return err
}
}
return tx.Commit()
}
// SiegeBarForBoss finds the HP bar to draw on a siege dispatch's card: current
// and max HP for the named boss around the time the dispatch was filed.
//
// A siege fact carries the boss and the defender count but not the HP, so the
// bar has to come from the war-room snapshot. Two places to look, in order:
//
// - the live row, when that boss is still camped (a siege_start card should
// show the bar as it stands right now, and it will keep sliding as the town
// chips away);
// - the history, for a Siege that has closed — matched on name and then on
// the row that ended nearest the dispatch, since the same boss comes back
// month after month and only the clock separates the two.
//
// ok is false when neither has it, which is a real and temporary state: the
// win/loss dispatch is filed the moment the Siege resolves, and the history that
// explains it doesn't reach Pete until the next 2-minute push. The card renders
// without a bar in the meantime rather than drawing a wrong one.
func SiegeBarForBoss(boss string, at int64) (current, max int, ok bool) {
if boss == "" {
return 0, 0, false
}
var active bool
var name string
var hpCur, hpMax int
err := Get().QueryRow(`
SELECT active, boss_name, hp_current, hp_max FROM adventure_siege WHERE id = 1`).
Scan(&active, &name, &hpCur, &hpMax)
if err == nil && active && name == boss && hpMax > 0 {
return hpCur, hpMax, true
}
// ORDER BY the distance from the dispatch, so a boss that has besieged the
// town three times resolves to the siege this dispatch is actually about.
err = Get().QueryRow(`
SELECT hp_remaining, hp_max FROM adventure_siege_history
WHERE boss_name = ? AND hp_max > 0
ORDER BY ABS(ended_at - ?) ASC LIMIT 1`, boss, at).Scan(&hpCur, &hpMax)
if err != nil {
return 0, 0, false
}
return hpCur, hpMax, true
}
// SiegeIsCamped answers the one question the siege_join pre-check asks, without
// LoadSiege's defender rows and whole history behind it — a one-column read on a
// pool that is MaxOpenConns(1).
//
// known is false when gogobee has never pushed a war room at all, which is NOT
// the same as a pushed snapshot saying no Siege is camped. The caller has to keep
// the two apart: a fresh deploy that has not been pushed to yet must still queue
// the order rather than show a dead button.
func SiegeIsCamped() (active, known bool, err error) {
err = Get().QueryRow(`SELECT active FROM adventure_siege WHERE id = 1`).Scan(&active)
if err == sql.ErrNoRows {
return false, false, nil
}
if err != nil {
return false, false, err
}
return active, true, nil
}
// LoadSiege returns the war room as last pushed. ok is false when gogobee has
// never pushed one at all — distinct from a pushed snapshot that says no Siege
// is camped, which is a real answer the page can render.
func LoadSiege() (Siege, bool, error) {
var s Siege
err := Get().QueryRow(`
SELECT active, boss_id, boss_name, tier, hp_current, hp_max,
starts_at, ends_at, bouts_today, snapshot_at
FROM adventure_siege WHERE id = 1`).Scan(
&s.Active, &s.BossID, &s.BossName, &s.Tier, &s.HPCurrent, &s.HPMax,
&s.StartsAt, &s.EndsAt, &s.BoutsToday, &s.SnapshotAt)
if err == sql.ErrNoRows {
return Siege{}, false, nil
}
if err != nil {
return Siege{}, false, err
}
drows, err := Get().Query(`
SELECT token, name, level, fights, damage, fought_today
FROM adventure_siege_defenders ORDER BY pos ASC`)
if err != nil {
return s, true, err
}
defer drows.Close()
for drows.Next() {
var d SiegeDefender
if err := drows.Scan(&d.Token, &d.Name, &d.Level, &d.Fights, &d.Damage, &d.FoughtToday); err != nil {
return s, true, err
}
s.Defenders = append(s.Defenders, d)
}
if err := drows.Err(); err != nil {
return s, true, err
}
hrows, err := Get().Query(`
SELECT boss_id, boss_name, tier, outcome, hp_remaining, hp_max, defenders, mvp, mvp_fights, ended_at
FROM adventure_siege_history ORDER BY ended_at DESC, boss_id DESC`)
if err != nil {
return s, true, err
}
defer hrows.Close()
for hrows.Next() {
var h SiegePast
if err := hrows.Scan(&h.BossID, &h.BossName, &h.Tier, &h.Outcome, &h.HPRemaining,
&h.HPMax, &h.Defenders, &h.MVP, &h.MVPFights, &h.EndedAt); err != nil {
return s, true, err
}
s.History = append(s.History, h)
}
return s, true, hrows.Err()
}
internal/storage/visit.go
+97
View File
@@ -0,0 +1,97 @@
package storage
import (
"database/sql"
)
// The visit clock behind the adventure section's "while you were away" panel.
//
// The panel answers "what happened to my adventurer since I last looked", which
// needs a per-user stamp — and the obvious one-column version of that is broken
// in a way that only shows up in a browser: show the news, move the stamp to now,
// and the reader's first refresh renders an empty box over the same events. So
// there are two stamps. See the adventure_visit schema comment.
// advVisitSessionGap is how long a gap in page loads counts as having gone away.
// Thirty minutes: long enough that a reader clicking through a dispatch and back
// keeps the same panel, short enough that "since last time" means something after
// a lunch break rather than only after a day.
const advVisitSessionGap = 30 * 60
// AdvVisitWindow stamps this visit and reports the instant the panel should read
// from — every dispatch after it is news to this user.
//
// firstVisit is true the first time a user is ever seen, and the caller must show
// nothing for it. The row is created stamped to now, so their history is not
// news: somebody signing in for the first time has not been "away", and greeting
// them with every death their character ever suffered would be a worse
// introduction than silence.
func AdvVisitWindow(userSub string, now int64) (from int64, firstVisit bool, err error) {
if userSub == "" {
return 0, true, nil
}
var windowFrom, lastSeen int64
err = Get().QueryRow(
`SELECT window_from, last_seen_at FROM adventure_visit WHERE user_sub = ?`,
userSub).Scan(&windowFrom, &lastSeen)
if err == sql.ErrNoRows {
_, ierr := Get().Exec(
`INSERT INTO adventure_visit (user_sub, window_from, last_seen_at) VALUES (?, ?, ?)`,
userSub, now, now)
return now, true, ierr
}
if err != nil {
return 0, true, err
}
// A new visit starts when the heartbeat has gone quiet for longer than the
// session gap. Only then does the window move — and it moves to where the
// reader actually left off (lastSeen), never to now, or the events between
// their last page load and this one would fall down the crack between the two.
if now-lastSeen > advVisitSessionGap {
windowFrom = lastSeen
}
_, err = Get().Exec(
`UPDATE adventure_visit SET window_from = ?, last_seen_at = ? WHERE user_sub = ?`,
windowFrom, now, userSub)
return windowFrom, false, err
}
// EventsBySubjectSince is EventsBySubject narrowed to what is new. The limit is
// applied to the *window*, not to the subject's whole history, so a player back
// from a long absence gets the most recent N of what they missed rather than N
// rows scanned from a history that might all predate the window.
func EventsBySubjectSince(name string, sinceUnix int64, limit int) ([]AdvEvent, error) {
if name == "" || limit <= 0 {
return nil, nil
}
rows, err := Get().Query(`
SELECT guid, event_type, tier, subject, opponent, boss, zone, region,
level, tally, outcome, milestone, stakes, run_id, occurred_at
FROM adventure_events
WHERE (subject = ? OR opponent = ?) AND occurred_at > ?
ORDER BY occurred_at DESC
LIMIT ?`, name, name, sinceUnix, limit)
if err != nil {
return nil, err
}
defer rows.Close()
var out []AdvEvent
for rows.Next() {
var e AdvEvent
var tier, subject, opponent, boss, zone, region sql.NullString
var outcome, milestone, stakes, runID sql.NullString
if err := rows.Scan(&e.GUID, &e.EventType, &tier, &subject, &opponent,
&boss, &zone, &region, &e.Level, &e.Tally, &outcome, &milestone,
&stakes, &runID, &e.OccurredAt); err != nil {
return nil, err
}
e.Tier, e.Subject, e.Opponent = tier.String, subject.String, opponent.String
e.Boss, e.Zone, e.Region = boss.String, zone.String, region.String
e.Outcome, e.Milestone, e.Stakes = outcome.String, milestone.String, stakes.String
e.RunID = runID.String
out = append(out, e)
}
return out, rows.Err()
}
internal/storage/visit_test.go
+36
View File
@@ -0,0 +1,36 @@
package storage
import (
"testing"
)
// TestAwayWindowOnlyMovesOnANewVisit pins the session gap directly. Within the
// gap the window is held; past it, it advances to where the reader actually left
// off — never to now, or everything between their last load and this one would
// fall down the crack.
func TestAwayWindowOnlyMovesOnANewVisit(t *testing.T) {
if err := Init(t.TempDir() + "/visit.db"); err != nil {
t.Fatal(err)
}
t.Cleanup(func() { Close() })
t0 := int64(1_000_000)
if _, first, err := AdvVisitWindow("sub-1", t0); err != nil || !first {
t.Fatalf("first call: first=%v err=%v", first, err)
}
// A minute later: same visit, window pinned to where it started.
from, _, err := AdvVisitWindow("sub-1", t0+60)
if err != nil || from != t0 {
t.Fatalf("window = %d (err %v), want it held at %d inside the session", from, err, t0)
}
// Well past the gap: a new visit, reading from the last heartbeat (t0+60),
// not from now.
from, _, err = AdvVisitWindow("sub-1", t0+60+advVisitSessionGap+1)
if err != nil {
t.Fatal(err)
}
if from != t0+60 {
t.Errorf("window = %d, want the previous heartbeat %d — anything else drops or replays events",
from, t0+60)
}
}
internal/web/adventure.go
+320 -42
View File
@@ -4,13 +4,14 @@ import (
"crypto/subtle" "crypto/subtle"
"encoding/json" "encoding/json"
"fmt" "fmt"
"html/template"
"io" "io"
"log/slog" "log/slog"
"net/http" "net/http"
"net/url" "net/url"
"strings" "strings"
"sync"
"time" "time"
"unicode"
"pete/internal/storage" "pete/internal/storage"
) )
@@ -37,6 +38,19 @@ type AdvFact struct {
Milestone string `json:"milestone"` Milestone string `json:"milestone"`
OccurredAt int64 `json:"occurred_at"` OccurredAt int64 `json:"occurred_at"`
NoPush bool `json:"no_push"` NoPush bool `json:"no_push"`
// RunID names the expedition this dispatch is the ending of, on the three
// event types that are one (a clear, a retreat, a death). It is what lets the
// permalink offer the run's own report — the log, the numbers, the moment it
// turned — instead of leaving a paragraph about an outcome with no way back to
// what produced it. Empty on every other fact.
RunID string `json:"run_id,omitempty"`
// Headline/Lede are gogobee's LLM-authored prose, both optional. When present
// and past the prose-guard they replace the template render; otherwise Pete
// falls back to renderAdventure. gogobee is compute here, Pete is the editor:
// the templates are no longer the renderer, they are the safety net. See
// proseGuard and adventure_expansion_spec.md §2.
Headline string `json:"headline,omitempty"`
Lede string `json:"lede,omitempty"`
} }
// AdvPost is a priority adventure item to post live to Matrix. Kept minimal and // AdvPost is a priority adventure item to post live to Matrix. Kept minimal and
@@ -93,19 +107,51 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
return return
} }
headline, lede, ok := renderAdventure(f) // Render the template first. It is the fallback for every fact whose LLM
if !ok { // prose is absent or fails the guard.
http.Error(w, "unknown event_type", http.StatusBadRequest) //
return // An event type Pete has no template for is NOT an error. It used to be a 400,
// and that was the wrong call: gogobee retries a 400 to its cap and then parks
// the dispatch forever, so the only thing the rejection accomplished was
// deleting a real game event that Pete simply hadn't learned to phrase yet.
// `companion_hire` was dropped that way from the day it shipped, and the
// mitigation on the books ("always deploy Pete first") is a rule a human has
// to remember rather than a property of the system.
//
// So: an unknown type publishes on the neutral fallback and is counted for the
// operator. gogobee can ship a new event type any day; the worst case is a
// thin card until Pete learns the words. 400 stays for facts that are actually
// invalid — no guid, or a failed name guard.
headline, lede, known := renderAdventure(f)
if !known {
advNoteUnknownType(f.EventType)
slog.Warn("adventure ingest: no template for event_type, publishing on fallback",
"guid", f.GUID, "event_type", f.EventType)
headline, lede = advFallbackRender(f)
} }
// Idempotent: a re-delivered fact (gogobee retry) is a no-op success. Checked
// Idempotent: a re-delivered fact (gogobee retry) is a no-op success. // before the prose-guard because the guard runs a board query (KnownCharacterNames);
// a retried dispatch we already have a story for should cost nothing.
if storage.IsGUIDSeen(f.GUID) { if storage.IsGUIDSeen(f.GUID) {
w.WriteHeader(http.StatusOK) w.WriteHeader(http.StatusOK)
_, _ = w.Write([]byte("duplicate")) _, _ = w.Write([]byte("duplicate"))
return return
} }
// Prefer gogobee's LLM prose when it is present and safe. Both fields must be
// supplied — a half-authored dispatch is not a voice, and mixing an LLM
// headline with a template lede reads as two writers. The guard is what makes
// the untrusted prose safe to print; a rejection is worth seeing loudly, since
// it is either a hallucinated name or someone who found an injection path.
if f.Headline != "" && f.Lede != "" {
if proseGuard(f.Headline, f.Lede, f.Actors) {
headline, lede = f.Headline, f.Lede
} else {
slog.Warn("adventure ingest: prose-guard rejected LLM dispatch, using template",
"guid", f.GUID, "event_type", f.EventType)
}
}
// A fact with no occurred_at would otherwise be stored at the Unix epoch: // A fact with no occurred_at would otherwise be stored at the Unix epoch:
// dated 1970 on the permalink, pinned to the bottom of the section, and // dated 1970 on the permalink, pinned to the bottom of the section, and
// outside every digest window. Treat "missing" as "now". // outside every digest window. Treat "missing" as "now".
@@ -115,7 +161,11 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
} }
articleURL := s.advPermalink(f.GUID) articleURL := s.advPermalink(f.GUID)
imageURL := advArtURL(f.EventType) // Keyed on the guid, not the event type: the card renderer reads the fact
// behind the dispatch so it can put the boss's name on it. The fact insert
// below is best-effort, and the card degrades to the type-only emblem when
// it isn't there — so this URL is safe to bake in before that runs.
imageURL := advArtURL(f.GUID)
if err := storage.InsertStory(&storage.Story{ if err := storage.InsertStory(&storage.Story{
GUID: f.GUID, GUID: f.GUID,
Headline: headline, Headline: headline,
@@ -132,6 +182,32 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
http.Error(w, "insert failed", http.StatusInternalServerError) http.Error(w, "insert failed", http.StatusInternalServerError)
return return
} }
// Keep the fact itself, not just the sentence we made out of it. The story row
// above is what people read; this is what the trophy case and timeline can
// count. Best-effort on purpose: a dispatch that published is published, and
// losing its structured twin costs a tally, not the news. Failing the request
// here would make gogobee retry a fact we already have a story for.
if err := storage.InsertAdventureEvent(&storage.AdvEvent{
GUID: f.GUID,
EventType: f.EventType,
Tier: f.Tier,
Subject: f.Subject,
Opponent: f.Opponent,
Boss: f.Boss,
Zone: f.Zone,
Region: f.Region,
Level: f.Level,
Tally: f.Count,
Outcome: f.Outcome,
Milestone: f.Milestone,
Stakes: f.Stakes,
Actors: f.Actors,
RunID: f.RunID,
OccurredAt: occurredAt,
}); err != nil {
slog.Error("adventure ingest: event record failed", "guid", f.GUID, "err", err)
}
slog.Info("adventure ingest: published", "guid", f.GUID, "event_type", f.EventType, "tier", f.Tier) slog.Info("adventure ingest: published", "guid", f.GUID, "event_type", f.EventType, "tier", f.Tier)
// NoPush (cold-start backfill) means "never goes to Matrix". Suppressing only // NoPush (cold-start backfill) means "never goes to Matrix". Suppressing only
@@ -148,7 +224,13 @@ func (s *Server) handleAdventureIngest(w http.ResponseWriter, r *http.Request) {
// PRIORITY beats post live to Matrix; BULLETIN beats wait for the daily // PRIORITY beats post live to Matrix; BULLETIN beats wait for the daily
// digest. Website section always gets the row above regardless of tier. // digest. Website section always gets the row above regardless of tier.
if f.Tier == "priority" && s.advPost != nil && s.adv.Channel != "" { //
// An untemplated type never interrupts the room, whatever tier it claims.
// Publishing one to the site is cheap and reversible — a thin card among
// cards. Pinging everyone in Matrix with a dispatch Pete couldn't phrase is
// neither. It still reaches Matrix through the daily digest, one line among
// many, which is the right volume for something we don't understand yet.
if f.Tier == "priority" && known && s.advPost != nil && s.adv.Channel != "" {
// No ImageURL: the emblem is an SVG (Matrix clients often block SVG // No ImageURL: the emblem is an SVG (Matrix clients often block SVG
// media), and the link's og:image carries the preview instead. // media), and the link's og:image carries the preview instead.
// No Source: the source tag exists to credit an outlet Pete is relaying // No Source: the source tag exists to credit an outlet Pete is relaying
@@ -180,6 +262,8 @@ func advEventMeta(eventType string) (label, emoji string) {
return "First clear", "🗺️" return "First clear", "🗺️"
case "zone_clear": case "zone_clear":
return "Zone cleared", "🗺️" return "Zone cleared", "🗺️"
case "treasure_found":
return "Treasure", "💎"
case "death": case "death":
return "In memoriam", "🪦" return "In memoriam", "🪦"
case "arrival": case "arrival":
@@ -202,46 +286,82 @@ func advEventMeta(eventType string) (label, emoji string) {
return "The contract landed", "💀" return "The contract landed", "💀"
case "mischief_fizzled": case "mischief_fizzled":
return "Nobody home", "🚪" return "Nobody home", "🚪"
case "companion_hire":
return "Pete tags along", "🎒"
} }
return "Dispatch", "📣" return "Dispatch", "📣"
} }
// advArtURL is the card/OG image for a dispatch: a themed SVG emblem served by // advUnknownTypes counts event types that arrived without a template, so an
// handleAdventureArt, keyed on event_type. Local (root-relative) so it bypasses // operator can see what Pete needs to learn to write. Before the unknown-type
// the external-image thumbnailer. // inversion these were 400s: gogobee retried to its cap and then parked the
func advArtURL(eventType string) string { // dispatch forever, which is how `companion_hire` was silently dropped for
return "/adventure/art/" + eventType + ".svg" // months. Now they publish on the neutral fallback and land here instead, where
// the admin status page can say "companion_hire ×12, still no template".
var advUnknownTypes = struct {
sync.Mutex
counts map[string]int
}{counts: map[string]int{}}
func advNoteUnknownType(eventType string) {
advUnknownTypes.Lock()
defer advUnknownTypes.Unlock()
advUnknownTypes.counts[eventType]++
} }
// handleAdventureArt renders the themed emblem for an event type — an adventure // AdvUnknownTypeCounts returns a copy of the untemplated-type tally.
// gradient with the event's emoji and label. Deterministic and dependency-free func AdvUnknownTypeCounts() map[string]int {
// (no external asset), so every dispatch card has visual identity instead of the advUnknownTypes.Lock()
// blank placeholder that made the section look broken next to RSS cards. defer advUnknownTypes.Unlock()
func (s *Server) handleAdventureArt(w http.ResponseWriter, r *http.Request) { out := make(map[string]int, len(advUnknownTypes.counts))
if !s.adv.Enabled { for k, v := range advUnknownTypes.counts {
http.NotFound(w, r) out[k] = v
return
} }
eventType := strings.TrimSuffix(r.PathValue("type"), ".svg") return out
label, emoji := advEventMeta(eventType)
w.Header().Set("Content-Type", "image/svg+xml; charset=utf-8")
w.Header().Set("Cache-Control", "public, max-age=86400")
_, _ = fmt.Fprintf(w, advArtSVG, template.HTMLEscapeString(emoji), template.HTMLEscapeString(strings.ToUpper(label)))
} }
// advArtSVG is the emblem template: %s = emoji, %s = label. 1200×630 (the OG // withArticle prefixes a noun with "a"/"an". Class names are a small closed set
// card ratio) so the same image works as a link-preview image. // from the game ("cleric", "artificer"), so first-letter vowel is enough — this
const advArtSVG = `<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630"> // is not trying to be a general English article engine.
<defs> func withArticle(noun string) string {
<linearGradient id="g" x1="0" y1="0" x2="1" y2="1"> if noun == "" {
<stop offset="0" stop-color="#7c5ce8"/> return ""
<stop offset="1" stop-color="#5836b8"/> }
</linearGradient> switch noun[0] {
</defs> case 'a', 'e', 'i', 'o', 'u':
<rect width="1200" height="630" fill="url(#g)"/> return "an " + noun
<text x="600" y="300" font-size="260" text-anchor="middle" dominant-baseline="central">%s</text> }
<text x="600" y="500" font-size="64" font-family="Fredoka, Nunito, system-ui, sans-serif" font-weight="700" fill="#ffffff" text-anchor="middle" letter-spacing="6" opacity="0.92">%s</text> return "a " + noun
</svg>` }
// advFallbackRender is the dispatch for an event type Pete has no template for.
//
// It is deliberately thin and deliberately honest: it says something happened
// and admits the details aren't in yet, rather than guessing at semantics Pete
// doesn't have. Only guarded or game-authored fields reach it — Subject has
// already passed factGuard, and Zone is game-authored — so it carries no more
// exposure than any templated branch.
//
// In practice it is rarely what publishes. gogobee authors LLM prose for every
// fact from the fact's fields with no per-type switch (authorDispatch in
// pete_dispatch_voice.go), so an unknown type still arrives with a real headline
// and lede, and this only shows through when the model is off or the prose-guard
// rejected it.
func advFallbackRender(f AdvFact) (headline, lede string) {
const stillGetting = " I'm still getting the details on this one — I'll fill it in properly when I have them."
switch {
case f.Subject != "" && f.Zone != "":
return fmt.Sprintf("Word in about %s.", f.Subject),
fmt.Sprintf("Something happened out in %s involving %s.%s", f.Zone, f.Subject, stillGetting)
case f.Subject != "":
return fmt.Sprintf("Word in about %s.", f.Subject),
fmt.Sprintf("%s has been up to something.%s", f.Subject, stillGetting)
case f.Zone != "":
return fmt.Sprintf("Something's happened in %s.", f.Zone),
"Word just came in from the field." + stillGetting
}
return "Word in from the realm.", "Something happened out there." + stillGetting
}
// advStoryPage is the per-story permalink view. It reuses the shared layout so a // advStoryPage is the per-story permalink view. It reuses the shared layout so a
// dispatch reads like the rest of the site, with an adventure-themed hero. // dispatch reads like the rest of the site, with an adventure-themed hero.
@@ -254,6 +374,10 @@ type advStoryPage struct {
Region string Region string
When string When string
Permalink string Permalink string
// RunReportURL is the link to the expedition behind this dispatch, when the
// dispatch is the end of one and the run is still reachable. Empty is the
// common case and renders nothing.
RunReportURL string
} }
// handleAdventureStory serves the server-rendered permalink for one dispatch // handleAdventureStory serves the server-rendered permalink for one dispatch
@@ -284,11 +408,29 @@ func (s *Server) handleAdventureStory(w http.ResponseWriter, r *http.Request) {
body = st.Lede // template-only dispatches carry the write-up in the lede body = st.Lede // template-only dispatches carry the write-up in the lede
} }
// The way back to what actually happened. Best-effort and usually absent: only
// the three end-of-expedition types carry a run id at all, and the run behind
// one is swept after a fortnight. A dispatch without it reads exactly as it
// did before the report existed.
// Region rides the same lookup rather than a second query. It is a *fact*
// field, never on the story row — the story is the words Pete wrote and they
// have no columns for where. So a dispatch filed before the fact table existed
// still renders regionless, which is what it always did.
runReport, region := "", ""
if ev, err := storage.AdventureEventByGUID(guid); err != nil {
slog.Error("adventure story: fact lookup failed", "guid", guid, "err", err)
} else {
runReport = runReportLinkFor(ev)
if ev != nil {
region = ev.Region
}
}
base := s.base(r) base := s.base(r)
base.Active = "adventure" base.Active = "adventure"
base.NoIndex = true // player-named page; keep out of search indexes (gap #5) base.NoIndex = true // player-named page; keep out of search indexes (gap #5)
if abs := strings.TrimRight(s.cfg.BaseURL, "/"); abs != "" { if abs := strings.TrimRight(s.cfg.BaseURL, "/"); abs != "" {
base.OGImage = abs + advArtURL(eventType) // emblem for link unfurls base.OGImage = abs + advArtURL(guid) // the dispatch's own card, for link unfurls
} }
s.render(w, "story", advStoryPage{ s.render(w, "story", advStoryPage{
pageData: base, pageData: base,
@@ -296,9 +438,10 @@ func (s *Server) handleAdventureStory(w http.ResponseWriter, r *http.Request) {
Emoji: emoji, Emoji: emoji,
Headline: st.Headline, Headline: st.Headline,
Body: body, Body: body,
Region: "", // reserved: region isn't stored on the row yet Region: region,
When: time.Unix(st.SeenAt, 0).UTC().Format("Jan 2, 2006"), When: time.Unix(st.SeenAt, 0).UTC().Format("Jan 2, 2006"),
Permalink: s.advPermalink(guid), Permalink: s.advPermalink(guid),
RunReportURL: runReport,
}) })
} }
@@ -347,6 +490,105 @@ func factGuard(f AdvFact) bool {
return true return true
} }
// Length caps for LLM-authored prose, enforced before render. The 64 KiB body
// cap on the ingest request is a transport limit, not a prose limit — a
// dispatch is a headline and a short paragraph, and anything past these is
// malformed, not a valid long story. Over the cap falls back to the template.
const (
maxDispatchHeadline = 200
maxDispatchLede = 800
)
// proseGuard decides whether gogobee's LLM-authored headline+lede is safe to
// print. factGuard checks the STRUCTURED Subject/Opponent fields; that was the
// whole safety story while Pete's own templates were the renderer, because a
// template can print nothing Pete did not interpolate. LLM prose breaks that
// assumption — the guard would be validating fields that are no longer the thing
// being rendered — so this checks the RENDERED TEXT itself.
//
// Two rejections, both falling back to the template:
// - Over the length caps: a runaway or padded generation, not a dispatch.
// - Naming a known adventurer the fact did not authorize: any character name
// Pete holds on the current board that is absent from the fact's Actors
// allow-list. Character names are player-chosen, so a hallucinated or
// injected name is a live way to put words in a real person's mouth on a
// public page. Boss/zone/region are game-authored, never on the board, so
// they never trip this.
//
// The name half is best-effort: an empty board (KnownCharacterNames nil) leaves
// only the length caps, which is the correct degraded behaviour — with no known
// names there is nothing to impersonate that Pete could recognise anyway.
func proseGuard(headline, lede string, actors []string) bool {
if len(headline) > maxDispatchHeadline || len(lede) > maxDispatchLede {
return false
}
allow := make(map[string]bool, len(actors))
for _, a := range actors {
if a != "" {
allow[strings.ToLower(a)] = true
}
}
text := strings.ToLower(headline + "\n" + lede)
for name := range storage.KnownCharacterNames() {
if allow[name] {
continue
}
if containsWholeWord(text, name) {
return false
}
}
return true
}
// containsWholeWord reports whether needle appears in haystack bounded by
// non-letter/digit runes (or the string edges). Both are already lowercased.
// Bounding avoids a short character name ("Al") matching inside an unrelated
// word ("Alabama") while still catching it as a standalone name; it is
// deliberately rune-aware so a non-ASCII player name still bounds correctly,
// where a stdlib \b would not.
func containsWholeWord(haystack, needle string) bool {
if needle == "" {
return false
}
from := 0
for {
i := strings.Index(haystack[from:], needle)
if i < 0 {
return false
}
start := from + i
end := start + len(needle)
beforeOK := start == 0 || !isWordRune(lastRune(haystack[:start]))
afterOK := end == len(haystack) || !isWordRune(firstRune(haystack[end:]))
if beforeOK && afterOK {
return true
}
from = start + 1
if from >= len(haystack) {
return false
}
}
}
func isWordRune(r rune) bool {
return unicode.IsLetter(r) || unicode.IsDigit(r)
}
func firstRune(s string) rune {
for _, r := range s {
return r
}
return 0
}
func lastRune(s string) rune {
var last rune
for _, r := range s {
last = r
}
return last
}
// renderAdventure returns the deterministic headline + lede for a fact. Copied // renderAdventure returns the deterministic headline + lede for a fact. Copied
// verbatim from the voice spec (pete_adventure_news_voice.md). Template-only — // verbatim from the voice spec (pete_adventure_news_voice.md). Template-only —
// no LLM — so output is safe and reproducible. ok is false for an unknown type. // no LLM — so output is safe and reproducible. ok is false for an unknown type.
@@ -386,6 +628,24 @@ func renderAdventure(f AdvFact) (headline, lede string, ok bool) {
inRegion = " in " + f.Region inRegion = " in " + f.Region
} }
return headline, fmt.Sprintf("%s made it through %s%s%s. Nicely done.", f.Subject, f.Zone, inRegion, atLevel), true return headline, fmt.Sprintf("%s made it through %s%s%s. Nicely done.", f.Subject, f.Zone, inRegion, atLevel), true
case "treasure_found":
// A story-grade find pulled from a dungeon. stakes is the item's name,
// outcome its rarity, and the priority tier marks a realm-first hoard
// nobody had ever pulled before — the same split zone_first uses.
inZone := f.Zone
if inZone == "" {
inZone = "the dungeon"
}
rarity := ""
if f.Outcome != "" {
rarity = strings.ToLower(f.Outcome) + " "
}
if f.Tier == "priority" {
return fmt.Sprintf("First ever: %s pulls %s out of %s.", f.Subject, f.Stakes, inZone),
fmt.Sprintf("Nobody had laid hands on %s before today. %s found the %shoard deep in %s%s, first in the realm to do it. Some haul.", f.Stakes, f.Subject, rarity, inZone, atLevel), true
}
return fmt.Sprintf("%s turned up %s in %s.", f.Subject, f.Stakes, inZone),
fmt.Sprintf("%s came back from %s with %s to show for it%s. A %sfind like that is worth a mention. Nice one.", f.Subject, inZone, f.Stakes, atLevel, rarity), true
case "death": case "death":
return fmt.Sprintf("We lost %s in %s.", f.Subject, f.Zone), return fmt.Sprintf("We lost %s in %s.", f.Subject, f.Zone),
fmt.Sprintf("Sad news to pass along: %s fell at level %d in %s. The graveyard's a little fuller tonight. Rest easy.", f.Subject, f.Level, f.Zone), true fmt.Sprintf("Sad news to pass along: %s fell at level %d in %s. The graveyard's a little fuller tonight. Rest easy.", f.Subject, f.Level, f.Zone), true
@@ -462,6 +722,24 @@ func renderAdventure(f AdvFact) (headline, lede string, ok bool) {
case "milestone": case "milestone":
return fmt.Sprintf("%s hits %s.", f.Subject, f.Milestone), return fmt.Sprintf("%s hits %s.", f.Subject, f.Milestone),
fmt.Sprintf("One for the books — %s just reached %s. The long road continues.", f.Subject, f.Milestone), true fmt.Sprintf("One for the books — %s just reached %s. The long road continues.", f.Subject, f.Milestone), true
case "companion_hire":
// Pete himself has been hired onto somebody's expedition. He is the one
// being reported on here, so this is the one family besides his duels that
// is properly first-person. Subject is the LEADER who hired him (and whose
// opt-out therefore applies), class_race is the seat he's filling.
seat, seatArticled := strings.ToLower(f.ClassRace), ""
if seat == "" {
seat, seatArticled = "an extra pair of hands", "an extra pair of hands"
} else {
seatArticled = withArticle(seat)
}
intoZone := ""
if f.Zone != "" {
intoZone = " into " + f.Zone
}
return fmt.Sprintf("Filling in as %s for %s.", seat, f.Subject),
fmt.Sprintf("%s needed %s and I wasn't doing much, so I'm tagging along%s%s. I'll pull my weight — the reporting can wait till we're home.",
f.Subject, seatArticled, intoZone, atLevel), true
} }
return "", "", false return "", "", false
} }
internal/web/adventure_art.go
+506
View File
@@ -0,0 +1,506 @@
package web
import (
"fmt"
"html/template"
"net/http"
"net/url"
"strings"
"unicode/utf8"
"pete/internal/storage"
)
// The dispatch card.
//
// Every adventure dispatch used to render the same image: one violet gradient,
// a swapped emoji, and a label. A death, a realm-first, and a legendary hoard
// were visually identical — and this image is not decoration, it is the og:image
// on every link Pete puts in Matrix and the thumbnail on every feed card. The
// most interesting thing that has ever happened in the realm looked exactly like
// the most routine.
//
// Two changes fix that. The card is keyed on the dispatch GUID rather than the
// event type, so it can read the fact behind the dispatch and put the actual
// NOUNS on it — the boss's name, the zone, the level, the item. And each event
// family gets its own palette, with treasure tinted by the rarity gogobee
// already computes and throws away into a sentence.
//
// Everything here stays deterministic, server-rendered, dependency-free SVG:
// same input, same bytes, no external asset, no font file, cacheable forever.
// advArtCard is the fully-resolved card: what to draw, already escaped-safe as
// plain text (the renderer escapes on write). Built by advArtCardFor.
type advArtCard struct {
Label string // the event-family chip, e.g. "THE SIEGE"
Emoji string
Noun string // the headline noun: boss, zone, item, or adventurer
Detail string // the supporting line: region, level, who
Ceremony string // ribbon text for a realm-first; "" for everything else
Palette advPalette
Bar *advArtBar // siege HP, when we have it
}
// advArtBar is the Siege health bar drawn onto a siege card. This is the W1
// deferral landing: a Matrix unfurl of "the town holds" that SHOWS the bar is
// worth ten paragraphs, and it was parked here because doing it in W1 would have
// meant threading boss HP through art plumbing this phase was going to redesign.
type advArtBar struct {
Current, Max int
}
// advPalette is one event family's colours. From/To are the background gradient
// stops; Accent tints the chip, the ribbon and the bar fill, and is also what a
// feed card borrows for its border.
type advPalette struct {
From, To, Accent string
}
// The house palette. Dark, saturated backgrounds so white text always clears
// contrast, with an accent bright enough to read as a border on both the light
// and dark site themes.
var (
palSiege = advPalette{"#7a1f12", "#2b0a06", "#ff6b3d"} // ember: the town is on fire
palDeath = advPalette{"#3b4250", "#171a20", "#9aa6b8"} // slate: no colour, on purpose
palBoss = advPalette{"#4a1030", "#1a0714", "#ff4d6d"}
palZone = advPalette{"#14532d", "#052e16", "#4ade80"}
palMischief = advPalette{"#4c1d95", "#120524", "#a78bfa"}
palArrival = advPalette{"#0e7490", "#083344", "#22d3ee"}
palMilestone = advPalette{"#a16207", "#422006", "#fbbf24"}
palSetback = advPalette{"#78350f", "#2a1206", "#f59e0b"} // retreat, departure
palRival = advPalette{"#1e3a8a", "#0b1a3d", "#60a5fa"}
palPete = advPalette{"#7c5ce8", "#5836b8", "#c4b5fd"} // Pete's own violet
palNeutral = advPalette{"#7c5ce8", "#5836b8", "#c4b5fd"} // the old one-and-only
// Treasure is tinted by rarity — the loot-game convention, and gogobee
// already computes the word (treasureRarityWord) and spends it on prose.
palLegendary = advPalette{"#b4530a", "#4a1d02", "#ffb020"}
palEpic = advPalette{"#5b21b6", "#2e1065", "#c084fc"}
palRare = advPalette{"#1e3a8a", "#0b1a3d", "#60a5fa"}
palUncommon = advPalette{"#14532d", "#052e16", "#4ade80"}
palCommon = advPalette{"#3f3f46", "#18181b", "#a1a1aa"}
)
// advPaletteFor picks the family colours. outcome carries the treasure rarity
// and is ignored everywhere else.
func advPaletteFor(eventType, outcome string) advPalette {
switch eventType {
case "siege_start", "siege_win", "siege_loss":
return palSiege
case "death":
return palDeath
case "boss_first", "boss_kill":
return palBoss
case "zone_first", "zone_clear":
return palZone
case "treasure_found":
switch strings.ToLower(outcome) {
case "legendary":
return palLegendary
case "epic":
return palEpic
case "rare":
return palRare
case "uncommon":
return palUncommon
case "common":
return palCommon
}
return palLegendary // story-grade finds are typically tier 5
case "mischief_contract", "mischief_survived", "mischief_downed", "mischief_fizzled":
return palMischief
case "arrival":
return palArrival
case "milestone":
return palMilestone
case "retreat", "departure":
return palSetback
case "standings", "rival_result", "pete_duel_win", "pete_duel_loss":
return palRival
case "companion_hire":
return palPete
}
return palNeutral
}
// advIsRealmFirst reports whether a dispatch is the first time anything like it
// has ever happened in the realm. gogobee already computes this — it is the
// priority/bulletin split claimRealmFirst applies — and until now it only
// decided whether Matrix got pinged. A thing nobody has ever done should also
// LOOK different from the ninth time somebody did it.
func advIsRealmFirst(eventType, tier string) bool {
switch eventType {
case "boss_first", "zone_first":
return true
case "treasure_found":
// A realm-first hoard rides the priority tier, the same split
// BuildTrophyCase counts on.
return tier == "priority"
}
return false
}
// advCardAccent is the feed-card tint for a dispatch: the family accent colour
// and whether it earns the realm-first ring. Returns "" for a non-adventure or
// unknown story so the caller leaves the card's default border alone.
func advCardAccent(eventType, tier, outcome string) (accent string, ceremony bool) {
if eventType == "" {
return "", false
}
return advPaletteFor(eventType, outcome).Accent, advIsRealmFirst(eventType, tier)
}
// advArtCardFor resolves a dispatch into everything the card draws.
//
// ev is nil for a dispatch with no stored fact — anything that predates the fact
// table, plus the brief window where the story row exists and the best-effort
// fact insert failed. That degrades to exactly the old card (family palette,
// emoji, label) rather than to a broken one.
func advArtCardFor(eventType string, ev *storage.AdvEvent) advArtCard {
label, emoji := advEventMeta(eventType)
card := advArtCard{Label: strings.ToUpper(label), Emoji: emoji, Palette: advPaletteFor(eventType, "")}
if ev == nil {
return card
}
card.Palette = advPaletteFor(eventType, ev.Outcome)
if advIsRealmFirst(eventType, ev.Tier) {
card.Ceremony = "REALM FIRST"
}
// The noun is whatever the dispatch is ABOUT — which is not the same field
// from family to family. A siege is about the boss; a treasure is about the
// item; a death is about the person.
switch eventType {
case "siege_start", "siege_win", "siege_loss":
card.Noun = ev.Boss
card.Detail = advSiegeDetail(eventType, ev.Tally)
if cur, max, ok := storage.SiegeBarForBoss(ev.Boss, ev.OccurredAt); ok {
card.Bar = &advArtBar{Current: cur, Max: max}
}
case "boss_first", "boss_kill":
card.Noun = ev.Boss
card.Detail = advJoinDetail(ev.Subject, ev.Zone, ev.Level)
case "zone_first", "zone_clear":
card.Noun = ev.Zone
card.Detail = advJoinDetail(ev.Subject, ev.Region, ev.Level)
case "treasure_found":
card.Noun = ev.Stakes // the item's name
card.Detail = advJoinDetail(ev.Subject, ev.Zone, ev.Level)
if ev.Outcome != "" {
card.Label = strings.ToUpper(ev.Outcome)
}
case "mischief_contract", "mischief_survived", "mischief_downed", "mischief_fizzled":
card.Noun = ev.Subject
card.Detail = advJoinDetail(ev.Boss, ev.Zone, ev.Level)
case "companion_hire":
card.Noun = ev.Subject
card.Detail = advJoinDetail("", ev.Zone, ev.Level)
case "milestone":
card.Noun = ev.Subject
card.Detail = ev.Milestone
default:
card.Noun = ev.Subject
card.Detail = advJoinDetail("", ev.Zone, ev.Level)
}
if card.Noun == "" { // a fact missing its own subject still gets a card
card.Noun = ev.Subject
}
return card
}
// advSiegeDetail is the siege card's supporting line. Tally is the defender
// count on a win; a start has none yet.
func advSiegeDetail(eventType string, defenders int) string {
switch {
case eventType == "siege_start":
return "the town is called out"
case defenders == 1:
return "1 defender"
case defenders > 1:
return fmt.Sprintf("%d defenders", defenders)
case eventType == "siege_win":
return "the town holds"
}
return "the gates gave way"
}
// advJoinDetail assembles the supporting line from whichever of who/where/level
// the fact actually has, dot-separated, skipping the empties. A card with one
// real field reads better than one padded out with "unknown".
func advJoinDetail(who, where string, level int) string {
var parts []string
if who != "" {
parts = append(parts, who)
}
if where != "" {
parts = append(parts, where)
}
if level > 0 {
parts = append(parts, fmt.Sprintf("level %d", level))
}
return strings.Join(parts, " · ")
}
// advArtURL is the card/OG image for a dispatch, keyed on the dispatch GUID so
// the renderer can read the fact behind it and name names. Root-relative, so it
// bypasses the external-image thumbnailer.
//
// The guid is path-escaped for the same reason advPermalink escapes it: it is
// ingest-supplied, and a stray "/" would produce a URL that routes somewhere
// else entirely.
//
// Older stories have an event-type URL baked into their image_url column
// (/adventure/art/death.svg). Those keep working — handleAdventureArt falls back
// to the type-only card when the path isn't a guid it knows — so nothing has to
// be backfilled and no card ever 404s.
func advArtURL(guid string) string {
return "/adventure/art/" + url.PathEscape(guid) + ".svg"
}
// handleAdventureArt renders one dispatch's card.
func (s *Server) handleAdventureArt(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
key := strings.TrimSuffix(r.PathValue("type"), ".svg")
// The path is either a guid ("death:<hash>:<ts>") or, for a story from
// before this was guid-keyed, a bare event type. Both start with the event
// type, so the family colours are right either way; only the nouns need the
// fact row.
ev, err := storage.AdventureEventByGUID(key)
if err != nil {
ev = nil // a read failure is a thinner card, not a broken image
}
eventType := key
if t, _, hasSep := strings.Cut(key, ":"); hasSep {
eventType = t
}
card := advArtCardFor(eventType, ev)
w.Header().Set("Content-Type", "image/svg+xml; charset=utf-8")
// A finished card never changes, so cache it hard. The exception is a siege
// card still waiting on its bar: the win/loss dispatch is filed before the
// war-room push that explains it, and an unfurl fetched in that window would
// otherwise be pinned barless for a day.
if card.Bar == nil && strings.HasPrefix(eventType, "siege_") {
w.Header().Set("Cache-Control", "public, max-age=300")
} else {
w.Header().Set("Cache-Control", "public, max-age=86400")
}
_, _ = w.Write([]byte(advRenderArt(card)))
}
// Card geometry. 1200×630 is the OG ratio, so the same image works as a
// link-preview and as a feed thumbnail.
const (
advArtW = 1200
advArtH = 630
// advSafeX is the horizontal margin anything readable has to stay inside.
//
// The card is 1200×630 for the OG ratio, but the feed thumbnail is a 16/10
// object-cover box — it keeps the full height and crops the WIDTH to
// 630×1.6 = 1008px, taking 96px off each side. A chip pinned at x=64 renders
// perfectly on the permalink and as "EGENDARY" in the feed. Centred text is
// unaffected; only the corner furniture has to respect this.
advSafeX = 116
)
// advDisplayFont is the site's display stack. No @font-face: an SVG served as an
// image can't fetch one, so this resolves against whatever the renderer has and
// falls through to the system UI face.
const advDisplayFont = "Fredoka, Nunito, system-ui, sans-serif"
// advRenderArt draws the card. Deterministic: same card in, same bytes out.
func advRenderArt(c advArtCard) string {
var b strings.Builder
fmt.Fprintf(&b, `<svg xmlns="http://www.w3.org/2000/svg" width="%d" height="%d" viewBox="0 0 %d %d" role="img" aria-label="%s">`,
advArtW, advArtH, advArtW, advArtH, esc(c.Label+" "+c.Noun))
fmt.Fprintf(&b, `<defs><linearGradient id="g" x1="0" y1="0" x2="1" y2="1"><stop offset="0" stop-color="%s"/><stop offset="1" stop-color="%s"/></linearGradient>`,
esc(c.Palette.From), esc(c.Palette.To))
// A soft radial lift behind the emoji so the middle of the card isn't flat.
fmt.Fprintf(&b, `<radialGradient id="v" cx="0.5" cy="0.34" r="0.62"><stop offset="0" stop-color="%s" stop-opacity="0.35"/><stop offset="1" stop-color="%s" stop-opacity="0"/></radialGradient></defs>`,
esc(c.Palette.Accent), esc(c.Palette.Accent))
fmt.Fprintf(&b, `<rect width="%d" height="%d" fill="url(#g)"/><rect width="%d" height="%d" fill="url(#v)"/>`,
advArtW, advArtH, advArtW, advArtH)
// An accent hairline along the bottom, so even a card cropped to a strip in
// a feed still carries its family colour.
fmt.Fprintf(&b, `<rect x="0" y="%d" width="%d" height="8" fill="%s"/>`, advArtH-8, advArtW, esc(c.Palette.Accent))
advDrawChip(&b, c)
if c.Ceremony != "" {
advDrawRibbon(&b, c)
}
// Vertical rhythm: emoji, noun, detail, and the bar when there is one. The
// block sits higher when a bar has to fit under it. The gaps are wider than
// they look on paper because an emoji is drawn from its own centre and a
// name from its baseline — set them any closer and a tall glyph sits on top
// of the capital letters underneath it.
emojiY, nounY, detailY := 250, 420, 488
if c.Bar != nil {
emojiY, nounY, detailY = 200, 350, 412
}
if c.Noun == "" {
// Nothing to name (a pre-fact-table dispatch): centre the emoji and let
// the label carry the card, which is what the old emblem did.
emojiY, nounY, detailY = 300, 0, 500
}
fmt.Fprintf(&b, `<text x="600" y="%d" font-size="%d" text-anchor="middle" dominant-baseline="central">%s</text>`,
emojiY, advEmojiSize(c), esc(c.Emoji))
if c.Noun != "" {
noun := advClamp(c.Noun, 38)
fmt.Fprintf(&b, `<text x="600" y="%d" font-size="%d" font-family="%s" font-weight="700" fill="#ffffff" text-anchor="middle">%s</text>`,
nounY, advFitSize(noun, 1060, 82, 40), advDisplayFont, esc(noun))
}
if c.Detail != "" {
detail := advClamp(c.Detail, 64)
fmt.Fprintf(&b, `<text x="600" y="%d" font-size="%d" font-family="%s" font-weight="600" fill="#ffffff" fill-opacity="0.72" text-anchor="middle">%s</text>`,
detailY, advFitSize(detail, 1040, 38, 26), advDisplayFont, esc(detail))
}
if c.Bar != nil {
advDrawBar(&b, c)
}
b.WriteString(`</svg>`)
return b.String()
}
// advEmojiSize shrinks the emblem when the card also has to carry a name — the
// old 260px glyph was the whole design, and next to a boss name it just crowds
// it out.
func advEmojiSize(c advArtCard) int {
if c.Noun == "" {
return 260
}
if c.Bar != nil {
return 110
}
return 148
}
// advDrawChip draws the event-family label as a pill in the top-left.
func advDrawChip(b *strings.Builder, c advArtCard) {
label := advClamp(c.Label, 28)
// Letter-spaced small caps: width is the glyph run plus the tracking.
const size, track = 30, 5.0
w := int(float64(utf8.RuneCountInString(label))*(float64(size)*0.62+track)) + 56
fmt.Fprintf(b, `<rect x="%d" y="56" width="%d" height="60" rx="30" fill="%s" fill-opacity="0.22" stroke="%s" stroke-opacity="0.55" stroke-width="2"/>`,
advSafeX, w, esc(c.Palette.Accent), esc(c.Palette.Accent))
fmt.Fprintf(b, `<text x="%d" y="86" font-size="%d" font-family="%s" font-weight="700" fill="#ffffff" letter-spacing="%.0f" text-anchor="middle" dominant-baseline="central">%s</text>`,
advSafeX+w/2, size, advDisplayFont, track, esc(label))
}
// advDrawRibbon draws the realm-first banner in the top-right. Filled with the
// accent at full strength — this is the one card element allowed to shout.
func advDrawRibbon(b *strings.Builder, c advArtCard) {
label := advClamp(c.Ceremony, 24)
const size, track = 28, 5.0
w := int(float64(utf8.RuneCountInString(label))*(float64(size)*0.62+track)) + 52
x := advArtW - advSafeX - w
fmt.Fprintf(b, `<rect x="%d" y="56" width="%d" height="60" rx="12" fill="%s"/>`, x, w, esc(c.Palette.Accent))
fmt.Fprintf(b, `<text x="%d" y="86" font-size="%d" font-family="%s" font-weight="700" fill="#0f0a04" letter-spacing="%.0f" text-anchor="middle" dominant-baseline="central">%s</text>`,
x+w/2, size, advDisplayFont, track, esc(label))
}
// advDrawBar draws the Siege health bar: the track, the fill, and the numbers.
//
// HP remaining, not damage dealt — the same direction the war room page draws,
// so the unfurl and the page you land on from it agree. The caption is
// event-aware because the bar alone doesn't say who won: an empty track on a
// victory card is the best possible outcome and would otherwise read at a glance
// as a wipe.
func advDrawBar(b *strings.Builder, c advArtCard) {
const x, y, w, h = 190, 470, 820, 34
frac := 0.0
if c.Bar.Max > 0 {
frac = float64(c.Bar.Current) / float64(c.Bar.Max)
}
if frac < 0 {
frac = 0
}
if frac > 1 {
frac = 1
}
fill := int(frac * w)
fmt.Fprintf(b, `<rect x="%d" y="%d" width="%d" height="%d" rx="%d" fill="#000000" fill-opacity="0.38"/>`, x, y, w, h, h/2)
if fill > 0 {
// rx on a very short fill would round it away to nothing; clamp the
// corner radius to half the drawn width so a nearly-dead boss still
// shows a sliver.
rx := h / 2
if fill/2 < rx {
rx = fill / 2
}
fmt.Fprintf(b, `<rect x="%d" y="%d" width="%d" height="%d" rx="%d" fill="%s"/>`, x, y, fill, h, rx, esc(c.Palette.Accent))
}
fmt.Fprintf(b, `<text x="600" y="%d" font-size="30" font-family="%s" font-weight="700" fill="#ffffff" fill-opacity="0.82" text-anchor="middle">%s</text>`,
y+h+40, advDisplayFont, esc(advBarCaption(c)))
}
// advBarCaption says what the bar means. A siege_win's bar is empty because the
// town emptied it.
func advBarCaption(c advArtCard) string {
switch {
case c.Bar.Current <= 0:
return fmt.Sprintf("all %s of it, brought to zero", advComma(c.Bar.Max))
case c.Bar.Current >= c.Bar.Max:
return fmt.Sprintf("%s HP, untouched so far", advComma(c.Bar.Max))
}
return fmt.Sprintf("%s HP left of %s", advComma(c.Bar.Current), advComma(c.Bar.Max))
}
// advComma renders an int with thousands separators. Siege pools run to five and
// six figures, and "18000" is a number you have to stop and parse.
func advComma(n int) string {
s := fmt.Sprintf("%d", n)
neg := strings.HasPrefix(s, "-")
s = strings.TrimPrefix(s, "-")
var out []byte
for i, d := range []byte(s) {
if i > 0 && (len(s)-i)%3 == 0 {
out = append(out, ',')
}
out = append(out, d)
}
if neg {
return "-" + string(out)
}
return string(out)
}
// advFitSize shrinks a font size until the string is likely to fit maxWidth,
// never below min. SVG has no measurement API on the server, so this is the
// standard approximation: ~0.58em per glyph for a humanist sans. Being a little
// conservative is the correct failure — a name that renders a shade small is
// fine, a name that runs off the card is not.
func advFitSize(s string, maxWidth, base, min int) int {
n := utf8.RuneCountInString(s)
if n == 0 {
return base
}
size := base
for size > min && float64(n)*float64(size)*0.58 > float64(maxWidth) {
size -= 2
}
return size
}
// advClamp truncates to n runes with an ellipsis. Rune-aware so a non-ASCII
// name isn't cut mid-character into a replacement glyph.
func advClamp(s string, n int) string {
if utf8.RuneCountInString(s) <= n {
return s
}
r := []rune(s)
return strings.TrimRight(string(r[:n-1]), " ·") + "…"
}
// esc escapes text for an SVG text node or attribute value. Everything on a card
// is either game-authored (boss, zone, item) or a character name that already
// passed the ingest fact-guard, so this is defence in depth rather than the only
// line — but the card is a public URL and it stays escaped regardless.
func esc(s string) string { return template.HTMLEscapeString(s) }
internal/web/adventure_art_test.go
+269
View File
@@ -0,0 +1,269 @@
package web
import (
"net/http/httptest"
"strings"
"testing"
"pete/internal/storage"
)
// TestArtPaletteSplitsFamilies is the regression for the whole point of W3: two
// different kinds of dispatch must not render the same image. Before this, every
// card in the section was the same violet gradient with a swapped emoji.
func TestArtPaletteSplitsFamilies(t *testing.T) {
death := advPaletteFor("death", "")
siege := advPaletteFor("siege_win", "")
zone := advPaletteFor("zone_clear", "")
if death == siege || siege == zone || death == zone {
t.Errorf("families share a palette: death=%v siege=%v zone=%v", death, siege, zone)
}
// Treasure is tinted by the rarity gogobee already computes and currently
// spends on an adjective in a sentence.
leg := advPaletteFor("treasure_found", "legendary")
rare := advPaletteFor("treasure_found", "rare")
if leg == rare {
t.Errorf("legendary and rare hoards render identically: %v", leg)
}
// Case shouldn't matter — the rarity word arrives however gogobee wrote it.
if advPaletteFor("treasure_found", "Legendary") != leg {
t.Error("rarity match is case-sensitive")
}
// An unrecognised rarity still gets the story-grade treatment rather than
// falling through to the neutral card.
if advPaletteFor("treasure_found", "mythic") != leg {
t.Error("unknown rarity dropped to the neutral palette")
}
}
// TestRealmFirstEarnsCeremony pins that the priority/bulletin split gogobee
// already computes now changes how a card LOOKS, not just whether Matrix gets
// pinged. A first-ever clear and the ninth repeat of it must be distinguishable.
func TestRealmFirstEarnsCeremony(t *testing.T) {
cases := []struct {
eventType, tier string
want bool
}{
{"zone_first", "priority", true},
{"zone_clear", "bulletin", false},
{"boss_first", "priority", true},
{"boss_kill", "bulletin", false},
{"treasure_found", "priority", true}, // realm-first hoard
{"treasure_found", "bulletin", false}, // someone else already pulled it
{"death", "priority", false}, // priority, but not a "first"
}
for _, c := range cases {
if got := advIsRealmFirst(c.eventType, c.tier); got != c.want {
t.Errorf("%s/%s ceremony = %v, want %v", c.eventType, c.tier, got, c.want)
}
}
// And it reaches the card as a ribbon.
ev := &storage.AdvEvent{EventType: "zone_first", Tier: "priority", Subject: "Josie", Zone: "The Sump", Level: 9}
card := advArtCardFor("zone_first", ev)
if card.Ceremony == "" {
t.Error("realm-first card has no ribbon")
}
if !strings.Contains(advRenderArt(card), card.Ceremony) {
t.Error("ribbon text never reached the SVG")
}
plain := advArtCardFor("zone_clear", &storage.AdvEvent{EventType: "zone_clear", Tier: "bulletin", Subject: "Josie", Zone: "The Sump"})
if plain.Ceremony != "" {
t.Error("a repeat clear got the realm-first ribbon")
}
}
// TestArtCardCarriesNouns: the card names the thing the dispatch is about, and
// which field that is differs per family. A siege is about the boss; a treasure
// is about the item.
func TestArtCardCarriesNouns(t *testing.T) {
treasure := advArtCardFor("treasure_found", &storage.AdvEvent{
EventType: "treasure_found", Tier: "bulletin", Subject: "Josie",
Zone: "The Sump", Stakes: "Ring of Nine Sorrows", Outcome: "epic", Level: 12,
})
if treasure.Noun != "Ring of Nine Sorrows" {
t.Errorf("treasure noun = %q, want the item", treasure.Noun)
}
if treasure.Label != "EPIC" {
t.Errorf("treasure label = %q, want the rarity", treasure.Label)
}
svg := advRenderArt(treasure)
for _, want := range []string{"Ring of Nine Sorrows", "Josie", "The Sump", "level 12", "EPIC"} {
if !strings.Contains(svg, want) {
t.Errorf("treasure card missing %q", want)
}
}
boss := advArtCardFor("boss_kill", &storage.AdvEvent{
EventType: "boss_kill", Subject: "Josie", Boss: "Aldric the Pale", Zone: "dragons_lair", Level: 14,
})
if boss.Noun != "Aldric the Pale" {
t.Errorf("boss noun = %q, want the boss", boss.Noun)
}
// A dispatch with no stored fact still renders — that is every story from
// before the fact table, plus the window where the best-effort fact insert
// failed. It degrades to the old emblem, not to a broken image.
bare := advArtCardFor("death", nil)
if bare.Noun != "" || bare.Label == "" {
t.Errorf("factless card = %+v, want label-only", bare)
}
if b := advRenderArt(bare); !strings.Contains(b, "<svg") || !strings.Contains(b, "🪦") {
t.Errorf("factless card didn't render an emblem: %s", b)
}
}
// TestSiegeCardDrawsTheBar is the W1 deferral landing. A Matrix unfurl of "the
// town holds" that shows the bar is worth ten paragraphs — and the bar has to
// come from the war-room snapshot, because the siege fact carries the boss and
// the defender count but never the HP.
func TestSiegeCardDrawsTheBar(t *testing.T) {
newAdvServer(t, "t") // fresh temp DB
if err := storage.ReplaceSiege(storage.Siege{
Active: false,
History: []storage.SiegePast{{
BossID: 7, BossName: "The Rust Sovereign", Tier: 5, Outcome: "defeated",
HPRemaining: 0, HPMax: 18000, Defenders: 6, EndedAt: 5000,
}},
}, 5000); err != nil {
t.Fatalf("seed siege: %v", err)
}
ev := &storage.AdvEvent{EventType: "siege_win", Tier: "priority",
Boss: "The Rust Sovereign", Tally: 6, OccurredAt: 5000}
card := advArtCardFor("siege_win", ev)
if card.Bar == nil {
t.Fatal("siege card has no bar")
}
if card.Bar.Max != 18000 {
t.Errorf("bar max = %d, want the pool", card.Bar.Max)
}
svg := advRenderArt(card)
for _, want := range []string{"The Rust Sovereign", "6 defenders", "brought to zero"} {
if !strings.Contains(svg, want) {
t.Errorf("siege card missing %q", want)
}
}
// A live Siege draws off the live row, so a siege_start card keeps sliding
// as the town chips away rather than freezing at the spawn value.
if err := storage.ReplaceSiege(storage.Siege{
Active: true, BossID: 8, BossName: "The Rust Sovereign", Tier: 5,
HPCurrent: 6200, HPMax: 18000, EndsAt: 9000,
}, 6000); err != nil {
t.Fatalf("seed live siege: %v", err)
}
live := advArtCardFor("siege_start", &storage.AdvEvent{
EventType: "siege_start", Boss: "The Rust Sovereign", OccurredAt: 6000})
if live.Bar == nil || live.Bar.Current != 6200 {
t.Fatalf("live siege bar = %+v, want the current pool", live.Bar)
}
// An unknown boss gets a siege card with no bar rather than a wrong one.
// This is the real window between a win being filed and the war-room push
// that explains it landing two minutes later.
orphan := advArtCardFor("siege_loss", &storage.AdvEvent{
EventType: "siege_loss", Boss: "Nobody In Particular", OccurredAt: 1})
if orphan.Bar != nil {
t.Errorf("drew a bar for a boss we have no snapshot of: %+v", orphan.Bar)
}
if !strings.Contains(advRenderArt(orphan), "Nobody In Particular") {
t.Error("barless siege card lost its boss name")
}
}
// TestArtRenderIsDeterministicAndEscaped: the card is a public URL served as an
// image, and it must be byte-stable so it can be cached hard.
func TestArtRenderIsDeterministicAndEscaped(t *testing.T) {
card := advArtCardFor("death", &storage.AdvEvent{
EventType: "death", Subject: `Bob<script>alert(1)</script>`, Zone: "the Underforge", Level: 3})
a := advRenderArt(card)
if a != advRenderArt(card) {
t.Error("render is not deterministic")
}
if strings.Contains(a, "<script>") {
t.Errorf("unescaped markup reached the SVG: %s", a)
}
// Long names shrink to fit instead of running off the 1200px card.
long := advArtCardFor("boss_kill", &storage.AdvEvent{
EventType: "boss_kill", Boss: strings.Repeat("Nebuchadnezzar ", 6)})
if got := advFitSize(long.Noun, 1060, 82, 40); got >= 82 {
t.Errorf("long name kept the full font size (%d)", got)
}
if n := len([]rune(advClamp(long.Noun, 38))); n > 38 {
t.Errorf("clamp let %d runes through", n)
}
}
// TestCardAccentTintsTheFeed pins the border tint the feed cards read. It is the
// same palette the art uses, so a card and its thumbnail agree.
func TestCardAccentTintsTheFeed(t *testing.T) {
legendary, first := advCardAccent("treasure_found", "priority", "legendary")
if legendary == "" || !first {
t.Errorf("legendary realm-first accent = %q ceremony=%v", legendary, first)
}
common, _ := advCardAccent("treasure_found", "bulletin", "common")
if common == legendary {
t.Error("a common find is tinted like a legendary one")
}
if a, _ := advCardAccent("", "", ""); a != "" {
t.Error("a non-adventure story got an accent")
}
if legendary != advPaletteFor("treasure_found", "legendary").Accent {
t.Error("feed accent and card art disagree on the colour")
}
}
// TestFeedCardRendersTheTint renders the real adventure page through the real
// template, because the interesting failure here is not in Go.
//
// html/template escapes a style attribute in CSS context and will replace a
// value it doesn't trust with ZgotmplZ, silently — the card would render with no
// border colour and nothing would say why. This is also the reason the accent is
// an inline style at all: a generated Tailwind class would be purged out of the
// stylesheet, which fails the same way and just as quietly.
func TestFeedCardRendersTheTint(t *testing.T) {
s, _ := newAdvServer(t, "t")
first := AdvFact{GUID: "zone_first:a:1000", EventType: "zone_first", Tier: "priority",
Actors: []string{"Josie"}, Subject: "Josie", Zone: "The Sump", Region: "Marches", Level: 9, OccurredAt: 1000}
repeat := AdvFact{GUID: "zone_clear:b:1001", EventType: "zone_clear", Tier: "bulletin",
Actors: []string{"Josie"}, Subject: "Josie", Zone: "The Sump", Region: "Marches", Level: 9, OccurredAt: 1001}
for _, f := range []AdvFact{first, repeat} {
if rw := postFact(t, s, "t", f); rw.Code != 200 {
t.Fatalf("ingest %s: status %d", f.GUID, rw.Code)
}
}
req := httptest.NewRequest("GET", "/adventure", nil)
w := httptest.NewRecorder()
s.handleChannel(w, req, Channel{Slug: "adventure", Title: "Adventure", Theme: "adventure"})
body := w.Body.String()
accent := advPaletteFor("zone_first", "").Accent
if !strings.Contains(body, "border-color:"+accent) {
t.Errorf("zone accent %q never reached the card border", accent)
}
if strings.Contains(body, "ZgotmplZ") {
t.Error("html/template rejected the accent as an unsafe CSS value")
}
if !strings.Contains(body, "Realm first") {
t.Error("the realm-first card has no ribbon in the feed")
}
// Exactly one of the two cards is a first. If both got the badge the split
// isn't doing anything.
if n := strings.Count(body, "Realm first"); n != 1 {
t.Errorf("realm-first badges = %d, want 1", n)
}
}
func TestCommaFormatsPools(t *testing.T) {
for in, want := range map[int]string{0: "0", 999: "999", 1000: "1,000", 18000: "18,000", 1234567: "1,234,567"} {
if got := advComma(in); got != want {
t.Errorf("advComma(%d) = %q, want %q", in, got, want)
}
}
}
internal/web/adventure_prose_test.go
+146
View File
@@ -0,0 +1,146 @@
package web
import (
"strings"
"testing"
"pete/internal/storage"
)
// TestProseAcceptedWhenClean: gogobee's LLM prose replaces the template render
// (on the site row AND the live Matrix post) when both fields are present and
// name nobody the fact did not authorize.
func TestProseAcceptedWhenClean(t *testing.T) {
const token = "t"
s, posted := newAdvServer(t, token)
const hl = "Josie went into the Ossuary alone and came back with the crown."
const lede = "No fanfare, no party — just Josie, a locked door, and a very bad afternoon for whatever was guarding it. She walked back out at level 14 with the thing everyone else left behind."
f := AdvFact{
GUID: "boss_kill:j:1", EventType: "boss_kill", Tier: "priority",
Actors: []string{"Josie"}, Subject: "Josie", Boss: "the Bone Warden",
Zone: "the Ossuary", Level: 14, OccurredAt: 1,
Headline: hl, Lede: lede,
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest status = %d body=%s", rw.Code, rw.Body.String())
}
got, err := storage.GetStoryByGUID(f.GUID)
if err != nil || got == nil {
t.Fatalf("story not stored: %v", err)
}
if got.Headline != hl {
t.Errorf("stored headline = %q, want the LLM headline", got.Headline)
}
if got.Lede != lede {
t.Errorf("stored lede = %q, want the LLM lede", got.Lede)
}
if len(*posted) != 1 || (*posted)[0].Headline != hl {
t.Fatalf("live post did not carry LLM headline: %+v", *posted)
}
}
// TestProseRejectedNamesBystander: prose that names a real adventurer on the
// board who is NOT in the fact's Actors is the injection this guard exists for.
// It must fall back to the template, not print the name.
func TestProseRejectedNamesBystander(t *testing.T) {
const token = "t"
s, _ := newAdvServer(t, token)
// Kif is a real, current adventurer — but this fact is about Josie.
if err := storage.ReplaceRoster([]storage.RosterEntry{
{Token: "tk", Name: "Kif", Level: 9, Status: "idle"},
}, 1); err != nil {
t.Fatal(err)
}
f := AdvFact{
GUID: "boss_kill:j:2", EventType: "boss_kill", Tier: "priority",
Actors: []string{"Josie"}, Subject: "Josie", Boss: "the Bone Warden",
Zone: "the Ossuary", Level: 14, OccurredAt: 1,
Headline: "Josie and Kif split the Ossuary hoard.",
Lede: "A tidy bit of teamwork down in the dark today.",
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest status = %d", rw.Code)
}
got, err := storage.GetStoryByGUID(f.GUID)
if err != nil || got == nil {
t.Fatalf("story not stored: %v", err)
}
if strings.Contains(got.Headline+got.Lede, "Kif") {
t.Errorf("bystander name leaked past the guard: %q / %q", got.Headline, got.Lede)
}
// The template render is what should have published instead.
tHl, _, _ := renderAdventure(f)
if got.Headline != tHl {
t.Errorf("did not fall back to template: headline = %q, want %q", got.Headline, tHl)
}
}
// TestProseRejectedTooLong: a runaway generation past the length caps is not a
// dispatch. Falls back to the template.
func TestProseRejectedTooLong(t *testing.T) {
const token = "t"
s, _ := newAdvServer(t, token)
f := AdvFact{
GUID: "arrival:z:1", EventType: "arrival", Tier: "bulletin",
Actors: []string{"Zapp"}, Subject: "Zapp", ClassRace: "human fighter",
OccurredAt: 1,
Headline: "Welcome, Zapp.",
Lede: strings.Repeat("very long ", maxDispatchLede),
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest status = %d", rw.Code)
}
got, err := storage.GetStoryByGUID(f.GUID)
if err != nil || got == nil {
t.Fatalf("story not stored: %v", err)
}
tHl, _, _ := renderAdventure(f)
if got.Headline != tHl {
t.Errorf("over-length prose was not rejected: headline = %q", got.Headline)
}
}
// TestProseNeedsBothFields: a headline with no lede is half a voice. The guard
// path is only taken when both are present; otherwise the whole template renders.
func TestProseNeedsBothFields(t *testing.T) {
const token = "t"
s, _ := newAdvServer(t, token)
f := AdvFact{
GUID: "arrival:z:2", EventType: "arrival", Tier: "bulletin",
Actors: []string{"Zapp"}, Subject: "Zapp", ClassRace: "human fighter",
OccurredAt: 1,
Headline: "Welcome, Zapp — a headline with no body.",
// Lede intentionally empty.
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest status = %d", rw.Code)
}
got, _ := storage.GetStoryByGUID(f.GUID)
tHl, _, _ := renderAdventure(f)
if got == nil || got.Headline != tHl {
t.Errorf("half-authored prose was used; want template headline %q", tHl)
}
}
func TestContainsWholeWord(t *testing.T) {
cases := []struct {
hay, needle string
want bool
}{
{"josie and kif split it", "kif", true},
{"the kiffish blade", "kif", false}, // substring, not a word
{"al arrived", "al", true}, // short name, still bounded
{"alabama arrived", "al", false}, // bounded off
{"ended with kif.", "kif", true}, // trailing punctuation is a boundary
{"名月 cleared it", "名月", true}, // non-ASCII name, bounded by space
{"the 名月光 shard", "名月", false}, // non-ASCII substring, not a word
{"nobody here", "kif", false}, // absent
}
for _, c := range cases {
if got := containsWholeWord(c.hay, c.needle); got != c.want {
t.Errorf("containsWholeWord(%q,%q) = %v, want %v", c.hay, c.needle, got, c.want)
}
}
}
internal/web/adventure_test.go
+238 -7
View File
@@ -218,11 +218,40 @@ func TestRenderZoneTaxonomy(t *testing.T) {
} }
} }
// TestRenderTreasure: a story-grade find names the item and its zone; a
// priority find is billed as a realm-first, and the rarity from outcome rides
// into the lede.
func TestRenderTreasure(t *testing.T) {
hoard := AdvFact{EventType: "treasure_found", Tier: "priority", Subject: "Josie",
Zone: "The Ossuary", Stakes: "Crown of the Drowned King", Outcome: "legendary", Level: 7}
hl, lede, ok := renderAdventure(hoard)
if !ok || !strings.Contains(hl, "First ever") || !strings.Contains(hl, "Crown of the Drowned King") {
t.Errorf("hoard headline = %q (ok=%v)", hl, ok)
}
if !strings.Contains(lede, "legendary") {
t.Errorf("hoard lede dropped the rarity: %q", lede)
}
find := AdvFact{EventType: "treasure_found", Tier: "bulletin", Subject: "Josie",
Zone: "The Sump", Stakes: "Ring of Nine Sorrows"}
hl2, _, ok := renderAdventure(find)
if !ok || !strings.Contains(hl2, "Josie") || !strings.Contains(hl2, "Ring of Nine Sorrows") ||
!strings.Contains(hl2, "The Sump") || strings.Contains(hl2, "First ever") {
t.Errorf("plain find headline = %q (ok=%v)", hl2, ok)
}
if lbl, emoji := advEventMeta("treasure_found"); lbl != "Treasure" || emoji == "" {
t.Errorf("treasure meta = %q/%q", lbl, emoji)
}
}
func TestAdventureArtAndMeta(t *testing.T) { func TestAdventureArtAndMeta(t *testing.T) {
const token = "t" const token = "t"
s, _ := newAdvServer(t, token) s, _ := newAdvServer(t, token)
// Emblem endpoint returns SVG with the event's emoji. // A bare event type still renders — that is what every story ingested before
// the card became guid-keyed has in its image_url column, and those links
// must not start 404ing.
areq := httptest.NewRequest("GET", "/adventure/art/death.svg", nil) areq := httptest.NewRequest("GET", "/adventure/art/death.svg", nil)
areq.SetPathValue("type", "death.svg") areq.SetPathValue("type", "death.svg")
arw := httptest.NewRecorder() arw := httptest.NewRecorder()
@@ -237,18 +266,30 @@ func TestAdventureArtAndMeta(t *testing.T) {
t.Errorf("art body missing emblem: %s", b) t.Errorf("art body missing emblem: %s", b)
} }
// Ingest sets the card image to the local emblem path. // Ingest keys the card image on the GUID, not the event type: the renderer
// reads the fact behind the dispatch so it can name the zone and the level
// instead of drawing the identical emblem for every death.
f := AdvFact{GUID: "death:abc:1000", EventType: "death", Tier: "priority", f := AdvFact{GUID: "death:abc:1000", EventType: "death", Tier: "priority",
Actors: []string{"Brannigan"}, Subject: "Brannigan", Zone: "the Underforge", Level: 4, OccurredAt: 1000} Actors: []string{"Brannigan"}, Subject: "Brannigan", Zone: "the Underforge", Level: 4, OccurredAt: 1000}
if rw := postFact(t, s, token, f); rw.Code != 200 { if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest status = %d", rw.Code) t.Fatalf("ingest status = %d", rw.Code)
} }
got, _ := storage.GetStoryByGUID("death:abc:1000") got, _ := storage.GetStoryByGUID("death:abc:1000")
if got == nil || got.ImageURL != "/adventure/art/death.svg" { if got == nil || got.ImageURL != "/adventure/art/death:abc:1000.svg" {
t.Errorf("story image = %q", got.ImageURL) t.Errorf("story image = %q", got.ImageURL)
} }
// Permalink page is noindex with an og:image. // And that card carries the nouns.
greq := httptest.NewRequest("GET", "/adventure/art/death:abc:1000.svg", nil)
greq.SetPathValue("type", "death:abc:1000.svg")
grw := httptest.NewRecorder()
s.handleAdventureArt(grw, greq)
gb := grw.Body.String()
if !strings.Contains(gb, "Brannigan") || !strings.Contains(gb, "the Underforge") || !strings.Contains(gb, "level 4") {
t.Errorf("guid card missing the fact's nouns: %s", gb)
}
// Permalink page is noindex with an og:image pointing at that same card.
preq := httptest.NewRequest("GET", "/adventure/death:abc:1000", nil) preq := httptest.NewRequest("GET", "/adventure/death:abc:1000", nil)
preq.SetPathValue("guid", "death:abc:1000") preq.SetPathValue("guid", "death:abc:1000")
prw := httptest.NewRecorder() prw := httptest.NewRecorder()
@@ -257,7 +298,7 @@ func TestAdventureArtAndMeta(t *testing.T) {
if !strings.Contains(body, `name="robots" content="noindex"`) { if !strings.Contains(body, `name="robots" content="noindex"`) {
t.Error("permalink not noindex") t.Error("permalink not noindex")
} }
if !strings.Contains(body, `property="og:image" content="https://news.example/adventure/art/death.svg"`) { if !strings.Contains(body, `property="og:image" content="https://news.example/adventure/art/death:abc:1000.svg"`) {
t.Errorf("permalink missing og:image; body=%s", body) t.Errorf("permalink missing og:image; body=%s", body)
} }
} }
@@ -313,8 +354,10 @@ func TestAdventureDisabled(t *testing.T) {
} }
// TestRenderMischief: gogobee's four mischief event types must all render. An // TestRenderMischief: gogobee's four mischief event types must all render. An
// unknown event_type is a 400 at ingest, which gogobee retries and then parks // untemplated type no longer 400s — it publishes on the neutral fallback (see
// forever — so "Pete deploys first" only helps if Pete actually knows the types. // TestUnknownEventTypePublishes) — so what is at stake here is voice, not data
// loss: these four carry the anonymity mechanic, and the generic fallback would
// strip out the part that makes it work.
// //
// It also pins the anonymity contract, which is the feature's whole social // It also pins the anonymity contract, which is the feature's whole social
// engine: an unsigned contract must not name the buyer, and a survival must. // engine: an unsigned contract must not name the buyer, and a survival must.
@@ -369,3 +412,191 @@ func TestRenderMischief(t *testing.T) {
} }
} }
} }
// TestRenderCompanionHire pins the template whose absence was a live bug.
//
// gogobee has emitted companion_hire from `!expedition hire` since the combat-
// engine work landed (expedition_companion_cmd.go). Pete had no case for it, so
// every one of those dispatches 400'd, retried to peteclient's cap, and parked
// forever. Nothing surfaced the loss: the game logged a successful emit, the
// queue row just never sent.
//
// The unknown-type inversion (TestUnknownEventTypePublishes) means a repeat of
// this costs a thin card rather than a deleted event — but the template is still
// the point, and this test is what says so.
func TestRenderCompanionHire(t *testing.T) {
f := AdvFact{EventType: "companion_hire", Tier: "bulletin",
Subject: "Josie", ClassRace: "Cleric", Zone: "holymachina", Level: 14}
hl, lede, ok := renderAdventure(f)
if !ok {
t.Fatal("companion_hire did not render — this is the bug, do not re-break it")
}
if !strings.Contains(hl, "cleric") {
t.Errorf("headline lost the seat Pete is filling: %q", hl)
}
if !strings.Contains(lede, "Josie") || !strings.Contains(lede, "holymachina") {
t.Errorf("lede lost the leader or the zone: %q", lede)
}
// He is talking about himself here, like his duels. Third-person Pete filling
// in as a cleric reads as someone else reporting on him.
if !strings.Contains(lede, "I'm") && !strings.Contains(lede, "I ") {
t.Errorf("companion_hire should be first-person Pete: %q", lede)
}
// "needed a cleric", never "needed cleric".
if !strings.Contains(lede, "a cleric") {
t.Errorf("seat needs its article in the lede: %q", lede)
}
if lbl, _ := advEventMeta("companion_hire"); lbl == "Dispatch" {
t.Error("companion_hire has no permalink label")
}
// A missing class must not produce "needed a ." — the fallback seat carries
// its own article.
bare := AdvFact{EventType: "companion_hire", Subject: "Josie"}
_, bareLede, ok := renderAdventure(bare)
if !ok {
t.Fatal("companion_hire with no class did not render")
}
if strings.Contains(bareLede, "a .") || strings.Contains(bareLede, "needed ") {
t.Errorf("empty class produced malformed prose: %q", bareLede)
}
}
// TestUnknownEventTypePublishes is the regression for the whole class of bug.
//
// An event type Pete has no template for must PUBLISH, not 400. A 400 is retried
// to peteclient's cap and then parked forever, so rejecting an unrecognised type
// does not defer the event — it deletes it, permanently, and that is how
// companion_hire went missing. The site can carry a thin card; it cannot recover
// a dispatch gogobee has given up on.
func TestUnknownEventTypePublishes(t *testing.T) {
const token = "s3cret-token"
s, posted := newAdvServer(t, token)
f := AdvFact{
GUID: "brand_new_thing:abc:5000", EventType: "brand_new_thing",
Tier: "priority", // claims priority, and still must not interrupt Matrix
Subject: "Josie", Actors: []string{"Josie"}, Zone: "holymachina",
OccurredAt: 5000,
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("unknown event_type: status = %d, want 200 — a 400 parks the dispatch forever", rw.Code)
}
got, err := storage.GetStoryByGUID("brand_new_thing:abc:5000")
if err != nil || got == nil {
t.Fatal("unknown event_type was not stored; the event is lost")
}
if !strings.Contains(got.Headline+got.Lede, "Josie") {
t.Errorf("fallback dropped the subject: %q / %q", got.Headline, got.Lede)
}
// Untemplated types never post live, whatever tier they claim: a thin card on
// the site is cheap, a thin ping to everyone in the room is not. It still
// reaches Matrix via the daily digest.
if len(*posted) != 0 {
t.Errorf("untemplated priority fact posted live to Matrix: %+v", *posted)
}
// And the operator can see what Pete needs to learn.
if AdvUnknownTypeCounts()["brand_new_thing"] == 0 {
t.Error("unknown type was not counted for the status page")
}
}
// TestUnknownEventTypeUsesProse: the inversion is not a downgrade in practice.
// gogobee authors LLM prose from the fact's fields with no per-type switch
// (authorDispatch), so a type Pete has never heard of still arrives with a real
// headline and lede — and must be allowed to use them. The thin fallback is only
// for when the model is off or the prose-guard rejected the output.
func TestUnknownEventTypeUsesProse(t *testing.T) {
const token = "s3cret-token"
s, _ := newAdvServer(t, token)
f := AdvFact{
GUID: "another_new_thing:def:6000", EventType: "another_new_thing",
Tier: "bulletin", Subject: "Josie", Actors: []string{"Josie"},
OccurredAt: 6000,
Headline: "Josie has taken up beekeeping.",
Lede: "Not the news I expected today, but there she is, out behind the chapel with a smoker and a very calm expression.",
}
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("status = %d, want 200", rw.Code)
}
got, err := storage.GetStoryByGUID("another_new_thing:def:6000")
if err != nil || got == nil {
t.Fatal("story not stored")
}
if got.Headline != f.Headline {
t.Errorf("LLM prose was discarded for an unknown type: got %q", got.Headline)
}
}
// TestUnknownEventTypeStillGuarded: publishing an untemplated type must not
// weaken the name guards. The fact-guard rejection is still a 400, because a
// fact naming someone it did not authorise is genuinely invalid — unlike a type
// Pete simply hasn't learned to phrase.
func TestUnknownEventTypeStillGuarded(t *testing.T) {
const token = "s3cret-token"
s, _ := newAdvServer(t, token)
f := AdvFact{
GUID: "unknowable:evil:1", EventType: "unknowable",
Subject: "Josie", Actors: []string{"Brannigan"}, OccurredAt: 1,
}
if rw := postFact(t, s, token, f); rw.Code != 400 {
t.Errorf("unguarded subject on an unknown type: status = %d, want 400", rw.Code)
}
if storage.IsGUIDSeen("unknowable:evil:1") {
t.Error("fact-guard rejection was stored anyway")
}
}
// TestPermalinkNamesTheRegion. Region is a fact field, never a story column — the
// story is Pete's words and they have no place for a where — so the permalink has
// to read it off the fact row it already loads for the run-report link. It was
// hardcoded empty with a `// reserved` comment for the whole life of the page.
//
// The second half matters as much: a multi-region zone is the only place a region
// exists, so a dispatch without one must not print an empty separator.
func TestPermalinkNamesTheRegion(t *testing.T) {
const token = "t"
s, _ := newAdvServer(t, token)
withRegion := AdvFact{
GUID: "zone_clear:reg:1000", EventType: "zone_clear", Tier: "bulletin",
Actors: []string{"Brannigan"}, Subject: "Brannigan",
Zone: "the Underforge", Region: "the Cinder Reach", Level: 14, OccurredAt: 1000,
}
without := AdvFact{
GUID: "zone_clear:noreg:1001", EventType: "zone_clear", Tier: "bulletin",
Actors: []string{"Brannigan"}, Subject: "Brannigan",
Zone: "the Underforge", Level: 14, OccurredAt: 1001,
}
for _, f := range []AdvFact{withRegion, without} {
if rw := postFact(t, s, token, f); rw.Code != 200 {
t.Fatalf("ingest %s = %d", f.GUID, rw.Code)
}
}
story := func(guid string) string {
req := httptest.NewRequest("GET", "/adventure/"+guid, nil)
req.SetPathValue("guid", guid)
rw := httptest.NewRecorder()
s.handleAdventureStory(rw, req)
if rw.Code != 200 {
t.Fatalf("permalink %s = %d", guid, rw.Code)
}
return rw.Body.String()
}
if !strings.Contains(story(withRegion.GUID), "the Cinder Reach") {
t.Error("permalink does not name the region the fact carries")
}
// The template joins the region on with " · "; a regionless dispatch must not
// render a dangling one.
if body := story(without.GUID); strings.Contains(body, "Reported ") &&
strings.Contains(body, " · </p>") {
t.Error("a dispatch with no region printed an empty separator")
}
}
internal/web/auth.go
+15 -3
View File
@@ -195,11 +195,23 @@ func (a *Authenticator) setCookie(w http.ResponseWriter, name, value string, ttl
} }
func (a *Authenticator) clearCookie(w http.ResponseWriter, name string) { func (a *Authenticator) clearCookie(w http.ResponseWriter, name string) {
http.SetCookie(w, &http.Cookie{ // A cookie delete only lands when its Domain matches the one the cookie was
// set with. The session cookie's scope has changed over Pete's life: host-only
// before the games site, then widened to the parent domain so news and games
// could share one login. A browser may still hold it under the older scope, and
// a clear under only the current scope leaves the other in place — a stranded
// cookie that keeps someone signed in with a session logout can't reach. So
// clear both: always host-only, plus the parent domain when one is configured.
base := http.Cookie{
Name: name, Value: "", Path: "/", MaxAge: -1, Name: name, Value: "", Path: "/", MaxAge: -1,
Domain: a.cookieDomain(name),
HttpOnly: true, Secure: true, SameSite: http.SameSiteLaxMode, HttpOnly: true, Secure: true, SameSite: http.SameSiteLaxMode,
}) }
http.SetCookie(w, &base) // host-only (no Domain attribute)
if d := a.cookieDomain(name); d != "" {
scoped := base
scoped.Domain = d
http.SetCookie(w, &scoped) // parent-domain scope
}
} }
// oauthFor returns the OAuth config to use for this request. The configured // oauthFor returns the OAuth config to use for this request. The configured
internal/web/auth_test.go
+50
View File
@@ -8,6 +8,56 @@ import (
"golang.org/x/oauth2" "golang.org/x/oauth2"
) )
// TestClearCookieClearsBothScopes: when a parent cookie domain is configured,
// clearCookie must emit a delete for BOTH the parent-domain scope and the
// host-only scope. A browser holding a session under the older host-only scope
// (from before the cookie domain widened for the games site) would otherwise
// survive logout and keep the user signed in with a session logout can't reach.
func TestClearCookieClearsBothScopes(t *testing.T) {
a := &Authenticator{domain: "parodia.dev"}
rec := httptest.NewRecorder()
a.clearCookie(rec, sessionCookie)
var hostOnly, scoped bool
for _, c := range rec.Result().Cookies() {
if c.Name != sessionCookie {
continue
}
if c.MaxAge >= 0 {
t.Errorf("clear cookie should expire the session, got MaxAge=%d", c.MaxAge)
}
switch c.Domain {
case "":
hostOnly = true
case "parodia.dev":
scoped = true
default:
t.Errorf("unexpected clear Domain %q", c.Domain)
}
}
if !hostOnly {
t.Error("missing host-only clear (no Domain) — stale host-only sessions stay stranded")
}
if !scoped {
t.Error("missing parent-domain clear (Domain=parodia.dev)")
}
}
// With no cookie domain configured, only the host-only clear is emitted.
func TestClearCookieHostOnlyWhenNoDomain(t *testing.T) {
a := &Authenticator{}
rec := httptest.NewRecorder()
a.clearCookie(rec, sessionCookie)
got := rec.Result().Cookies()
if len(got) != 1 {
t.Fatalf("want exactly one clear cookie, got %d", len(got))
}
if got[0].Domain != "" {
t.Errorf("want host-only clear, got Domain=%q", got[0].Domain)
}
}
func TestSignVerifyRoundTrip(t *testing.T) { func TestSignVerifyRoundTrip(t *testing.T) {
a := &Authenticator{secret: []byte("test-secret-key-at-least-16")} a := &Authenticator{secret: []byte("test-secret-key-at-least-16")}
payload := []byte(`{"sub":"abc","exp":123}`) payload := []byte(`{"sub":"abc","exp":123}`)
internal/web/away.go
+164
View File
@@ -0,0 +1,164 @@
package web
import (
"fmt"
"log/slog"
"net/http"
"time"
"pete/internal/storage"
)
// "While you were away" — the one panel on the site that is about the reader.
//
// Everything else in the adventure section is the realm's news: the board, the
// Siege, the standings. This is the owner's own adventurer, and only what has
// happened to them since they last looked. It pairs with W6's push alerts and
// covers the gap those deliberately leave: the alerts are four opt-in categories
// chosen for being worth interrupting somebody over, while this catches
// everything, for people who would rather not be interrupted at all.
//
// It renders on /adventure page 1 only. The panel is present tense and page 2 of
// an archive is not where anybody looks for what just happened, which is the same
// rule the roster and the Siege strip already follow.
// awayCap bounds the panel. Six lines is a glance; a longer list is the trail on
// the adventurer's own page, which is where the "all of it" link goes.
const awayCap = 6
// awayView is the panel. Has is false in every case where there is nothing
// honest to show — not signed in, no adventurer, first ever visit, or simply
// nothing new — and the template renders nothing at all rather than an empty box
// announcing that nothing happened.
type awayView struct {
Has bool
Name string // the reader's own character
Since string // "3 hours", "2 days" — how long they were gone
Lines []awayLine
// HasMore says there is more than the cap, without saying how much more. The
// window query reads one row past the cap to learn this; an exact count would
// need a second query over the same window to tell somebody a number they are
// about to click past anyway.
HasMore bool
Token string // their adventurer page, where the rest of the trail is
}
// awayLine is one thing that happened, in the trail's own shape. Built from the
// fact rather than from the dispatch headline for the same reason buildTimeline
// is: a headline is a news sentence written to be shouted once, and six of them
// stacked in a panel read as shouting.
type awayLine struct {
Emoji string
Label string
Line string
When string // relative: this panel is about recency
Permalink string
Notable bool
}
// awayPanel builds the panel for whoever is asking, and stamps their visit.
//
// The stamp is written even when the panel comes back empty — even for a signed-in
// user with no adventurer at all — and that is deliberate: a clock that only
// advances when there is something to show would hand somebody their entire
// backlog on the day they finally rolled a character.
func (s *Server) awayPanel(r *http.Request) awayView {
if s.auth == nil {
return awayView{}
}
u := s.auth.userFromRequest(r)
if u == nil {
return awayView{}
}
now := time.Now().Unix()
from, first, err := storage.AdvVisitWindow(u.Sub, now)
if err != nil {
slog.Error("away: visit clock failed", "sub", u.Sub, "err", err)
return awayView{}
}
if first {
// Never seen before. Their history is not news to them, and a first visit
// greeted by every death their character ever suffered is a worse welcome
// than no panel at all.
return awayView{}
}
// The ownership join, re-read on every request rather than cached anywhere —
// same discipline as the alert sender and the run report link. It fails closed
// on an opt-out and on a player gogobee has stopped pushing, both of which mean
// Pete cannot honestly say which adventurer is this reader's.
lp := buyerLocalpart(u)
if lp == "" {
return awayView{}
}
name, ok := storage.AdvCharacterForOwner(lp)
if !ok {
return awayView{}
}
// One extra row is fetched past the cap purely to answer "is there more",
// without a second COUNT query over the same window.
events, err := storage.EventsBySubjectSince(name, from, awayCap+1)
if err != nil {
slog.Error("away: dispatch lookup failed", "subject", name, "err", err)
return awayView{}
}
if len(events) == 0 {
return awayView{}
}
v := awayView{Has: true, Name: name, Since: awaySince(now - from)}
if token, ok := storage.SelfToken(lp); ok {
v.Token = token
}
if len(events) > awayCap {
v.HasMore = true
events = events[:awayCap]
}
for _, e := range events {
label, emoji := advEventMeta(e.EventType)
v.Lines = append(v.Lines, awayLine{
Emoji: emoji,
Label: label,
Line: timelineLine(name, e),
When: awayAgo(now - e.OccurredAt),
Permalink: s.advPermalink(e.GUID),
Notable: e.EventType == "boss_first" || e.EventType == "zone_first" ||
e.EventType == "death",
})
}
return v
}
// awaySince phrases the gap the panel covers. Rounded down, and it never claims
// less than an hour: the window is at least one session gap wide, and "since 34
// minutes ago" is a precision the clock behind it does not have.
func awaySince(secs int64) string {
switch d := time.Duration(secs) * time.Second; {
case d < 2*time.Hour:
return "an hour"
case d < 48*time.Hour:
return fmt.Sprintf("%d hours", int(d.Hours()))
case d < 14*24*time.Hour:
return fmt.Sprintf("%d days", int(d.Hours())/24)
default:
return "a while"
}
}
// awayAgo is a compact relative stamp for one line. Deliberately not the trail's
// "Jan 2, 2006": everything in this panel is recent by construction, and a date
// on it would make the reader do the subtraction themselves.
func awayAgo(secs int64) string {
switch d := time.Duration(secs) * time.Second; {
case d < time.Minute:
return "just now"
case d < time.Hour:
return fmt.Sprintf("%dm ago", int(d.Minutes()))
case d < 24*time.Hour:
return fmt.Sprintf("%dh ago", int(d.Hours()))
default:
return fmt.Sprintf("%dd ago", int(d.Hours())/24)
}
}
internal/web/away_test.go
+164
View File
@@ -0,0 +1,164 @@
package web
import (
"encoding/json"
"net/http"
"net/http/httptest"
"testing"
"time"
"pete/internal/storage"
)
// The "while you were away" panel. Two things are worth pinning: it never shows
// somebody else's adventurer, and its window survives a page refresh — the
// failure that would make the whole panel useless without breaking anything a
// unit test would normally notice.
// awayReq builds a request for /adventure as a signed-in user, or anonymously
// when sub is empty.
func awayReq(t *testing.T, s *Server, sub, username string) *http.Request {
t.Helper()
r := httptest.NewRequest("GET", "/adventure", nil)
if sub != "" {
payload, _ := json.Marshal(SessionUser{
Sub: sub, Username: username, Exp: time.Now().Add(time.Hour).Unix(),
})
r.AddCookie(&http.Cookie{Name: sessionCookie, Value: s.auth.sign(payload)})
}
return r
}
// seedAwayOwner puts one adventurer on the board owned by localpart, the way the
// two real pushes do.
func seedAwayOwner(t *testing.T, localpart, character string) {
t.Helper()
now := time.Now().Unix()
if err := storage.ReplaceRoster([]storage.RosterEntry{{
Token: "tok-" + localpart, Name: character, Level: 14, Status: "idle",
}}, now); err != nil {
t.Fatal(err)
}
if err := storage.ReplacePlayerDetail([]storage.PlayerDetail{{
Localpart: localpart, Token: "tok-" + localpart,
}}, now); err != nil {
t.Fatal(err)
}
}
func seedAwayEvent(t *testing.T, guid, kind, subject string, at int64) {
t.Helper()
if err := storage.InsertAdventureEvent(&storage.AdvEvent{
GUID: guid, EventType: kind, Subject: subject, Zone: "holymachina",
OccurredAt: at,
}); err != nil {
t.Fatal(err)
}
}
// TestAwayPanelIsSilentOnAFirstVisit. A brand-new row means "never seen before",
// and treating that as "away since the epoch" would greet somebody's first
// sign-in with every death their character ever suffered.
func TestAwayPanelIsSilentOnAFirstVisit(t *testing.T) {
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
seedAwayOwner(t, "josie", "Josie")
seedAwayEvent(t, "death:a:1", "death", "Josie", time.Now().Add(-time.Hour).Unix())
if v := s.awayPanel(awayReq(t, s, "sub-1", "josie")); v.Has {
t.Errorf("first visit rendered a panel of %d lines; it must be silent", len(v.Lines))
}
// And the clock was still stamped, so the next visit has a window to read from.
from, first, err := storage.AdvVisitWindow("sub-1", time.Now().Unix())
if err != nil {
t.Fatal(err)
}
if first || from == 0 {
t.Errorf("visit clock not stamped on the first pass (from=%d first=%v)", from, first)
}
}
// TestAwayPanelSurvivesARefresh is the reason adventure_visit has two columns.
// The naive one-column version shows the news, moves the stamp to now, and then
// renders an empty box over the same events the moment the reader reloads —
// which is exactly what somebody does after clicking into a dispatch and back.
func TestAwayPanelSurvivesARefresh(t *testing.T) {
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
seedAwayOwner(t, "josie", "Josie")
// A visit two hours ago established the clock. Stamped directly rather than
// through awayPanel, because the panel reads the wall clock and this test is
// about what happens between two visits rather than inside one.
if _, first, err := storage.AdvVisitWindow("sub-1", time.Now().Add(-2*time.Hour).Unix()); err != nil || !first {
t.Fatalf("seed visit: first=%v err=%v", first, err)
}
// Then something happened to Josie.
seedAwayEvent(t, "death:a:1", "death", "Josie", time.Now().Add(-time.Minute).Unix())
first := s.awayPanel(awayReq(t, s, "sub-1", "josie"))
if !first.Has || len(first.Lines) != 1 {
t.Fatalf("panel = %+v, want one line about the death", first)
}
if first.Name != "Josie" {
t.Errorf("panel names %q, want Josie", first.Name)
}
// The refresh. Same panel, not an empty one.
again := s.awayPanel(awayReq(t, s, "sub-1", "josie"))
if !again.Has || len(again.Lines) != len(first.Lines) {
t.Errorf("refresh emptied the panel: %+v", again)
}
}
// TestAwayPanelNeverShowsAnotherPlayersNews. The panel is keyed on a fact's
// character name, resolved through the owner join — the same join the alert
// sender uses, and the same failure-closed rule. A signed-in visitor who owns
// nothing must see nothing, never the realm's news relabelled as their own.
func TestAwayPanelNeverShowsAnotherPlayersNews(t *testing.T) {
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
seedAwayOwner(t, "josie", "Josie")
seedAwayEvent(t, "death:a:1", "death", "Josie", time.Now().Add(-time.Minute).Unix())
// Anonymous: no panel, and no visit row to create either.
if v := s.awayPanel(awayReq(t, s, "", "")); v.Has {
t.Error("an anonymous visitor got a personal panel")
}
// Signed in, but owns no adventurer on the board.
if v := s.awayPanel(awayReq(t, s, "sub-stranger", "stranger")); v.Has {
t.Errorf("a visitor with no adventurer got %+v", v)
}
// Second pass, now that their visit row exists — the branch that would fall
// through to a broadcast if the ownership join were ever treated as optional.
if v := s.awayPanel(awayReq(t, s, "sub-stranger", "stranger")); v.Has {
t.Errorf("a visitor with no adventurer got %+v on their second visit", v)
}
}
// TestAwayPanelCapsAndCounts: six lines is a glance, and the overflow has to be
// counted rather than silently dropped.
func TestAwayPanelCapsAndCounts(t *testing.T) {
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
seedAwayOwner(t, "josie", "Josie")
if _, first, err := storage.AdvVisitWindow("sub-1", time.Now().Add(-4*time.Hour).Unix()); err != nil || !first {
t.Fatalf("seed visit: first=%v err=%v", first, err)
}
base := time.Now().Add(-time.Hour).Unix()
for i := 0; i < awayCap+3; i++ {
seedAwayEvent(t, "boss_kill:"+string(rune('a'+i))+":1", "boss_kill", "Josie", base+int64(i))
}
v := s.awayPanel(awayReq(t, s, "sub-1", "josie"))
if len(v.Lines) != awayCap {
t.Errorf("panel drew %d lines, want the cap of %d", len(v.Lines), awayCap)
}
if !v.HasMore {
t.Error("overflow was not flagged; the extra events would read as if they never happened")
}
if v.Token != "tok-josie" {
t.Errorf("panel links to %q, want the reader's own adventurer page", v.Token)
}
}
internal/web/css_purge_test.go
+240
View File
@@ -0,0 +1,240 @@
package web
import (
"os"
"regexp"
"sort"
"strings"
"testing"
)
// The Tailwind purge trap, made loud.
//
// tailwind.config.js has input.css in its OWN content glob, so a hand-written
// component class survives the purge only if its literal name can be *extracted*
// from that file. A name that only ever appears glued to something else — the
// canonical case is a rule written solely as `.foo::before` — is not extractable
// and Tailwind drops the rule from output.css. Nothing errors. The page just
// renders unstyled, and it is invisible until somebody looks at that exact
// element on that exact page.
//
// That has now cost three phases: flagged twice, and actually bitten once when
// `.firsts-entry-zone::before` was silently dropped. The mitigation everybody
// reached for — "remember to grep output.css after make css" — is the discipline
// that failed, and it is worse than it looks because Tailwind ESCAPES class
// names in its output (`.text-[color:var(--warn)]` is written
// `.text-\[color\:var\(--warn\)\]`), so a naive grep for the literal name
// reports a false negative that looks exactly like a purge failure.
//
// So: a test. It needs no list to maintain — the list IS input.css — and it
// turns a silent styling failure into a red build.
//
// A Tailwind `safelist` was the other option and is worse: a list somebody has
// to remember to add to is the same failure mode one level up.
// cssClassInSelector matches a class name in a selector. The leading dot must
// not be preceded by an identifier character, so `1.5rem` in a declaration is
// never mistaken for a class.
var cssClassInSelector = regexp.MustCompile(`\.(-?[A-Za-z_][-\w]*)`)
// cssComment strips /* ... */ so a class name mentioned in prose can't be read
// as a declaration. Several of the component blocks have long explanatory
// comments that name other classes.
var cssComment = regexp.MustCompile(`(?s)/\*.*?\*/`)
// componentClasses returns every class name declared inside an `@layer
// components` block of input.css.
//
// It walks the file rather than regexing whole rules because a component block
// can contain nested at-rules (`@media`, `@supports`) and because a selector can
// be a list spanning several lines. The walk collects each *prelude* — the text
// between one brace and the next — and reads class names out of it. An at-rule
// prelude (`@media ...`) is skipped; a declaration body is never a prelude
// because it is followed by `}`, not `{`.
func componentClasses(t *testing.T, css string) []string {
t.Helper()
css = cssComment.ReplaceAllString(css, " ")
seen := map[string]bool{}
var out []string
// Find each `@layer components` block by brace-counting from its opening
// brace, then walk only inside it.
const marker = "@layer components"
for idx := 0; ; {
i := strings.Index(css[idx:], marker)
if i < 0 {
break
}
i += idx
open := strings.Index(css[i:], "{")
if open < 0 {
break
}
open += i
depth := 0
var prelude strings.Builder
end := len(css)
for j := open; j < len(css); j++ {
switch css[j] {
case '{':
depth++
// depth 1 is the @layer's own brace; anything deeper opened on a
// prelude we have been buffering.
if depth > 1 {
sel := strings.TrimSpace(prelude.String())
if !strings.HasPrefix(sel, "@") {
for _, m := range cssClassInSelector.FindAllStringSubmatch(sel, -1) {
if !seen[m[1]] {
seen[m[1]] = true
out = append(out, m[1])
}
}
}
}
prelude.Reset()
case '}':
depth--
prelude.Reset()
if depth == 0 {
end = j
}
default:
prelude.WriteByte(css[j])
}
if depth == 0 && j > open {
break
}
}
idx = end + 1
}
sort.Strings(out)
return out
}
// cssEscape renders a class name the way Tailwind writes it into output.css:
// every character outside [A-Za-z0-9_-] is backslash-escaped. This is the half
// of the check that a grep gets wrong.
func cssEscape(name string) string {
var b strings.Builder
for _, r := range name {
if r == '-' || r == '_' || (r >= '0' && r <= '9') ||
(r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || r > 127 {
b.WriteRune(r)
continue
}
b.WriteByte('\\')
b.WriteRune(r)
}
return b.String()
}
// selectorPresent reports whether `.name` appears in the (minified) stylesheet
// as a selector rather than as a prefix of a longer class name. Tailwind's
// output has no line breaks, so the boundary check is the whole test.
func selectorPresent(css, name string) bool {
needle := "." + cssEscape(name)
for i := 0; ; {
j := strings.Index(css[i:], needle)
if j < 0 {
return false
}
j += i
i = j + 1
// A match must not be the head of a longer name: `.map` inside
// `.map-svg` ends on '-', which is an identifier character.
if k := j + len(needle); k < len(css) {
c := css[k]
if c == '-' || c == '_' || c == '\\' ||
(c >= '0' && c <= '9') || (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') {
continue
}
}
return true
}
}
// TestEveryComponentClassSurvivesThePurge is the whole point of this file. If it
// fails, run `make css` first — a stale output.css looks identical to a purged
// class from here, and that is deliberate: shipping a stylesheet that predates
// the rule you just wrote is the same bug wearing a different hat.
func TestEveryComponentClassSurvivesThePurge(t *testing.T) {
inRaw, err := os.ReadFile("static/css/input.css")
if err != nil {
t.Fatalf("read input.css: %v", err)
}
outRaw, err := os.ReadFile("static/css/output.css")
if err != nil {
t.Fatalf("read output.css: %v — run `make css`", err)
}
in, out := string(inRaw), string(outRaw)
classes := componentClasses(t, in)
if len(classes) < 50 {
t.Fatalf("only found %d component classes in input.css — the parser has stopped working, "+
"which would make this test pass for the wrong reason", len(classes))
}
var missing []string
for _, c := range classes {
if !selectorPresent(out, c) {
missing = append(missing, c)
}
}
if len(missing) > 0 {
t.Errorf("%d class(es) declared in input.css's @layer components are absent from output.css: %s\n"+
"Either run `make css`, or the name is not extractable from input.css — a rule written only as "+
"`.foo::before` or only inside a nested selector cannot be extracted, and Tailwind purges it "+
"silently. Give it a plain `.foo { ... }` declaration (a custom property is enough).",
len(missing), strings.Join(missing, ", "))
}
}
// TestPurgeCheckCatchesAPseudoOnlyClass proves the check would have caught the
// W4 bug, using a synthetic pair rather than trusting that the real stylesheet
// happens to exercise the path. Without this, a parser that silently found
// nothing would leave the real test green forever.
func TestPurgeCheckCatchesAPseudoOnlyClass(t *testing.T) {
in := `@layer components {
/* a comment naming .decoy-class, which must not be collected */
.kept { color: red; }
.pseudo-only::before { content: ""; }
@media (min-width: 40rem) {
.nested { display: none; }
}
}`
got := componentClasses(t, in)
want := []string{"kept", "nested", "pseudo-only"}
if strings.Join(got, ",") != strings.Join(want, ",") {
t.Fatalf("componentClasses = %v, want %v", got, want)
}
// Tailwind's output as it would be if `.pseudo-only` were not extractable.
out := `.kept{color:red}.nested-thing{display:block}`
if !selectorPresent(out, "kept") {
t.Error("kept should be present")
}
if selectorPresent(out, "pseudo-only") {
t.Error("pseudo-only should be reported missing — this is the W4 bug")
}
// The boundary check: `.nested` must not match inside `.nested-thing`.
if selectorPresent(out, "nested") {
t.Error("nested matched the prefix of .nested-thing — the boundary check is broken")
}
}
// TestPurgeCheckComparesEscapedForms is the W6 lesson as a test: a raw-name grep
// reports a false negative on any class Tailwind had to escape, which reads
// exactly like a purge failure and once cost a session's time "fixing" a class
// that was never broken.
func TestPurgeCheckComparesEscapedForms(t *testing.T) {
out := `.text-\[color\:var\(--warn\)\]{color:var(--warn)}`
if !selectorPresent(out, "text-[color:var(--warn)]") {
t.Error("escaped class reported missing — the check must escape before comparing")
}
if strings.Contains(out, ".text-[color:var(--warn)]") {
t.Error("fixture is wrong: the raw form should not appear in Tailwind output")
}
}
internal/web/equip.go
+307
View File
@@ -0,0 +1,307 @@
package web
import (
"encoding/json"
"errors"
"io"
"log/slog"
"net/http"
"time"
"pete/internal/storage"
)
// The equip queue's web seam.
//
// Two audiences, same shape as mischief. A signed-in owner, on their own detail
// page, clicks Equip or Unequip; the OIDC-gated buy half records the intent after
// proving they own the page and the item. gogobee hits the bearer-authed pair: it
// polls pending orders and pushes a verdict. Pete never runs an equip rule — it
// records intent and files the verdict; the item actually moves on the game box,
// on gogobee's next poll tick. The UI says "queued" and never claims it landed.
// equipBurstWindow / equipBurstMax are Pete's own anti-spam guard, nothing more.
// The real eligibility — still-owned, wearable, the 3-bond cap — is gogobee's, at
// verdict time. This only stops a stuck mouse button from spooling the table.
const (
equipBurstWindow = time.Hour
equipBurstMax = 40
)
// equipOrderReq is the browser's request. The owner names the page they're on
// (proving ownership), what they're doing, and the item — by its inventory row id
// for an equip, or by slot for an unequip. Pete resolves the display facts itself
// from the owner's own detail, never trusting the client for name or slot.
type equipOrderReq struct {
Token string `json:"token"`
Action string `json:"action"`
ItemID int64 `json:"item_id"`
Slot string `json:"slot"`
Tier int `json:"tier"` // upgrade only: the target standard tier; verified against the pushed slot view
}
// handleEquipOrder places a pending equip/unequip for the signed-in owner. It
// asserts what Pete can honestly know: the viewer is signed in, owns this exact
// page (proven by a row gogobee pushed, never by the token alone), and the item
// is actually in the panel they claim. Bond caps and the rest of the rulebook are
// gogobee's, checked when it drains the order.
func (s *Server) handleEquipOrder(w http.ResponseWriter, r *http.Request) {
u := s.requireUser(w, r)
if u == nil {
return
}
owner := buyerLocalpart(u)
if owner == "" {
writeEquipError(w, http.StatusConflict, "please sign in again")
return
}
var req equipOrderReq
if !decodeStateBody(w, r, &req) {
return
}
if req.Token == "" {
writeEquipError(w, http.StatusBadRequest, "no character")
return
}
switch req.Action {
case storage.EquipActionEquip, storage.EquipActionUnequip,
storage.EquipActionUpgrade, storage.EquipActionRepair:
default:
writeEquipError(w, http.StatusBadRequest, "bad action")
return
}
// Ownership: only the localpart that owns this exact page token may dress it.
// The detail row is gogobee's own proof of owner<->page; a token alone proves
// nothing.
pd, ok, err := storage.PlayerDetailByOwner(owner, req.Token)
if err != nil {
slog.Error("equip: owner lookup", "err", err)
writeEquipError(w, http.StatusInternalServerError, "internal error")
return
}
if !ok {
writeEquipError(w, http.StatusForbidden, "that's not your adventurer")
return
}
// Resolve every fact of the order from the owner's own pushed detail — never
// from the client — so a forged name, slot, tier, or price can't ride in. An
// equip names a backpack item by its row id; an unequip/take-off names a worn
// slot (a magic DnD slot in Equipped, or a masterwork/arena standard slot in
// Slots); upgrade and repair name a standard slot in Slots and move money, so
// the target tier is trusted only when it matches the slot's pushed NextTier.
var (
itemName string
slot string
itemID int64
tier int
)
switch req.Action {
case storage.EquipActionEquip:
it, found := findBackpackItem(pd.Inventory, req.ItemID)
if !found {
writeEquipError(w, http.StatusBadRequest, "that item isn't in your pack")
return
}
itemName, slot, itemID = it.Name, it.Slot, req.ItemID
case storage.EquipActionUnequip:
// Magic take-off keys on a DnD slot in Equipped; masterwork/arena take-off
// keys on a standard slot in Slots (CanTakeOff). The vocabularies are disjoint,
// so try each — gogobee disambiguates the same way. A plain shop-tier slot has
// nothing to round-trip, so it never resolves here (revert is an upgrade path).
if it, found := findWornSlot(pd.Equipped, req.Slot); found {
itemName, slot = it.Name, it.Slot
} else if sv, found := findSlotView(pd.Slots, req.Slot); found && sv.CanTakeOff {
itemName, slot = sv.Name, sv.Slot
} else {
writeEquipError(w, http.StatusBadRequest, "nothing to take off there")
return
}
case storage.EquipActionUpgrade:
sv, found := findSlotView(pd.Slots, req.Slot)
if !found || sv.NextTier == 0 {
writeEquipError(w, http.StatusBadRequest, "no upgrade available for that slot")
return
}
if req.Tier != sv.NextTier {
// The web offers the next tier only; a request for anything else is a stale
// page or a forged jump. Refuse rather than debit for a tier the owner never
// saw priced.
writeEquipError(w, http.StatusConflict, "that upgrade is out of date, reload the page")
return
}
itemName, slot, tier = sv.NextName, sv.Slot, sv.NextTier
case storage.EquipActionRepair:
sv, found := findSlotView(pd.Slots, req.Slot)
if !found || sv.RepairCost == 0 {
writeEquipError(w, http.StatusBadRequest, "nothing to repair there")
return
}
itemName, slot = sv.Name, sv.Slot
}
since := time.Now().Add(-equipBurstWindow).Unix()
if n, err := storage.CountEquipOrdersSince(u.Sub, since); err != nil {
slog.Error("equip: burst count", "err", err)
writeEquipError(w, http.StatusInternalServerError, "internal error")
return
} else if n >= equipBurstMax {
writeEquipError(w, http.StatusTooManyRequests, "slow down, too many changes in a short while")
return
}
characterName := ""
if entry, ok, err := storage.RosterEntryByToken(req.Token); err == nil && ok {
characterName = entry.Name
}
order, err := storage.InsertEquipOrder(u.Sub, owner, characterName, itemID, itemName, slot, req.Action, tier)
if err != nil {
slog.Error("equip: insert order", "err", err)
writeEquipError(w, http.StatusInternalServerError, "internal error")
return
}
slog.Info("equip: order placed", "guid", order.GUID, "owner", owner, "action", req.Action, "slot", slot)
w.Header().Set("Cache-Control", "no-store")
writeJSON(w, order)
}
// findBackpackItem finds a wearable backpack item by its row id. Only magic items
// carry a non-zero ID, so a zero id can never match — the id both names the item
// and gates the action to the magic-item equip path.
func findBackpackItem(items []storage.ItemView, id int64) (storage.ItemView, bool) {
if id == 0 {
return storage.ItemView{}, false
}
for _, it := range items {
if it.ID == id {
return it, true
}
}
return storage.ItemView{}, false
}
// findWornSlot finds a worn item by the slot it fills.
func findWornSlot(items []storage.ItemView, slot string) (storage.ItemView, bool) {
if slot == "" {
return storage.ItemView{}, false
}
for _, it := range items {
if it.Slot == slot {
return it, true
}
}
return storage.ItemView{}, false
}
// findSlotView finds one of the 5 standard equipment slots by name. It is the
// server-side source of truth for a take-off / upgrade / repair: the request
// names a slot, and every other fact (name, next tier, price, repair cost) is
// read from here rather than trusted from the client.
func findSlotView(slots []storage.EquipSlotView, slot string) (storage.EquipSlotView, bool) {
if slot == "" {
return storage.EquipSlotView{}, false
}
for _, sv := range slots {
if sv.Slot == slot {
return sv, true
}
}
return storage.EquipSlotView{}, false
}
// handleEquipOrders returns the signed-in owner's own recent equip orders for the
// status strip, newest first. Scoped to their OIDC subject.
func (s *Server) handleEquipOrders(w http.ResponseWriter, r *http.Request) {
u := s.requireUser(w, r)
if u == nil {
return
}
orders, err := storage.EquipOrdersByOwner(u.Sub, 20)
if err != nil {
slog.Error("equip: orders by owner", "err", err)
writeEquipError(w, http.StatusInternalServerError, "internal error")
return
}
if orders == nil {
orders = []storage.EquipOrder{}
}
w.Header().Set("Cache-Control", "no-store")
writeJSON(w, orders)
}
// ---- the gogobee wire: bearer-authed, idempotent -------------------------------
// equipPollLimit caps one poll, matching the mischief seam.
const equipPollLimit = 50
// handleEquipPending is gogobee's poll: every order still waiting. Like mischief
// there is no stale-reoffer window — a gogobee that dies mid-apply leaves the order
// pending to be offered again, and gogobee's guid guard makes the replay a no-op.
func (s *Server) handleEquipPending(w http.ResponseWriter, r *http.Request) {
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
orders, err := storage.PendingEquipOrders(equipPollLimit)
if err != nil {
slog.Error("equip: pending", "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
if orders == nil {
orders = []storage.EquipOrder{}
}
writeJSON(w, orders)
}
// equipVerdict is gogobee's answer on an order: the terminal status and a human
// note to render.
type equipVerdict struct {
GUID string `json:"guid"`
Status string `json:"status"`
Detail string `json:"detail,omitempty"`
}
// handleEquipVerdict files gogobee's verdict against a pending order. Idempotent:
// gogobee's poll loop retries, so the same verdict can arrive more than once and
// only the first moves the order. An unknown guid is a 400 — under the seam's
// contract that parks the row for a human rather than retrying forever against a
// row that will never exist.
func (s *Server) handleEquipVerdict(w http.ResponseWriter, r *http.Request) {
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
var v equipVerdict
if err := json.NewDecoder(io.LimitReader(r.Body, 1<<14)).Decode(&v); err != nil {
http.Error(w, "bad json", http.StatusBadRequest)
return
}
if v.GUID == "" {
http.Error(w, "guid is required", http.StatusBadRequest)
return
}
order, err := storage.ResolveEquipOrder(v.GUID, v.Status, v.Detail)
if errors.Is(err, storage.ErrNoSuchEquipOrder) {
slog.Error("equip: verdict for an order we've never heard of", "guid", v.GUID, "status", v.Status)
http.Error(w, "no such order", http.StatusBadRequest)
return
}
if err != nil {
slog.Error("equip: resolve", "guid", v.GUID, "status", v.Status, "err", err)
http.Error(w, "bad verdict", http.StatusBadRequest)
return
}
slog.Info("equip: order resolved", "guid", order.GUID, "status", order.Status)
writeJSON(w, order)
}
func writeEquipError(w http.ResponseWriter, code int, msg string) {
w.Header().Set("Content-Type", "application/json; charset=utf-8")
w.WriteHeader(code)
_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
}
internal/web/equip_test.go
+314
View File
@@ -0,0 +1,314 @@
package web
import (
"encoding/json"
"net/http/httptest"
"strings"
"testing"
"time"
"pete/internal/storage"
)
// The equip queue's web seam. Two contracts: the owner half proves ownership and
// resolves the item from Pete's own record (never the client), and the gogobee
// half is a bearer-authed, idempotent pending/verdict pair.
// seedEquip stands up a board + a private detail set owned by `owner`, with a
// wearable backpack magic item (ID != 0, the equip handle) and a worn item in a
// slot. Mirrors seedWho but pins the fields the equip path keys on.
func seedEquip(t *testing.T, owner string) *Server {
t.Helper()
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
now := time.Now().Unix()
e := entry("tok-josie", "Josie", "expedition", "holymachina")
if w := postRoster(t, s, "tok", rosterPush{SnapshotAt: now, Adventurers: []storage.RosterEntry{e}}); w.Code != 200 {
t.Fatalf("seed roster = %d", w.Code)
}
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
Localpart: owner,
Token: "tok-josie",
Inventory: []storage.ItemView{
// A wearable magic item: carries an ID, so it can be equipped.
{ID: 501, Name: "Ring of Protection", Type: "ring", Tier: 4, Value: 900,
Slot: "ring_1", Attunement: true, Effect: "-8% damage taken"},
// Mundane gear: no ID, so no equip handle even though it has a slot.
{Name: "Miner's Pick", Type: "MasterworkGear", Tier: 3, Value: 300,
Slot: "weapon", SkillSource: "mining"},
},
Equipped: []storage.ItemView{
{Name: "Cloak of Elvenkind", Type: "wondrous", Value: 2000, Slot: "cloak",
Effect: "faster to act", Attunement: true, Attuned: true},
},
// The 5 standard slots (ask 7). weapon is a worn masterwork (round-trippable,
// at max tier, damaged → repairable); boots is plain shop-tier at T3 with a
// T4 upgrade offered and nothing to take off or repair.
Slots: []storage.EquipSlotView{
{Slot: "weapon", Name: "Deepforged Blade", Tier: 5, Condition: 80,
Masterwork: true, CanTakeOff: true, RepairCost: 40},
{Slot: "boots", Name: "Leather Boots", Tier: 3, Condition: 100,
NextTier: 4, NextName: "Sturdy Boots", NextPrice: 25000},
},
Balance: 100000,
}}}); w.Code != 200 {
t.Fatalf("seed detail = %d", w.Code)
}
return s
}
func placeEquip(t *testing.T, s *Server, username string, req equipOrderReq) *httptest.ResponseRecorder {
t.Helper()
r := as(t, s, username, "POST", "/api/equip/order", req)
w := httptest.NewRecorder()
s.handleEquipOrder(w, r)
return w
}
// TestEquipOrderHappyEquip: the owner equips a backpack magic item; Pete resolves
// the item name and slot from its own record and queues a pending order.
func TestEquipOrderHappyEquip(t *testing.T) {
s := seedEquip(t, "reala")
w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "equip", ItemID: 501})
if w.Code != 200 {
t.Fatalf("equip = %d body=%s", w.Code, w.Body.String())
}
var o storage.EquipOrder
if err := json.Unmarshal(w.Body.Bytes(), &o); err != nil {
t.Fatal(err)
}
if o.Status != storage.EquipPending || o.Action != "equip" || o.ItemID != 501 {
t.Fatalf("order = %+v", o)
}
// Name and slot come from Pete's own detail, not the request.
if o.ItemName != "Ring of Protection" || o.Slot != "ring_1" || o.CharacterName != "Josie" {
t.Fatalf("order didn't resolve from the owner's record: %+v", o)
}
if pending, _ := storage.PendingEquipOrders(10); len(pending) != 1 {
t.Fatal("order didn't land in the pending set")
}
}
// TestEquipOrderHappyUnequip: taking off a worn item rides on the slot; item_id 0.
func TestEquipOrderHappyUnequip(t *testing.T) {
s := seedEquip(t, "reala")
w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "unequip", Slot: "cloak"})
if w.Code != 200 {
t.Fatalf("unequip = %d body=%s", w.Code, w.Body.String())
}
var o storage.EquipOrder
_ = json.Unmarshal(w.Body.Bytes(), &o)
if o.Action != "unequip" || o.Slot != "cloak" || o.ItemName != "Cloak of Elvenkind" || o.ItemID != 0 {
t.Fatalf("unequip order = %+v", o)
}
}
// TestEquipOrderRejections: the honest failure surface — not your page, item not
// in the pack, empty slot, unequippable mundane gear, bad action.
func TestEquipOrderRejections(t *testing.T) {
s := seedEquip(t, "reala")
// A different signed-in user does not own Josie's page.
if w := placeEquip(t, s, "mallory", equipOrderReq{Token: "tok-josie", Action: "equip", ItemID: 501}); w.Code != 403 {
t.Errorf("non-owner equip = %d, want 403", w.Code)
}
// An item id that isn't in the pack.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "equip", ItemID: 999}); w.Code != 400 {
t.Errorf("unknown item = %d, want 400", w.Code)
}
// Mundane gear has a slot but no id, so it can never be named for equip.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "equip", ItemID: 0}); w.Code != 400 {
t.Errorf("no-id equip = %d, want 400", w.Code)
}
// Unequip of a slot nothing is in.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "unequip", Slot: "boots"}); w.Code != 400 {
t.Errorf("empty-slot unequip = %d, want 400", w.Code)
}
// A bogus action.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "wield", ItemID: 501}); w.Code != 400 {
t.Errorf("bad action = %d, want 400", w.Code)
}
}
// TestEquipTakeOffMasterwork: a worn masterwork piece in a standard slot rides the
// unequip action, resolved from Slots (CanTakeOff), keyed on the slot with no item id.
func TestEquipTakeOffMasterwork(t *testing.T) {
s := seedEquip(t, "reala")
w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "unequip", Slot: "weapon"})
if w.Code != 200 {
t.Fatalf("take off = %d body=%s", w.Code, w.Body.String())
}
var o storage.EquipOrder
_ = json.Unmarshal(w.Body.Bytes(), &o)
if o.Action != "unequip" || o.Slot != "weapon" || o.ItemName != "Deepforged Blade" || o.ItemID != 0 {
t.Fatalf("take-off order = %+v", o)
}
}
// TestEquipUpgradeHappy: upgrading the boots to their next tier queues an upgrade
// order carrying the target tier and the tier's name — both resolved from the
// pushed slot view, not the request.
func TestEquipUpgradeHappy(t *testing.T) {
s := seedEquip(t, "reala")
w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "upgrade", Slot: "boots", Tier: 4})
if w.Code != 200 {
t.Fatalf("upgrade = %d body=%s", w.Code, w.Body.String())
}
var o storage.EquipOrder
_ = json.Unmarshal(w.Body.Bytes(), &o)
if o.Action != "upgrade" || o.Slot != "boots" || o.Tier != 4 || o.ItemName != "Sturdy Boots" || o.ItemID != 0 {
t.Fatalf("upgrade order = %+v", o)
}
}
// TestEquipRepairHappy: repairing a damaged slot queues a repair order keyed on the
// slot, no money in the request — the cost is gogobee's at apply time.
func TestEquipRepairHappy(t *testing.T) {
s := seedEquip(t, "reala")
w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "repair", Slot: "weapon"})
if w.Code != 200 {
t.Fatalf("repair = %d body=%s", w.Code, w.Body.String())
}
var o storage.EquipOrder
_ = json.Unmarshal(w.Body.Bytes(), &o)
if o.Action != "repair" || o.Slot != "weapon" || o.ItemName != "Deepforged Blade" {
t.Fatalf("repair order = %+v", o)
}
}
// TestEquipUpgradeRepairRejections: the money-spending actions trust only the
// pushed slot view. A forged tier, a slot with no upgrade offered, a repair of a
// full-condition slot, and a non-owner all bounce before any order is placed.
func TestEquipUpgradeRepairRejections(t *testing.T) {
s := seedEquip(t, "reala")
// A tier that isn't the slot's pushed NextTier: a stale page or a forged jump.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "upgrade", Slot: "boots", Tier: 5}); w.Code != 409 {
t.Errorf("forged upgrade tier = %d, want 409", w.Code)
}
// weapon is at max tier (NextTier 0): no upgrade to offer.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "upgrade", Slot: "weapon", Tier: 6}); w.Code != 400 {
t.Errorf("upgrade with no offer = %d, want 400", w.Code)
}
// boots are at full condition: nothing to repair.
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "repair", Slot: "boots"}); w.Code != 400 {
t.Errorf("repair of full-condition slot = %d, want 400", w.Code)
}
// A non-owner can't spend someone else's euros.
if w := placeEquip(t, s, "mallory", equipOrderReq{Token: "tok-josie", Action: "upgrade", Slot: "boots", Tier: 4}); w.Code != 403 {
t.Errorf("non-owner upgrade = %d, want 403", w.Code)
}
// No order should have survived any of those.
if pending, _ := storage.PendingEquipOrders(10); len(pending) != 0 {
t.Fatalf("a rejected money action still queued an order: %+v", pending)
}
}
// TestEquipPanelRenders: the owner's who page renders the Equipment panel with the
// three controls and the confirm data (balance) the money actions need.
func TestEquipPanelRenders(t *testing.T) {
s := seedEquip(t, "reala")
body := getWho(t, s, "tok-josie", "reala").Body.String()
for _, want := range []string{
"Equipment",
"Deepforged Blade",
"Take off", // the masterwork weapon is round-trippable
"Upgrade to Sturdy Boots", // the boots offer the next tier
"Repair", // the damaged weapon can be mended
"data-balance=\"100000.00\"", // the confirm dialog needs the balance
} {
if !strings.Contains(body, want) {
t.Errorf("equipment panel missing %q", want)
}
}
// The public Gear panel is suppressed for the owner (the Equipment panel
// supersedes it), so its heading must not appear on the owner render.
// A non-owner still sees the public sheet unchanged.
anon := getWho(t, s, "tok-josie", "").Body.String()
if strings.Contains(anon, "Deepforged Blade") {
t.Error("the owner-only equipment panel leaked onto the public page")
}
}
// TestEquipWireIdempotentAndAuthed: gogobee's pending/verdict pair is bearer-only,
// never nulls, and files a verdict once.
func TestEquipWireIdempotentAndAuthed(t *testing.T) {
s := seedEquip(t, "reala")
if w := placeEquip(t, s, "reala", equipOrderReq{Token: "tok-josie", Action: "equip", ItemID: 501}); w.Code != 200 {
t.Fatalf("seed order = %d", w.Code)
}
// The owner sees their own order in the "my orders" strip.
if rows := mustEquipOrders(t, s, "reala"); len(rows) != 1 {
t.Fatalf("owner sees %d orders, want 1", len(rows))
}
// No bearer → 401 on both machine endpoints.
if w := httptest.NewRecorder(); func() bool {
s.handleEquipPending(w, jsonReq(t, "GET", "/api/equip/pending", "", nil))
return w.Code == 401
}() == false {
t.Error("pending without bearer should be 401")
}
// Pending returns the order (bearer-authed), never null.
w := httptest.NewRecorder()
s.handleEquipPending(w, jsonReq(t, "GET", "/api/equip/pending", "tok", nil))
if w.Code != 200 {
t.Fatalf("pending = %d", w.Code)
}
var pending []storage.EquipOrder
if err := json.Unmarshal(w.Body.Bytes(), &pending); err != nil || len(pending) != 1 {
t.Fatalf("pending body = %s err=%v", w.Body.String(), err)
}
guid := pending[0].GUID
// A verdict resolves it; a replay is a no-op.
verdict := func(status, detail string) *httptest.ResponseRecorder {
rw := httptest.NewRecorder()
s.handleEquipVerdict(rw, jsonReq(t, "POST", "/api/equip/verdict", "tok",
equipVerdict{GUID: guid, Status: status, Detail: detail}))
return rw
}
if w := verdict("applied", "worn"); w.Code != 200 {
t.Fatalf("verdict = %d body=%s", w.Code, w.Body.String())
}
if w := verdict("rejected_not_owned", "too late"); w.Code != 200 {
t.Fatalf("replay verdict = %d", w.Code)
}
got, _ := storage.EquipOrderByGUID(guid)
if got.Status != storage.EquipApplied || got.Detail != "worn" {
t.Fatalf("replay overwrote the first verdict: %+v", got)
}
// Unknown guid parks with a 400, not a silent retry.
rw := httptest.NewRecorder()
s.handleEquipVerdict(rw, jsonReq(t, "POST", "/api/equip/verdict", "tok",
equipVerdict{GUID: "ghost", Status: "applied"}))
if rw.Code != 400 {
t.Errorf("unknown guid = %d, want 400", rw.Code)
}
}
// mustEquipOrders returns the raw "my orders" JSON rows for a user. Small helper
// so the wire test can pull the guid it just created without reaching into storage.
func mustEquipOrders(t *testing.T, s *Server, username string) []json.RawMessage {
t.Helper()
r := as(t, s, username, "GET", "/api/equip/orders", nil)
w := httptest.NewRecorder()
s.handleEquipOrders(w, r)
if w.Code != 200 {
t.Fatalf("orders = %d", w.Code)
}
var rows []json.RawMessage
if err := json.Unmarshal(w.Body.Bytes(), &rows); err != nil {
t.Fatal(err)
}
return rows
}
internal/web/games_solitaire.go
+2
View File
@@ -60,6 +60,7 @@ type solitaireView struct {
Passes int `json:"passes"` // through the stock, counting this one; -1 unlimited Passes int `json:"passes"` // through the stock, counting this one; -1 unlimited
Moves int `json:"moves"` Moves int `json:"moves"`
CanAuto bool `json:"can_auto"` CanAuto bool `json:"can_auto"`
Won bool `json:"won"` // every card face up, stock and waste empty: one press finishes it
Home int `json:"home"` // cards on the foundations Home int `json:"home"` // cards on the foundations
PerCard float64 `json:"per_card"` // what one more is worth PerCard float64 `json:"per_card"` // what one more is worth
@@ -86,6 +87,7 @@ func viewSolitaire(g klondike.State) solitaireView {
Passes: g.PassesLeft(), Passes: g.PassesLeft(),
Moves: g.Moves, Moves: g.Moves,
CanAuto: g.CanAuto(), CanAuto: g.CanAuto(),
Won: g.Won(),
Home: g.Home(), Home: g.Home(),
PerCard: g.PerCard(), PerCard: g.PerCard(),
BreakEven: g.Tier.BreakEven(), BreakEven: g.Tier.BreakEven(),
internal/web/handlers.go
+95
View File
@@ -18,6 +18,7 @@ const pageSize = 24
// StoryView is the trimmed-down record used in templates. // StoryView is the trimmed-down record used in templates.
type StoryView struct { type StoryView struct {
ID int64 ID int64
GUID string
Headline string Headline string
Lede string Lede string
ImageURL string ImageURL string
@@ -29,11 +30,14 @@ type StoryView struct {
Channel string // channel slug; also the theme key Channel string // channel slug; also the theme key
ReadMins int // estimated reading time in minutes; 0 = unknown (no chip) ReadMins int // estimated reading time in minutes; 0 = unknown (no chip)
Views int // all-time reader-mode opens; 0 = none yet (no badge) Views int // all-time reader-mode opens; 0 = none yet (no badge)
Accent string // adventure only: the event family's colour, "" for everything else
Ceremony bool // adventure only: this is a realm-first and gets the ribbon
} }
func toView(s storage.Story) StoryView { func toView(s storage.Story) StoryView {
return StoryView{ return StoryView{
ID: s.ID, ID: s.ID,
GUID: s.GUID,
Headline: s.Headline, Headline: s.Headline,
Lede: s.Lede, Lede: s.Lede,
ImageURL: s.ImageURL, ImageURL: s.ImageURL,
@@ -73,6 +77,44 @@ func decorate(groups ...[]StoryView) {
g[i].Views = views[g[i].ID] g[i].Views = views[g[i].ID]
} }
} }
decorateAdventure(groups...)
}
// decorateAdventure tints adventure cards by what they are: the event family's
// accent on the border, and the realm-first ribbon on a first-ever.
//
// The information was always there — gogobee computes the rarity of a find and
// whether a clear is the realm's first, and both were being spent on a sentence
// and then thrown away. A feed where a legendary hoard and a routine repeat look
// identical is throwing away the game's own sense of occasion.
//
// One batched read over the guids of the adventure cards only, skipped entirely
// on a page with none — which is most pages. Best-effort like the rest of
// decorate: a miss leaves the default border, not a broken card.
func decorateAdventure(groups ...[]StoryView) {
var guids []string
seen := make(map[string]bool)
for _, g := range groups {
for _, v := range g {
if v.Channel == "adventure" && v.GUID != "" && !seen[v.GUID] {
seen[v.GUID] = true
guids = append(guids, v.GUID)
}
}
}
if len(guids) == 0 {
return
}
facets := storage.AdventureEventFacets(guids)
for _, g := range groups {
for i := range g {
ev, ok := facets[g[i].GUID]
if !ok {
continue
}
g[i].Accent, g[i].Ceremony = advCardAccent(ev.EventType, ev.Tier, ev.Outcome)
}
}
} }
// readMinutes turns a character count into a rounded minutes-to-read estimate, // readMinutes turns a character count into a rounded minutes-to-read estimate,
@@ -104,6 +146,7 @@ type pageData struct {
IsAdmin bool // signed-in user is on the admin allowlist (shows /status link) IsAdmin bool // signed-in user is on the admin allowlist (shows /status link)
PushEnabled bool // Web Push is configured (shows the notifications toggle to signed-in users) PushEnabled bool // Web Push is configured (shows the notifications toggle to signed-in users)
PushPublicKey string // VAPID public key handed to the client to subscribe PushPublicKey string // VAPID public key handed to the client to subscribe
AdvEnabled bool // the adventure section is configured (shows its alert categories in settings)
TTS template.JS // JSON {enabled, default, voices:[{id,label}]} for read-aloud, or "null" TTS template.JS // JSON {enabled, default, voices:[{id,label}]} for read-aloud, or "null"
NoIndex bool // emit <meta name="robots" content="noindex"> — used by the adventure section NoIndex bool // emit <meta name="robots" content="noindex"> — used by the adventure section
OGImage string // absolute og:image URL for link unfurls (adventure emblem); "" = none OGImage string // absolute og:image URL for link unfurls (adventure emblem); "" = none
@@ -126,6 +169,17 @@ type channelPage struct {
Roster []RosterView Roster []RosterView
RosterStale bool RosterStale bool
ShowRoster bool ShowRoster bool
// Siege is the war room, summarised into a strip at the top of the section.
// Same page-1-only rule as the roster and for the same reason. It renders
// even with nothing camped, because the link to the history is the other half
// of what makes a live Siege feel like it counts.
Siege SiegeView
// Away is the signed-in owner's "while you were away" panel: what happened to
// their own adventurer since their last visit. Zero for everyone else, and
// zero for an owner who has missed nothing — see awayPanel.
Away awayView
} }
type indexPage struct { type indexPage struct {
@@ -176,6 +230,7 @@ func (s *Server) base(r *http.Request) pageData {
PostingEnabled: s.postingEnabled, PostingEnabled: s.postingEnabled,
PushEnabled: s.auth != nil && s.cfg.Push.Enabled, PushEnabled: s.auth != nil && s.cfg.Push.Enabled,
PushPublicKey: s.cfg.Push.VAPIDPublicKey, PushPublicKey: s.cfg.Push.VAPIDPublicKey,
AdvEnabled: s.adv.Enabled,
TTS: template.JS("null"), TTS: template.JS("null"),
} }
if s.tts != nil { if s.tts != nil {
@@ -353,6 +408,8 @@ func (s *Server) handleChannel(w http.ResponseWriter, r *http.Request, ch Channe
if ch.Slug == "adventure" && page == 1 { if ch.Slug == "adventure" && page == 1 {
data.Roster, data.RosterStale, _ = s.roster() data.Roster, data.RosterStale, _ = s.roster()
data.ShowRoster = true data.ShowRoster = true
data.Siege = s.siege()
data.Away = s.awayPanel(r)
} }
s.render(w, "channel", data) s.render(w, "channel", data)
} }
@@ -662,6 +719,44 @@ var funcs = template.FuncMap{
} }
return m return m
}, },
// euro formats a whole-euro price with thousands separators. The money confirm
// in the browser already does this via toLocaleString, and a button reading
// "€45000" above a dialog reading "€45,000" looks like two different prices.
"euro": func(n int) string {
s := strconv.Itoa(n)
neg := strings.HasPrefix(s, "-")
if neg {
s = s[1:]
}
for i := len(s) - 3; i > 0; i -= 3 {
s = s[:i] + "," + s[i:]
}
if neg {
s = "-" + s
}
return s
},
// untilUnix is timeAgo's mirror: how long is LEFT, for a deadline the reader
// can still act on. Rounded down deliberately — a window with 47 hours in it
// says "1 day left", which is the safe way to be wrong about a deadline.
"untilUnix": func(unix int64) string {
if unix <= 0 {
return ""
}
d := time.Until(time.Unix(unix, 0))
switch {
case d <= 0:
return "closed"
case d < time.Hour:
return "less than an hour left"
case d < 24*time.Hour:
return fmt.Sprintf("%dh left", int(d.Hours()))
case d < 48*time.Hour:
return "1 day left"
default:
return fmt.Sprintf("%d days left", int(d.Hours())/24)
}
},
"timeAgo": func(t time.Time) string { "timeAgo": func(t time.Time) string {
d := time.Since(t) d := time.Since(t)
switch { switch {
internal/web/orders.go
+370
View File
@@ -0,0 +1,370 @@
package web
import (
"encoding/json"
"errors"
"io"
"log/slog"
"net/http"
"time"
"pete/internal/storage"
)
// The action queue's web seam — the first verbs the web can play, as opposed to
// the equip queue's dressing-up.
//
// Two audiences, same shape as equip and mischief. A signed-in owner clicks
// "Pull out" on their own adventurer page or "Take your bout" on the war room;
// gogobee hits the bearer-authed pair, polling pending orders and pushing a
// verdict. Pete runs no game rule: it records that somebody asked, and renders
// what gogobee answered. The UI says "asked for" and never claims it landed.
//
// The character is resolved from the SESSION, never from the request. A session
// maps to exactly one localpart and a localpart to exactly one adventurer, so
// there is nothing for the client to name and therefore nothing to forge — the
// equip queue has to take an item id and a slot off the wire and re-resolve them;
// this one has no such surface at all.
// advOrderBurstWindow / advOrderBurstMax blunt a stuck mouse button. The real
// gates are gogobee's — one extraction ends the run, one bout per day — and the
// pending-order guard below stops the common double-click outright.
const (
advOrderBurstWindow = time.Hour
advOrderBurstMax = 30
)
// advOrderReq is the browser's request: the verb, and for the three verbs that
// take arguments, which zone / which loadout / how many days. See the file
// comment on why nothing here identifies the character.
//
// None of these fields is trusted. Each is looked up in the owner's OWN offer
// list — the one gogobee pushed onto their private self-detail row — and the
// order stores what was found there, not what was sent. So a forged zone id
// resolves to nothing and is refused before an order exists.
type advOrderReq struct {
Action string `json:"action"`
Zone string `json:"zone,omitempty"`
Loadout string `json:"loadout,omitempty"`
Days int `json:"days,omitempty"`
}
// handleAdvOrder places a pending action for the signed-in owner. It asserts what
// Pete can honestly know — the viewer is signed in, and gogobee has pushed a
// self-detail row for them, which is gogobee's own proof that this person has an
// adventurer. Everything about whether the action is legal *right now* is
// gogobee's, at verdict time; the pre-checks here only produce a better message
// than a verdict thirty seconds later would.
func (s *Server) handleAdvOrder(w http.ResponseWriter, r *http.Request) {
u := s.requireUser(w, r)
if u == nil {
return
}
owner := buyerLocalpart(u)
if owner == "" {
writeAdvOrderError(w, http.StatusConflict, "please sign in again")
return
}
var req advOrderReq
if !decodeStateBody(w, r, &req) {
return
}
switch req.Action {
case storage.AdvActionExtract, storage.AdvActionSiegeJoin,
storage.AdvActionExpedition, storage.AdvActionResume, storage.AdvActionBabysit,
storage.AdvActionAbandon, storage.AdvActionLeave, storage.AdvActionBabysitCancel:
default:
writeAdvOrderError(w, http.StatusBadRequest, "bad action")
return
}
// Ownership. The self-detail row is gogobee's own owner<->adventurer proof, the
// same join the who page's private panels and the alert sender use. No row means
// this account has no adventurer — or gogobee has stopped pushing, in which case
// an order it can't attribute is not one we should queue.
token, ok := storage.SelfToken(owner)
if !ok {
writeAdvOrderError(w, http.StatusForbidden, "no adventurer on the board for this account")
return
}
// One outstanding order per verb. Two queued extracts would apply in sequence
// and the second would answer "no expedition to leave" — a rejection for
// something that worked, which is the worst thing this strip could say.
if pending, err := storage.HasPendingAdvOrder(u.Sub, req.Action); err != nil {
slog.Error("orders: pending lookup", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
} else if pending {
writeAdvOrderError(w, http.StatusConflict, "already asked — waiting on the game box")
return
}
since := time.Now().Add(-advOrderBurstWindow).Unix()
if n, err := storage.CountAdvOrdersSince(u.Sub, since); err != nil {
slog.Error("orders: burst count", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
} else if n >= advOrderBurstMax {
writeAdvOrderError(w, http.StatusTooManyRequests, "slow down, too many requests in a short while")
return
}
// The roster lookup is for the character name the order carries; the one
// surviving pre-check below is courtesy only. Anything read here is Pete's
// snapshot copy, up to two minutes behind the game box, so it is never
// authoritative and is only allowed the last word where being two minutes late
// cannot make it wrong.
characterName := ""
entry, haveEntry, err := storage.RosterEntryByToken(token)
if err != nil {
slog.Error("orders: roster lookup", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
}
if haveEntry {
characterName = entry.Name
}
// No pre-check on extract, deliberately, and it is the same call abandon and
// leave make in resolveAdvOrderParams: the mark's status is up to two minutes
// stale here and a Matrix departure can outrun the roster push, so "reads idle"
// would refuse a run gogobee would happily have ended. The cost accepted is
// that a genuine mistake comes back as rejected_not_running rather than as an
// instant refusal, which is the honest answer anyway.
if req.Action == storage.AdvActionSiegeJoin {
// This one stays, because it is not a personal status: whether a boss is
// camped outside town is a town-wide fact on a day-or-longer clock, so a
// two-minute-old copy is almost never wrong about it. Note the known/active
// split — no snapshot at all must queue the order (a fresh deploy must not
// have a dead button); only a snapshot that positively says active=0 refuses.
active, known, err := storage.SiegeIsCamped()
if err != nil {
slog.Error("orders: siege lookup", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
}
if known && !active {
writeAdvOrderError(w, http.StatusConflict, "no Siege is camped outside town")
return
}
}
// Resolve the verb's arguments against this owner's own offers. Everything
// this returns came out of gogobee's push, so the stored order can only ever
// name a zone, a loadout and a price the game itself quoted to this player.
params, msg := resolveAdvOrderParams(owner, token, req)
if msg != "" {
writeAdvOrderError(w, http.StatusConflict, msg)
return
}
order, err := storage.InsertAdvOrder(u.Sub, owner, token, characterName, req.Action, params)
if err != nil {
slog.Error("orders: insert order", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
}
slog.Info("orders: action placed", "guid", order.GUID, "owner", owner, "action", req.Action)
w.Header().Set("Cache-Control", "no-store")
writeJSON(w, order)
}
// resolveAdvOrderParams turns the browser's arguments into the stored ones by
// looking each up in the owner's pushed offer list, and returns the reason to
// refuse when it cannot. Five of the eight verbs take no arguments and resolve to
// nil — but babysit_cancel still comes through here, because the offer row is
// the one place Pete can see that there is no sitter to dismiss.
//
// Note what W5a's "Pete has never heard about it" asymmetry does NOT need to
// become here. There is no such state to defer on: the detail row this reads is
// the same row SelfToken already found, so by the time we get here it exists.
// What a gogobee too old to push offers produces is an EMPTY offer list, and
// then the page renders no picker at all — so there is no dead button to protect
// against, only forged arguments to refuse.
func resolveAdvOrderParams(owner, token string, req advOrderReq) (*storage.AdvOrderParams, string) {
switch req.Action {
case storage.AdvActionExtract, storage.AdvActionSiegeJoin:
return nil, ""
case storage.AdvActionAbandon, storage.AdvActionLeave:
// No snapshot pre-check for either, deliberately, and it is the same call
// W5a made for extract: the board is up to two minutes stale, so the only
// thing Pete could test — "the mark reads idle" — would refuse actions the
// game would have allowed. Abandon is worse than extract in that respect,
// because an *extracted* expedition is still abandonable while its owner
// reads as standing in town. gogobee answers rejected_not_running /
// rejected_not_leader / rejected_is_leader, and the strip shows it.
return nil, ""
}
detail, haveDetail, err := storage.PlayerDetailByOwner(owner, token)
if err != nil {
slog.Error("orders: detail lookup", "err", err)
return nil, "couldn't read your adventurer just now"
}
if !haveDetail {
// Only reachable if the row went away between SelfToken and here — the
// roster push replaces the whole table. Refuse rather than guess.
return nil, "couldn't read your adventurer just now"
}
switch req.Action {
case storage.AdvActionExpedition:
if req.Zone == "" {
return nil, "pick somewhere to go first"
}
if len(detail.Zones) == 0 {
// An empty offer list usually means they are already out there, but Pete
// cannot tell that from a game box too old to push offers at all, so say
// only what was actually seen. Unreachable from the page either way — with
// no offers the picker doesn't render — so this is a hand-crafted request.
return nil, "nowhere is on offer for you right now"
}
for _, z := range detail.Zones {
if z.ID != req.Zone {
continue
}
for _, l := range z.Loadouts {
if l.Key == req.Loadout {
return &storage.AdvOrderParams{Zone: z.ID, Loadout: l.Key}, ""
}
}
return nil, "that isn't a loadout for that zone"
}
return nil, "that zone isn't open to you"
case storage.AdvActionResume:
if detail.Resume == nil {
return nil, "there's no expedition waiting for you"
}
for _, l := range detail.Resume.Loadouts {
if l.Key == req.Loadout {
return &storage.AdvOrderParams{Loadout: l.Key}, ""
}
}
return nil, "that isn't a loadout for that zone"
case storage.AdvActionBabysit:
if req.Days != 7 && req.Days != 30 {
return nil, "the sitter works by the week or by the month"
}
if detail.Babysit != nil && detail.Babysit.Active {
return nil, "a sitter is already looking after your camp"
}
return &storage.AdvOrderParams{Days: req.Days}, ""
case storage.AdvActionBabysitCancel:
// The mirror of the check above, and the one W9 verb where the snapshot
// really does contradict the request: a sitter's engagement is a fact about
// the character, not about where they are standing, so it does not go stale
// the way "on an expedition" does. A missing offer is still not a refusal —
// that is a gogobee too old to push one, not a player without a sitter.
if detail.Babysit != nil && !detail.Babysit.Active {
return nil, "there's no sitter to dismiss"
}
return nil, ""
}
return nil, "bad action"
}
// handleAdvOrders returns the signed-in owner's own recent actions for the status
// strip, newest first. Scoped to their OIDC subject.
func (s *Server) handleAdvOrders(w http.ResponseWriter, r *http.Request) {
u := s.requireUser(w, r)
if u == nil {
return
}
orders, err := storage.AdvOrdersByOwner(u.Sub, 10)
if err != nil {
slog.Error("orders: by owner", "err", err)
writeAdvOrderError(w, http.StatusInternalServerError, "internal error")
return
}
if orders == nil {
orders = []storage.AdvOrder{}
}
w.Header().Set("Cache-Control", "no-store")
writeJSON(w, orders)
}
// ---- the gogobee wire: bearer-authed, idempotent -------------------------------
// advOrderPollLimit caps one poll, matching the equip and mischief seams.
const advOrderPollLimit = 50
// handleAdvOrdersPending is gogobee's poll: every action still waiting. Like the
// seams beside it there is no stale-reoffer window — a gogobee that dies mid-apply
// leaves the order pending to be offered again, and its guid ledger makes the
// replay a no-op.
func (s *Server) handleAdvOrdersPending(w http.ResponseWriter, r *http.Request) {
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
orders, err := storage.PendingAdvOrders(advOrderPollLimit)
if err != nil {
slog.Error("orders: pending", "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
if orders == nil {
orders = []storage.AdvOrder{}
}
writeJSON(w, orders)
}
// advOrderVerdict is gogobee's answer on an order: the terminal status and a
// human note to render.
type advOrderVerdict struct {
GUID string `json:"guid"`
Status string `json:"status"`
Detail string `json:"detail,omitempty"`
}
// handleAdvOrderVerdict files gogobee's verdict against a pending order.
// Idempotent: gogobee's poll loop retries, so the same verdict can arrive more
// than once and only the first moves the order. An unknown guid is a 400 — under
// this seam's contract that parks the row for a human rather than retrying
// forever against a row that will never exist.
func (s *Server) handleAdvOrderVerdict(w http.ResponseWriter, r *http.Request) {
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
var v advOrderVerdict
if err := json.NewDecoder(io.LimitReader(r.Body, 1<<14)).Decode(&v); err != nil {
http.Error(w, "bad json", http.StatusBadRequest)
return
}
if v.GUID == "" {
http.Error(w, "guid is required", http.StatusBadRequest)
return
}
order, err := storage.ResolveAdvOrder(v.GUID, v.Status, v.Detail)
if errors.Is(err, storage.ErrNoSuchAdvOrder) {
slog.Error("orders: verdict for an order we've never heard of", "guid", v.GUID, "status", v.Status)
http.Error(w, "no such order", http.StatusBadRequest)
return
}
if errors.Is(err, storage.ErrBadAdvVerdict) {
slog.Error("orders: verdict outside the terminal set", "guid", v.GUID, "status", v.Status)
http.Error(w, "bad verdict", http.StatusBadRequest)
return
}
if err != nil {
// A storage failure, not a bad request. 400 here would park a perfectly
// resolvable order forever on a transient database error; 500 gets it
// retried on gogobee's next poll.
slog.Error("orders: resolve", "guid", v.GUID, "status", v.Status, "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
slog.Info("orders: action resolved", "guid", order.GUID, "action", order.Action, "status", order.Status)
writeJSON(w, order)
}
func writeAdvOrderError(w http.ResponseWriter, code int, msg string) {
w.Header().Set("Content-Type", "application/json; charset=utf-8")
w.WriteHeader(code)
_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
}
internal/web/orders_test.go
+428
View File
@@ -0,0 +1,428 @@
package web
import (
"bytes"
"encoding/json"
"net/http/httptest"
"strings"
"testing"
"time"
"pete/internal/storage"
)
// W5: the action queue's web seam. Two contracts, same shape as the equip queue's
// tests — the owner half must be unable to act for anybody but itself, and the
// gogobee half is a bearer-authed, idempotent pending/verdict pair.
// seedActions stands up a board and a private detail row owned by `owner`, which
// together are gogobee's proof that this account has an adventurer. `status` is
// the roster status the mark carries ("expedition" or "idle"), because the
// extract pre-check reads it.
func seedActions(t *testing.T, owner, status string) *Server {
t.Helper()
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
now := time.Now().Unix()
e := entry("tok-josie", "Josie", status, "holymachina")
if w := postRoster(t, s, "tok", rosterPush{SnapshotAt: now, Adventurers: []storage.RosterEntry{e}}); w.Code != 200 {
t.Fatalf("seed roster = %d", w.Code)
}
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
Localpart: owner, Token: "tok-josie",
}}}); w.Code != 200 {
t.Fatalf("seed detail = %d", w.Code)
}
return s
}
func placeAction(t *testing.T, s *Server, username, action string) *httptest.ResponseRecorder {
t.Helper()
r := as(t, s, username, "POST", "/api/adventure/order", advOrderReq{Action: action})
w := httptest.NewRecorder()
s.handleAdvOrder(w, r)
return w
}
// TestActionOrderNamesNoCharacter is the reason this seam has a smaller attack
// surface than the equip queue's: nothing in the request identifies an
// adventurer, so there is no id to forge. The order that lands must be attributed
// to the session's own localpart and its own token, whatever the body said.
func TestActionOrderNamesNoCharacter(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
// A body carrying extra fields — a token, a localpart — must change nothing:
// the handler reads only Action off it.
r := as(t, s, "holymachina", "POST", "/api/adventure/order", map[string]any{
"action": "extract", "token": "tok-somebody-else", "owner_localpart": "someone",
})
w := httptest.NewRecorder()
s.handleAdvOrder(w, r)
if w.Code != 200 {
t.Fatalf("order = %d (%s)", w.Code, w.Body.String())
}
var got storage.AdvOrder
if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
t.Fatalf("decode: %v", err)
}
if got.OwnerLocalpart != "holymachina" {
t.Fatalf("owner = %q, want the session's localpart", got.OwnerLocalpart)
}
if got.Token != "tok-josie" {
t.Fatalf("token = %q, want the token resolved from the session, not the body", got.Token)
}
if got.Status != storage.AdvOrderPending {
t.Fatalf("status = %q, want pending — Pete never claims an action landed", got.Status)
}
}
// TestActionOrderNeedsAnAdventurer: a signed-in visitor with no self-detail row
// has no adventurer for gogobee to act on. Queuing the order anyway would file
// something gogobee can only answer with a rejection.
func TestActionOrderNeedsAnAdventurer(t *testing.T) {
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
if w := placeAction(t, s, "stranger", "extract"); w.Code != 403 {
t.Fatalf("order without an adventurer = %d, want 403", w.Code)
}
}
// TestOnlyOneOutstandingOrderPerVerb. Two queued extracts apply in sequence and
// the second answers "you weren't on an expedition" — a rejection for something
// that worked, which is the worst thing the strip could say. The guard is per
// verb, so a pending extract must not block a Siege bout.
func TestOnlyOneOutstandingOrderPerVerb(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
postSiege(t, s, "tok", liveSiege(time.Now().Unix(), 800))
if w := placeAction(t, s, "holymachina", "extract"); w.Code != 200 {
t.Fatalf("first extract = %d (%s)", w.Code, w.Body.String())
}
w := placeAction(t, s, "holymachina", "extract")
if w.Code != 409 {
t.Fatalf("second extract = %d, want 409", w.Code)
}
if w := placeAction(t, s, "holymachina", "siege_join"); w.Code != 200 {
t.Fatalf("bout blocked by a pending extract = %d (%s); the guard is per verb", w.Code, w.Body.String())
}
}
// TestOnlyTownWideFactsArePreChecked. Pete's copy of the board is up to two
// minutes behind the game box, so what it may refuse locally turns on whether
// being two minutes late could make the answer wrong. A personal status can:
// somebody who set out over Matrix still reads as idle here, and refusing their
// extract would deny a run gogobee would have ended. A boss camped outside town
// cannot: that is town-wide and runs on a day-or-longer clock.
func TestOnlyTownWideFactsArePreChecked(t *testing.T) {
// Idle mark: extract goes through anyway, and rejected_not_running is the
// answer if the mark really was standing in town.
s := seedActions(t, "holymachina", "idle")
if w := placeAction(t, s, "holymachina", "extract"); w.Code != 200 {
t.Fatalf("extract while idle = %d, want it queued (%s)", w.Code, w.Body.String())
}
// No Siege pushed at all: unknown, not "inactive". Pete has never heard from
// gogobee about a boss, and refusing on that would make the button dead on a
// fresh deploy. It must go through and let gogobee answer.
if w := placeAction(t, s, "holymachina", "siege_join"); w.Code != 200 {
t.Fatalf("bout with no siege snapshot at all = %d, want it queued", w.Code)
}
// A snapshot that positively says no boss is camped: refuse.
s2 := seedActions(t, "holymachina", "idle")
now := time.Now().Unix()
postSiege(t, s2, "tok", siegePush{SnapshotAt: now, Siege: storage.Siege{Active: false}})
if w := placeAction(t, s2, "holymachina", "siege_join"); w.Code != 409 {
t.Fatalf("bout with no boss camped = %d, want 409", w.Code)
}
}
func TestActionOrderRejectsAnUnknownVerb(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
if w := placeAction(t, s, "holymachina", "sell_house"); w.Code != 400 {
t.Fatalf("unknown action = %d, want 400", w.Code)
}
}
// TestActionOrdersAreScopedToTheirOwner: the strip is read back by OIDC subject.
// `as` signs every session as sub-1, so this drives the storage layer directly to
// prove the scoping rather than pretending two sessions exist.
func TestActionOrdersAreScopedToTheirOwner(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
if w := placeAction(t, s, "holymachina", "extract"); w.Code != 200 {
t.Fatalf("place = %d", w.Code)
}
if _, err := storage.InsertAdvOrder("sub-2", "someone", "tok-other", "Other", storage.AdvActionExtract, nil); err != nil {
t.Fatalf("insert other: %v", err)
}
r := as(t, s, "holymachina", "GET", "/api/adventure/orders", nil)
w := httptest.NewRecorder()
s.handleAdvOrders(w, r)
var got []storage.AdvOrder
if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
t.Fatalf("decode: %v", err)
}
if len(got) != 1 || got[0].OwnerLocalpart != "holymachina" {
t.Fatalf("orders = %+v, want only the signed-in owner's", got)
}
}
// TestActionVerdictIsIdempotent: gogobee's poll loop retries, so the same verdict
// arrives more than once and only the first may move the order. A second verdict
// overwriting the first would let a re-offer's "no expedition to leave" replace
// the "done" that was true.
func TestActionVerdictIsIdempotent(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
w := placeAction(t, s, "holymachina", "extract")
var order storage.AdvOrder
_ = json.Unmarshal(w.Body.Bytes(), &order)
first := postVerdict(t, s, "tok", advOrderVerdict{
GUID: order.GUID, Status: storage.AdvOrderApplied, Detail: "Out on day 3.",
})
if first.Code != 200 {
t.Fatalf("verdict = %d (%s)", first.Code, first.Body.String())
}
second := postVerdict(t, s, "tok", advOrderVerdict{
GUID: order.GUID, Status: storage.AdvRejectedNotRunning, Detail: "no run",
})
if second.Code != 200 {
t.Fatalf("retried verdict = %d, want a quiet 200", second.Code)
}
got, err := storage.AdvOrderByGUID(order.GUID)
if err != nil {
t.Fatalf("read back: %v", err)
}
if got.Status != storage.AdvOrderApplied || !strings.Contains(got.Detail, "day 3") {
t.Fatalf("order = %q/%q, want the first verdict to stand", got.Status, got.Detail)
}
}
// TestActionWireNeedsTheBearerToken: the poll and the verdict are gogobee's, and
// the pending list names every player who has asked for something.
func TestActionWireNeedsTheBearerToken(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
placeAction(t, s, "holymachina", "extract")
req := httptest.NewRequest("GET", "/api/adventure/orders/pending", nil)
w := httptest.NewRecorder()
s.handleAdvOrdersPending(w, req)
if w.Code != 401 {
t.Fatalf("unauthed poll = %d, want 401", w.Code)
}
req = httptest.NewRequest("GET", "/api/adventure/orders/pending", nil)
req.Header.Set("Authorization", "Bearer tok")
w = httptest.NewRecorder()
s.handleAdvOrdersPending(w, req)
if w.Code != 200 {
t.Fatalf("authed poll = %d", w.Code)
}
var pending []storage.AdvOrder
if err := json.Unmarshal(w.Body.Bytes(), &pending); err != nil {
t.Fatalf("decode: %v", err)
}
if len(pending) != 1 || pending[0].Action != storage.AdvActionExtract {
t.Fatalf("pending = %+v, want the one queued extract", pending)
}
}
// TestVerdictForAnUnknownOrderIs400: under this seam's contract that parks the
// row for a human rather than retrying forever against a row that can never
// exist.
func TestVerdictForAnUnknownOrderIs400(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
if w := postVerdict(t, s, "tok", advOrderVerdict{GUID: "nope", Status: storage.AdvOrderApplied}); w.Code != 400 {
t.Fatalf("verdict for an unknown guid = %d, want 400", w.Code)
}
}
func postVerdict(t *testing.T, s *Server, token string, v advOrderVerdict) *httptest.ResponseRecorder {
t.Helper()
body, _ := json.Marshal(v)
req := httptest.NewRequest("POST", "/api/adventure/orders/verdict", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
w := httptest.NewRecorder()
s.handleAdvOrderVerdict(w, req)
return w
}
// ── W5b: the three verbs that take arguments ─────────────────────────────────
// seedOffers is seedActions with an offer list on the private detail row — which
// is what gogobee pushes, and what every W5b param is resolved against.
func seedOffers(t *testing.T, owner, status string, pd storage.PlayerDetail) *Server {
t.Helper()
s, _ := newAdvServer(t, "tok")
s.auth = &Authenticator{secret: []byte("test-secret-key-at-least-16")}
now := time.Now().Unix()
e := entry("tok-josie", "Josie", status, owner)
if w := postRoster(t, s, "tok", rosterPush{SnapshotAt: now, Adventurers: []storage.RosterEntry{e}}); w.Code != 200 {
t.Fatalf("seed roster = %d", w.Code)
}
pd.Localpart = owner
pd.Token = "tok-josie"
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{pd}}); w.Code != 200 {
t.Fatalf("seed detail = %d", w.Code)
}
return s
}
func offeredZones() []storage.ZoneOffer {
return []storage.ZoneOffer{{
ID: "goblin_warrens", Display: "Goblin Warrens", Tier: 1,
Loadouts: []storage.LoadoutOffer{
{Key: "lean", Name: "lean", Cost: 40, Days: 3},
{Key: "balanced", Name: "balanced", Cost: 80, Days: 5},
},
}}
}
func placeParams(t *testing.T, s *Server, username string, req advOrderReq) *httptest.ResponseRecorder {
t.Helper()
r := as(t, s, username, "POST", "/api/adventure/order", req)
w := httptest.NewRecorder()
s.handleAdvOrder(w, r)
return w
}
// The whole point of resolving params against the owner's own offer list: a
// forged zone, or a loadout that zone does not sell, must never reach an order
// row. gogobee would refuse them anyway — this is the cheap answer, thirty
// seconds earlier, and it keeps the queue clean.
func TestExpeditionParamsAreResolvedAgainstTheOwnersOffers(t *testing.T) {
s := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{Zones: offeredZones()})
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionExpedition, Zone: "dragons_lair", Loadout: "lean",
}); w.Code != 409 {
t.Fatalf("forged zone = %d, want 409 (%s)", w.Code, w.Body.String())
}
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionExpedition, Zone: "goblin_warrens", Loadout: "enormous",
}); w.Code != 409 {
t.Fatalf("forged loadout = %d, want 409 (%s)", w.Code, w.Body.String())
}
w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionExpedition, Zone: "goblin_warrens", Loadout: "balanced",
})
if w.Code != 200 {
t.Fatalf("offered zone = %d, want 200 (%s)", w.Code, w.Body.String())
}
var got storage.AdvOrder
if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
t.Fatalf("decode: %v", err)
}
if got.Params == nil || got.Params.Zone != "goblin_warrens" || got.Params.Loadout != "balanced" {
t.Fatalf("params = %+v, want the resolved zone and loadout", got.Params)
}
// And they survive the round trip to gogobee's poll, which is the only reason
// they are stored at all.
pending, err := storage.PendingAdvOrders(10)
if err != nil {
t.Fatalf("pending: %v", err)
}
if len(pending) != 1 || pending[0].Params == nil || pending[0].Params.Zone != "goblin_warrens" {
t.Fatalf("pending params lost in the round trip: %+v", pending)
}
}
// An empty zone list is a refusal, and the message says only what Pete saw. It
// usually means the adventurer is already out — gogobee omits the offers
// entirely while they are down there — but a game box too old to push offers
// sends the same empty list, so the copy claims nothing about which. Refusing
// cheaply here beats a verdict thirty seconds later saying the same thing.
func TestNoZoneOffersMeansNothingOnOffer(t *testing.T) {
s := seedOffers(t, "holymachina", "expedition", storage.PlayerDetail{})
w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionExpedition, Zone: "goblin_warrens", Loadout: "lean",
})
if w.Code != 409 {
t.Fatalf("departure with no offers = %d, want 409 (%s)", w.Code, w.Body.String())
}
}
// The sitter sells two durations and nothing else, and is not sold twice.
func TestBabysitParamsAreTheTwoDurationsOnly(t *testing.T) {
s := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{
Babysit: &storage.BabysitOffer{WeekCost: 700, MonthCost: 3000},
})
for _, days := range []int{0, 3, 365} {
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionBabysit, Days: days,
}); w.Code != 409 {
t.Fatalf("%d-day sitter = %d, want 409", days, w.Code)
}
}
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionBabysit, Days: 30,
}); w.Code != 200 {
t.Fatalf("month = %d, want 200 (%s)", w.Code, w.Body.String())
}
// Already engaged: the page should not be offering this at all, but a stale
// tab can still post it.
s2 := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{
Babysit: &storage.BabysitOffer{Active: true, WeekCost: 700, MonthCost: 3000},
})
if w := placeParams(t, s2, "holymachina", advOrderReq{
Action: storage.AdvActionBabysit, Days: 7,
}); w.Code != 409 {
t.Fatalf("second sitter = %d, want 409", w.Code)
}
}
// Resume is refused when the snapshot positively says there is nothing waiting,
// and accepted with a loadout the offer actually lists.
func TestResumeParamsNeedAnOfferedLoadout(t *testing.T) {
s := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{})
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionResume, Loadout: "lean",
}); w.Code != 409 {
t.Fatalf("resume with nothing waiting = %d, want 409", w.Code)
}
s2 := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{
Resume: &storage.ResumeOffer{ZoneID: "goblin_warrens", Display: "Goblin Warrens", Day: 3,
Loadouts: []storage.LoadoutOffer{{Key: "lean", Name: "lean", Cost: 40, Days: 3}}},
})
if w := placeParams(t, s2, "holymachina", advOrderReq{
Action: storage.AdvActionResume, Loadout: "heavy",
}); w.Code != 409 {
t.Fatalf("unoffered loadout = %d, want 409", w.Code)
}
if w := placeParams(t, s2, "holymachina", advOrderReq{
Action: storage.AdvActionResume, Loadout: "lean",
}); w.Code != 200 {
t.Fatalf("offered loadout = %d, want 200 (%s)", w.Code, w.Body.String())
}
}
// The offer list is the whole gate, so it is worth pinning that an empty one is
// a refusal rather than a pass-through: gogobee omits the zones while the
// adventurer is out, and a pass-through there would queue a departure that is
// certain to come back "you're already on expedition".
//
// There is deliberately no "Pete has never heard of this player" case to test:
// the detail row this resolves against is the same row the ownership check
// already found, so it always exists by then. A gogobee too old to push offers
// yields an empty list and the page renders no picker at all.
func TestParamsResolveOnlyAgainstAPushedOffer(t *testing.T) {
s := seedOffers(t, "holymachina", "idle", storage.PlayerDetail{Zones: offeredZones()})
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionExpedition, Zone: "goblin_warrens", Loadout: "lean",
}); w.Code != 200 {
t.Fatalf("offered zone = %d, want 200 (%s)", w.Code, w.Body.String())
}
// Resume is not on offer for this player at all, so it is refused even though
// the loadout key is a real one from the zone list above.
if w := placeParams(t, s, "holymachina", advOrderReq{
Action: storage.AdvActionResume, Loadout: "lean",
}); w.Code != 409 {
t.Fatalf("resume with no offer = %d, want 409", w.Code)
}
}
internal/web/orders_undo_test.go
+269
View File
@@ -0,0 +1,269 @@
package web
import (
"testing"
"time"
"pete/internal/storage"
)
// W9: the three verbs that undo something. Two halves are worth pinning.
//
// The first is offersToUndo, which is the only place on this site where Pete
// decides what a player MAY do from facts rather than from a list gogobee handed
// it. Getting it wrong in the generous direction puts "Call the whole thing off"
// — a button that throws away four people's day — in front of somebody who is not
// the leader, so the interesting cases are the ones where it must stay quiet.
//
// The second is that the two new verdict names round-trip. gogobee 400s on an
// unknown verdict and parks the order, so a name that exists on one side and not
// the other is a player watching "asked for…" forever.
func seat(kind, name, token string, level int) partySeat {
return partySeat{Kind: kind, Name: name, Token: token, Level: level}
}
// TestOffersToUndoReadsTheViewersOwnSeat is the core of the phase. A shared
// expedition publishes a seat per body, so which button this page offers is
// decided by finding the viewer among them — never by "there is a party, so
// somebody can abandon it".
func TestOffersToUndoReadsTheViewersOwnSeat(t *testing.T) {
party := []partySeat{
seat("leader", "Josie", "tok-josie", 14),
seat("member", "Camcast", "tok-cam", 11),
seat("companion", "Pete", "", 9),
}
cases := []struct {
name string
token, status string
partyKnown bool
party []partySeat
self storage.PlayerDetail
abandon, leave, cancel bool
}{
{
name: "leader of a party is offered the abandon",
token: "tok-josie", status: "expedition", partyKnown: true, party: party,
abandon: true,
},
{
name: "member of a party is offered the exit, never the abandon",
token: "tok-cam", status: "expedition", partyKnown: true, party: party,
leave: true,
},
{
// A solo run publishes no party at all (partySeatViews returns nil below
// two seats), so an empty list on a live run means "nobody else", not
// "we don't know" — and the one body down there is the leader.
name: "solo run is offered the abandon",
token: "tok-josie", status: "expedition", partyKnown: true,
abandon: true,
},
{
// The fail-closed case. A party we cannot find ourselves in is a
// snapshot we do not understand, and the safe answer is to offer
// nothing rather than guess which of the two buttons applies.
name: "a party with no seat for the viewer offers nothing",
token: "tok-nobody", status: "expedition", partyKnown: true, party: party,
},
{
// The one that came out of running it. An undecodable public sheet
// gives the same empty slice as a solo run, and treating the two alike
// offered a party MEMBER the abandon — convincingly, with the rest of
// the page looking fine.
name: "a run whose sheet did not decode offers nothing",
token: "tok-cam", status: "expedition", partyKnown: false,
},
{
// The same empty slice again, this time from a gogobee too old to push
// seats at all. It decodes fine, so only the sender's own flag tells it
// apart from the solo case two rows up.
name: "an empty party from a sender that never pushes seats offers nothing",
token: "tok-cam", status: "expedition", partyKnown: false, party: nil,
},
{
// The asymmetry: the seat list is self-evidencing, so it keeps working
// against a sender whose capability we cannot confirm. A seat saying
// "member" is not a guess, and refusing the exit here would strand
// somebody in a party for the length of the rollout.
name: "a seated member is offered the exit even without the flag",
token: "tok-cam", status: "expedition", partyKnown: false, party: party,
leave: true,
},
{
name: "standing in town with nothing open offers nothing",
token: "tok-josie", status: "idle", partyKnown: true, party: nil,
},
{
// The case the roster status cannot see: an extracted expedition is
// still its owner's to close, and its owner reads as idle in town with
// no party. The resume offer is the only sign the run is still open.
name: "an extracted run is abandonable from town",
token: "tok-josie", status: "idle",
self: storage.PlayerDetail{Resume: &storage.ResumeOffer{ZoneID: "holymachina", Day: 3}},
abandon: true,
},
{
name: "an engaged sitter can be sent home",
token: "tok-josie", status: "idle",
self: storage.PlayerDetail{Babysit: &storage.BabysitOffer{Active: true}},
cancel: true,
},
{
name: "an unengaged sitter cannot",
token: "tok-josie", status: "idle",
self: storage.PlayerDetail{Babysit: &storage.BabysitOffer{Active: false, WeekCost: 700}},
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
abandon, leave, cancel := offersToUndo(tc.token, tc.status, tc.partyKnown, tc.party, tc.self)
if abandon != tc.abandon || leave != tc.leave || cancel != tc.cancel {
t.Fatalf("offers = abandon:%v leave:%v cancel:%v, want abandon:%v leave:%v cancel:%v",
abandon, leave, cancel, tc.abandon, tc.leave, tc.cancel)
}
})
}
}
// TestAbandonAndLeaveAreNeverBothOffered. They are opposite claims about the
// same person, and a page showing both would be asking the reader to work out
// which one they are. No input may produce the pair.
//
// This test found a real one: a member seated in somebody else's live run who
// ALSO has their own extracted run waiting has both facts true at once, about two
// different expeditions. offersToUndo suppresses the abandon in that case; see
// the comment on the Resume clause.
func TestAbandonAndLeaveAreNeverBothOffered(t *testing.T) {
for _, kind := range []string{"leader", "member", "companion", "", "nonsense"} {
party := []partySeat{seat("leader", "Josie", "tok-josie", 14), seat(kind, "Me", "tok-me", 8)}
for _, status := range []string{"expedition", "idle"} {
for _, resume := range []*storage.ResumeOffer{nil, {ZoneID: "z", Day: 2}} {
abandon, leave, _ := offersToUndo("tok-me", status, true, party, storage.PlayerDetail{Resume: resume})
if abandon && leave {
t.Fatalf("kind=%q status=%q resume=%v offered both ways out at once", kind, status, resume != nil)
}
}
}
}
}
// TestUndoOrdersAreAccepted: the three verbs must survive the action allow-list
// and land as pending orders. A verb Pete does not know is a 400 at the door,
// which is a dead button rather than a refusal anybody can read.
func TestUndoOrdersAreAccepted(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
for _, action := range []string{storage.AdvActionAbandon, storage.AdvActionLeave} {
if w := placeAction(t, s, "holymachina", action); w.Code != 200 {
t.Fatalf("%s = %d (%s)", action, w.Code, w.Body.String())
}
}
// Per verb, so the two do not block each other or anything already queued.
pending, err := storage.PendingAdvOrders(0)
if err != nil {
t.Fatalf("pending: %v", err)
}
if len(pending) != 2 {
t.Fatalf("pending = %d orders, want 2", len(pending))
}
}
// TestAbandonIsOfferedToAMarkStandingInTown is W5a's asymmetry restated for the
// two expedition verbs, and it is the reason neither has a snapshot pre-check.
// The board is up to two minutes stale, and an EXTRACTED run is abandonable
// while its owner reads as idle — so refusing on "the mark is in town" would
// refuse the case the verb exists for. gogobee answers rejected_not_running if
// the run really has gone.
func TestAbandonIsOfferedToAMarkStandingInTown(t *testing.T) {
s := seedActions(t, "holymachina", "idle")
if w := placeAction(t, s, "holymachina", storage.AdvActionAbandon); w.Code != 200 {
t.Fatalf("abandon from town = %d (%s), want it queued and answered by the game box",
w.Code, w.Body.String())
}
if w := placeAction(t, s, "holymachina", storage.AdvActionLeave); w.Code != 200 {
t.Fatalf("leave from town = %d (%s)", w.Code, w.Body.String())
}
}
// TestBabysitCancelRefusesWhenThereIsNoSitter is the one W9 pre-check that IS
// allowed to be the last word locally, and the comment in resolveAdvOrderParams
// says why: an engagement is a fact about the character rather than about where
// they are standing, so it does not go stale the way "on an expedition" does.
//
// A MISSING offer is still not a refusal — that is a gogobee too old to push one,
// not a player without a sitter — and the second half here pins that.
func TestBabysitCancelRefusesWhenThereIsNoSitter(t *testing.T) {
s := seedActions(t, "holymachina", "idle")
now := time.Now().Unix()
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
Localpart: "holymachina", Token: "tok-josie",
Babysit: &storage.BabysitOffer{Active: false, WeekCost: 700, MonthCost: 2400},
}}}); w.Code != 200 {
t.Fatalf("detail push = %d", w.Code)
}
if w := placeAction(t, s, "holymachina", storage.AdvActionBabysitCancel); w.Code != 409 {
t.Fatalf("cancel with no sitter = %d, want 409", w.Code)
}
// Sitter engaged: allowed.
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
Localpart: "holymachina", Token: "tok-josie",
Babysit: &storage.BabysitOffer{Active: true, WeekCost: 700, MonthCost: 2400},
}}}); w.Code != 200 {
t.Fatalf("detail push = %d", w.Code)
}
if w := placeAction(t, s, "holymachina", storage.AdvActionBabysitCancel); w.Code != 200 {
t.Fatalf("cancel with a sitter = %d (%s)", w.Code, w.Body.String())
}
// No babysit offer at all: a gogobee that predates the offer push. Queue it
// and let the game box answer, rather than making the button dead.
if w := postDetail(t, s, "tok", detailPush{SnapshotAt: now, Players: []storage.PlayerDetail{{
Localpart: "holymachina", Token: "tok-josie",
}}}); w.Code != 200 {
t.Fatalf("detail push = %d", w.Code)
}
storage.Get().Exec(`DELETE FROM adventure_orders`)
if w := placeAction(t, s, "holymachina", storage.AdvActionBabysitCancel); w.Code != 200 {
t.Fatalf("cancel with no offer pushed = %d (%s), want it deferred to gogobee",
w.Code, w.Body.String())
}
}
// TestNewVerdictsRoundTrip: gogobee 400s on a verdict Pete will not take, and
// that parks the order — the player watches "asked for…" and nothing ever
// answers. So every status the game box can file has to be accepted here.
func TestNewVerdictsRoundTrip(t *testing.T) {
s := seedActions(t, "holymachina", "expedition")
for _, tc := range []struct{ action, verdict string }{
{storage.AdvActionLeave, storage.AdvRejectedIsLeader},
{storage.AdvActionBabysitCancel, storage.AdvRejectedNothingToCancel},
{storage.AdvActionAbandon, storage.AdvRejectedNotLeader},
} {
storage.Get().Exec(`DELETE FROM adventure_orders`)
w := placeAction(t, s, "holymachina", tc.action)
if w.Code != 200 {
t.Fatalf("place %s = %d (%s)", tc.action, w.Code, w.Body.String())
}
pending, err := storage.PendingAdvOrders(0)
if err != nil || len(pending) != 1 {
t.Fatalf("pending = %v (%v)", pending, err)
}
rec := postVerdict(t, s, "tok", advOrderVerdict{
GUID: pending[0].GUID, Status: tc.verdict, Detail: "because.",
})
if rec.Code != 200 {
t.Fatalf("verdict %s = %d (%s) — an unknown status parks the order forever",
tc.verdict, rec.Code, rec.Body.String())
}
got, err := storage.AdvOrderByGUID(pending[0].GUID)
if err != nil {
t.Fatalf("read back: %v", err)
}
if got.Status != tc.verdict {
t.Fatalf("stored status = %q, want %q", got.Status, tc.verdict)
}
}
}
internal/web/push_adventure.go
+424
View File
@@ -0,0 +1,424 @@
package web
import (
"context"
"encoding/json"
"fmt"
"log/slog"
"net/url"
"strings"
"time"
"pete/internal/storage"
)
// Adventure alerts: the only channel that reaches a player who isn't looking at
// the site or at Matrix.
//
// This rides entirely on facts gogobee is already sending. Every trigger below
// is a dispatch that already lands in adventure_events, so the whole phase is
// Pete-side and no new wire, event type or deploy ordering is involved.
//
// Two things separate it from the news digest it sits beside:
//
// - Its own clock. A digest is a summary and six hours late is fine; "the
// Siege has begun" six hours late is worse than silence, because the bout
// the alert is asking for may already be over.
// - Its own watermark (last_adv_notified_at). Sharing the digest's column
// would let each sender consume the other's backlog.
// advAlertInterval matches the roster tick that delivers the facts. Checking
// faster than they can arrive only burns queries.
const advAlertInterval = 2 * time.Minute
// advAlertScan caps how many dispatches one pass inspects. Generously above the
// realm's real rate (a busy day is tens of dispatches, not hundreds), so hitting
// it means something is wrong rather than something is busy — see the warning in
// sendAdventureAlerts.
const advAlertScan = 200
// advPrefsKey is where the client stores the per-category opt-ins, alongside the
// other synced preferences. Its value is a JSON object of {category: true}.
const advPrefsKey = "pete.advPush.v1"
// The alert categories. Every one is opt-in and defaults OFF: a user who turned
// on notifications did so for news, and quietly enrolling them in game alerts
// they never asked for is how a notification permission gets revoked for good.
//
// advCatSiege is realm-wide — it needs no ownership and reaches everyone who
// asked for it. The other three are owner-scoped and reach exactly one person.
const (
advCatSiege = "siege"
advCatRun = "run"
advCatDeparture = "departure"
advCatContract = "contract"
)
// advAlert is one notification a pass has decided to send.
type advAlert struct {
Category string
Title string
Body string
URL string
}
// StartAdventureAlerts launches the alert loop when push and the adventure
// section are both configured. Safe to call unconditionally.
func (s *Server) StartAdventureAlerts(ctx context.Context) {
if !s.cfg.Push.Enabled || s.auth == nil || !s.adv.Enabled {
return
}
go s.runAdventureAlerts(ctx)
}
func (s *Server) runAdventureAlerts(ctx context.Context) {
slog.Info("web: adventure alert sender started", "interval", advAlertInterval)
ticker := time.NewTicker(advAlertInterval)
defer ticker.Stop()
for {
select {
case <-ctx.Done():
return
case <-ticker.C:
s.sendAdventureAlerts()
}
}
}
// sendAdventureAlerts runs one pass: read the dispatches nobody has been told
// about yet, and for each subscription decide whether any of them is that
// person's business.
func (s *Server) sendAdventureAlerts() {
subs, err := storage.ListPushSubscriptions()
if err != nil {
slog.Error("adv-push: list subscriptions failed", "err", err)
return
}
if len(subs) == 0 {
return
}
now := time.Now().Unix()
// A row written before adventure alerts existed carries watermark 0, which
// read literally means "has never been told about anything" and would page the
// subscriber for the entire history of the realm on the first tick after
// deploy. Stamp those to now and let them start from the next dispatch. This
// is the deploy-safety valve for the whole phase.
live := subs[:0]
for _, sub := range subs {
if sub.LastAdvNotifiedAt == 0 {
if err := storage.TouchAdvPushSubscription(sub.Endpoint, now); err != nil {
slog.Error("adv-push: seed watermark failed", "sub", sub.UserSub, "err", err)
}
continue
}
live = append(live, sub)
}
if len(live) == 0 {
return
}
// One scan serves every subscriber: read from the oldest watermark in the set
// and let each row be filtered per subscription below.
oldest := live[0].LastAdvNotifiedAt
for _, sub := range live {
if sub.LastAdvNotifiedAt < oldest {
oldest = sub.LastAdvNotifiedAt
}
}
events, err := storage.AdvEventsSince(oldest, advAlertScan)
if err != nil {
slog.Error("adv-push: scan dispatches failed", "err", err)
return
}
if len(events) == 0 {
return
}
if len(events) == advAlertScan {
// The scan was capped, so dispatches older than the window exist and are
// about to be skipped by the watermark advance below. Alerts are
// time-sensitive enough that dropping the tail is right; being quiet about
// it is not.
slog.Warn("adv-push: scan hit its cap; older dispatches skipped",
"cap", advAlertScan, "since", oldest)
}
// events[0] is the newest in the window (occurred_at DESC) and is where every
// watermark lands this pass, sent or not.
newest := events[0].OccurredAt
// Both lookups are per-user, and a user can hold several endpoints (phone,
// desktop). Cache within the pass so a two-device user costs one prefs parse
// and one ownership join rather than two.
catsByUser := make(map[string]map[string]bool)
nameByLocalpart := make(map[string]string)
sent, pruned := 0, 0
for _, sub := range live {
cats, ok := catsByUser[sub.UserSub]
if !ok {
cats = advCategoriesFor(sub.UserSub)
catsByUser[sub.UserSub] = cats
}
if len(cats) == 0 {
// Nothing enabled. Still advance, so turning a category on later starts
// from that moment rather than replaying the backlog it was off for.
s.touchAdv(sub.Endpoint, newest)
continue
}
// The ownership join is re-read every pass rather than trusted from the
// subscription row, and that is deliberate: an opt-out, a removal or a
// character change has to close the channel immediately, exactly as
// runReportLinkFor re-resolves rather than trusting a stored id.
mine := ""
if sub.Localpart != "" {
if cached, ok := nameByLocalpart[sub.Localpart]; ok {
mine = cached
} else {
if name, ok := storage.AdvCharacterForOwner(sub.Localpart); ok {
mine = name
}
nameByLocalpart[sub.Localpart] = mine
}
}
var top *advAlert
extra := 0
for _, ev := range events {
if ev.OccurredAt <= sub.LastAdvNotifiedAt {
continue // this endpoint has already been told
}
alert, ok := advAlertFor(ev, mine)
if !ok || !cats[alert.Category] {
continue
}
if top == nil {
// events are newest-first, so the first match is the newest match.
a := alert
top = &a
continue
}
extra++
}
if top == nil {
s.touchAdv(sub.Endpoint, newest)
continue
}
gone, err := s.sendPush(sub, buildAdvPayload(*top, extra))
if gone {
if derr := storage.RemovePushSubscription(sub.Endpoint); derr != nil {
slog.Error("adv-push: prune gone subscription failed", "err", derr)
} else {
pruned++
}
continue
}
if err != nil {
// Leave the watermark alone: a transient push-service failure should be
// retried on the next tick, not swallowed. The alert is at most
// advAlertInterval late, and the events are still in the window.
slog.Warn("adv-push: send failed", "sub", sub.UserSub, "err", err)
continue
}
s.touchAdv(sub.Endpoint, newest)
sent++
}
if sent > 0 || pruned > 0 {
slog.Info("adv-push: pass complete", "sent", sent, "pruned", pruned, "subscriptions", len(live))
}
}
func (s *Server) touchAdv(endpoint string, ts int64) {
if err := storage.TouchAdvPushSubscription(endpoint, ts); err != nil {
slog.Error("adv-push: advance watermark failed", "endpoint", endpoint, "err", err)
}
}
// advAlertFor decides whether one dispatch is worth waking somebody for, and in
// what words. mine is the character name belonging to the subscriber, or "" when
// Pete cannot establish one — in which case only realm-wide alerts can match.
//
// Every owner-scoped branch compares against mine and nothing else. There is no
// path here where an unresolved owner falls through to a broadcast: a game alert
// naming somebody's adventurer, delivered to the wrong phone, is a privacy leak
// dressed as a feature.
func advAlertFor(ev storage.AdvEvent, mine string) (advAlert, bool) {
switch ev.EventType {
case "siege_start":
boss := ev.Boss
if boss == "" {
boss = "Something"
}
return advAlert{
Category: advCatSiege,
Title: "The Siege has begun",
Body: fmt.Sprintf("%s is camped outside the town. Everyone gets one bout a day.", boss),
URL: "/adventure/siege",
}, true
case "siege_win":
return advAlert{
Category: advCatSiege,
Title: "The town holds",
Body: siegeOutcomeBody(ev, "went down"),
URL: "/adventure/siege",
}, true
case "siege_loss":
return advAlert{
Category: advCatSiege,
Title: "The Siege is over",
Body: siegeOutcomeBody(ev, "walked away still standing"),
URL: "/adventure/siege",
}, true
}
// Everything below is about one person, so an unmatched subject ends it here.
if mine == "" || ev.Subject != mine {
return advAlert{}, false
}
switch ev.EventType {
case "death":
return advAlert{
Category: advCatRun,
Title: fmt.Sprintf("%s fell in %s", mine, orPlace(ev.Zone)),
Body: "The expedition is over. They'll need picking up.",
URL: advRunOrStoryURL(ev),
}, true
case "zone_clear":
return advAlert{
Category: advCatRun,
Title: fmt.Sprintf("%s cleared %s", mine, orPlace(ev.Zone)),
Body: "They're through it and on the way home. Read how it went.",
URL: advRunOrStoryURL(ev),
}, true
case "retreat":
return advAlert{
Category: advCatRun,
Title: fmt.Sprintf("%s backed out of %s", mine, orPlace(ev.Zone)),
Body: "Everyone came home breathing. The run's finished either way.",
URL: advRunOrStoryURL(ev),
}, true
case "departure":
return advAlert{
Category: advCatDeparture,
Title: fmt.Sprintf("%s got bored and left", mine),
Body: fmt.Sprintf("No orders, no escort. They packed the cheap kit and set off into %s on their own.",
orPlace(ev.Zone)),
URL: advStoryURL(ev.GUID),
}, true
case "mischief_contract":
body := "Somebody paid to have something sent after them, and isn't saying who. Survive it and the money's theirs."
if ev.Opponent != "" {
body = fmt.Sprintf("%s paid for it and signed the thing. It's out there looking right now.", ev.Opponent)
}
return advAlert{
Category: advCatContract,
Title: fmt.Sprintf("There's a contract out on %s", mine),
Body: body,
URL: advStoryURL(ev.GUID),
}, true
}
return advAlert{}, false
}
// siegeOutcomeBody names the boss when the fact carried one. The verb differs by
// outcome, so it is the caller's.
func siegeOutcomeBody(ev storage.AdvEvent, verb string) string {
if ev.Boss == "" {
return fmt.Sprintf("It %s. See how the town did.", verb)
}
return fmt.Sprintf("%s %s. See how the town did.", ev.Boss, verb)
}
func orPlace(zone string) string {
if zone == "" {
return "the dark"
}
return zone
}
// advRunOrStoryURL prefers the run report, which is the richer landing place for
// an expedition that has just ended, and falls back to the dispatch permalink.
// Runs that predate the liveblog carry no run id and land on the story, which is
// what they have always done.
func advRunOrStoryURL(ev storage.AdvEvent) string {
if ev.RunID != "" {
return runReportPath(ev.RunID)
}
return advStoryURL(ev.GUID)
}
// advStoryURL is advPermalink's relative half, and it escapes for the same
// reason: the guid arrives over a wire, and one that grew a slash would send the
// notification somewhere else entirely.
func advStoryURL(guid string) string {
return "/adventure/" + url.PathEscape(guid)
}
// buildAdvPayload renders the notification JSON the service worker expects. The
// tag is per-category so a Siege alert can't silently replace an unread alert
// about somebody's own adventurer on the lock screen.
func buildAdvPayload(a advAlert, extra int) []byte {
body := a.Body
if extra == 1 {
body += " Plus 1 other update."
} else if extra > 1 {
body += fmt.Sprintf(" Plus %d other updates.", extra)
}
b, _ := json.Marshal(map[string]string{
"title": a.Title,
"body": body,
"url": a.URL,
"tag": "pete-adv-" + a.Category,
})
return b
}
// advCategoriesFor returns the alert categories a user has switched on. An
// absent key, an unparseable blob or a user who has never opened the settings
// drawer all yield an empty set, which sends nothing — the safe direction for a
// channel that interrupts people.
func advCategoriesFor(sub string) map[string]bool {
return userPrefBoolSet(sub, advPrefsKey)
}
// userPrefBoolSet reads one {name: bool} map out of a user's stored preferences
// blob, keeping only the true entries.
//
// The blob mirrors localStorage: a JSON object whose values are themselves JSON
// *strings*. That double encoding is the client's doing, not ours, so unwrap it
// — while tolerating a bare object, since a hand-written or migrated blob may
// carry one. Any parse failure yields an empty set, and every caller treats an
// empty set as "no", so a corrupt blob costs a feature rather than misfiring it.
func userPrefBoolSet(sub, key string) map[string]bool {
out := map[string]bool{}
blob, err := storage.GetUserPrefs(sub)
if err != nil || blob == "" {
return out
}
var prefs map[string]json.RawMessage
if err := json.Unmarshal([]byte(blob), &prefs); err != nil {
return out
}
raw, ok := prefs[key]
if !ok {
return out
}
inner := []byte(raw)
var asStr string
if err := json.Unmarshal(raw, &asStr); err == nil {
inner = []byte(asStr)
}
var set map[string]bool
if err := json.Unmarshal(inner, &set); err != nil {
return out
}
for name, on := range set {
if on {
out[strings.TrimSpace(name)] = true
}
}
return out
}
internal/web/push_adventure_test.go
+283
View File
@@ -0,0 +1,283 @@
package web
import (
"encoding/json"
"strings"
"testing"
"time"
"pete/internal/storage"
)
// TestOwnerScopedAlertsNeverBroadcast is the security regression for this whole
// phase, and it is the one to keep if the rest are ever thinned out.
//
// Three of the four categories name somebody's adventurer. The sender resolves
// "which character belongs to this subscriber" from a join that can legitimately
// come back empty — a player off the board, an opt-out, a session with no
// username. If an empty answer ever fell through to "matches anything", every
// subscriber's phone would light up with a stranger's death, naming them.
func TestOwnerScopedAlertsNeverBroadcast(t *testing.T) {
owned := []storage.AdvEvent{
{EventType: "death", Subject: "Josie", Zone: "The Crypt"},
{EventType: "zone_clear", Subject: "Josie", Zone: "The Crypt"},
{EventType: "retreat", Subject: "Josie", Zone: "The Crypt"},
{EventType: "departure", Subject: "Josie", Zone: "The Crypt"},
{EventType: "mischief_contract", Subject: "Josie", Stakes: "500 gold"},
}
for _, ev := range owned {
// No resolvable owner at all.
if _, ok := advAlertFor(ev, ""); ok {
t.Errorf("%s matched with no owner resolved; that is a broadcast of a private event", ev.EventType)
}
// An owner, but somebody else's dispatch.
if _, ok := advAlertFor(ev, "Quack"); ok {
t.Errorf("%s about Josie matched a subscriber who plays Quack", ev.EventType)
}
// The actual owner.
if _, ok := advAlertFor(ev, "Josie"); !ok {
t.Errorf("%s about Josie did not match Josie", ev.EventType)
}
}
}
// TestSiegeAlertsAreRealmWide is the other half: the Siege is the one communal
// mechanic, so it must reach a subscriber whose ownership join came back empty —
// including someone who has never made a character at all.
func TestSiegeAlertsAreRealmWide(t *testing.T) {
for _, kind := range []string{"siege_start", "siege_win", "siege_loss"} {
a, ok := advAlertFor(storage.AdvEvent{EventType: kind, Boss: "The Hollow King"}, "")
if !ok {
t.Fatalf("%s did not match a subscriber with no character", kind)
}
if a.Category != advCatSiege {
t.Errorf("%s filed under %q, want %q", kind, a.Category, advCatSiege)
}
if a.URL != "/adventure/siege" {
t.Errorf("%s links to %q, want the war room", kind, a.URL)
}
}
}
// TestUntemplatedDispatchIsSilent pins that adding an event type upstream does
// not silently start paging people. W0 made an unknown event_type render as a
// neutral card rather than 400 — the right call for a *page*, and the wrong one
// for a phone. A dispatch nobody has written alert copy for gets no alert.
func TestUntemplatedDispatchIsSilent(t *testing.T) {
for _, kind := range []string{"treasure_found", "milestone", "arrival", "companion_hire", "brand_new_thing"} {
if _, ok := advAlertFor(storage.AdvEvent{EventType: kind, Subject: "Josie"}, "Josie"); ok {
t.Errorf("%s produced an alert; new event types must opt in, not opt out", kind)
}
}
}
// TestEndedRunAlertPrefersTheRunReport pins the landing page. A finished
// expedition has a report worth reading; a dispatch that predates the liveblog
// has no run id and must still land somewhere real rather than on /adventure/.
func TestEndedRunAlertPrefersTheRunReport(t *testing.T) {
withRun := storage.AdvEvent{EventType: "zone_clear", Subject: "Josie", GUID: "g1", RunID: "run-7"}
a, ok := advAlertFor(withRun, "Josie")
if !ok || a.URL != "/adventure/run/run-7" {
t.Errorf("url = %q, want the run report", a.URL)
}
noRun := storage.AdvEvent{EventType: "zone_clear", Subject: "Josie", GUID: "g2"}
a, ok = advAlertFor(noRun, "Josie")
if !ok || a.URL != "/adventure/g2" {
t.Errorf("url = %q, want the story permalink fallback", a.URL)
}
}
// TestAlertCopySurvivesAnEmptyZone guards the copy against the blank-noun defect
// that W2b hit twice: a fact is allowed to arrive with fields missing, and the
// result must still read as a sentence rather than "Josie fell in ".
func TestAlertCopySurvivesAnEmptyZone(t *testing.T) {
a, ok := advAlertFor(storage.AdvEvent{EventType: "death", Subject: "Josie"}, "Josie")
if !ok {
t.Fatal("death with no zone produced no alert")
}
if a.Title != "Josie fell in the dark" {
t.Errorf("title = %q; a missing zone must still read as a sentence", a.Title)
}
// Same for a siege with no boss name on the fact.
b, _ := advAlertFor(storage.AdvEvent{EventType: "siege_win"}, "")
if b.Body != "It went down. See how the town did." {
t.Errorf("body = %q; a nameless boss must still read as a sentence", b.Body)
}
}
// TestUnsignedContractKeepsItsSecret. The anonymity of an unsigned mischief
// contract is the mechanic — the buyer's name is the reward for surviving it. A
// notification that leaked it would hand the payoff to the target for free.
func TestUnsignedContractKeepsItsSecret(t *testing.T) {
signed, _ := advAlertFor(storage.AdvEvent{
EventType: "mischief_contract", Subject: "Josie", Opponent: "Quack",
}, "Josie")
if !strings.Contains(signed.Body, "Quack") {
t.Errorf("a signed contract hid its buyer: %q", signed.Body)
}
anon, _ := advAlertFor(storage.AdvEvent{EventType: "mischief_contract", Subject: "Josie"}, "Josie")
if strings.Contains(anon.Body, "Quack") || !strings.Contains(anon.Body, "isn't saying who") {
t.Errorf("an unsigned contract gave something away: %q", anon.Body)
}
}
// TestCategoriesDefaultToNothing pins the consent model. A user who turned on
// news notifications has not asked to be told about the game, and every way the
// preference can be missing or broken must mean "no".
func TestCategoriesDefaultToNothing(t *testing.T) {
s, _ := newAdvServer(t, "tok")
_ = s
for name, blob := range map[string]string{
"no prefs row at all": "",
"prefs but no key": `{"pete.weather.loc.v1":"\"London\""}`,
"key is not JSON": `{"pete.advPush.v1":"not json at all"}`,
"key is a JSON null": `{"pete.advPush.v1":null}`,
"all boxes unchecked": `{"pete.advPush.v1":"{\"siege\":false,\"run\":false}"}`,
} {
if blob != "" {
if err := storage.PutUserPrefs("sub-1", blob, "Josie", "j@example.com"); err != nil {
t.Fatal(err)
}
}
if got := advCategoriesFor("sub-1"); len(got) != 0 {
t.Errorf("%s: enabled %v, want nothing", name, got)
}
}
}
// TestCategoriesReadTheDoubleEncodedBlob. The client mirrors localStorage, whose
// values are strings, so the stored map arrives as JSON inside a JSON string.
// Both that shape and a bare object must parse — the bare form is what a
// hand-edited or migrated blob looks like.
func TestCategoriesReadTheDoubleEncodedBlob(t *testing.T) {
s, _ := newAdvServer(t, "tok")
_ = s
nested, _ := json.Marshal(map[string]string{
advPrefsKey: `{"siege":true,"run":true,"departure":false}`,
})
if err := storage.PutUserPrefs("sub-1", string(nested), "Josie", ""); err != nil {
t.Fatal(err)
}
got := advCategoriesFor("sub-1")
if !got[advCatSiege] || !got[advCatRun] {
t.Errorf("double-encoded blob parsed to %v, want siege+run", got)
}
if got[advCatDeparture] {
t.Error("an explicitly false category was treated as enabled")
}
bare := `{"pete.advPush.v1":{"contract":true}}`
if err := storage.PutUserPrefs("sub-2", bare, "Quack", ""); err != nil {
t.Fatal(err)
}
if got := advCategoriesFor("sub-2"); !got[advCatContract] {
t.Errorf("bare-object blob parsed to %v, want contract", got)
}
}
// TestFirstPassNeverReplaysTheBacklog is the deploy safety valve.
//
// Every subscription that exists when this ships carries watermark 0. Read
// literally that means "has never been told anything", and the first tick would
// page every subscriber for every dispatch Pete has ever stored — on the same
// pass, from a feature they never switched on. The seeding branch stamps those
// rows to now and sends nothing, so alerts begin at the next real dispatch.
func TestFirstPassNeverReplaysTheBacklog(t *testing.T) {
s, _ := newAdvServer(t, "tok")
// A subscriber with everything switched on and a character on the board —
// i.e. the person most exposed to a replay.
seedSubscriberWithEverythingOn(t, "sub-1", "josie", "Josie")
// A realm with history, all of it well before now.
old := time.Now().Add(-90 * 24 * time.Hour).Unix()
for i, kind := range []string{"death", "zone_clear", "siege_start", "departure"} {
if err := storage.InsertAdventureEvent(&storage.AdvEvent{
GUID: string(rune('a'+i)) + "-guid", EventType: kind, Subject: "Josie",
Boss: "The Hollow King", Zone: "The Crypt", OccurredAt: old + int64(i),
}); err != nil {
t.Fatal(err)
}
}
before := time.Now().Unix()
// No push service is reachable from a test, so a send would surface as an
// error rather than silence. What this asserts is that we never get that far:
// the watermark is seeded and the pass returns having considered nobody.
s.sendAdventureAlerts()
subs, err := storage.ListPushSubscriptions()
if err != nil || len(subs) != 1 {
t.Fatalf("read back %d subscriptions (err %v), want 1", len(subs), err)
}
if subs[0].LastAdvNotifiedAt < before {
t.Fatalf("watermark = %d, want >= %d: a 0 watermark must be stamped to now, not read as 'tell them everything'",
subs[0].LastAdvNotifiedAt, before)
}
// And the pass after it is quiet, because everything in the realm is now
// behind the watermark.
s.sendAdventureAlerts()
subs, _ = storage.ListPushSubscriptions()
if subs[0].LastAdvNotifiedAt < before {
t.Error("second pass moved the watermark backwards")
}
}
// TestCategoriesOffStillAdvanceTheWatermark. Someone with push on but no
// adventure categories must not accumulate a backlog: switching a category on
// should start from that moment, not replay everything it was off for.
func TestCategoriesOffStillAdvanceTheWatermark(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if err := storage.AddPushSubscription("sub-1", "josie", "https://push.example/ep", "p", "a"); err != nil {
t.Fatal(err)
}
// Move off the seeding branch so the pass actually evaluates this row.
if err := storage.TouchAdvPushSubscription("https://push.example/ep", 1000); err != nil {
t.Fatal(err)
}
if err := storage.InsertAdventureEvent(&storage.AdvEvent{
GUID: "g1", EventType: "siege_start", Boss: "The Hollow King", OccurredAt: 5000,
}); err != nil {
t.Fatal(err)
}
s.sendAdventureAlerts()
subs, _ := storage.ListPushSubscriptions()
if len(subs) != 1 || subs[0].LastAdvNotifiedAt != 5000 {
t.Fatalf("watermark = %d, want 5000: a subscriber with nothing enabled must still move past what they were not told",
subs[0].LastAdvNotifiedAt)
}
}
// seedSubscriberWithEverythingOn wires the full happy path: a push endpoint, a
// character on the board with an owner, and every alert category enabled.
func seedSubscriberWithEverythingOn(t *testing.T, sub, localpart, character string) {
t.Helper()
if err := storage.AddPushSubscription(sub, localpart, "https://push.example/"+sub, "p", "a"); err != nil {
t.Fatal(err)
}
blob, _ := json.Marshal(map[string]string{
advPrefsKey: `{"siege":true,"run":true,"departure":true,"contract":true}`,
})
if err := storage.PutUserPrefs(sub, string(blob), character, ""); err != nil {
t.Fatal(err)
}
if err := storage.ReplaceRoster([]storage.RosterEntry{{
Token: "tok-" + localpart, Name: character, Level: 14, Status: "idle",
}}, time.Now().Unix()); err != nil {
t.Fatal(err)
}
if err := storage.ReplacePlayerDetail([]storage.PlayerDetail{{
Localpart: localpart, Token: "tok-" + localpart,
}}, time.Now().Unix()); err != nil {
t.Fatal(err)
}
}
internal/web/push_sender.go
+3 -33
View File
@@ -180,40 +180,10 @@ func (s *Server) sendPush(sub storage.PushSubscription, payload []byte) (gone bo
} }
// disabledSourcesFor returns the set of source names a user has hidden, read // disabledSourcesFor returns the set of source names a user has hidden, read
// from their stored prefs blob. The blob mirrors localStorage: a JSON object // from their stored prefs blob. Any parse failure yields an empty (deny-nothing)
// whose "pete.disabledSources.v1" value is itself a JSON string encoding a // set — see userPrefBoolSet for the blob's shape and why it is double-encoded.
// {sourceName: true} map. Any parse failure yields an empty (deny-nothing) set.
func disabledSourcesFor(sub string) map[string]bool { func disabledSourcesFor(sub string) map[string]bool {
out := map[string]bool{} return userPrefBoolSet(sub, "pete.disabledSources.v1")
blob, err := storage.GetUserPrefs(sub)
if err != nil || blob == "" {
return out
}
var prefs map[string]json.RawMessage
if err := json.Unmarshal([]byte(blob), &prefs); err != nil {
return out
}
raw, ok := prefs["pete.disabledSources.v1"]
if !ok {
return out
}
// The value is normally a JSON *string* containing JSON; unwrap that first,
// but tolerate a bare object too.
inner := []byte(raw)
var asStr string
if err := json.Unmarshal(raw, &asStr); err == nil {
inner = []byte(asStr)
}
var set map[string]bool
if err := json.Unmarshal(inner, &set); err != nil {
return out
}
for name, on := range set {
if on {
out[name] = true
}
}
return out
} }
// pushClient returns the shared SSRF-guarded, timeout-bounded HTTP client used // pushClient returns the shared SSRF-guarded, timeout-bounded HTTP client used
internal/web/pwa.go
+46 -1
View File
@@ -47,7 +47,11 @@ func (s *Server) handlePushSubscribe(w http.ResponseWriter, r *http.Request) {
http.Error(w, `{"error":"invalid endpoint"}`, http.StatusBadRequest) http.Error(w, `{"error":"invalid endpoint"}`, http.StatusBadRequest)
return return
} }
if err := storage.AddPushSubscription(u.Sub, req.Endpoint, req.Keys.P256dh, req.Keys.Auth); err != nil { // The localpart is captured here because this is the only place the mapping is
// available: the alert sender runs on a ticker with no session to read. It may
// be empty for a session minted before the game economy existed — that costs
// only the owner-scoped alerts, and heals on the next re-subscribe.
if err := storage.AddPushSubscription(u.Sub, buyerLocalpart(u), req.Endpoint, req.Keys.P256dh, req.Keys.Auth); err != nil {
slog.Error("push: subscribe failed", "sub", u.Sub, "err", err) slog.Error("push: subscribe failed", "sub", u.Sub, "err", err)
http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError) http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
return return
@@ -55,6 +59,47 @@ func (s *Server) handlePushSubscribe(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusNoContent) w.WriteHeader(http.StatusNoContent)
} }
// handlePushHeal fills in the Matrix handle on a subscription stored before the
// column existed. W6 shipped owner-scoped adventure alerts keyed on the
// localpart, and every row that predates it carries an empty one — so those
// subscribers get the realm-wide Siege alerts and silently never get the ones
// about their own adventurer. Nothing in the browser re-subscribes on its own
// (pwa.js only calls subscribe() on a click), so without this they stay broken
// until they happen to toggle notifications off and on again.
//
// It takes only an endpoint, and it is deliberately not a subscribe: see
// HealPushSubscriptionLocalpart on why re-using the upsert here would have
// silenced the digest for anybody who reads the site regularly.
func (s *Server) handlePushHeal(w http.ResponseWriter, r *http.Request) {
u := s.requireUser(w, r)
if u == nil {
return
}
if !s.cfg.Push.Enabled {
http.Error(w, `{"error":"push disabled"}`, http.StatusNotFound)
return
}
var req struct {
Endpoint string `json:"endpoint"`
}
if !decodeStateBodyN(w, r, &req, maxPushBodyBytes) {
return
}
if req.Endpoint == "" {
http.Error(w, `{"error":"incomplete subscription"}`, http.StatusBadRequest)
return
}
// 204 whether or not a row moved. The client asks once per endpoint and has
// nothing to do with the answer, and reporting a miss would tell a caller
// whether somebody else's endpoint is on file.
if err := storage.HealPushSubscriptionLocalpart(u.Sub, req.Endpoint, buyerLocalpart(u)); err != nil {
slog.Error("push: heal failed", "sub", u.Sub, "err", err)
http.Error(w, `{"error":"internal error"}`, http.StatusInternalServerError)
return
}
w.WriteHeader(http.StatusNoContent)
}
// handlePushUnsubscribe drops the caller's own stored subscription by endpoint. // handlePushUnsubscribe drops the caller's own stored subscription by endpoint.
// The delete is scoped to the signed-in user so one account can't remove // The delete is scoped to the signed-in user so one account can't remove
// another's subscription by presenting its endpoint string. // another's subscription by presenting its endpoint string.
internal/web/realm.go
+462
View File
@@ -0,0 +1,462 @@
package web
import (
"encoding/json"
"fmt"
"io"
"log/slog"
"net/http"
"sort"
"time"
"pete/internal/storage"
)
// The realm pages: the world map, the board, and the hall of firsts.
//
// Everything Pete has published so far is either the present moment (the roster,
// the Siege bar) or one thing that happened (a dispatch, a run report). None of
// it says what this place IS. A visitor who reads every dispatch on the site
// still cannot answer "how many zones are there", "is the Drowned Star harder
// than the Sunken Vault", or "has anybody ever actually beaten it" — and those
// are the questions that turn a feed of incidents into a world.
//
// The three pages are one snapshot because they are one question. Every number
// on all three comes off the same scan of the same run history on the game box;
// splitting the wire would mean three ways for the same fact to disagree with
// itself depending on which page you were standing on.
//
// The map is deliberately NOT who_map.go's layout engine, which the plan
// expected it to be. That engine lays out a *graph* — nodes joined by edges, at
// BFS depth from an entrance — and the realm has no edges. Zones are not
// connected to each other; you pick one from town and go. Forcing a graph layout
// onto a set would have produced a picture that implied a topology the game does
// not have. What the realm has instead is an *order*, by difficulty, and that is
// what gets drawn: tier bands, hardest last.
const (
// realmStaleAfter — how old the snapshot may get before the pages stop
// claiming the occupant dots are live. gogobee recomputes the realm every ten
// minutes rather than every two (it is aggregate scans over the whole run
// history, and a first clear does not move), so the window is proportionally
// wider: several missed pushes, not one unlucky one.
realmStaleAfter = 45 * time.Minute
// Payload bounds. A realm has tens of zones, tens of players, and a first per
// zone plus a first per treasure; these only stop a malformed or hostile push
// spooling unbounded rows.
realmMaxZones = 500
realmMaxFirsts = 5000
realmMaxStandings = 1000
)
// realmPush is the payload gogobee POSTs to /api/ingest/realm.
type realmPush struct {
SnapshotAt int64 `json:"snapshot_at"`
storage.Realm
}
// RealmZoneView is one zone as the map draws it: gogobee's facts plus the few
// presentational calls Pete is allowed to make.
type RealmZoneView struct {
storage.RealmZone
Cleared bool // anybody, ever
Unbeaten bool // nobody, ever — the ominous state
FirstWhen string // "Mar 4, 2026", empty when unknown
Levels string // "levels 5–8", or "level 5" when the band is one wide
Busy bool // somebody is in there right now
}
// RealmTierView is one difficulty band of the map. The band is the unit the page
// draws in, because difficulty order is the only real structure the realm has.
type RealmTierView struct {
Tier int
Label string
Blurb string
Postgame bool
Zones []RealmZoneView
Cleared int // zones in this band somebody has beaten
}
// RealmView is the map page.
type RealmView struct {
Known bool // gogobee has pushed at least one snapshot
Stale bool
Tiers []RealmTierView
ZoneCount int
ClearedZones int
Unbeaten int
OutThere int // adventurers on expedition right now, across the whole realm
SnapshotAt int64
LastSeenAgo string
}
// RealmStandingView is one line of the board.
type RealmStandingView struct {
storage.RealmStanding
Rank int
Deaths int // Pete's own count, from the dispatches he filed — see DeathsBySubject
}
// StandingsView is the board page.
type StandingsView struct {
Known bool
Stale bool
Rows []RealmStandingView
PeteWins int
PeteLosses int
PeteFought bool // he has a record at all; zero-zero renders as "no bouts yet"
SnapshotAt int64
LastSeenAgo string
}
// RealmFirstView is one entry in the hall.
type RealmFirstView struct {
storage.RealmFirst
When string
Kind string // the raw kind, kept for the CSS hook
Label string // "First through" / "First to hold" — reads as a sentence
}
// FirstsView is the hall of firsts page, grouped by year so a long ledger reads
// as a history rather than as a list.
type FirstsView struct {
Known bool
Stale bool
Years []RealmFirstYear
Total int
Zones int
Others int
SnapshotAt int64
LastSeenAgo string
}
// RealmFirstYear is one year's worth of firsts, newest year first.
type RealmFirstYear struct {
Year int
Firsts []RealmFirstView
}
type realmPage struct {
pageData
Realm RealmView
}
type standingsPage struct {
pageData
Standings StandingsView
}
type firstsPage struct {
pageData
Firsts FirstsView
}
// realmTierLabels names the difficulty bands. gogobee's zone tiers are 1–6 and
// the sixth is the postgame; the labels are the game's own words for them.
var realmTierLabels = map[int]struct{ label, blurb string }{
1: {"Tier I · The Outskirts", "Where everybody starts. Close enough to town to walk back from."},
2: {"Tier II · The Reaches", "Further out, and the road stops being a road."},
3: {"Tier III · The Deep Country", "Long enough that you camp. Bring supplies you don't think you'll need."},
4: {"Tier IV · The Far Places", "Multi-region crossings. People come back from these different."},
5: {"Tier V · The Last Doors", "The end of the map as it was drawn. Very few have seen all of these."},
6: {"Mythic · The Postgame", "Sealed until you're level 18 and have put down both Tier V bosses. It does not get easier past here."},
}
// handleRealmIngest replaces the realm with gogobee's latest snapshot.
func (s *Server) handleRealmIngest(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
var push realmPush
if err := json.NewDecoder(io.LimitReader(r.Body, 4<<20)).Decode(&push); err != nil {
http.Error(w, "bad json", http.StatusBadRequest)
return
}
if len(push.Zones) > realmMaxZones {
http.Error(w, "zone list too large", http.StatusBadRequest)
return
}
if len(push.Firsts) > realmMaxFirsts {
http.Error(w, "firsts ledger too large", http.StatusBadRequest)
return
}
if len(push.Standings) > realmMaxStandings {
http.Error(w, "standings too large", http.StatusBadRequest)
return
}
if push.SnapshotAt <= 0 {
push.SnapshotAt = time.Now().Unix()
}
// Never trust the channel with a name. A nameless row renders as a blank line
// on a public page, so it is rejected rather than drawn — the same rule the
// siege muster applies to its defenders.
for i, z := range push.Zones {
if z.ID == "" || z.Display == "" {
http.Error(w, fmt.Sprintf("zone %d: id and display are required", i), http.StatusBadRequest)
return
}
for j, o := range z.Occupants {
if o.Name == "" {
http.Error(w, fmt.Sprintf("zone %d occupant %d: name is required", i, j), http.StatusBadRequest)
return
}
}
}
for i, st := range push.Standings {
if st.Name == "" {
http.Error(w, fmt.Sprintf("standing %d: name is required", i), http.StatusBadRequest)
return
}
}
// A first with no display would render as an empty row in the history book.
// Unlike a name this one Pete can repair himself — gogobee already falls back
// to the raw target for a kind it has no words for, and doing the same here
// means a future first kind can never blank a row.
for i := range push.Firsts {
if push.Firsts[i].Display == "" {
push.Firsts[i].Display = push.Firsts[i].Target
}
if push.Firsts[i].Display == "" {
http.Error(w, fmt.Sprintf("first %d: target is required", i), http.StatusBadRequest)
return
}
}
if err := storage.ReplaceRealm(push.Realm, push.SnapshotAt); err != nil {
slog.Error("realm ingest: replace failed", "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
slog.Info("realm ingest: realm replaced",
"zones", len(push.Zones), "firsts", len(push.Firsts), "standings", len(push.Standings))
w.WriteHeader(http.StatusOK)
}
// loadRealmSnapshot reads the snapshot once and reports staleness. All three
// pages go through it so they can never disagree about how old the realm is.
func (s *Server) loadRealmSnapshot() (storage.Realm, bool, bool) {
snap, known, err := storage.LoadRealm()
if err != nil {
slog.Error("realm: load failed", "err", err)
return storage.Realm{}, false, true
}
stale := !known || snap.SnapshotAt == 0 ||
time.Since(time.Unix(snap.SnapshotAt, 0)) > realmStaleAfter
return snap, known, stale
}
// handleRealmPage serves the world map.
func (s *Server) handleRealmPage(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
s.track(r, "adventure")
base := s.base(r)
base.Active = "adventure"
s.render(w, "realm", realmPage{pageData: base, Realm: s.realm()})
}
// realm builds the map view.
func (s *Server) realm() RealmView {
snap, known, stale := s.loadRealmSnapshot()
v := RealmView{Known: known, Stale: stale, SnapshotAt: snap.SnapshotAt}
if snap.SnapshotAt > 0 {
v.LastSeenAgo = shortTimeAgo(time.Unix(snap.SnapshotAt, 0))
}
byTier := map[int][]RealmZoneView{}
for _, z := range snap.Zones {
zv := RealmZoneView{
RealmZone: z,
// Cleared is Clears > 0, NOT "FirstClearBy is set". The two come
// apart exactly when the first clearer opted out: the zone has been
// beaten and the claim stands, it just has no name on it. Keying the
// ominous never-beaten styling off the name would make an
// anonymisation look like a fact about the world.
Cleared: z.Clears > 0,
Busy: len(z.Occupants) > 0,
Levels: levelBand(z.LevelMin, z.LevelMax),
}
zv.Unbeaten = !zv.Cleared
if z.FirstClearAt > 0 {
zv.FirstWhen = time.Unix(z.FirstClearAt, 0).UTC().Format("Jan 2, 2006")
}
byTier[z.Tier] = append(byTier[z.Tier], zv)
v.ZoneCount++
if zv.Cleared {
v.ClearedZones++
} else {
v.Unbeaten++
}
v.OutThere += len(z.Occupants)
}
tiers := make([]int, 0, len(byTier))
for t := range byTier {
tiers = append(tiers, t)
}
sort.Ints(tiers)
for _, t := range tiers {
tv := RealmTierView{Tier: t, Zones: byTier[t], Postgame: t >= 6}
if lbl, ok := realmTierLabels[t]; ok {
tv.Label, tv.Blurb = lbl.label, lbl.blurb
} else {
// A tier the labels don't know about still draws, with an honest
// generic heading rather than an empty one. Same degrade-don't-drop
// rule as an untemplated dispatch.
tv.Label = fmt.Sprintf("Tier %d", t)
}
for _, z := range tv.Zones {
if z.Cleared {
tv.Cleared++
}
}
v.Tiers = append(v.Tiers, tv)
}
return v
}
// handleStandingsPage serves the board.
func (s *Server) handleStandingsPage(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
s.track(r, "adventure")
base := s.base(r)
base.Active = "adventure"
s.render(w, "standings", standingsPage{pageData: base, Standings: s.standings()})
}
// standings builds the board view.
//
// The rank is gogobee's push order, not anything computed here: the ordering
// ("deepest tier beaten, then how much of the realm you have beaten") is a
// statement about what the game values, and the game is the thing entitled to
// make it. Pete's job is to draw it and to add the two columns the game box
// cannot answer — the death count and Pete's own record.
func (s *Server) standings() StandingsView {
snap, known, stale := s.loadRealmSnapshot()
v := StandingsView{Known: known, Stale: stale, SnapshotAt: snap.SnapshotAt}
if snap.SnapshotAt > 0 {
v.LastSeenAgo = shortTimeAgo(time.Unix(snap.SnapshotAt, 0))
}
deaths, err := storage.DeathsBySubject()
if err != nil {
// A missing death column is a missing column. It is not worth failing the
// whole board over, and a zero would be a lie, so the template renders a
// dash for anyone not in the map — which is what an absent map produces.
slog.Error("standings: death counts", "err", err)
deaths = nil
}
for i, st := range snap.Standings {
v.Rows = append(v.Rows, RealmStandingView{
RealmStanding: st,
Rank: i + 1,
Deaths: deaths[st.Name],
})
}
if w, l, err := storage.PeteDuelRecord(); err != nil {
slog.Error("standings: pete duel record", "err", err)
} else {
v.PeteWins, v.PeteLosses = w, l
v.PeteFought = w+l > 0
}
return v
}
// handleFirstsPage serves the hall of firsts.
func (s *Server) handleFirstsPage(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
s.track(r, "adventure")
base := s.base(r)
base.Active = "adventure"
s.render(w, "firsts", firstsPage{pageData: base, Firsts: s.firsts()})
}
// firsts builds the hall.
//
// gogobee pushes the ledger oldest-first, which is the order it happened in. The
// page reverses it into newest-year-first, because a history book that opens on
// the oldest page is an archive and this is meant to read as "look what has been
// happening" — but within a year it stays chronological, so a year reads forward
// the way a year did.
func (s *Server) firsts() FirstsView {
snap, known, stale := s.loadRealmSnapshot()
v := FirstsView{Known: known, Stale: stale, SnapshotAt: snap.SnapshotAt}
if snap.SnapshotAt > 0 {
v.LastSeenAgo = shortTimeAgo(time.Unix(snap.SnapshotAt, 0))
}
byYear := map[int][]RealmFirstView{}
for _, f := range snap.Firsts {
fv := RealmFirstView{RealmFirst: f, Kind: f.Kind}
switch f.Kind {
case "zone":
fv.Label = "First through"
case "treasure":
fv.Label = "First to hold"
default:
fv.Label = "First"
}
year := 0
if f.AtUnix > 0 {
t := time.Unix(f.AtUnix, 0).UTC()
fv.When = t.Format("Jan 2, 2006")
year = t.Year()
}
byYear[year] = append(byYear[year], fv)
v.Total++
if f.Kind == "zone" {
v.Zones++
} else {
v.Others++
}
}
years := make([]int, 0, len(byYear))
for y := range byYear {
years = append(years, y)
}
// Newest year first. Year 0 is "the ledger has no date for this", which
// sorts last — an undated first is real but it is not news.
sort.Sort(sort.Reverse(sort.IntSlice(years)))
for _, y := range years {
v.Years = append(v.Years, RealmFirstYear{Year: y, Firsts: byYear[y]})
}
return v
}
// levelBand renders a zone's level range as words. A one-wide band ("levels
// 5–5") reads as a typo, so it collapses to "level 5"; a band with no numbers at
// all renders as nothing rather than as "levels 0–0".
func levelBand(min, max int) string {
switch {
case min <= 0 && max <= 0:
return ""
case min == max:
return fmt.Sprintf("level %d", min)
case min <= 0:
return fmt.Sprintf("up to level %d", max)
case max <= 0:
return fmt.Sprintf("level %d and up", min)
default:
return fmt.Sprintf("levels %d–%d", min, max)
}
}
internal/web/realm_test.go
+362
View File
@@ -0,0 +1,362 @@
package web
import (
"bytes"
"encoding/json"
"net/http/httptest"
"testing"
"time"
"pete/internal/storage"
)
func postRealm(t *testing.T, s *Server, token string, push realmPush) *httptest.ResponseRecorder {
t.Helper()
body, _ := json.Marshal(push)
req := httptest.NewRequest("POST", "/api/ingest/realm", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
w := httptest.NewRecorder()
s.handleRealmIngest(w, req)
return w
}
func zone(id, display string, tier, clears, clearers int) storage.RealmZone {
return storage.RealmZone{
ID: id, Display: display, Tier: tier,
LevelMin: tier * 3, LevelMax: tier*3 + 3,
Clears: clears, Clearers: clearers,
}
}
// TestRealmReplacesNeverMerges is the realm's core contract and it is the same
// one the board and the war room have: gogobee sends the whole thing, Pete's
// copy becomes it. Everything on these pages is a *derived* answer recomputed
// upstream — a clear count, a first-clearer, who is inside — so a merge would
// let a correction upstream leave a wrong number here permanently, and an
// occupant who came home would never leave the map.
func TestRealmReplacesNeverMerges(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
first := zone("warren", "Goblin Warren", 1, 4, 2)
first.Occupants = []storage.RealmOccupant{{Token: "t1", Name: "Josie", Level: 9, Day: 2}}
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Zones: []storage.RealmZone{first, zone("vault", "Sunken Vault", 2, 0, 0)},
Standings: []storage.RealmStanding{{Token: "t1", Name: "Josie", Level: 9, Clears: 4}},
Firsts: []storage.RealmFirst{{Kind: "zone", Target: "warren", Display: "Goblin Warren", AtUnix: now - 86400}},
}}); w.Code != 200 {
t.Fatalf("first push = %d, want 200", w.Code)
}
// Josie comes home, the Vault gets beaten, and the second zone drops out of
// the push entirely (say it was retired upstream).
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now + 600, Realm: storage.Realm{
Zones: []storage.RealmZone{zone("warren", "Goblin Warren", 1, 5, 2)},
Standings: []storage.RealmStanding{{Token: "t1", Name: "Josie", Level: 10, Clears: 5}},
}}); w.Code != 200 {
t.Fatalf("second push = %d, want 200", w.Code)
}
v := s.realm()
if v.ZoneCount != 1 {
t.Fatalf("zone count = %d, want 1 — a dropped zone survived the swap", v.ZoneCount)
}
if v.OutThere != 0 {
t.Errorf("out-there = %d, want 0 — an occupant who came home is still on the map", v.OutThere)
}
if got := v.Tiers[0].Zones[0].Clears; got != 5 {
t.Errorf("clears = %d, want 5 — the count didn't follow the snapshot", got)
}
if fv := s.firsts(); fv.Total != 0 {
t.Errorf("firsts total = %d, want 0 — the ledger didn't follow the snapshot", fv.Total)
}
if sv := s.standings(); len(sv.Rows) != 1 || sv.Rows[0].Level != 10 {
t.Errorf("standings didn't follow the snapshot: %+v", sv.Rows)
}
}
// TestAnonymisedFirstClearIsNotAnUnbeatenZone is the one that matters most on
// this page.
//
// gogobee anonymises an opted-out first-clearer rather than deleting the claim:
// the zone HAS been beaten and the clear counts still add up, there is just no
// name on it. If Pete keyed the ominous never-beaten styling off "is there a
// name" instead of off "are there any clears", an opt-out would silently rewrite
// the history of the realm — a place somebody conquered would be drawn as a
// place nobody has ever come out of.
func TestAnonymisedFirstClearIsNotAnUnbeatenZone(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
beaten := zone("vault", "Sunken Vault", 2, 3, 1) // cleared, but no name on it
beaten.FirstClearAt = now - 86400
untouched := zone("abyss", "Abyss Portal", 5, 0, 0)
named := zone("warren", "Goblin Warren", 1, 2, 1)
named.FirstClearBy, named.FirstClearToken = "Josie", "t1"
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Zones: []storage.RealmZone{named, beaten, untouched},
}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
byID := map[string]RealmZoneView{}
for _, tier := range s.realm().Tiers {
for _, z := range tier.Zones {
byID[z.ID] = z
}
}
if byID["vault"].Unbeaten {
t.Error("an anonymised clear drew as never-beaten — an opt-out rewrote the realm's history")
}
if !byID["vault"].Cleared {
t.Error("a zone with clears > 0 did not read as cleared")
}
if !byID["abyss"].Unbeaten {
t.Error("a zone with no clears at all did not read as unbeaten — the ominous state is the point")
}
if byID["warren"].Unbeaten {
t.Error("a named clear drew as never-beaten")
}
v := s.realm()
if v.ClearedZones != 2 || v.Unbeaten != 1 {
t.Errorf("header totals = %d cleared / %d unbeaten, want 2/1", v.ClearedZones, v.Unbeaten)
}
}
// TestRealmStaleWhenTheWireGoesQuiet. The realm is pushed every ten minutes
// rather than every two, so its staleness window is proportionally wider — but
// it still has to exist. An occupant list that stopped updating an hour ago must
// not keep claiming somebody is standing in a dungeon.
func TestRealmStaleWhenTheWireGoesQuiet(t *testing.T) {
s, _ := newAdvServer(t, "tok")
old := time.Now().Add(-2 * time.Hour).Unix()
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: old, Realm: storage.Realm{
Zones: []storage.RealmZone{zone("warren", "Goblin Warren", 1, 1, 1)},
}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
v := s.realm()
if !v.Known {
t.Fatal("a pushed realm reads as never-pushed")
}
if !v.Stale {
t.Error("a two-hour-old realm claims to be live")
}
// All three pages share one snapshot read, so they must agree about its age.
if !s.standings().Stale || !s.firsts().Stale {
t.Error("the three realm pages disagree about how old the realm is")
}
}
// TestUnpushedRealmIsNotAnEmptyRealm. "gogobee has never pushed" and "gogobee
// pushed a realm with nothing in it" are different states and the pages say
// different things about them — the first is Pete admitting he has no survey,
// the second is a real answer about a quiet realm.
func TestUnpushedRealmIsNotAnEmptyRealm(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if v := s.realm(); v.Known {
t.Error("an unpushed realm claims to be known")
}
if v := s.standings(); v.Known {
t.Error("unpushed standings claim to be known")
}
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: time.Now().Unix(), Realm: storage.Realm{}}); w.Code != 200 {
t.Fatalf("empty push = %d, want 200", w.Code)
}
v := s.realm()
if !v.Known {
t.Error("an empty-but-pushed realm reads as never-pushed")
}
if v.ZoneCount != 0 {
t.Errorf("zone count = %d, want 0", v.ZoneCount)
}
}
// TestRealmIngestRejectsNamelessRows. A nameless row renders as a blank line on
// a public page. gogobee already refuses to send one (it skips a character with
// no name rather than falling back to a Matrix handle), so this is the wire
// refusing to be the thing that puts a hole in the page.
func TestRealmIngestRejectsNamelessRows(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
nameless := zone("warren", "Goblin Warren", 1, 1, 1)
nameless.Occupants = []storage.RealmOccupant{{Token: "t1", Name: ""}}
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Zones: []storage.RealmZone{nameless},
}}); w.Code != 400 {
t.Errorf("nameless occupant = %d, want 400", w.Code)
}
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Standings: []storage.RealmStanding{{Token: "t1", Name: ""}},
}}); w.Code != 400 {
t.Errorf("nameless standing = %d, want 400", w.Code)
}
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Zones: []storage.RealmZone{{ID: "", Display: "Nowhere"}},
}}); w.Code != 400 {
t.Errorf("idless zone = %d, want 400", w.Code)
}
}
// TestUnknownFirstKindStillGetsIntoTheHall. The ledger is open-ended: gogobee
// claims a realm-first on (kind, target) and nothing stops a third kind shipping
// later. A first Pete has no words for is still a thing that happened exactly
// once, so it renders with a generic label and its raw target as its name — the
// same degrade-don't-drop rule W0 settled on for an untemplated event_type. A
// missing display is repaired at ingest rather than rejected.
func TestUnknownFirstKindStillGetsIntoTheHall(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: now, Realm: storage.Realm{
Firsts: []storage.RealmFirst{
{Kind: "zone", Target: "warren", Display: "Goblin Warren", Holder: "Josie", Token: "t1", AtUnix: now - 86400},
{Kind: "hat", Target: "very_big_hat", AtUnix: now - 3600}, // no display: repaired, not rejected
},
}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
v := s.firsts()
if v.Total != 2 {
t.Fatalf("hall has %d entries, want 2 — an unknown kind was dropped", v.Total)
}
var hat *RealmFirstView
for i := range v.Years {
for j := range v.Years[i].Firsts {
if v.Years[i].Firsts[j].Kind == "hat" {
hat = &v.Years[i].Firsts[j]
}
}
}
if hat == nil {
t.Fatal("the unknown-kind first is not in any year")
}
if hat.Display != "very_big_hat" {
t.Errorf("display = %q, want the raw target — a blank row is worse than an ugly one", hat.Display)
}
if hat.Label == "" {
t.Error("an unknown kind got no label at all")
}
}
// TestFirstsAreNewestYearFirstButChronologicalWithinAYear. A history book that
// opens on the oldest page is an archive; this is meant to read as "look what
// has been happening". Within a year it stays forward-ordered, the way a year
// did. An undated entry sorts to the bottom — it is real, but it is not news.
func TestFirstsAreNewestYearFirstButChronologicalWithinAYear(t *testing.T) {
s, _ := newAdvServer(t, "tok")
y2025 := time.Date(2025, 6, 1, 0, 0, 0, 0, time.UTC).Unix()
y2026a := time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC).Unix()
y2026b := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC).Unix()
// Pushed oldest-first, which is how gogobee sends it.
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: time.Now().Unix(), Realm: storage.Realm{
Firsts: []storage.RealmFirst{
{Kind: "zone", Target: "undated", Display: "Somewhere", AtUnix: 0},
{Kind: "zone", Target: "a", Display: "First Place", AtUnix: y2025},
{Kind: "zone", Target: "b", Display: "Second Place", AtUnix: y2026a},
{Kind: "zone", Target: "c", Display: "Third Place", AtUnix: y2026b},
},
}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
v := s.firsts()
if len(v.Years) != 3 {
t.Fatalf("got %d year groups, want 3 (2026, 2025, undated)", len(v.Years))
}
if v.Years[0].Year != 2026 || v.Years[1].Year != 2025 || v.Years[2].Year != 0 {
t.Fatalf("year order = %d, %d, %d; want 2026, 2025, 0",
v.Years[0].Year, v.Years[1].Year, v.Years[2].Year)
}
if got := v.Years[0].Firsts; got[0].Display != "Second Place" || got[1].Display != "Third Place" {
t.Errorf("within 2026 the order is %q then %q; want chronological", got[0].Display, got[1].Display)
}
}
// TestStandingsKeepGogobeesRank. The ordering is a statement about what the game
// values ("deepest tier beaten, then how much of the realm you have beaten") and
// the game is entitled to make it. Pete renumbers nothing — a board that
// re-sorted on a column Pete happened to find interesting would disagree with
// the game about who is ahead.
func TestStandingsKeepGogobeesRank(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: time.Now().Unix(), Realm: storage.Realm{
Standings: []storage.RealmStanding{
{Token: "t1", Name: "Josie", Level: 14, DeepestTier: 5, Zones: 3, Clears: 9},
// Higher level and more clears, but shallower — and gogobee put them
// second, so second is where they render.
{Token: "t2", Name: "Quack", Level: 20, DeepestTier: 3, Zones: 8, Clears: 40},
},
}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
rows := s.standings().Rows
if len(rows) != 2 {
t.Fatalf("got %d rows, want 2", len(rows))
}
if rows[0].Name != "Josie" || rows[0].Rank != 1 {
t.Errorf("rank 1 = %q (rank field %d), want Josie/1 — Pete re-sorted the game's board",
rows[0].Name, rows[0].Rank)
}
if rows[1].Rank != 2 {
t.Errorf("second row has rank %d, want 2", rows[1].Rank)
}
}
// TestPeteHasNoRecordUntilHeFilesOne. The pete_duel_win/loss templates have
// existed in the renderer since before anything emitted them, so the record
// reads zero-zero today. Zero-zero has to render as "no bouts yet" and not as a
// 0% win rate, which would be a claim about bouts that never happened.
func TestPeteHasNoRecordUntilHeFilesOne(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if w := postRealm(t, s, "tok", realmPush{SnapshotAt: time.Now().Unix(), Realm: storage.Realm{}}); w.Code != 200 {
t.Fatalf("push = %d, want 200", w.Code)
}
v := s.standings()
if v.PeteFought {
t.Error("Pete claims a duel record with no duel dispatches filed")
}
if v.PeteWins != 0 || v.PeteLosses != 0 {
t.Errorf("record = %d-%d, want 0-0", v.PeteWins, v.PeteLosses)
}
}
// TestLevelBandReadsLikeWords. "levels 5–5" reads as a typo and "levels 0–0" as
// a bug; neither is a thing to print on a page about a place.
func TestLevelBandReadsLikeWords(t *testing.T) {
cases := []struct {
min, max int
want string
}{
{5, 8, "levels 5–8"},
{5, 5, "level 5"},
{0, 0, ""},
{0, 4, "up to level 4"},
{18, 0, "level 18 and up"},
}
for _, c := range cases {
if got := levelBand(c.min, c.max); got != c.want {
t.Errorf("levelBand(%d, %d) = %q, want %q", c.min, c.max, got, c.want)
}
}
}
// TestRealmIngestNeedsTheBearer. Same gate as every other ingest: the realm is
// public to read and authenticated to write.
func TestRealmIngestNeedsTheBearer(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if w := postRealm(t, s, "wrong", realmPush{SnapshotAt: time.Now().Unix()}); w.Code != 401 {
t.Errorf("bad bearer = %d, want 401", w.Code)
}
}
internal/web/run.go
+458
View File
@@ -0,0 +1,458 @@
package web
import (
"encoding/json"
"fmt"
"io"
"log/slog"
"net/http"
"strconv"
"strings"
"time"
"pete/internal/storage"
)
// The expedition liveblog.
//
// Until now Pete only ever heard how a run *ended*: a zone cleared, a retreat, a
// death. The run itself — the fight that nearly went wrong two rooms back, the
// trap, the haul — was narrated into one Matrix DM and thrown away. The map on
// the adventurer page has always shown *where* somebody is. This shows what
// happened there, which is the half that makes it a story instead of a position.
//
// It arrives on its own channel, deliberately not the dispatch queue: beats are
// high-volume and low-stakes, and a chatty run must never be able to spend the
// retry budget a death dispatch depends on. They are also the one thing gogobee
// pushes that is history rather than state, so they append instead of replacing.
//
// The log is a *log*. Lines are short, factual and stacked; Pete does not
// narrate them. His voice is for the dispatch that gets filed when the run ends
// — a running commentary in the same register would drown it out.
const (
// runBeatsMaxBatch bounds one push. gogobee batches on its 2-minute roster
// tick and caps itself well below this; the limit is here to stop a
// malformed or hostile payload spooling unbounded rows.
runBeatsMaxBatch = 1000
// runLogCap is how many beats the page shows. Read from the END — a log is
// read for what just happened, and a party deep into its third region would
// otherwise be showing its first morning forever.
runLogCap = 60
// runFinishedGrace is how long a finished run stays on the adventurer page.
// The interesting moment is the one right after it ends ("what happened?"),
// and that question is asked in minutes, not days. After this the page goes
// back to being a sheet.
runFinishedGrace = 6 * time.Hour
// runRetentionDays is how long a finished run's beats are kept at all.
runRetentionDays = 14
)
// runBeatsPush is the payload gogobee POSTs to /api/ingest/run.
type runBeatsPush struct {
Beats []storage.RunBeat `json:"beats"`
}
// runLogLine is one beat rendered for the column.
type runLogLine struct {
Emoji string
Text string
Room string // "4/9", or empty for a beat that isn't in a room
When string
Hurt bool // the party took damage or lost: worth an eye
Good bool // a find, a kill, a clear
}
// RunLogView is the liveblog as the page draws it.
type RunLogView struct {
Has bool
Live bool
Zone string
Outcome string // "" while live
Lines []runLogLine
Rooms string // "4 / 9"
// ReportURL points at the run's permalink, and only once the run is over.
// While it is still walking the log on this page IS the report, and offering a
// link to a second copy of what somebody is already reading is just a way to
// lose them.
ReportURL string
}
// handleRunIngest stores a batch of beats.
//
// Note what is NOT rejected here: an unknown beat kind. That is the same lesson
// the dispatch ingest learned the hard way — a beat Pete has no line for is a
// styling problem, not a validity problem, and 400ing it would silently delete a
// game event and park the row upstream forever. An unknown kind is stored, and
// renders as its own bare noun rather than not at all.
func (s *Server) handleRunIngest(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
var push runBeatsPush
if err := json.NewDecoder(io.LimitReader(r.Body, 4<<20)).Decode(&push); err != nil {
http.Error(w, "bad json", http.StatusBadRequest)
return
}
if len(push.Beats) > runBeatsMaxBatch {
http.Error(w, "batch too large", http.StatusBadRequest)
return
}
now := time.Now().Unix()
kept := make([]storage.RunBeat, 0, len(push.Beats))
for i, b := range push.Beats {
// run_id and seq ARE the row. Without both there is nothing to be
// idempotent on, and a re-send would duplicate the story.
if b.RunID == "" || b.Seq <= 0 {
http.Error(w, fmt.Sprintf("beat %d: run_id and a positive seq are required", i), http.StatusBadRequest)
return
}
// A beat with no clock can't be ordered against the rest of the run and
// would break the retention sweep, which keys on when a run ended.
if b.OccurredAt <= 0 {
b.OccurredAt = now
}
// Prose only rides the one kind that has any, and only after it clears the
// guard. A rejection drops the words and keeps the beat: the row is what
// stops gogobee re-authoring the same summary every tick forever, and a
// report with no summary is still a report.
if b.Kind == "summary" {
if !runSummaryGuard(b.Prose, runSummaryName(b)) {
slog.Warn("run ingest: prose-guard rejected run summary",
"run", b.RunID, "seq", b.Seq, "len", len(b.Prose))
b.Prose = ""
}
} else {
b.Prose = ""
}
kept = append(kept, b)
}
if len(kept) == 0 {
w.WriteHeader(http.StatusOK)
return
}
if err := storage.AppendRunBeats(kept); err != nil {
slog.Error("run ingest: append failed", "err", err, "beats", len(kept))
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
slog.Debug("run ingest: beats stored", "beats", len(kept))
w.WriteHeader(http.StatusOK)
}
// runSummaryName is the one character name a run summary is allowed to use.
//
// The beat carries it (gogobee knows who it is writing about), but a summary
// arrives a tick or two after the run ended and could be the first beat of that
// run Pete ever sees if an earlier batch was lost — so the stored header is the
// fallback. With neither, the guard runs with an empty allow-list, which rejects
// any summary naming anyone on the board. That is the right way to fail: a
// nameless summary about a nameless run is not worth the exposure.
func runSummaryName(b storage.RunBeat) string {
if b.Name != "" {
return b.Name
}
if run, ok, err := storage.RunByID(b.RunID); err == nil && ok {
return run.Name
}
return ""
}
// runLogFor builds the liveblog for one adventurer, or an empty view when there
// is nothing worth showing.
func runLogFor(token string) RunLogView {
run, ok, err := storage.LatestRunForToken(token)
if err != nil {
slog.Error("run log: header lookup failed", "err", err)
return RunLogView{}
}
if !ok {
return RunLogView{}
}
// A run that finished days ago is not news. It stays in the database — the
// dispatch that announced it links to it — but the adventurer page is about
// now, and an old log sitting under a live map reads as the live one.
if !run.Live() && time.Since(time.Unix(run.EndedAt, 0)) > runFinishedGrace {
return RunLogView{}
}
beats, err := storage.RunBeats(run.RunID, runLogCap)
if err != nil {
slog.Error("run log: beats lookup failed", "run", run.RunID, "err", err)
return RunLogView{}
}
if len(beats) == 0 {
return RunLogView{}
}
v := RunLogView{
Has: true,
Live: run.Live(),
Zone: run.Zone,
Outcome: run.Outcome,
}
if run.TotalRooms > 0 {
last := beats[len(beats)-1]
if last.Room > 0 {
v.Rooms = fmt.Sprintf("%d / %d", last.Room, run.TotalRooms)
}
}
if !v.Live {
v.ReportURL = runReportPath(run.RunID)
}
for _, b := range beats {
// The zone lives on the header, not on every beat — gogobee sends it once,
// on `start`, and the beat table has no column for it. Handing it back here
// is what stops the opening line reading "Set out into something", which is
// what a straight render of the stored row produces.
if b.Zone == "" {
b.Zone = run.Zone
}
if line, ok := renderRunBeat(b); ok {
v.Lines = append(v.Lines, line)
}
}
return v
}
// renderRunBeat turns one beat into one line. ok is false for a beat with
// nothing to say — a haul of nothing, a room with no identity.
//
// Everything here is assembled from the beat's own nouns and numbers. gogobee
// sends no prose down this channel and Pete invents none: the point of the log
// is that it is what happened, in order, and a line that reads better than the
// facts support is a line that is lying about a run somebody actually walked.
func renderRunBeat(b storage.RunBeat) (runLogLine, bool) {
l := runLogLine{When: time.Unix(b.OccurredAt, 0).UTC().Format("15:04")}
if b.Room > 0 && b.TotalRooms > 0 {
l.Room = fmt.Sprintf("%d/%d", b.Room, b.TotalRooms)
}
switch b.Kind {
case "summary":
// Prose about the whole run, not a moment in it. It belongs at the top of
// the report, and dropped into the middle of a log it would read as a beat
// that somehow saw the ending coming.
return runLogLine{}, false
case "start":
l.Emoji = "🚪"
l.Text = "Set out into " + orUnknown(b.Zone)
if b.TotalRooms > 0 {
l.Text += fmt.Sprintf(" — %d rooms deep", b.TotalRooms)
}
case "room":
l.Emoji = roomEmoji(b.RoomKind)
what, named := roomWord(b.RoomKind)
if b.Outcome == "doubled back" {
// "Doubled back to the next room" is a contradiction — the room behind
// you is the last one, not the next. Only a room with a name of its own
// is worth pointing at on the way back.
if !named {
l.Text = "Doubled back a room"
return l, true
}
l.Text = "Doubled back to the " + what
return l, true
}
l.Text = "Into the " + what
case "combat":
switch b.Outcome {
case "won":
l.Emoji = "⚔️"
l.Good = true
l.Text = orUnknown(b.Target) + " down"
if b.Amount > 0 {
l.Text += fmt.Sprintf(" — took %d", b.Amount)
} else {
l.Text += " — untouched"
}
case "retreat":
l.Emoji = "⏳"
l.Hurt = true
l.Text = "Outlasted by " + orUnknown(b.Target) + " — withdrew"
default:
l.Emoji = "💀"
l.Hurt = true
l.Text = "Fell to " + orUnknown(b.Target)
}
// The crown marks a boss BEATEN. On a boss that killed you it reads as
// congratulating the wrong party, so a loss keeps its skull whatever room
// it happened in.
if b.RoomKind == "boss" && b.Outcome == "won" {
l.Emoji = "👑"
} else if b.RoomKind == "elite" && b.Outcome == "won" {
l.Text = "Elite " + l.Text
}
if hp := hpTail(b); hp != "" {
l.Text += hp
}
if b.Crits > 0 {
l.Text += fmt.Sprintf(" · %s", plural(b.Crits, "critical hit", "critical hits"))
}
case "trap":
l.Emoji = "🕳"
if b.Amount <= 0 {
l.Text = "Trap — stepped over it"
l.Good = true
break
}
l.Hurt = true
l.Text = fmt.Sprintf("Trap sprung — %d damage", b.Amount)
if hp := hpTail(b); hp != "" {
l.Text += hp
}
case "treasure":
l.Emoji = "💎"
l.Good = true
l.Text = "Found " + orUnknown(b.Target)
switch b.Outcome {
case "cache":
l.Text += " in a cache"
case "boss":
l.Text += " on the boss"
}
case "haul":
if b.Amount <= 0 {
return runLogLine{}, false
}
l.Emoji = "🧺"
l.Text = fmt.Sprintf("Gathered %d", b.Amount)
if b.Target != "" {
l.Text += " — mostly " + b.Target
}
if b.Count > 1 {
l.Text += fmt.Sprintf(" (%d kinds)", b.Count)
}
case "lock":
l.Emoji = "🔒"
if b.Outcome == "picked" {
l.Good = true
l.Text = "Picked the lock"
if b.Target != "" {
l.Text += " — " + b.Target
}
break
}
l.Hurt = true
l.Text = "Every way on sealed — doubled back"
case "region":
l.Emoji = "🗺"
l.Room = "" // a border is between rooms, not in one
l.Text = "Crossed into " + orUnknown(b.Target)
if b.Region != "" {
l.Text = "Left " + b.Region + " for " + orUnknown(b.Target)
}
case "end":
switch b.Outcome {
case "cleared":
l.Emoji = "🏆"
l.Good = true
l.Text = "Run complete"
case "died":
l.Emoji = "💀"
l.Hurt = true
l.Text = "Run ended — didn't make it out"
case "retreated":
l.Emoji = "🚑"
l.Hurt = true
l.Text = "Withdrew, wounded but alive"
default:
l.Emoji = "🚪"
l.Text = "Run ended"
}
default:
// A kind Pete has no line for. Show the noun rather than nothing — the
// same call the dispatch ingest makes for an unknown event type, and for
// the same reason: silence here is indistinguishable from a bug.
l.Emoji = "•"
l.Text = strings.ReplaceAll(b.Kind, "_", " ")
if b.Target != "" {
l.Text += " — " + b.Target
}
}
if l.Text == "" {
return runLogLine{}, false
}
return l, true
}
// hpTail is the " (HP 21/34)" suffix, and only when the pair is real. A zero max
// means gogobee didn't send one, not that the adventurer has no health.
func hpTail(b storage.RunBeat) string {
if b.HPMax <= 0 {
return ""
}
return fmt.Sprintf(" · %d/%d HP", b.HP, b.HPMax)
}
// roomWord names a room the way somebody walking through it would. "exploration"
// is the engine's word for "a room", and echoing it back reads like a database
// column; the rooms with an actual identity get named and the rest are just the
// next one along.
// named is false for a room with no identity of its own, which is most of them.
// Callers that need to say something about a *particular* room have to know the
// difference — see the doubled-back branch.
func roomWord(kind string) (word string, named bool) {
switch kind {
case "entry":
return "entrance", true
case "trap":
return "trapped room", true
case "elite":
return "elite's room", true
case "boss":
return "boss chamber", true
case "secret":
return "hidden room", true
}
return "next room", false
}
func roomEmoji(kind string) string {
switch kind {
case "trap":
return "🕳"
case "elite":
return "🛡"
case "boss":
return "👑"
case "entry":
return "🚪"
}
return "🚶"
}
func orUnknown(s string) string {
if s == "" {
return "something"
}
return s
}
func plural(n int, one, many string) string {
if n == 1 {
return "1 " + one
}
return strconv.Itoa(n) + " " + many
}
internal/web/run_report.go
+410
View File
@@ -0,0 +1,410 @@
package web
import (
"fmt"
"log/slog"
"net/http"
"net/url"
"strings"
"time"
"pete/internal/storage"
)
// The run report — the permalink an expedition leaves behind.
//
// The liveblog on the adventurer page answers "what is happening"; it is capped,
// it scrolls, and six hours after the run ends it is gone, because that page is
// about now. This answers the other question, the one asked afterwards and often
// by somebody who wasn't watching: what *was* that run. So it is the whole log,
// uncapped, with the numbers rolled up and the moment it turned pulled out of
// the middle — and it is stable for a fortnight, which is what makes it a thing
// worth putting in a dispatch and a thing worth sending to somebody.
//
// It is deliberately assembled from the same beats the liveblog renders, through
// the same renderRunBeat. A report that told a different story from the log it
// was built out of would be the more convincing of the two and the less true.
//
// The one thing here that Pete did not write is the summary: gogobee's LLM reads
// the finished run back and says what it was about. That is a judgement, not a
// fact, so it is the only prose on the channel and it passes the same guard a
// dispatch lede does before it reaches this page.
// runReportCap bounds the log on the report. Far above the liveblog's 60 — the
// point of this page is that nothing is missing — but not unbounded: a stuck
// multi-day expedition can beat out thousands of rows, and a page nobody can
// scroll is its own kind of missing.
const runReportCap = 500
// runStat is one rolled-up number with its label. Assembled rather than
// hardcoded in the template so a run with nothing to say about traps doesn't
// render a proud zero.
type runStat struct {
Value string
Label string
}
// RunReportView is the report as the page draws it.
type RunReportView struct {
pageData
RunID string
Name string
WhoURL string // link back to the adventurer page; "" when they're off the board
Level int
Zone string
Live bool
Outcome string // the raw word, for the chip class
Verdict string // the human sentence for it
Emoji string
Summary string
When string
Elapsed string
Rooms string
Stats []runStat
// Turning is the single beat that decided the run — the biggest thing that
// happened to the party's health in one go. Nil on a run where nothing much
// did, which is a real outcome and not worth inventing drama for.
Turning *runLogLine
Lines []runLogLine
Truncated bool
Permalink string
}
// runReportPath is the report's URL. The run id is generated by gogobee as
// 16 hex characters, but it is still escaped: it arrives over a wire, and a link
// that routes somewhere else because an id grew a slash is a bug you find in
// production.
func runReportPath(runID string) string {
return "/adventure/run/" + url.PathEscape(runID)
}
// handleRunReport serves one expedition's report.
//
// The visibility rule is the adventurer page's, exactly: a run whose token is not
// on the current board 404s. Finishing a run does not take anyone off the board —
// they stay on it as idle — so this only ever fires for a player who opted out or
// was removed, which is precisely the case where a room-by-room account of where
// they went must stop being reachable. An unattributed run (its `start` beat never
// arrived, so there is no token at all) 404s for the same reason: Pete cannot
// establish whose run it is, and "don't know" is not a basis for publishing one.
func (s *Server) handleRunReport(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
runID := r.PathValue("run_id")
run, ok, err := storage.RunByID(runID)
if err != nil {
slog.Error("run report: header lookup failed", "run", runID, "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
if !ok || run.Token == "" {
http.NotFound(w, r)
return
}
entry, onBoard, err := storage.RosterEntryByToken(run.Token)
if err != nil {
slog.Error("run report: roster lookup failed", "run", runID, "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
if !onBoard {
http.NotFound(w, r)
return
}
beats, err := storage.RunBeats(run.RunID, runReportCap)
if err != nil {
slog.Error("run report: beats lookup failed", "run", runID, "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
if len(beats) == 0 {
// A header with no beats is a run that was pruned out from under its own
// dispatch, or one whose beats never landed. Either way there is no report.
http.NotFound(w, r)
return
}
s.track(r, "adventure")
view := buildRunReport(run, beats)
base := s.base(r)
base.Active = "adventure"
base.NoIndex = true // names a player character, like every other adventure page
view.pageData = base
// The name on the header is the roster's, not the beat's: the `start` beat
// froze a name at the moment the party set out, and the board is the current
// truth about what to call somebody.
if entry.Name != "" {
view.Name = entry.Name
}
view.WhoURL = "/adventure/who/" + url.PathEscape(run.Token)
view.Permalink = s.siteURL(runReportPath(run.RunID))
s.render(w, "run_report", view)
}
// buildRunReport turns a run and its beats into the page. Pure — no storage, no
// server — so the whole render is testable against a slice of beats, which is
// the only honest way to check that a run reads correctly.
func buildRunReport(run storage.Run, beats []storage.RunBeat) RunReportView {
v := RunReportView{
RunID: run.RunID,
Name: run.Name,
Level: run.Level,
Zone: run.Zone,
Live: run.Live(),
Outcome: run.Outcome,
Summary: run.Summary,
}
if v.Name == "" {
v.Name = "An adventurer"
}
if v.Zone == "" {
v.Zone = "the dungeon"
}
v.Verdict, v.Emoji = runVerdict(run)
when := run.EndedAt
if when == 0 {
when = run.StartedAt
}
if when > 0 {
v.When = time.Unix(when, 0).UTC().Format("Jan 2, 2006 · 15:04")
}
v.Elapsed = runElapsed(run, beats)
// How far they got — and only when that is a fact worth stating. A dungeon
// graph forks, so a run that cleared it never walks every room, and a header
// reading "room 7 / 9" over the word "Cleared it" says they fell two short of
// something. On a run that ended badly the same number is the whole story.
if run.Outcome != "cleared" {
deepest := 0
for _, b := range beats {
if b.Room > deepest {
deepest = b.Room
}
}
switch {
case deepest > 0 && run.TotalRooms > 0:
v.Rooms = fmt.Sprintf("got as far as room %d of %d", deepest, run.TotalRooms)
case deepest > 0:
v.Rooms = fmt.Sprintf("got as far as room %d", deepest)
}
}
var turningAt int64 = -1
for _, b := range beats {
// The summary is prose about the run, not a moment in it. It has its own
// place on the page and would read as a stray paragraph in the middle of a
// log if it were allowed to render as a line.
if b.Kind == "summary" {
continue
}
if b.Zone == "" {
b.Zone = run.Zone
}
line, ok := renderRunBeat(b)
if !ok {
continue
}
v.Lines = append(v.Lines, line)
// The turning point is the single largest hit the party took in one go.
// Ties go to the earlier beat: the moment a run turned is the first time
// it did, not the last time it did it again.
if hurt := beatHurt(b); hurt > 0 && int64(hurt) > turningAt {
turningAt = int64(hurt)
pick := line
v.Turning = &pick
}
}
v.Truncated = len(beats) >= runReportCap
v.Stats = runStats(beats)
return v
}
// beatHurt is how much health one beat cost, and it is the only thing the
// turning point is chosen on. Damage the party absorbed is the currency of a
// dungeon crawl: a fight won without a scratch is not the moment anything
// turned, however big the monster was.
func beatHurt(b storage.RunBeat) int {
switch b.Kind {
case "combat", "trap":
return b.Amount
}
return 0
}
// runVerdict is the human reading of an outcome, plus the emoji the header wears.
func runVerdict(run storage.Run) (verdict, emoji string) {
if run.Live() {
return "Still under way", "🚶"
}
switch run.Outcome {
case "cleared":
return "Cleared it", "🏆"
case "died":
return "Didn't come home", "💀"
case "retreated":
return "Walked out wounded", "🚑"
case "abandoned":
// The generic funnel's word. It covers a region crossing and an idle reap
// alike, and neither of those is a failure — saying "abandoned" at somebody
// would be Pete editorialising with the least informative word available.
return "Ended", "🚪"
}
return "Ended", "🚪"
}
// runElapsed is how long the party was down there, phrased the way somebody
// would say it. Preference order matters: the header clock is authoritative when
// it has both ends, and the beats are the fallback for a run whose `start` never
// arrived (which is exactly the run whose started_at is a later beat's clock).
func runElapsed(run storage.Run, beats []storage.RunBeat) string {
from, to := run.StartedAt, run.EndedAt
if from == 0 && len(beats) > 0 {
from = beats[0].OccurredAt
}
if to == 0 && len(beats) > 0 {
to = beats[len(beats)-1].OccurredAt
}
if from == 0 || to <= from {
return ""
}
d := time.Duration(to-from) * time.Second
switch {
case d < time.Minute:
return "under a minute"
case d < time.Hour:
return fmt.Sprintf("%d min", int(d.Minutes()))
case d < 24*time.Hour:
h := int(d.Hours())
m := int(d.Minutes()) % 60
if m == 0 {
return plural(h, "hour", "hours")
}
return fmt.Sprintf("%dh %dm", h, m)
}
return plural(int(d.Hours()/24), "day", "days")
}
// runStats rolls the beats up into the tiles above the log.
//
// Only non-zero tiles are emitted. A run that sprung no traps should say nothing
// about traps rather than display a confident 0 — the tile row is a summary of
// what this run *was*, and padding it out with absences makes every run look the
// same, which is the exact failure the report exists to fix.
func runStats(beats []storage.RunBeat) []runStat {
var (
fights, wins, damage, crits int
treasures, traps, gathered int
)
for _, b := range beats {
switch b.Kind {
case "combat":
fights++
if b.Outcome == "won" {
wins++
}
damage += b.Amount
crits += b.Crits
case "trap":
if b.Amount > 0 {
traps++
damage += b.Amount
}
case "treasure":
treasures++
case "haul":
gathered += b.Amount
}
}
var out []runStat
add := func(n int, label, plural string) {
if n <= 0 {
return
}
if n != 1 && plural != "" {
label = plural
}
out = append(out, runStat{Value: fmt.Sprintf("%d", n), Label: label})
}
if fights > 0 {
// Wins over fights rather than two tiles: on a run that ended badly the
// interesting number is the gap between them, and two separate tiles make a
// reader do the subtraction.
out = append(out, runStat{
Value: fmt.Sprintf("%d/%d", wins, fights),
Label: "fights won",
})
}
add(damage, "damage taken", "")
add(treasures, "treasure found", "treasures found")
add(traps, "trap sprung", "traps sprung")
add(crits, "critical hit", "critical hits")
add(gathered, "supplies gathered", "")
return out
}
// runReportLinkFor is the "read the run" link for a dispatch, or "" when there
// isn't one to offer.
//
// Three ways to have no link, all of them normal: the fact predates the run
// report (or isn't the end of an expedition) and carries no run id; the run has
// been swept by the fortnight retention; or its owner has since left the board.
// The last one is why this re-checks visibility rather than trusting the stored
// id — an opt-out has to close the door on links that were minted before it.
func runReportLinkFor(ev *storage.AdvEvent) string {
if ev == nil || ev.RunID == "" {
return ""
}
run, ok, err := storage.RunByID(ev.RunID)
if err != nil {
slog.Error("run report link: header lookup failed", "run", ev.RunID, "err", err)
return ""
}
if !ok || run.Token == "" {
return ""
}
if _, onBoard, err := storage.RosterEntryByToken(run.Token); err != nil || !onBoard {
return ""
}
return runReportPath(run.RunID)
}
// maxRunSummary caps the LLM run summary. Longer than a dispatch lede on purpose
// — it is three sentences over a whole expedition rather than one over a single
// fact — and still short enough that a runaway generation is rejected rather
// than printed.
const maxRunSummary = 1200
// runSummaryGuard decides whether gogobee's run summary is safe to print. It is
// the liveblog's half of proseGuard and it exists for the identical reason: the
// text is LLM output over player-chosen names, so the only defence that means
// anything is checking the RENDERED words rather than the structured fields
// beside them.
//
// The allow-list is the run's own adventurer, which is the only person a run
// summary has any business naming. A summary that names a *different* character
// on the board is either a hallucination or somebody who found an injection path,
// and both are the same answer: drop the prose, keep the report. The report
// without a summary is the log and the numbers, which is most of it.
func runSummaryGuard(text, name string) bool {
if strings.TrimSpace(text) == "" || len(text) > maxRunSummary {
return false
}
allow := map[string]bool{}
if name != "" {
allow[strings.ToLower(name)] = true
}
lowered := strings.ToLower(text)
for known := range storage.KnownCharacterNames() {
if allow[known] {
continue
}
if containsWholeWord(lowered, known) {
return false
}
}
return true
}
internal/web/run_report_test.go
+355
View File
@@ -0,0 +1,355 @@
package web
import (
"net/http/httptest"
"strings"
"testing"
"time"
"pete/internal/storage"
)
// onBoard puts the run's owner on the roster. Every report test needs it: the
// report's visibility gate is the adventurer page's, and with no board at all
// every token reads as opted-out.
func onBoard(t *testing.T, s *Server, ingest, token, name string) {
t.Helper()
if w := postRoster(t, s, ingest, rosterPush{
SnapshotAt: time.Now().Unix(),
Adventurers: []storage.RosterEntry{entry(token, name, "idle", "")},
}); w.Code != 200 {
t.Fatalf("roster push failed: %d %s", w.Code, w.Body.String())
}
}
// aFinishedRun is a small but realistic expedition: two fights, a trap that hurt
// more than either of them, a find, and a clean ending.
func aFinishedRun(now int64) []storage.RunBeat {
return []storage.RunBeat{
startBeat(now),
{RunID: "run-1", Seq: 2, Kind: "combat", OccurredAt: now + 60, Room: 2, TotalRooms: 9,
Target: "Bone Chanter", Outcome: "won", Amount: 7, HP: 61, HPMax: 68, Crits: 1},
{RunID: "run-1", Seq: 3, Kind: "trap", OccurredAt: now + 120, Room: 3, TotalRooms: 9,
RoomKind: "trap", Outcome: "sprung", Amount: 22, HP: 39, HPMax: 68},
{RunID: "run-1", Seq: 4, Kind: "treasure", OccurredAt: now + 200, Room: 4, TotalRooms: 9,
Target: "Ashlight Pendant", Outcome: "cache"},
{RunID: "run-1", Seq: 5, Kind: "combat", OccurredAt: now + 300, Room: 5, TotalRooms: 9,
RoomKind: "boss", Target: "Valdris", Outcome: "won", Amount: 12, HP: 27, HPMax: 68},
{RunID: "run-1", Seq: 6, Kind: "end", OccurredAt: now + 360, Room: 5, TotalRooms: 9,
Outcome: "cleared"},
}
}
func getReport(t *testing.T, s *Server, runID string) *httptest.ResponseRecorder {
t.Helper()
req := httptest.NewRequest("GET", "/adventure/run/"+runID, nil)
req.SetPathValue("run_id", runID)
w := httptest.NewRecorder()
s.handleRunReport(w, req)
return w
}
// TestRunReportRendersTheWholeRun. The liveblog is capped and expires; the
// report is the artefact, so what it has to get right is that everything is
// there — every beat, the rollup, and the moment it turned.
func TestRunReportRendersTheWholeRun(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
onBoard(t, s, token, "tok-abc", "Josie")
postBeats(t, s, token, aFinishedRun(now)...)
w := getReport(t, s, "run-1")
if w.Code != 200 {
t.Fatalf("report: %d %s", w.Code, w.Body.String())
}
body := w.Body.String()
for _, want := range []string{
"Josie in Crypt of Valdris",
"Cleared it",
"Bone Chanter down",
"Trap sprung — 22 damage",
"Found Ashlight Pendant",
"Valdris down",
"Run complete",
"2/2", // fights won, as one tile rather than two
"41", // damage taken: 7 + 22 + 12
"Where it turned", // the trap, being the biggest single hit
} {
if !strings.Contains(body, want) {
t.Errorf("report is missing %q", want)
}
}
}
// TestTurningPointIsTheBiggestHit. The plan's word for it is "turning point" and
// the temptation is to pick the boss, because a boss is the most *important*
// thing in a run. It isn't the thing that turned it: a boss killed without a
// scratch turned nothing, and the trap two rooms earlier that took a third of
// the party's health is the beat the reader is looking for.
func TestTurningPointIsTheBiggestHit(t *testing.T) {
now := time.Now().Unix()
run := storage.Run{RunID: "r", Token: "t", Name: "Josie", Zone: "Crypt", TotalRooms: 9,
StartedAt: now, EndedAt: now + 360, Outcome: "cleared"}
v := buildRunReport(run, aFinishedRun(now))
if v.Turning == nil {
t.Fatal("no turning point on a run with a 22-damage trap in it")
}
if !strings.Contains(v.Turning.Text, "Trap sprung") {
t.Errorf("turning point = %q, want the trap (22) over the boss (12)", v.Turning.Text)
}
// A run where nothing landed has no turning point rather than a made-up one.
quiet := []storage.RunBeat{
{RunID: "r", Seq: 1, Kind: "start", OccurredAt: now, Zone: "Crypt", TotalRooms: 3},
{RunID: "r", Seq: 2, Kind: "combat", OccurredAt: now + 10, Target: "Rat", Outcome: "won"},
{RunID: "r", Seq: 3, Kind: "end", OccurredAt: now + 20, Outcome: "cleared"},
}
if q := buildRunReport(run, quiet); q.Turning != nil {
t.Errorf("invented a turning point on an untouched run: %q", q.Turning.Text)
}
}
// TestHowFarTheyGotOnlyMattersWhenTheyFellShort. A dungeon graph forks, so a run
// that cleared it never walks every room — "room 7 / 9" printed under the words
// "Cleared it" says they came up two short of something they in fact finished.
// On a run that ended badly the same number is the whole story.
func TestHowFarTheyGotOnlyMattersWhenTheyFellShort(t *testing.T) {
now := time.Now().Unix()
beats := aFinishedRun(now)
base := storage.Run{RunID: "r", Token: "t", Name: "Josie", Zone: "Crypt", TotalRooms: 9,
StartedAt: now, EndedAt: now + 360}
cleared := base
cleared.Outcome = "cleared"
if v := buildRunReport(cleared, beats); v.Rooms != "" {
t.Errorf("a cleared run advertised how far it got: %q", v.Rooms)
}
died := base
died.Outcome = "died"
if v := buildRunReport(died, beats); v.Rooms != "got as far as room 5 of 9" {
t.Errorf("Rooms = %q, want the depth on a run that ended badly", v.Rooms)
}
}
// TestRunStatsSkipTheZeroes. The tile row is meant to say what THIS run was. A
// run that sprung no traps and found no treasure rendering two confident zeroes
// makes every run look identical, which is the exact failure the report exists
// to fix.
func TestRunStatsSkipTheZeroes(t *testing.T) {
now := time.Now().Unix()
stats := runStats([]storage.RunBeat{
{Kind: "combat", Outcome: "won", Target: "Rat", Amount: 3, OccurredAt: now},
{Kind: "trap", Outcome: "avoided", Amount: 0, OccurredAt: now + 1}, // stepped over it
})
for _, s := range stats {
if strings.Contains(s.Label, "trap") {
t.Errorf("a trap that was avoided produced a tile: %+v", s)
}
if strings.Contains(s.Label, "treasure") {
t.Errorf("a run with no finds produced a treasure tile: %+v", s)
}
if strings.Contains(s.Label, "critical") {
t.Errorf("a run with no crits produced a crit tile: %+v", s)
}
}
if len(stats) != 2 { // fights won + damage taken
t.Fatalf("want 2 tiles, got %d: %+v", len(stats), stats)
}
}
// TestRunReportIsGatedOnTheBoard is the report's half of TestOffTheBoardShipsNoLog.
//
// The report outlives the liveblog by a fortnight and is linked from a public
// dispatch, so it is the surface most likely to still be reachable after somebody
// opts out. Coming off the board is what an opt-out looks like from Pete's side,
// and from that moment a room-by-room account of where they went has to stop
// resolving — including through the link a dispatch minted days earlier.
func TestRunReportIsGatedOnTheBoard(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
onBoard(t, s, token, "tok-abc", "Josie")
postBeats(t, s, token, aFinishedRun(now)...)
if w := getReport(t, s, "run-1"); w.Code != 200 {
t.Fatalf("report should serve while its owner is on the board: %d", w.Code)
}
ev := &storage.AdvEvent{GUID: "zone_clear:x:1", EventType: "zone_clear", Subject: "Josie",
RunID: "run-1", OccurredAt: now}
if err := storage.InsertAdventureEvent(ev); err != nil {
t.Fatal(err)
}
if link := runReportLinkFor(ev); link != "/adventure/run/run-1" {
t.Fatalf("dispatch link = %q, want the report path", link)
}
// They opt out: gogobee stops sending them, so the next board has no such
// token. The beats Pete already holds are append-only and can't be recalled —
// what has to happen is that they become unreachable.
if w := postRoster(t, s, token, rosterPush{
SnapshotAt: now + 1,
Adventurers: []storage.RosterEntry{entry("someone-else", "Quack", "idle", "")},
}); w.Code != 200 {
t.Fatalf("roster push failed: %d", w.Code)
}
if w := getReport(t, s, "run-1"); w.Code != 404 {
t.Errorf("report still served after its owner left the board: %d", w.Code)
}
if link := runReportLinkFor(ev); link != "" {
t.Errorf("dispatch still offers a link to an opted-out player's run: %q", link)
}
}
// TestUnattributedRunHasNoReport. A run whose `start` beat never arrived still
// gets a readable log — that is deliberate, and W2a pinned it. But it has no
// token, so Pete cannot establish whose run it is, and "don't know" is not a
// basis on which to publish where somebody went.
func TestUnattributedRunHasNoReport(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
onBoard(t, s, token, "tok-abc", "Josie")
postBeats(t, s, token,
storage.RunBeat{RunID: "orphan", Seq: 2, Kind: "combat", OccurredAt: now,
Room: 2, TotalRooms: 9, Target: "Bone Chanter", Outcome: "won"},
storage.RunBeat{RunID: "orphan", Seq: 3, Kind: "end", OccurredAt: now + 5, Outcome: "cleared"},
)
if w := getReport(t, s, "orphan"); w.Code != 404 {
t.Errorf("served a report for a run with no owner: %d", w.Code)
}
}
// TestRunSummaryIsGuardedLikeADispatch. The summary is the only prose on the
// beat channel and it is LLM output over player-chosen names, so the field
// checks that make a *fact* safe are worth nothing here — the words are the
// thing being rendered. A summary that names a different adventurer on the board
// is either a hallucination or an injection, and both get the same answer: keep
// the report, drop the prose.
func TestRunSummaryIsGuardedLikeADispatch(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
if w := postRoster(t, s, token, rosterPush{SnapshotAt: now, Adventurers: []storage.RosterEntry{
entry("tok-abc", "Josie", "idle", ""),
entry("tok-def", "Quack", "idle", ""),
}}); w.Code != 200 {
t.Fatalf("roster push failed: %d", w.Code)
}
postBeats(t, s, token, aFinishedRun(now)...)
// Names a bystander who was never on this expedition.
if w := postBeats(t, s, token, storage.RunBeat{
RunID: "run-1", Seq: 7, Kind: "summary", OccurredAt: now + 400, Name: "Josie",
Prose: "Josie and Quack went down into the crypt together and only one came back.",
}); w.Code != 200 {
t.Fatalf("a rejected summary should still be a 200: %d %s", w.Code, w.Body.String())
}
run, _, err := storage.RunByID("run-1")
if err != nil {
t.Fatal(err)
}
if run.Summary != "" {
t.Errorf("guard let through a summary naming a bystander: %q", run.Summary)
}
// The same beat, about the right person only. The seq differs because the
// rejected row is still stored — that is what stops gogobee re-authoring it
// forever — so a retry has to be a new beat.
good := "Josie took a bad trap on the way in and finished the boss on a quarter of her health."
if w := postBeats(t, s, token, storage.RunBeat{
RunID: "run-1", Seq: 8, Kind: "summary", OccurredAt: now + 401, Name: "Josie", Prose: good,
}); w.Code != 200 {
t.Fatalf("summary rejected: %d %s", w.Code, w.Body.String())
}
run, _, err = storage.RunByID("run-1")
if err != nil {
t.Fatal(err)
}
if run.Summary != good {
t.Errorf("summary = %q, want it stored", run.Summary)
}
// And it renders on the report, above the log rather than inside it.
w := getReport(t, s, "run-1")
if !strings.Contains(w.Body.String(), good) {
t.Error("the summary didn't reach the report page")
}
v := runLogFor("tok-abc")
for _, ln := range v.Lines {
if strings.Contains(ln.Text, "bad trap on the way in") {
t.Errorf("the summary rendered as a log line: %q", ln.Text)
}
}
}
// TestOnlyTheSummaryBeatCarriesProse. The guard at ingest only inspects the kind
// it knows about, so any other kind arriving with prose would put unguarded text
// onto the header. Both halves have to hold — the beat must be scrubbed, and the
// header fold must ignore it even if it weren't.
func TestOnlyTheSummaryBeatCarriesProse(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
onBoard(t, s, token, "tok-abc", "Josie")
postBeats(t, s, token, startBeat(now), storage.RunBeat{
RunID: "run-1", Seq: 2, Kind: "combat", OccurredAt: now + 10,
Target: "Bone Chanter", Outcome: "won",
Prose: "and then Quack showed up out of nowhere",
})
run, _, err := storage.RunByID("run-1")
if err != nil {
t.Fatal(err)
}
if run.Summary != "" {
t.Errorf("a combat beat wrote the run summary: %q", run.Summary)
}
beats, err := storage.RunBeats("run-1", 0)
if err != nil {
t.Fatal(err)
}
for _, b := range beats {
if b.Prose != "" {
t.Errorf("beat %d (%s) kept prose it isn't allowed to carry: %q", b.Seq, b.Kind, b.Prose)
}
}
}
// TestFinishedRunOffersItsReport / a live one doesn't. While a run is still
// walking, the column on the adventurer page IS the report; a link to a second
// copy of what somebody is already reading is only a way to lose them.
func TestFinishedRunOffersItsReport(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
onBoard(t, s, token, "tok-abc", "Josie")
postBeats(t, s, token, startBeat(now))
if v := runLogFor("tok-abc"); v.ReportURL != "" {
t.Errorf("a live run offered a report link: %q", v.ReportURL)
}
postBeats(t, s, token, storage.RunBeat{
RunID: "run-1", Seq: 9, Kind: "end", OccurredAt: now + 60, Outcome: "cleared"})
if v := runLogFor("tok-abc"); v.ReportURL != "/adventure/run/run-1" {
t.Errorf("ReportURL = %q, want the report path once the run is over", v.ReportURL)
}
}
// TestRunElapsedFallsBackToTheBeats. started_at comes off the `start` beat, so a
// run that lost it has a zero clock on the header and would otherwise report no
// duration at all — on precisely the run where the log is the only record there is.
func TestRunElapsedFallsBackToTheBeats(t *testing.T) {
now := time.Now().Unix()
beats := []storage.RunBeat{
{RunID: "r", Seq: 2, Kind: "combat", OccurredAt: now, Target: "Rat", Outcome: "won"},
{RunID: "r", Seq: 3, Kind: "end", OccurredAt: now + 5400, Outcome: "cleared"},
}
// No StartedAt: the beat that would have set it never arrived.
got := runElapsed(storage.Run{RunID: "r", EndedAt: now + 5400}, beats)
if got != "1h 30m" {
t.Errorf("elapsed = %q, want 1h 30m off the beats", got)
}
}
internal/web/run_test.go
+362
View File
@@ -0,0 +1,362 @@
package web
import (
"bytes"
"encoding/json"
"net/http/httptest"
"testing"
"time"
"pete/internal/storage"
)
func postBeats(t *testing.T, s *Server, token string, beats ...storage.RunBeat) *httptest.ResponseRecorder {
t.Helper()
body, _ := json.Marshal(runBeatsPush{Beats: beats})
req := httptest.NewRequest("POST", "/api/ingest/run", bytes.NewReader(body))
if token != "" {
req.Header.Set("Authorization", "Bearer "+token)
}
w := httptest.NewRecorder()
s.handleRunIngest(w, req)
return w
}
// startBeat is the beat that names a run. Everything downstream keys on run_id
// alone, so this is the only one that has to carry identity.
func startBeat(now int64) storage.RunBeat {
return storage.RunBeat{
RunID: "run-1", Seq: 1, Kind: "start", OccurredAt: now,
Token: "tok-abc", Name: "Josie", Level: 14, Zone: "Crypt of Valdris", TotalRooms: 9,
}
}
// TestUnknownBeatKindIsStoredAndRendered is the regression for a whole class of
// bug, not for one beat kind.
//
// The dispatch channel learned this the hard way: an unknown event_type used to
// 400, which parked the queue row upstream and silently deleted a game event
// that had actually happened. The beat channel is a second chance to make the
// same mistake, and this is the test that stops it — gogobee must be able to
// invent a beat kind on any Tuesday and have it show up as a plain line rather
// than as a 400 and a hole in the log.
func TestUnknownBeatKindIsStoredAndRendered(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
if w := postBeats(t, s, token,
startBeat(now),
storage.RunBeat{RunID: "run-1", Seq: 2, Kind: "seance", OccurredAt: now + 5,
Room: 2, TotalRooms: 9, Target: "a cold draught"},
); w.Code != 200 {
t.Fatalf("unknown beat kind rejected: %d %s", w.Code, w.Body.String())
}
v := runLogFor("tok-abc")
if !v.Has {
t.Fatal("no log built for a run that has two beats")
}
if len(v.Lines) != 2 {
t.Fatalf("want 2 lines, got %d: %+v", len(v.Lines), v.Lines)
}
last := v.Lines[1]
if last.Text != "seance — a cold draught" {
t.Errorf("unknown kind rendered as %q; it should degrade to its own noun", last.Text)
}
}
// TestBeatIngestRequiresIdentity — run_id and seq ARE the row. Without both
// there is nothing for the re-send to collapse onto, so this is the one thing
// the ingest is strict about.
func TestBeatIngestRequiresIdentity(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
if w := postBeats(t, s, token, storage.RunBeat{Seq: 1, Kind: "room", OccurredAt: now}); w.Code != 400 {
t.Errorf("beat with no run_id: want 400, got %d", w.Code)
}
if w := postBeats(t, s, token,
storage.RunBeat{RunID: "run-1", Kind: "room", OccurredAt: now}); w.Code != 400 {
t.Errorf("beat with no seq: want 400, got %d", w.Code)
}
if w := postBeats(t, s, "wrong-token", startBeat(now)); w.Code != 401 {
t.Errorf("unauthed beat: want 401, got %d", w.Code)
}
}
// TestBeatsAreIdempotentOnRunAndSeq. gogobee re-sends a batch whenever it
// delivered it but failed to mark it locally, which is a normal outcome of a
// crash between two writes — so a duplicate batch has to be free.
func TestBeatsAreIdempotentOnRunAndSeq(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
beats := []storage.RunBeat{
startBeat(now),
{RunID: "run-1", Seq: 2, Kind: "room", OccurredAt: now + 10, Room: 2, TotalRooms: 9, RoomKind: "exploration"},
}
for i := 0; i < 3; i++ {
if w := postBeats(t, s, token, beats...); w.Code != 200 {
t.Fatalf("push %d: %d %s", i, w.Code, w.Body.String())
}
}
stored, err := storage.RunBeats("run-1", 0)
if err != nil {
t.Fatal(err)
}
if len(stored) != 2 {
t.Fatalf("three identical pushes produced %d beats, want 2", len(stored))
}
}
// TestRunHeaderIsDerivedAndSticky. The header is not pushed as its own object —
// it is folded out of the beats. The forty beats after `start` carry no name and
// no zone, and none of them may erase the one that did.
func TestRunHeaderIsDerivedAndSticky(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
postBeats(t, s, token, startBeat(now))
postBeats(t, s, token,
storage.RunBeat{RunID: "run-1", Seq: 2, Kind: "room", OccurredAt: now + 10, Room: 2, TotalRooms: 9},
storage.RunBeat{RunID: "run-1", Seq: 3, Kind: "combat", OccurredAt: now + 20,
Room: 2, TotalRooms: 9, Target: "Bone Chanter", Outcome: "won", Amount: 7, HP: 61, HPMax: 68},
)
run, ok, err := storage.RunByID("run-1")
if err != nil || !ok {
t.Fatalf("run header missing: ok=%v err=%v", ok, err)
}
if run.Name != "Josie" || run.Zone != "Crypt of Valdris" || run.Level != 14 {
t.Errorf("later beats clobbered the start beat's identity: %+v", run)
}
if !run.Live() {
t.Error("run with no end beat should still be live")
}
// Now close it, then try to reopen it with a second, less specific end.
postBeats(t, s, token,
storage.RunBeat{RunID: "run-1", Seq: 4, Kind: "end", OccurredAt: now + 30, Outcome: "died"},
storage.RunBeat{RunID: "run-1", Seq: 5, Kind: "end", OccurredAt: now + 31, Outcome: "abandoned"},
)
run, _, _ = storage.RunByID("run-1")
if run.Live() {
t.Error("run with an end beat should not be live")
}
if run.Outcome != "died" {
t.Errorf("outcome = %q, want %q — the first, specific close must win", run.Outcome, "died")
}
}
// TestRunWithNoStartBeatStillHasALog. A start beat can be lost (retention on the
// game box, an opt-out flipped mid-run, a batch that never made it). The run
// that follows is unattributed, which is a reason not to hang it off an
// adventurer page — not a reason to throw the log away.
func TestRunWithNoStartBeatStillHasALog(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
if w := postBeats(t, s, token,
storage.RunBeat{RunID: "orphan", Seq: 7, Kind: "combat", OccurredAt: now,
Room: 3, TotalRooms: 9, Target: "Gravewright", Outcome: "won"},
); w.Code != 200 {
t.Fatalf("orphan beat rejected: %d", w.Code)
}
run, ok, err := storage.RunByID("orphan")
if err != nil || !ok {
t.Fatalf("orphan run has no header: ok=%v err=%v", ok, err)
}
if run.Token != "" {
t.Errorf("orphan run claimed token %q", run.Token)
}
// ...and it is unreachable from any adventurer page, which is the point.
if v := runLogFor(""); v.Has {
t.Error("empty token resolved to a log")
}
}
// TestFinishedRunAgesOffThePage. The adventurer page is about now. A run that
// ended days ago sitting under a live map reads as the live one, which is worse
// than showing nothing — the rows stay in the database for the dispatch that
// links to them.
func TestFinishedRunAgesOffThePage(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
old := time.Now().Add(-24 * time.Hour).Unix()
postBeats(t, s, token,
storage.RunBeat{RunID: "run-old", Seq: 1, Kind: "start", OccurredAt: old,
Token: "tok-abc", Name: "Josie", Zone: "Underforge", TotalRooms: 8},
storage.RunBeat{RunID: "run-old", Seq: 2, Kind: "end", OccurredAt: old + 600, Outcome: "cleared"},
)
if v := runLogFor("tok-abc"); v.Has {
t.Error("a run that ended a day ago is still on the page")
}
if beats, _ := storage.RunBeats("run-old", 0); len(beats) != 2 {
t.Errorf("aged-off run lost its stored beats: %d", len(beats))
}
}
// TestLiveRunBeatsAFinishedOne is the border-crossing case, and it is the reason
// the page picks a run by liveness before recency.
//
// A multi-region expedition closes one run and opens the next in the same
// breath: the outgoing `end` beat and the incoming `start` beat carry the same
// second, and which one has the later updated_at is a coin flip. Losing it means
// the page shows the log of a region the party has already walked out of, with a
// "cleared" chip on it, while they are three rooms into the next one.
func TestLiveRunBeatsAFinishedOne(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
postBeats(t, s, token,
storage.RunBeat{RunID: "region-1", Seq: 1, Kind: "start", OccurredAt: now - 60,
Token: "tok-abc", Name: "Josie", Zone: "The Slagworks", TotalRooms: 6},
// The crossing and the next region's opening land on the same clock tick.
storage.RunBeat{RunID: "region-1", Seq: 2, Kind: "end", OccurredAt: now, Outcome: "cleared"},
storage.RunBeat{RunID: "region-2", Seq: 1, Kind: "start", OccurredAt: now,
Token: "tok-abc", Name: "Josie", Zone: "The Deep Bellows", TotalRooms: 7},
)
run, ok, err := storage.LatestRunForToken("tok-abc")
if err != nil || !ok {
t.Fatalf("no run resolved: ok=%v err=%v", ok, err)
}
if run.RunID != "region-2" {
t.Fatalf("page picked %q (%s); the live run must win over the finished one",
run.RunID, run.Outcome)
}
if v := runLogFor("tok-abc"); !v.Live || v.Zone != "The Deep Bellows" {
t.Errorf("log = %q live:%v, want the region they are actually in", v.Zone, v.Live)
}
}
// TestRunLogShowsTheTail. A log is read for what just happened. A party deep
// into a long expedition must not be showing its first morning.
func TestRunLogShowsTheTail(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
beats := []storage.RunBeat{startBeat(now)}
for i := 2; i <= runLogCap+20; i++ {
beats = append(beats, storage.RunBeat{
RunID: "run-1", Seq: int64(i), Kind: "room", OccurredAt: now + int64(i),
Room: i, TotalRooms: 400, RoomKind: "exploration",
})
}
if w := postBeats(t, s, token, beats...); w.Code != 200 {
t.Fatalf("push: %d %s", w.Code, w.Body.String())
}
v := runLogFor("tok-abc")
if len(v.Lines) != runLogCap {
t.Fatalf("want %d lines, got %d", runLogCap, len(v.Lines))
}
// Oldest-first within the tail, and the tail ends at the newest beat.
if got := v.Lines[len(v.Lines)-1].Room; got != "80/400" {
t.Errorf("last line room = %q, want the newest beat", got)
}
if v.Rooms != "80 / 400" {
t.Errorf("header room = %q", v.Rooms)
}
}
// TestOffTheBoardShipsNoLog. Coming off the board means opted out or removed —
// finishing a run leaves an adventurer on it as idle. So the branch that answers
// "this token is no longer listed" must not hand back a room-by-room account of
// where its owner is; the page 404s in the same situation, and an API that is
// more forthcoming than the page it backs is a leak with extra steps.
func TestOffTheBoardShipsNoLog(t *testing.T) {
const token = "tok"
s, _ := newAdvServer(t, token)
now := time.Now().Unix()
postBeats(t, s, token, startBeat(now),
storage.RunBeat{RunID: "run-1", Seq: 2, Kind: "combat", OccurredAt: now + 10,
Room: 2, TotalRooms: 9, Target: "Bone Chanter", Outcome: "won"})
// Never pushed a roster, so no token is on the board — the opted-out case.
req := httptest.NewRequest("GET", "/api/adventure/who/tok-abc", nil)
req.SetPathValue("token", "tok-abc")
w := httptest.NewRecorder()
s.handleAdventureWhoAPI(w, req)
var got map[string]any
if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
t.Fatalf("decode: %v (%s)", err, w.Body.String())
}
if got["live"] != false {
t.Errorf("live = %v, want false", got["live"])
}
if _, leaked := got["run_log"]; leaked {
t.Errorf("an off-the-board token was handed its run log: %s", w.Body.String())
}
}
// TestRenderRunBeatCarriesTheNouns pins the shape of the lines: they are built
// out of the beat and nothing else. A line that reads better than the facts
// support is a line lying about a run somebody actually walked.
func TestRenderRunBeatCarriesTheNouns(t *testing.T) {
cases := []struct {
name string
beat storage.RunBeat
want string
hurt bool
good bool
}{
{"kill", storage.RunBeat{Kind: "combat", Outcome: "won", Target: "Bone Chanter",
Amount: 7, HP: 61, HPMax: 68}, "Bone Chanter down — took 7 · 61/68 HP", false, true},
{"clean kill", storage.RunBeat{Kind: "combat", Outcome: "won", Target: "Rat",
HP: 68, HPMax: 68}, "Rat down — untouched · 68/68 HP", false, true},
{"death", storage.RunBeat{Kind: "combat", Outcome: "down", Target: "The Rotmother",
HP: 0, HPMax: 68}, "Fell to The Rotmother · 0/68 HP", true, false},
{"timeout", storage.RunBeat{Kind: "combat", Outcome: "retreat", Target: "Aldric"},
"Outlasted by Aldric — withdrew", true, false},
{"trap", storage.RunBeat{Kind: "trap", Amount: 12, HP: 40, HPMax: 68},
"Trap sprung — 12 damage · 40/68 HP", true, false},
{"trap avoided", storage.RunBeat{Kind: "trap"}, "Trap — stepped over it", false, true},
{"treasure", storage.RunBeat{Kind: "treasure", Target: "Coin Pouch", Outcome: "cache"},
"Found Coin Pouch in a cache", false, true},
{"haul", storage.RunBeat{Kind: "haul", Amount: 6, Target: "Ironcap", Count: 3},
"Gathered 6 — mostly Ironcap (3 kinds)", false, false},
{"region", storage.RunBeat{Kind: "region", Region: "The Shallows", Target: "The Deep"},
"Left The Shallows for The Deep", false, false},
{"cleared", storage.RunBeat{Kind: "end", Outcome: "cleared"}, "Run complete", false, true},
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
l, ok := renderRunBeat(c.beat)
if !ok {
t.Fatal("beat produced no line")
}
if l.Text != c.want {
t.Errorf("text = %q, want %q", l.Text, c.want)
}
if l.Hurt != c.hurt || l.Good != c.good {
t.Errorf("tint = hurt:%v good:%v, want hurt:%v good:%v", l.Hurt, l.Good, c.hurt, c.good)
}
})
}
// A haul of nothing is not a beat. gogobee already skips it, but the renderer
// is the second line of defence against a column of "Gathered 0".
if _, ok := renderRunBeat(storage.RunBeat{Kind: "haul"}); ok {
t.Error("empty haul produced a line")
}
}
// TestHPTailOnlyWhenReal. A zero max means gogobee didn't send a pair, not that
// the adventurer has no health — and "0/0 HP" on a winning line reads as a death.
func TestHPTailOnlyWhenReal(t *testing.T) {
l, _ := renderRunBeat(storage.RunBeat{Kind: "combat", Outcome: "won", Target: "Rat"})
if got := l.Text; got != "Rat down — untouched" {
t.Errorf("text = %q; a missing HP pair must not be drawn", got)
}
}
internal/web/server.go
+61 -1
View File
@@ -102,7 +102,7 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
shared []string shared []string
pages []string pages []string
}{ }{
{"layout", []string{"_card"}, []string{"index", "channel", "weather", "bookmarks", "for-you", "status", "story", "who"}}, {"layout", []string{"_card", "_realmnav"}, []string{"index", "channel", "weather", "bookmarks", "for-you", "status", "story", "who", "siege", "run_report", "realm", "standings", "firsts"}},
{"games_layout", []string{"_chipbar"}, []string{"games", "games_door", "blackjack", "hangman", "solitaire", "trivia", "uno", "holdem"}}, {"games_layout", []string{"_chipbar"}, []string{"games", "games_door", "blackjack", "hangman", "solitaire", "trivia", "uno", "holdem"}},
} }
tpls := make(map[string]*template.Template) tpls := make(map[string]*template.Template)
@@ -231,6 +231,39 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
mux.HandleFunc("GET /adventure/who/{token}", s.handleAdventureWho) mux.HandleFunc("GET /adventure/who/{token}", s.handleAdventureWho)
mux.HandleFunc("GET /api/adventure/who/{token}", s.handleAdventureWhoAPI) mux.HandleFunc("GET /api/adventure/who/{token}", s.handleAdventureWhoAPI)
// The expedition liveblog. Beats arrive bearer-authed and render two ways:
// live, inside the adventurer page under the map, on that page's own poll —
// and afterwards as the run's own report, which is the artefact a dispatch
// links to and a player shares. Three segments, so the report never overlaps
// /adventure/{guid}, and its middle segment is a literal, so it never
// overlaps /adventure/art/{type} either.
mux.HandleFunc("POST /api/ingest/run", s.handleRunIngest)
mux.HandleFunc("GET /adventure/run/{run_id}", s.handleRunReport)
// The Siege war room. Ingest is bearer-authed like the roster; the page and
// its poll are public — the same exposure the board already has.
//
// GET /adventure/siege is a LITERAL two-segment pattern, so it beats
// /adventure/{guid} on Go's most-specific-match rule. Nothing is shadowed by
// it either: a dispatch guid is "<type>:<hash>:<ts>" and can never be the
// bare word "siege".
mux.HandleFunc("POST /api/ingest/siege", s.handleSiegeIngest)
mux.HandleFunc("GET /api/adventure/siege", s.handleSiegeAPI)
mux.HandleFunc("GET /adventure/siege", s.handleSiegePage)
// The realm: the world map, the board, and the hall of firsts. One
// bearer-authed ingest behind all three, and all three public — every number
// on them is already public on the board or in a dispatch.
//
// Same literal-two-segment reasoning as /adventure/siege: "realm",
// "standings" and "firsts" beat /adventure/{guid} on Go's most-specific-match
// rule, and nothing is shadowed because a dispatch guid is
// "<type>:<hash>:<ts>" and can never be a bare word.
mux.HandleFunc("POST /api/ingest/realm", s.handleRealmIngest)
mux.HandleFunc("GET /adventure/realm", s.handleRealmPage)
mux.HandleFunc("GET /adventure/standings", s.handleStandingsPage)
mux.HandleFunc("GET /adventure/firsts", s.handleFirstsPage)
// Per-dispatch permalink (the article_url every ingested story points at). // Per-dispatch permalink (the article_url every ingested story points at).
// Public GET; self-gates on adv.Enabled. Distinct from GET /adventure (the // Public GET; self-gates on adv.Enabled. Distinct from GET /adventure (the
// channel listing, registered in the channels loop above). // channel listing, registered in the channels loop above).
@@ -255,6 +288,20 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
mux.HandleFunc("GET /api/mischief/pending", s.handleMischiefPending) mux.HandleFunc("GET /api/mischief/pending", s.handleMischiefPending)
mux.HandleFunc("POST /api/mischief/claim", s.handleMischiefClaim) mux.HandleFunc("POST /api/mischief/claim", s.handleMischiefClaim)
// The equip queue's game-box wire: gogobee polls pending equip/unequip orders
// and pushes a verdict. Same bearer token and same reason as the pair above —
// the caller is a machine on the tailnet. The owner-facing half hangs off the
// auth block below.
mux.HandleFunc("GET /api/equip/pending", s.handleEquipPending)
mux.HandleFunc("POST /api/equip/verdict", s.handleEquipVerdict)
// The action queue's game-box wire: gogobee polls the verbs an owner asked for
// from the web (pull out of a run, take today's bout) and pushes a verdict.
// Bearer-authed for the same reason as every seam above it. Its own poll and
// its own table, not more actions on the equip queue — see storage/orders.go.
mux.HandleFunc("GET /api/adventure/orders/pending", s.handleAdvOrdersPending)
mux.HandleFunc("POST /api/adventure/orders/verdict", s.handleAdvOrderVerdict)
// The casino. Signed-in only — there is money in it — so these hang off the // The casino. Signed-in only — there is money in it — so these hang off the
// auth block, and gamesReady() also insists on a Matrix server name: without // auth block, and gamesReady() also insists on a Matrix server name: without
// one, no player can be named to gogobee's ledger and the tables stay shut. // one, no player can be named to gogobee's ledger and the tables stay shut.
@@ -282,10 +329,23 @@ func New(cfg config.WebConfig, sources []config.SourceConfig, postingEnabled boo
mux.HandleFunc("GET /api/mischief/catalog", s.handleMischiefCatalog) mux.HandleFunc("GET /api/mischief/catalog", s.handleMischiefCatalog)
mux.HandleFunc("POST /api/mischief/order", s.handleMischiefOrder) mux.HandleFunc("POST /api/mischief/order", s.handleMischiefOrder)
mux.HandleFunc("GET /api/mischief/orders", s.handleMischiefOrders) mux.HandleFunc("GET /api/mischief/orders", s.handleMischiefOrders)
// The equip queue, owner side. Signed-in only — an order dresses a
// specific owner's character — and gated on the adventure seam like the
// storefront, since without a board there is no detail page to equip from.
mux.HandleFunc("POST /api/equip/order", s.handleEquipOrder)
mux.HandleFunc("GET /api/equip/orders", s.handleEquipOrders)
// The action queue, owner side. Signed-in only — the session IS the
// character, there is nothing in the request to identify one — and gated
// on the adventure seam like everything else here.
mux.HandleFunc("POST /api/adventure/order", s.handleAdvOrder)
mux.HandleFunc("GET /api/adventure/orders", s.handleAdvOrders)
} }
if s.cfg.Push.Enabled { if s.cfg.Push.Enabled {
mux.HandleFunc("POST /api/push/subscribe", s.handlePushSubscribe) mux.HandleFunc("POST /api/push/subscribe", s.handlePushSubscribe)
mux.HandleFunc("POST /api/push/unsubscribe", s.handlePushUnsubscribe) mux.HandleFunc("POST /api/push/unsubscribe", s.handlePushUnsubscribe)
mux.HandleFunc("POST /api/push/heal", s.handlePushHeal)
} }
if s.tts != nil { if s.tts != nil {
mux.HandleFunc("POST /api/tts", s.handleTTS) mux.HandleFunc("POST /api/tts", s.handleTTS)
internal/web/siege.go
+292
View File
@@ -0,0 +1,292 @@
package web
import (
"encoding/json"
"fmt"
"io"
"log/slog"
"net/http"
"time"
"pete/internal/storage"
)
// The Siege war room.
//
// The Siege is the one thing in the realm everybody works on at once: a named
// boss camps outside town for 72 hours behind a single shared HP pool, and every
// adventurer gets one bout a day against it. Until now that existed only in
// Matrix, which means it was invisible to anyone not in the room at the time —
// a communal event nobody can see is a communal event that fails.
//
// It arrives the same way the board does: gogobee pushes the whole thing on the
// roster tick and Pete replaces its copy. That is the right shape here for the
// same reason it was there — the pool is state, not history. A retried snapshot
// would be a lie about how much HP is left, and the next tick carries the truth.
//
// The page's job is one thing above all others: make the bar visibly move. The
// whole point of a shared pool is watching the town chip it down, and a number
// that only changes when you reload is not a siege, it is a report about one.
const (
// siegeStaleAfter — how old the snapshot can get before the page stops
// claiming the bar is live. Same reasoning and same ticker as the roster, so
// the same window: several missed pushes, not one unlucky one.
siegeStaleAfter = 12 * time.Minute
// siegeMaxDefenders / siegeMaxHistory bound a push. A realm has tens of
// players and a Siege a month; these only stop a malformed or hostile payload
// spooling unbounded rows.
siegeMaxDefenders = 500
siegeMaxHistory = 200
)
// siegePush is the payload gogobee POSTs to /api/ingest/siege.
type siegePush struct {
SnapshotAt int64 `json:"snapshot_at"`
storage.Siege
}
// SiegeView is the war room as the page renders it: gogobee's facts plus the
// few presentational things Pete is allowed to decide (percentages, wording,
// the fought/waiting split).
type SiegeView struct {
Active bool
Stale bool
Known bool // gogobee has pushed at least one snapshot
BossName string
Tier int
HPCurrent int
HPMax int
HPPercent int
Damage int // HPMax - HPCurrent, the town's total contribution
StartsAt int64
EndsAt int64
BoutsToday int
Fought []storage.SiegeDefender // took today's bout
Waiting []storage.SiegeDefender // hasn't yet — the gap the page wants felt
Mustered int // defenders who have fought at least once
History []SiegePastView
SnapshotAt int64
LastSeenAgo string
}
// SiegePastView is one closed-out Siege, with the bar it ended on.
type SiegePastView struct {
storage.SiegePast
Won bool
HPPercent int
When string
}
type siegePage struct {
pageData
Siege SiegeView
// The viewer's own standing in the muster, when they are signed in and have
// an adventurer. This is the only personal thing on an otherwise wholly
// public page, and it exists to hang one button off: the war room is where
// somebody realises the town needs them, so it is where they should be able
// to answer.
//
// YouFought reads a snapshot up to two minutes old, so it decides what the
// page OFFERS and never what the game allows — a bout taken in Matrix inside
// that window comes back from gogobee as rejected_already_fought, which is
// the honest answer and the one the strip shows.
YouOnBoard bool
YouFought bool
}
// handleSiegeIngest replaces the war room with gogobee's latest snapshot.
func (s *Server) handleSiegeIngest(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
if !s.bearerOK(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
var push siegePush
if err := json.NewDecoder(io.LimitReader(r.Body, 1<<20)).Decode(&push); err != nil {
http.Error(w, "bad json", http.StatusBadRequest)
return
}
if len(push.Defenders) > siegeMaxDefenders {
http.Error(w, "defender board too large", http.StatusBadRequest)
return
}
if len(push.History) > siegeMaxHistory {
http.Error(w, "history too large", http.StatusBadRequest)
return
}
if push.SnapshotAt <= 0 {
push.SnapshotAt = time.Now().Unix()
}
// A snapshot with no timestamp can't age, so it would claim to be live
// forever; the roster ingest treats that the same way.
push.Siege.SnapshotAt = push.SnapshotAt
// Never trust the channel with a name. gogobee already anonymises opted-out
// defenders (empty token, "an adventurer"), but a nameless row would render
// as a blank line on a public page, so it is rejected rather than drawn.
for i, d := range push.Defenders {
if d.Name == "" {
http.Error(w, fmt.Sprintf("defender %d: name is required", i), http.StatusBadRequest)
return
}
}
// An active Siege with no pool is not a Siege — it is a division by zero on
// the bar, and the page has no honest way to draw it.
if push.Active && push.HPMax <= 0 {
http.Error(w, "active siege needs hp_max", http.StatusBadRequest)
return
}
if err := storage.ReplaceSiege(push.Siege, push.SnapshotAt); err != nil {
slog.Error("siege ingest: replace failed", "err", err)
http.Error(w, "internal error", http.StatusInternalServerError)
return
}
slog.Info("siege ingest: war room replaced",
"active", push.Active, "boss", push.BossName,
"defenders", len(push.Defenders), "history", len(push.History))
w.WriteHeader(http.StatusOK)
}
// handleSiegePage serves the war room. Public: the Siege is a town-wide event
// and the defender board is the same anonymity model as the live board.
func (s *Server) handleSiegePage(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
s.track(r, "adventure")
base := s.base(r)
base.Active = "adventure"
view := s.siege()
page := siegePage{pageData: base, Siege: view}
if base.User != nil {
if token, ok := storage.SelfToken(buyerLocalpart(base.User)); ok {
page.YouOnBoard = true
for _, d := range view.Fought {
if d.Token == token {
page.YouFought = true
break
}
}
}
}
// Unlike the who page this one is NOT noindex: it names a boss and a town,
// and the defender list is character names that are already public on the
// board. There is nothing here that ties a page to a person more than
// /adventure already does.
s.render(w, "siege", page)
}
// handleSiegeAPI serves the war room as JSON for the page's own re-poll. This
// is what makes the bar move without a reload, so it is deliberately cheap and
// deliberately public — the same exposure as the rendered page, no more.
func (s *Server) handleSiegeAPI(w http.ResponseWriter, r *http.Request) {
if !s.adv.Enabled {
http.NotFound(w, r)
return
}
v := s.siege()
w.Header().Set("Content-Type", "application/json")
w.Header().Set("Cache-Control", "no-store")
_ = json.NewEncoder(w).Encode(map[string]any{
"active": v.Active,
"stale": v.Stale,
"known": v.Known,
"boss_name": v.BossName,
"tier": v.Tier,
"hp_current": v.HPCurrent,
"hp_max": v.HPMax,
"hp_percent": v.HPPercent,
"damage": v.Damage,
"ends_at": v.EndsAt,
"bouts_today": v.BoutsToday,
"mustered": v.Mustered,
"fought": v.Fought,
"waiting": v.Waiting,
"snapshot_at": v.SnapshotAt,
})
}
// siege builds the view from the last snapshot.
//
// A stale war room is still returned, dimmed and labelled, for the same reason
// the board is: "here is where the pool stood when we lost contact" beats an
// empty page, and it stops the bar from quietly lying about being live.
func (s *Server) siege() SiegeView {
snap, known, err := storage.LoadSiege()
if err != nil {
slog.Error("siege: load failed", "err", err)
return SiegeView{Stale: true}
}
v := SiegeView{
Active: snap.Active,
Known: known,
BossName: snap.BossName,
Tier: snap.Tier,
HPCurrent: snap.HPCurrent,
HPMax: snap.HPMax,
StartsAt: snap.StartsAt,
EndsAt: snap.EndsAt,
BoutsToday: snap.BoutsToday,
SnapshotAt: snap.SnapshotAt,
}
if !known || snap.SnapshotAt == 0 || time.Since(time.Unix(snap.SnapshotAt, 0)) > siegeStaleAfter {
v.Stale = true
}
if snap.SnapshotAt > 0 {
v.LastSeenAgo = shortTimeAgo(time.Unix(snap.SnapshotAt, 0))
}
if snap.HPMax > 0 {
v.HPPercent = clampPercent(snap.HPCurrent * 100 / snap.HPMax)
v.Damage = snap.HPMax - snap.HPCurrent
}
// The fought/waiting split is the mechanic made visible: one bout per person
// per day means an adventurer standing in the "yet to fight" column is a bout
// the town has not spent yet. gogobee sends every alive, non-opted-out
// adventurer — not just contributors — precisely so this column exists.
for _, d := range snap.Defenders {
if d.Fights > 0 {
v.Mustered++
}
if d.FoughtToday {
v.Fought = append(v.Fought, d)
} else {
v.Waiting = append(v.Waiting, d)
}
}
for _, h := range snap.History {
pv := SiegePastView{SiegePast: h, Won: h.Outcome == "defeated"}
if h.HPMax > 0 {
pv.HPPercent = clampPercent(h.HPRemaining * 100 / h.HPMax)
}
if h.EndedAt > 0 {
pv.When = time.Unix(h.EndedAt, 0).UTC().Format("Jan 2, 2006")
}
v.History = append(v.History, pv)
}
return v
}
// clampPercent keeps a computed bar width inside 0–100 whatever the snapshot
// claimed. gogobee clamps its own pool at zero, but the bar is drawn from
// arithmetic on two numbers off the wire and must not be able to overflow its
// track on a malformed one.
func clampPercent(p int) int {
if p < 0 {
return 0
}
if p > 100 {
return 100
}
return p
}
internal/web/siege_test.go
+347
View File
@@ -0,0 +1,347 @@
package web
import (
"bytes"
"encoding/json"
"net/http/httptest"
"strings"
"testing"
"time"
"pete/internal/storage"
)
func postSiege(t *testing.T, s *Server, token string, push siegePush) *httptest.ResponseRecorder {
t.Helper()
body, _ := json.Marshal(push)
req := httptest.NewRequest("POST", "/api/ingest/siege", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+token)
w := httptest.NewRecorder()
s.handleSiegeIngest(w, req)
return w
}
func liveSiege(now int64, hpCurrent int, defenders ...storage.SiegeDefender) siegePush {
return siegePush{SnapshotAt: now, Siege: storage.Siege{
Active: true,
BossID: 7,
BossName: "Gorloth the Sunderer",
Tier: 4,
HPCurrent: hpCurrent,
HPMax: 1000,
StartsAt: now - 3600,
EndsAt: now + 68*3600,
Defenders: defenders,
}}
}
// TestSiegeReplacesNeverMerges is the war room's core contract, and it is the
// same one the board has: gogobee sends the whole thing and Pete's copy becomes
// it. A defender who dropped out of a later snapshot has to leave the board, and
// a Siege that resolved has to stop showing a live bar. An upsert would leave
// both standing forever.
func TestSiegeReplacesNeverMerges(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
if w := postSiege(t, s, "tok", liveSiege(now, 800,
storage.SiegeDefender{Token: "t1", Name: "Josie", Fights: 2, Damage: 150, FoughtToday: true},
storage.SiegeDefender{Token: "t2", Name: "Quack", Fights: 1, Damage: 50},
)); w.Code != 200 {
t.Fatalf("first push = %d, want 200", w.Code)
}
// Quack opts out; gogobee stops sending her under a name.
if w := postSiege(t, s, "tok", liveSiege(now+120, 700,
storage.SiegeDefender{Token: "t1", Name: "Josie", Fights: 3, Damage: 250, FoughtToday: true},
)); w.Code != 200 {
t.Fatalf("second push = %d, want 200", w.Code)
}
v := s.siege()
if got := len(v.Fought) + len(v.Waiting); got != 1 {
t.Fatalf("muster has %d rows, want 1 — a dropped defender survived the swap", got)
}
if v.HPCurrent != 700 {
t.Errorf("hp_current = %d, want 700 — the pool didn't follow the snapshot", v.HPCurrent)
}
// And a snapshot saying the Siege ended must clear the live bar entirely.
if w := postSiege(t, s, "tok", siegePush{SnapshotAt: now + 240, Siege: storage.Siege{Active: false}}); w.Code != 200 {
t.Fatalf("resolution push = %d, want 200", w.Code)
}
if v := s.siege(); v.Active {
t.Error("war room still reads active after a snapshot said the Siege was over")
}
}
// TestSiegeSplitsFoughtFromWaiting is the mechanic made visible. One bout per
// person per day means a defender who hasn't swung today is damage the pool has
// not seen — the page's whole nudge — so the split has to come off FoughtToday
// and not off "has any fights at all". A veteran of nine bouts who hasn't been
// out today belongs in the waiting column.
func TestSiegeSplitsFoughtFromWaiting(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
postSiege(t, s, "tok", liveSiege(now, 500,
storage.SiegeDefender{Token: "t1", Name: "Josie", Fights: 9, Damage: 400, FoughtToday: false},
storage.SiegeDefender{Token: "t2", Name: "Quack", Fights: 1, Damage: 100, FoughtToday: true},
storage.SiegeDefender{Token: "t3", Name: "Newbie", Fights: 0, Damage: 0},
))
v := s.siege()
if len(v.Fought) != 1 || v.Fought[0].Name != "Quack" {
t.Errorf("fought-today = %+v, want just Quack", v.Fought)
}
if len(v.Waiting) != 2 {
t.Fatalf("waiting = %d rows, want 2 (Josie has bouts but not today, Newbie has none)", len(v.Waiting))
}
if v.Mustered != 2 {
t.Errorf("mustered = %d, want 2 — that counts anyone who has ever fought, not today's turnout", v.Mustered)
}
}
// TestSiegeAnonDefenderKeepsRankLosesLink is the opt-out rule, and it is
// deliberately NOT the board's rule. The board omits an opted-out player
// outright, because a row showing class + level + zone re-identifies them. Here
// the damage is part of what the town did to the boss: dropping it would
// understate the shared effort and stop the numbers adding up. So the row stays,
// anonymous, with no token — and therefore no link to a page that would name them.
func TestSiegeAnonDefenderKeepsRankLosesLink(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
postSiege(t, s, "tok", liveSiege(now, 100,
storage.SiegeDefender{Name: "an adventurer", Fights: 5, Damage: 700, FoughtToday: true},
storage.SiegeDefender{Token: "t1", Name: "Josie", Fights: 1, Damage: 200, FoughtToday: true},
))
v := s.siege()
if len(v.Fought) != 2 {
t.Fatalf("fought = %d rows, want 2 — the anonymous contributor was dropped", len(v.Fought))
}
// Push order is gogobee's ranking and Pete must preserve it: the anonymous
// defender out-damaged Josie and holds the top of the board.
if v.Fought[0].Name != "an adventurer" {
t.Errorf("top of the board is %q, want the anonymous defender — rank was lost", v.Fought[0].Name)
}
if v.Fought[0].Token != "" {
t.Error("anonymous defender carries a token — that is a link back to a page that names them")
}
}
// TestSiegeGoesStale: if gogobee stops talking, the bar must stop claiming to be
// live. A health bar that confidently shows a pool level from an hour ago is
// worse than one that admits it lost the wire, because the whole promise of the
// page is that the number is true *right now*.
func TestSiegeGoesStale(t *testing.T) {
s, _ := newAdvServer(t, "tok")
old := time.Now().Add(-30 * time.Minute).Unix()
postSiege(t, s, "tok", liveSiege(old, 900))
v := s.siege()
if !v.Stale {
t.Error("a 30-minute-old snapshot reads as live")
}
if v.HPCurrent != 900 {
t.Errorf("hp_current = %d, want 900 — a stale war room must still show the last known pool", v.HPCurrent)
}
}
// TestSiegeNeverPushedIsNotAnEmptySiege distinguishes the two states that look
// alike from the outside: gogobee has never told us about a Siege, versus it has
// told us there isn't one. Only the second can honestly say "quiet month".
func TestSiegeNeverPushedIsNotAnEmptySiege(t *testing.T) {
s, _ := newAdvServer(t, "tok")
if v := s.siege(); v.Known {
t.Error("war room claims to know the Siege state before gogobee ever pushed one")
}
postSiege(t, s, "tok", siegePush{SnapshotAt: time.Now().Unix(), Siege: storage.Siege{Active: false}})
v := s.siege()
if !v.Known {
t.Error("war room still reads unknown after a snapshot said no Siege is camped")
}
if v.Active {
t.Error("no-siege snapshot rendered as an active Siege")
}
}
// TestSiegeRejectsUnrenderableSnapshots. Two things a public page cannot draw:
// a defender with no name (a blank row), and an active Siege with no pool (a
// divide-by-zero on the bar). Both are 400s — unlike an unknown *event type*,
// which W0 deliberately made a 200, because that one is a styling gap where
// these are malformed state.
func TestSiegeRejectsUnrenderableSnapshots(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
w := postSiege(t, s, "tok", liveSiege(now, 500, storage.SiegeDefender{Token: "t1", Fights: 1}))
if w.Code != 400 {
t.Errorf("nameless defender = %d, want 400", w.Code)
}
bad := liveSiege(now, 500)
bad.HPMax = 0
if w := postSiege(t, s, "tok", bad); w.Code != 400 {
t.Errorf("active siege with no pool = %d, want 400", w.Code)
}
req := httptest.NewRequest("POST", "/api/ingest/siege", strings.NewReader("{}"))
req.Header.Set("Authorization", "Bearer wrong")
rec := httptest.NewRecorder()
s.handleSiegeIngest(rec, req)
if rec.Code != 401 {
t.Errorf("bad bearer = %d, want 401", rec.Code)
}
}
// TestSiegeHistoryRendersEndedBar. The history is what makes the live bar mean
// anything, so the numbers behind it have to survive the round trip: a won Siege
// ended at zero (an empty track), a lost one shows what was still standing.
func TestSiegeHistoryRendersEndedBar(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
push := siegePush{SnapshotAt: now, Siege: storage.Siege{
Active: false,
History: []storage.SiegePast{
{BossID: 2, BossName: "The Ashen Wyrm", Tier: 5, Outcome: "survived",
HPRemaining: 300, HPMax: 1200, Defenders: 3, MVP: "Josie", MVPFights: 4, EndedAt: now - 86400},
{BossID: 1, BossName: "The Iron Colossus", Tier: 4, Outcome: "defeated",
HPRemaining: 0, HPMax: 800, Defenders: 5, MVP: "Quack", MVPFights: 6, EndedAt: now - 172800},
},
}}
if w := postSiege(t, s, "tok", push); w.Code != 200 {
t.Fatalf("history push = %d, want 200", w.Code)
}
v := s.siege()
if len(v.History) != 2 {
t.Fatalf("history = %d rows, want 2", len(v.History))
}
// Newest first: the Wyrm ended a day ago, the Colossus two.
if v.History[0].BossName != "The Ashen Wyrm" {
t.Errorf("history[0] = %q, want the most recent Siege first", v.History[0].BossName)
}
if v.History[0].Won {
t.Error("a survived Siege reads as a win")
}
if v.History[0].HPPercent != 25 {
t.Errorf("survived bar = %d%%, want 25 (300 of 1200 still standing)", v.History[0].HPPercent)
}
if !v.History[1].Won || v.History[1].HPPercent != 0 {
t.Errorf("defeated Siege = won %v at %d%%, want won at 0%%", v.History[1].Won, v.History[1].HPPercent)
}
}
// TestSiegeHistoryCollisionDoesNotFreezeTheWarRoom. boss_id is the history's
// primary key and it is not settled whether gogobee means the siege instance or
// the boss type by it, so two rows can arrive sharing one. Under a bare INSERT
// that failed the transaction carrying the live boss and the muster too, and the
// war room stopped moving on the last good snapshot with nothing to say why. The
// ingest has to degrade to a lost history row instead.
func TestSiegeHistoryCollisionDoesNotFreezeTheWarRoom(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
push := liveSiege(now, 650)
push.Siege.History = []storage.SiegePast{
{BossID: 3, BossName: "The Ashen Wyrm", Tier: 5, Outcome: "survived",
HPRemaining: 300, HPMax: 1200, Defenders: 3, EndedAt: now - 86400},
{BossID: 3, BossName: "The Ashen Wyrm", Tier: 5, Outcome: "defeated",
HPRemaining: 0, HPMax: 1200, Defenders: 6, EndedAt: now - 30*86400},
}
if w := postSiege(t, s, "tok", push); w.Code != 200 {
t.Fatalf("push with a duplicated boss_id = %d, want 200 (%s)", w.Code, w.Body.String())
}
v := s.siege()
if !v.Active || v.HPCurrent != 650 {
t.Fatalf("war room = active %v at %d hp, want the pushed live boss — the collision took the whole push down",
v.Active, v.HPCurrent)
}
if len(v.History) != 1 {
t.Errorf("history = %d rows, want 1 (the last of the colliding pair)", len(v.History))
}
}
// TestSiegeAPIFeedsTheBar. The bar only moves because this endpoint answers, so
// the field names it emits are load-bearing: the page's JS reads hp_percent to
// set the width and active to decide whether to keep polling at all.
func TestSiegeAPIFeedsTheBar(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
postSiege(t, s, "tok", liveSiege(now, 250,
storage.SiegeDefender{Token: "t1", Name: "Josie", Fights: 1, Damage: 750, FoughtToday: true}))
rec := httptest.NewRecorder()
s.handleSiegeAPI(rec, httptest.NewRequest("GET", "/api/adventure/siege", nil))
if rec.Code != 200 {
t.Fatalf("api = %d, want 200", rec.Code)
}
var got map[string]any
if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
t.Fatal(err)
}
if got["active"] != true {
t.Error("api says the Siege isn't active")
}
if got["hp_percent"].(float64) != 25 {
t.Errorf("hp_percent = %v, want 25 — the bar would draw at the wrong width", got["hp_percent"])
}
if got["bouts_today"] == nil || got["mustered"].(float64) != 1 {
t.Errorf("api dropped the turnout counters: %v", got)
}
}
// TestSiegeTemplateExecutes renders all three states the page has to survive —
// a live Siege, a quiet realm with history, and a realm that has never had one.
// Template execution errors are silent in production (render logs and returns a
// half-written body), so a parse-clean template that blows up on a nil field is
// exactly the class of bug that reaches a visitor before it reaches a log.
func TestSiegeTemplateExecutes(t *testing.T) {
s, _ := newAdvServer(t, "tok")
now := time.Now().Unix()
render := func(v SiegeView) string {
t.Helper()
var b strings.Builder
if err := s.tpls["siege"].ExecuteTemplate(&b, "layout",
siegePage{pageData: pageData{SiteTitle: "Pete", Channels: channels}, Siege: v}); err != nil {
t.Fatal(err)
}
return b.String()
}
postSiege(t, s, "tok", liveSiege(now, 250,
storage.SiegeDefender{Token: "t1", Name: "Josie", Level: 12, Fights: 3, Damage: 600, FoughtToday: true},
storage.SiegeDefender{Name: "an adventurer", Fights: 1, Damage: 150},
storage.SiegeDefender{Token: "t3", Name: "Camcast", Level: 4},
))
live := render(s.siege())
if !strings.Contains(live, "Gorloth the Sunderer") {
t.Error("live page doesn't name the boss")
}
if !strings.Contains(live, `style="width: 25%"`) {
t.Error("live page didn't draw the bar at the pool's width")
}
if !strings.Contains(live, `/adventure/who/t1`) {
t.Error("live page doesn't link a named defender to their page")
}
if strings.Contains(live, `/adventure/who/"`) {
t.Error("live page emitted an empty who link — the anonymous defender got a link anyway")
}
// Quiet realm with history, and a realm that has never seen one.
quiet := render(SiegeView{Known: true, History: []SiegePastView{{
SiegePast: storage.SiegePast{BossName: "The Iron Colossus", Tier: 4, Outcome: "defeated",
HPMax: 800, Defenders: 5, MVP: "Quack", MVPFights: 6}, Won: true, When: "Jun 1, 2026"}}})
if !strings.Contains(quiet, "Nothing's camped outside town") || !strings.Contains(quiet, "The Iron Colossus") {
t.Error("quiet page lost either the empty state or the history")
}
if fresh := render(SiegeView{}); !strings.Contains(fresh, "haven't heard from the field") {
t.Error("never-pushed page doesn't say it hasn't heard from the field")
}
}
internal/web/static/audio/casino/LICENSE.txt
+21
View File
@@ -0,0 +1,21 @@
Casino Audio
by Kenney Vleugels (Kenney.nl)
------------------------------
License (Creative Commons Zero, CC0)
http://creativecommons.org/publicdomain/zero/1.0/
You may use these assets in personal and commercial projects.
Credit (Kenney or www.kenney.nl) would be nice but is not mandatory.
------------------------------
Donate: http://support.kenney.nl
Request: http://request.kenney.nl
Follow on Twitter for updates:
@KenneyNL
internal/web/static/audio/casino/cardFan1.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardFan2.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardPlace1.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardPlace2.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardPlace3.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardPlace4.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardShuffle.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide1.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide2.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide3.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide4.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide5.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/cardSlide6.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/chipLay1.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/chipLay2.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/chipsHandle2.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/chipsHandle4.ogg
BIN
View File
Binary file not shown.
internal/web/static/audio/casino/chipsHandle6.ogg
BIN
View File
Binary file not shown.
internal/web/static/css/input.css
+690 -1
View File
@@ -8,6 +8,15 @@
thanks to the `transition-colors duration-1000` on <body>. thanks to the `transition-colors duration-1000` on <body>.
---------------------------------------------------------------------------- */ ---------------------------------------------------------------------------- */
/* --warn is the "you should look at this" amber, and it is a phase variable for
the same reason --ink is: the phase decides how dark the card underneath is.
Tailwind's dark: variant cannot do this job here — darkMode is unconfigured,
so dark: follows the OS's prefers-color-scheme, which has nothing to do with
which phase Pete is showing. A dark phase under a light OS renders amber-700
on the night card at 2.34:1, and a light phase under a dark OS renders
amber-400 on cream at 1.55:1 — half of the four combinations unreadable, and
which half depends on a setting outside the page. Only night has a dark card;
dusk and dawn are lit despite their names. */
:root, :root,
html[data-phase="day"] { html[data-phase="day"] {
--bg: #fff7e4; /* warm cream */ --bg: #fff7e4; /* warm cream */
@@ -15,6 +24,7 @@ html[data-phase="day"] {
--card: #ffffff; --card: #ffffff;
--ink: #3a2e1f; --ink: #3a2e1f;
--accent: #f2a541; /* sunshine yellow */ --accent: #f2a541; /* sunshine yellow */
--warn: #b45309;
} }
html[data-phase="dawn"] { html[data-phase="dawn"] {
@@ -23,6 +33,7 @@ html[data-phase="dawn"] {
--card: #fff4ea; --card: #fff4ea;
--ink: #4a2e2a; --ink: #4a2e2a;
--accent: #ff8a65; --accent: #ff8a65;
--warn: #b45309;
} }
html[data-phase="dusk"] { html[data-phase="dusk"] {
@@ -31,6 +42,7 @@ html[data-phase="dusk"] {
--card: #fff1de; --card: #fff1de;
--ink: #3d2417; --ink: #3d2417;
--accent: #e6553a; --accent: #e6553a;
--warn: #b45309;
} }
html[data-phase="night"] { html[data-phase="night"] {
@@ -39,6 +51,7 @@ html[data-phase="night"] {
--card: #2d365a; --card: #2d365a;
--ink: #f1ecd8; /* moonlight */ --ink: #f1ecd8; /* moonlight */
--accent: #f9d976; /* lantern */ --accent: #f9d976; /* lantern */
--warn: #fbbf24; /* the only dark card, so the only light amber */
} }
@layer base { @layer base {
@@ -93,6 +106,33 @@ html[data-phase="night"] {
.text-theme-lego { color: #b00d0e; } .text-theme-lego { color: #b00d0e; }
.text-theme-adventure { color: #5836b8; } .text-theme-adventure { color: #5836b8; }
/* Night repaint. The colours above are all tuned to sit on a light card, and
nobody checked them against a dark one when the phases were built: on
night's #2d365a every single one lands between 1.08:1 (eu) and 3.12:1
(finance), i.e. the whole family is below AA and eu is very nearly
invisible. Same hue, lifted lightness, saturation floored at 0.62 so the
dulled ones stay a colour instead of going grey — all now ≥5.5:1.
Only night gets this. Dusk and dawn are lit cards despite the names, so
they keep the originals exactly. Lego cannot stay pillar-box red and be
readable on navy — a red light enough to pass reads as salmon, and that is
the honest trade rather than a red nobody can see.
Deliberately NOT Tailwind's dark: variant: darkMode is unconfigured, so
dark: follows the OS's prefers-color-scheme, which knows nothing about
which phase Pete is showing. Keyed off the phase, like --ink is. */
html[data-phase="night"] .text-theme-gaming { color: #30cb7b; }
html[data-phase="night"] .text-theme-tech { color: #7fb8e1; }
html[data-phase="night"] .text-theme-politics { color: #e5a191; }
html[data-phase="night"] .text-theme-eu { color: #8bb1ff; }
html[data-phase="night"] .text-theme-music { color: #caa2e9; }
html[data-phase="night"] .text-theme-anime { color: #e89cb6; }
html[data-phase="night"] .text-theme-foss { color: #f69d5d; }
html[data-phase="night"] .text-theme-kids { color: #19c7ba; }
html[data-phase="night"] .text-theme-finance { color: #07cb8e; }
html[data-phase="night"] .text-theme-lego { color: #f79898; }
html[data-phase="night"] .text-theme-adventure { color: #baa9eb; }
.decoration-theme-gaming { text-decoration-color: #4caf7d; } .decoration-theme-gaming { text-decoration-color: #4caf7d; }
.decoration-theme-tech { text-decoration-color: #5aa9e6; } .decoration-theme-tech { text-decoration-color: #5aa9e6; }
.decoration-theme-politics { text-decoration-color: #e07a5f; } .decoration-theme-politics { text-decoration-color: #e07a5f; }
@@ -940,6 +980,18 @@ html[data-phase="night"] {
will-change: transform, opacity; will-change: transform, opacity;
} }
/* Falling money — the win curtain. Positioned entirely by the transform WAAPI
drives (see moneyRain in casino-fx.js), so it starts pinned to the top-left. */
.pete-money {
position: absolute;
top: 0;
left: 0;
font-size: 1.6rem;
line-height: 1;
filter: drop-shadow(0 2px 2px rgba(0,0,0,0.35));
will-change: transform, opacity;
}
/* The dealer's beat before they draw out. */ /* The dealer's beat before they draw out. */
.pete-dealer-think { .pete-dealer-think {
animation: pete-think 0.9s ease-in-out infinite; animation: pete-think 0.9s ease-in-out infinite;
@@ -1288,6 +1340,16 @@ html[data-phase="night"] {
/* An empty place a card could be: the stock when it's spent, a foundation /* An empty place a card could be: the stock when it's spent, a foundation
waiting for its ace, a column waiting for a king. Same footprint as a card, waiting for its ace, a column waiting for a king. Same footprint as a card,
so nothing on the board reflows when one empties. */ so nothing on the board reflows when one empties. */
/* Where cards go home. Solitaire lifts a copy of every card bound for a
foundation into here so it can keep flying while the board underneath it
redraws in one go. It never takes a click and it never scrolls. */
.pete-flight-layer {
position: fixed;
inset: 0;
z-index: 60;
pointer-events: none;
}
.pete-slot { .pete-slot {
position: relative; position: relative;
display: grid; display: grid;
@@ -1436,6 +1498,52 @@ html[data-phase="night"] {
/* A move that won't go. Said in the one language a board can speak. */ /* A move that won't go. Said in the one language a board can speak. */
.pete-nope { animation: pete-shake 0.4s cubic-bezier(0.36, 0.07, 0.19, 0.97); } .pete-nope { animation: pete-shake 0.4s cubic-bezier(0.36, 0.07, 0.19, 0.97); }
/* Dragging. A press on a card that can be lifted belongs to the card and not to
the page, or a drag down a column scrolls the board instead of moving a run. */
.pete-card[data-live="1"] { touch-action: none; }
[data-solitaire][data-dragging] { cursor: grabbing; user-select: none; }
[data-solitaire][data-dragging] .pete-card[data-live="1"]:hover .pete-card-front {
filter: none;
}
/* The run you lifted stays on the felt, faded: where it came from, and where it
goes back to if you let go over nothing. */
[data-solitaire][data-dragging] .pete-card[data-held="1"] {
opacity: 0.3;
transform: none;
}
[data-solitaire][data-dragging] .pete-card[data-held="1"] .pete-card-front {
box-shadow: none;
}
/* The copy under your hand. It doesn't answer to hit tests — the felt beneath it
has to be the thing you're pointing at. */
.pete-drag {
position: fixed;
left: 0;
top: 0;
z-index: 60;
pointer-events: none;
filter: drop-shadow(0 14px 22px rgba(0, 0, 0, 0.45));
transform: translate3d(-999px, -999px, 0);
}
.pete-drag .pete-card { position: relative; }
.pete-drag[data-ok="1"] .pete-card-front {
box-shadow: 0 0 0 3px rgba(242, 181, 61, 0.9);
}
/* The pile you're actually over, told apart from the ones that would merely
take it. */
.pete-slot[data-over="1"],
.pete-col[data-over="1"] .pete-slot,
.pete-col[data-over="1"] .pete-card:last-child .pete-card-front {
border-color: rgba(242, 181, 61, 1);
box-shadow: 0 0 0 4px rgba(242, 181, 61, 0.75);
}
.pete-slot[data-over="1"],
.pete-col[data-over="1"] .pete-slot {
background: rgba(242, 181, 61, 0.24);
}
/* A card arriving on a foundation lands with a flash: it is the only move in /* A card arriving on a foundation lands with a flash: it is the only move in
the game that pays you, so it is the only one that gets a noise. */ the game that pays you, so it is the only one that gets a noise. */
.pete-home-flash { animation: pete-home 0.5s ease-out; } .pete-home-flash { animation: pete-home 0.5s ease-out; }
@@ -1444,6 +1552,14 @@ html[data-phase="night"] {
100% { box-shadow: 0 0 0 1.4rem rgba(242, 181, 61, 0); } 100% { box-shadow: 0 0 0 1.4rem rgba(242, 181, 61, 0); }
} }
/* The finish button on a won board breathes, so the one press left to make is
the one the eye lands on. */
.pete-finish { animation: pete-finish-pulse 1.6s ease-in-out infinite; }
@keyframes pete-finish-pulse {
0%, 100% { box-shadow: 0 0 0 0 rgba(242, 181, 61, 0.55); }
50% { box-shadow: 0 0 0 0.9rem rgba(242, 181, 61, 0); }
}
/* The rail: the house's rack, what you've banked, the meter. On a wide screen /* The rail: the house's rack, what you've banked, the meter. On a wide screen
it's a column down the right of the felt; on a narrow one it lies down and it's a column down the right of the felt; on a narrow one it lies down and
sits under the board. */ sits under the board. */
@@ -1978,6 +2094,93 @@ html[data-phase="night"] {
} }
.pete-uno-seat[data-out="1"] .pete-uno-count { color: #ffb3ba; } .pete-uno-seat[data-out="1"] .pete-uno-count { color: #ffb3ba; }
/* The send-off. When the mercy rule buries a seat, uno.js rolls one of four
of these and drops it over that seat — or over your hand, if it's you going
down. Every piece is built fresh and clears itself, so it can't outlive the
hand. The wrap is a zero-size anchor at the seat's middle; the pieces hang
off it. */
.pete-uno-bury {
position: absolute;
left: 50%;
top: 45%;
width: 0;
height: 0;
z-index: 40;
pointer-events: none;
}
/* Rockslide: a handful of boulders come down and pile where the seat was. */
.pete-uno-rock {
position: absolute;
left: 0;
top: 0;
font-size: 1.5rem;
line-height: 1;
filter: drop-shadow(0 2px 1px rgba(0,0,0,0.4));
animation: pete-bury-rock 0.6s cubic-bezier(0.5, 0, 0.7, 1) both;
animation-delay: var(--d, 0ms);
}
@keyframes pete-bury-rock {
0% { transform: translate(calc(-50% + var(--dx)), -3.4rem) rotate(0deg); opacity: 0; }
20% { opacity: 1; }
75% { transform: translate(calc(-50% + var(--dx)), var(--dy)) rotate(var(--rot)); }
85% { transform: translate(calc(-50% + var(--dx)), calc(var(--dy) - 0.22rem)) rotate(var(--rot)); }
100% { transform: translate(calc(-50% + var(--dx)), var(--dy)) rotate(var(--rot)); opacity: 1; }
}
/* Tombstone and coffin: one heavy thing drops in and sets, with a small bounce. */
.pete-uno-tomb,
.pete-uno-coffin {
position: absolute;
left: 0;
top: 0;
line-height: 1;
filter: drop-shadow(0 3px 2px rgba(0,0,0,0.45));
animation: pete-bury-drop 0.5s cubic-bezier(0.34, 1.3, 0.64, 1) both;
}
.pete-uno-tomb { font-size: 2.4rem; }
.pete-uno-coffin { font-size: 2.5rem; }
@keyframes pete-bury-drop {
0% { transform: translate(-50%, -3.2rem) scale(0.7); opacity: 0; }
55% { opacity: 1; }
70% { transform: translate(-50%, -50%) scale(1.06); }
82% { transform: translate(-50%, -44%) scale(1); }
100% { transform: translate(-50%, -50%) scale(1); opacity: 1; }
}
/* The Mega Man death: a flash, then eight pieces fire out and wink off. */
.pete-uno-zap-flash {
position: absolute;
left: 0;
top: 0;
width: 1.5rem;
height: 1.5rem;
margin: -0.75rem 0 0 -0.75rem;
border-radius: 999px;
background: radial-gradient(circle, #fff 0%, rgba(180,220,255,0) 70%);
animation: pete-bury-flash 0.35s ease-out both;
}
@keyframes pete-bury-flash {
0% { transform: scale(0.3); opacity: 0.95; }
100% { transform: scale(1.9); opacity: 0; }
}
.pete-uno-zap-bit {
position: absolute;
left: 0;
top: 0;
width: 0.5rem;
height: 0.5rem;
margin: -0.25rem 0 0 -0.25rem;
border-radius: 999px;
background: #cfeaff;
box-shadow: 0 0 6px 1px rgba(150,210,255,0.9);
animation: pete-bury-zap 0.5s ease-out both;
}
@keyframes pete-bury-zap {
0% { transform: rotate(var(--ang)) translateX(0.2rem); opacity: 1; }
100% { transform: rotate(var(--ang)) translateX(3.4rem); opacity: 0; }
}
/* The rules switch: two dials, and this is the one that isn't the table size. */ /* The rules switch: two dials, and this is the one that isn't the table size. */
.pete-seg { .pete-seg {
display: inline-flex; display: inline-flex;
@@ -2031,7 +2234,8 @@ html[data-phase="night"] {
.pete-tile-hit, .pete-tile-hit,
.pete-meter[data-hit="1"] { animation: none; } .pete-meter[data-hit="1"] { animation: none; }
.pete-nope, .pete-nope,
.pete-home-flash { animation: none; } .pete-home-flash,
.pete-finish { animation: none; }
.pete-card[data-held="1"] { transition: none; } .pete-card[data-held="1"] { transition: none; }
/* The clock still drains — it is information, not decoration — but it stops /* The clock still drains — it is information, not decoration — but it stops
pulsing at you, and a wrong answer stops shaking. */ pulsing at you, and a wrong answer stops shaking. */
@@ -2043,6 +2247,9 @@ html[data-phase="night"] {
.pete-uno-card[data-glow="1"]::before { animation: none; } .pete-uno-card[data-glow="1"]::before { animation: none; }
.pete-uno-card[data-glow="1"] .pete-uno-face::after { display: none; } .pete-uno-card[data-glow="1"] .pete-uno-face::after { display: none; }
.pete-uno-pending { animation: none; } .pete-uno-pending { animation: none; }
/* The grave still gets marked — that's information — it just doesn't fall in.
uno.js drops a single static headstone here rather than the full rockslide. */
.pete-uno-tomb { animation: none; transform: translate(-50%, -50%); }
} }
} }
@@ -2437,3 +2644,485 @@ html[data-room] .pete-felt {
.pete-poker-you .pete-seat-cards { --card-h: 6rem; --card-w: 4.3rem; min-height: 6rem; } .pete-poker-you .pete-seat-cards { --card-h: 6rem; --card-w: 4.3rem; min-height: 6rem; }
.pete-poker-pot-total { font-size: 1.25rem; } .pete-poker-pot-total { font-size: 1.25rem; }
} }
@layer components {
/* Dungeon map (who page). The graph arrives already cut to the fog-of-war
frontier; who_map.go lays it out and who.html draws it as inline SVG. Node
colours ride the phase through --ink/--card like every card does, with a
per-kind tint carried in --map-fill so the SVG discs and the legend dots
read from one source. The adventure purple marks the room you're in. */
.map-svg { display: block; overflow: visible; }
.map-edge {
stroke: color-mix(in srgb, var(--ink) 26%, transparent);
stroke-width: 2.5;
stroke-linecap: round;
}
.map-edge-locked {
stroke: #c98a2b; /* a barred door reads amber, not ink */
stroke-dasharray: 3 5;
}
.map-disc {
fill: var(--map-fill, color-mix(in srgb, var(--ink) 9%, var(--card)));
stroke: color-mix(in srgb, var(--map-stroke, var(--ink)) 55%, transparent);
stroke-width: 2;
}
.map-glyph {
fill: color-mix(in srgb, var(--map-stroke, var(--ink)) 85%, var(--ink));
font-size: 13px;
font-weight: 700;
pointer-events: none;
}
.map-node-current .map-disc { stroke: #6d4bd8; stroke-width: 2.5; }
.map-ring { fill: none; stroke: #6d4bd8; stroke-width: 2; opacity: 0.5; }
/* Per-kind tint. Set on the node group (and the legend dot); both the disc
fill and the glyph colour derive from it. */
.map-node-entry { --map-fill: color-mix(in srgb, #3fa66a 22%, var(--card)); --map-stroke: #2f8a54; }
.map-node-boss { --map-fill: color-mix(in srgb, #c0392b 22%, var(--card)); --map-stroke: #a52f22; }
.map-node-trap { --map-fill: color-mix(in srgb, #d98324 22%, var(--card)); --map-stroke: #b56a17; }
.map-node-elite { --map-fill: color-mix(in srgb, #6d4bd8 20%, var(--card)); --map-stroke: #5836b8; }
.map-node-secret { --map-fill: color-mix(in srgb, #b08d2e 22%, var(--card)); --map-stroke: #8f7018; }
.map-node-harvest { --map-fill: color-mix(in srgb, #3f8f6a 18%, var(--card)); --map-stroke: #2f7355; }
.map-node-rest { --map-fill: color-mix(in srgb, #3f83a6 18%, var(--card)); --map-stroke: #2f6a88; }
.map-node-plain { --map-fill: color-mix(in srgb, var(--ink) 9%, var(--card)); --map-stroke: var(--ink); }
.map-node-unknown { --map-fill: color-mix(in srgb, var(--ink) 5%, var(--card)); --map-stroke: color-mix(in srgb, var(--ink) 40%, transparent); }
.map-node-unknown .map-disc { stroke-dasharray: 3 4; }
/* Legend swatches. Same --map-fill source as the nodes. */
.map-dot {
width: 11px; height: 11px; border-radius: 9999px;
background: var(--map-fill, color-mix(in srgb, var(--ink) 9%, var(--card)));
border: 1.5px solid color-mix(in srgb, var(--map-stroke, var(--ink)) 55%, transparent);
}
.map-node-unknown.map-dot { border-style: dashed; }
.map-door-legend {
width: 16px; height: 0;
border-top: 2.5px dashed #c98a2b;
}
}
@layer components {
/* Item compare chips (who page, owner's backpack). gogobee decides the verdict
and per-stat deltas; Pete only colours them. Every colour mixes a fixed hue
into --ink for the text and --card for the fill, so it lands on the readable
side of the card in all four phases — the same by-construction contrast trick
the dungeon map uses, not a Tailwind dark: variant (which follows the OS, not
Pete's phase). The verdict chip is the anchor and always renders; a phone has
no hover, so nothing hides behind one. */
.cmp-chip {
display: inline-flex; align-items: center; gap: 0.25rem;
font-size: 11px; font-weight: 600; line-height: 1;
border-radius: 9999px; padding: 0.18rem 0.5rem;
border: 1px solid transparent;
}
.cmp-up {
color: color-mix(in srgb, #3fa66a 65%, var(--ink));
background: color-mix(in srgb, #3fa66a 16%, var(--card));
border-color: color-mix(in srgb, #3fa66a 38%, transparent);
}
.cmp-down {
color: color-mix(in srgb, #c0392b 60%, var(--ink));
background: color-mix(in srgb, #c0392b 15%, var(--card));
border-color: color-mix(in srgb, #c0392b 36%, transparent);
}
.cmp-side {
color: color-mix(in srgb, var(--ink) 80%, transparent);
background: color-mix(in srgb, var(--ink) 8%, var(--card));
border-color: color-mix(in srgb, var(--ink) 22%, transparent);
}
.cmp-new {
color: color-mix(in srgb, #6d4bd8 62%, var(--ink));
background: color-mix(in srgb, #6d4bd8 15%, var(--card));
border-color: color-mix(in srgb, #6d4bd8 36%, transparent);
}
.cmp-inert {
color: var(--warn); /* --warn is already a phase variable — safe on night */
background: color-mix(in srgb, var(--warn) 16%, var(--card));
border-color: color-mix(in srgb, var(--warn) 36%, transparent);
}
.cmp-same {
color: color-mix(in srgb, var(--ink) 55%, transparent);
background: color-mix(in srgb, var(--ink) 6%, var(--card));
border-color: color-mix(in srgb, var(--ink) 16%, transparent);
}
/* Per-stat deltas — tint-only, lighter than the verdict chip so it stays the
anchor. Green reads as a gain, red as a loss; the engine set the flag. */
.cmp-delta {
font-size: 11px; font-weight: 500; line-height: 1;
border-radius: 9999px; padding: 0.15rem 0.45rem;
}
.cmp-delta-up { color: color-mix(in srgb, #3fa66a 65%, var(--ink)); background: color-mix(in srgb, #3fa66a 13%, var(--card)); }
.cmp-delta-down { color: color-mix(in srgb, #c0392b 60%, var(--ink)); background: color-mix(in srgb, #c0392b 12%, var(--card)); }
}
@layer components {
/* The Siege war room. One rule carries the whole page: the health bar has a
width transition, so a poll that lands a lower pool *slides* the bar down
instead of snapping it. That is the difference between watching the town
chip a boss and reading a report about it, and it costs one line.
prefers-reduced-motion turns the slide off — the number is still correct,
it just arrives instantly.
The ember palette is deliberate and not the adventure purple: a siege is
the one thing on the site that should look like an emergency. It mixes a
fixed hue into --card/--ink like the map and compare chips do, so it lands
readable in all four phases without a dark: variant. */
.siege-track {
position: relative;
height: 1.75rem;
border-radius: 9999px;
overflow: hidden;
background: color-mix(in srgb, var(--ink) 12%, var(--card));
box-shadow: inset 0 2px 4px rgba(0,0,0,0.12);
}
.siege-fill {
height: 100%;
border-radius: 9999px;
background: linear-gradient(90deg, #e0562f 0%, #c0392b 60%, #8f1f16 100%);
transition: width 1.4s cubic-bezier(0.22, 0.61, 0.36, 1);
}
.siege-fill-spent { background: linear-gradient(90deg, #6b7280 0%, #4b5563 100%); }
/* A living siege breathes. Slow and low-contrast on purpose — it should read
as "this is happening now", not as a thing demanding to be clicked. */
.siege-live .siege-fill { animation: siege-pulse 3.2s ease-in-out infinite; }
@keyframes siege-pulse {
0%, 100% { filter: brightness(1); }
50% { filter: brightness(1.12); }
}
.siege-chip {
display: inline-flex; align-items: center; gap: 0.3rem;
font-size: 11px; font-weight: 600; line-height: 1;
border-radius: 9999px; padding: 0.22rem 0.6rem;
border: 1px solid transparent;
}
.siege-chip-fought {
color: color-mix(in srgb, #3fa66a 65%, var(--ink));
background: color-mix(in srgb, #3fa66a 15%, var(--card));
border-color: color-mix(in srgb, #3fa66a 36%, transparent);
}
.siege-chip-waiting {
color: var(--warn);
background: color-mix(in srgb, var(--warn) 14%, var(--card));
border-color: color-mix(in srgb, var(--warn) 34%, transparent);
}
.siege-chip-held {
color: color-mix(in srgb, #3fa66a 65%, var(--ink));
background: color-mix(in srgb, #3fa66a 15%, var(--card));
border-color: color-mix(in srgb, #3fa66a 36%, transparent);
}
.siege-chip-fell {
color: color-mix(in srgb, #c0392b 60%, var(--ink));
background: color-mix(in srgb, #c0392b 15%, var(--card));
border-color: color-mix(in srgb, #c0392b 36%, transparent);
}
/* The past-siege bar: same track, smaller, and frozen at the pool the Siege
ended on. A won Siege ends at zero and draws as an empty track, which is
exactly the right picture. */
.siege-track-sm { height: 0.5rem; }
.siege-track-sm .siege-fill { transition: none; }
@media (prefers-reduced-motion: reduce) {
.siege-fill { transition: none; }
.siege-live .siege-fill { animation: none; }
}
/* The expedition liveblog: a column of what happened, room by room, under the
map that says where. Deliberately plainer than the rest of the page — this
is a log, and forty decorated cards would be unreadable at the length a real
run reaches. The rail down the left is what makes it read as one journey
rather than as a list of unrelated lines. */
.runlog {
list-style: none; margin: 0; padding: 0 0 0 1.1rem;
border-left: 2px solid color-mix(in srgb, var(--ink) 12%, transparent);
display: flex; flex-direction: column; gap: 0.55rem;
max-height: 26rem; overflow-y: auto;
}
.runlog-line {
display: grid; grid-template-columns: 1.4rem 1fr auto;
align-items: baseline; gap: 0.5rem;
font-size: 13px; line-height: 1.4;
color: color-mix(in srgb, var(--ink) 78%, transparent);
}
.runlog-emoji { font-size: 14px; }
.runlog-text { min-width: 0; overflow-wrap: anywhere; }
.runlog-meta {
font-size: 11px; font-variant-numeric: tabular-nums; white-space: nowrap;
color: color-mix(in srgb, var(--ink) 42%, transparent);
}
/* Two tints and no more. A log where every second line is coloured is a log
with no emphasis at all; these mark the beats a reader is scanning for —
what hurt, and what was worth having. */
.runlog-hurt .runlog-text { color: color-mix(in srgb, #c0392b 62%, var(--ink)); font-weight: 600; }
.runlog-good .runlog-text { color: color-mix(in srgb, #3fa66a 60%, var(--ink)); }
/* On the report the log is the page, not a panel inside one: it scrolls with
the document instead of trapping the whole run in a 26rem window that a
reader has to find the edge of before they can move through it. */
.runlog-full { max-height: none; overflow-y: visible; }
/* ── The realm: map, board, hall of firsts ──────────────────────────────
These are hand-written component classes, not generated utilities, and that
matters: a Tailwind class built from a template value gets purged out of the
stylesheet and fails SILENTLY. .standings-tier-{{.DeepestTier}} is exactly
that shape, so all six variants are spelled out below rather than composed.
If a seventh tier ever ships, it needs a line here.
The realm's accent is the adventure purple, unlike the Siege's ember — the
Siege is an emergency, the realm is the standing shape of the world. */
/* Tabs across the four standing pages. */
.realm-tab {
font-weight: 600;
color: color-mix(in srgb, var(--ink) 55%, transparent);
border-bottom: 2px solid transparent;
padding-bottom: 0.15rem;
transition: color 0.15s ease, border-color 0.15s ease;
}
.realm-tab:hover { color: var(--ink); }
.realm-tab-on {
color: #6d4bd8;
border-bottom-color: #6d4bd8;
}
/* The one place in this block a raw purple is set as a foreground rather than
mixed into --ink, so the one place that needs the night override the
existing .text-theme-adventure rule already carries. Everything else here
goes through color-mix and lands readable in all four phases by itself. */
html[data-phase="night"] .realm-tab-on {
color: #baa9eb;
border-bottom-color: #baa9eb;
}
/* A zone card. The default is a place people go: readable, unremarkable. */
.realm-zone {
border-radius: 1.25rem;
padding: 1rem 1.15rem;
background: var(--card);
border: 2px solid color-mix(in srgb, var(--ink) 10%, transparent);
box-shadow: 0 2px 8px rgba(0,0,0,0.06);
transition: border-color 0.15s ease, transform 0.15s ease;
}
.realm-zone:hover { transform: translateY(-1px); }
/* A zone NOBODY has ever cleared. This is the one piece of styling on the page
that has to carry a fact on its own, without being read: a visitor scanning
the map should see where the realm ends before they read a word of it.
Desaturated, dashed, recessed — the opposite of the busy state below. */
.realm-zone-unbeaten {
background: color-mix(in srgb, var(--ink) 5%, var(--card));
border-color: color-mix(in srgb, var(--ink) 18%, transparent);
border-style: dashed;
}
.realm-unbeaten-line {
color: color-mix(in srgb, var(--ink) 52%, transparent);
font-style: italic;
letter-spacing: 0.01em;
}
/* Somebody is in there right now. It wins over the unbeaten styling by source
order, deliberately: a party currently inside a place nobody has ever beaten
is the most interesting card on the page and should read as live, not dead. */
.realm-zone-busy {
border-color: color-mix(in srgb, #6d4bd8 45%, transparent);
border-style: solid;
background: color-mix(in srgb, #6d4bd8 5%, var(--card));
}
/* The postgame band, drawn apart from the rest of the map: it is gated content
and the page should look like it changes character there. */
.realm-band-postgame {
background: color-mix(in srgb, var(--ink) 6%, var(--card));
border: 2px dashed color-mix(in srgb, var(--ink) 20%, transparent);
}
/* The board's deepest-tier chip. Six literal classes on purpose — see the note
at the top of this block. The ramp runs cool-to-hot so a column of them
reads as a gradient of how far people have got. */
.standings-tier {
display: inline-flex; align-items: center;
font-size: 11px; font-weight: 700; line-height: 1;
border-radius: 9999px; padding: 0.25rem 0.5rem;
border: 1px solid transparent;
}
.standings-tier-1 { color: color-mix(in srgb, #6b7280 70%, var(--ink)); background: color-mix(in srgb, #6b7280 12%, var(--card)); border-color: color-mix(in srgb, #6b7280 30%, transparent); }
.standings-tier-2 { color: color-mix(in srgb, #3fa66a 65%, var(--ink)); background: color-mix(in srgb, #3fa66a 12%, var(--card)); border-color: color-mix(in srgb, #3fa66a 30%, transparent); }
.standings-tier-3 { color: color-mix(in srgb, #2f7fd0 65%, var(--ink)); background: color-mix(in srgb, #2f7fd0 12%, var(--card)); border-color: color-mix(in srgb, #2f7fd0 30%, transparent); }
.standings-tier-4 { color: color-mix(in srgb, #8b5cf6 65%, var(--ink)); background: color-mix(in srgb, #8b5cf6 12%, var(--card)); border-color: color-mix(in srgb, #8b5cf6 32%, transparent); }
.standings-tier-5 { color: color-mix(in srgb, #e0562f 65%, var(--ink)); background: color-mix(in srgb, #e0562f 13%, var(--card)); border-color: color-mix(in srgb, #e0562f 34%, transparent); }
.standings-tier-6 { color: color-mix(in srgb, #c9a227 72%, var(--ink)); background: color-mix(in srgb, #c9a227 15%, var(--card)); border-color: color-mix(in srgb, #c9a227 40%, transparent); font-weight: 800; }
/* A realm-first count. Gold, because it is the one number on the board that
can never go up for anybody else once it has been claimed. */
.standings-firsts {
color: color-mix(in srgb, #c9a227 72%, var(--ink));
font-weight: 700;
}
/* The hall of firsts: a ruled ledger with a spine, so a long list reads as a
record rather than as a feed. */
.firsts-ledger {
border-left: 2px solid color-mix(in srgb, var(--ink) 12%, transparent);
padding-left: 1.15rem;
}
.firsts-entry {
position: relative;
padding: 0.7rem 0;
border-bottom: 1px solid color-mix(in srgb, var(--ink) 7%, transparent);
}
.firsts-entry:last-child { border-bottom: 0; }
.firsts-entry::before {
content: "";
position: absolute;
left: -1.45rem; top: 1.15rem;
width: 0.5rem; height: 0.5rem;
border-radius: 9999px;
background: var(--first-dot, color-mix(in srgb, var(--ink) 25%, var(--card)));
}
/* The per-kind dot colour goes through a custom property rather than through
a `.firsts-entry-zone::before` rule, and that is a purge fix, not a style
preference. tailwind.config.js has input.css itself in its content glob, so
a hand-written component class survives the purge only when the extractor
can lift its literal name out of this file — and a class name glued to
`::before` does not extract. It fails SILENTLY, which is how it got noticed
here only because the rule was grepped for afterwards. Any new
`.realm-*`/`.firsts-*` variant wants a plain-selector declaration for the
same reason. */
.firsts-entry-zone { --first-dot: #6d4bd8; }
.firsts-entry-treasure { --first-dot: #c9a227; }
@media (prefers-reduced-motion: reduce) {
.realm-zone:hover { transform: none; }
}
}
@layer components {
/* W7 small surfaces: the pet XP bar and the party roster, both on the
adventurer page. Same purge discipline as the block above — every class here
is declared on a plain selector so Tailwind's extractor can lift its literal
name out of this file. Nothing here is keyed to a pseudo-element. */
/* Pet levelling. It has been happening since the XP wiring was fixed and no
surface has ever shown it. Deliberately a thin rail rather than a health-bar
lookalike: a pet's progress is a nice thing to notice, not a stat to watch. */
.pet-xp-track {
height: 0.3rem;
border-radius: 9999px;
background: color-mix(in srgb, var(--ink) 10%, var(--card));
overflow: hidden;
}
.pet-xp-fill {
height: 100%;
border-radius: 9999px;
background: color-mix(in srgb, #3fa66a 70%, var(--ink));
}
/* At the cap there is nothing left to fill, and an empty track would read as
the opposite. Fill it whole and let the label say why. */
.pet-xp-capped {
background: color-mix(in srgb, #c9a227 72%, var(--ink));
}
/* The party roster. One row per seat, and the three kinds have to be tellable
apart at a glance because they mean different things about the run: the
leader owns the clock, a member is another player, the companion is hired. */
.party-seat {
display: flex;
align-items: baseline;
gap: 0.6rem;
padding: 0.45rem 0;
border-bottom: 1px solid color-mix(in srgb, var(--ink) 7%, transparent);
}
.party-seat:last-child { border-bottom: 0; }
.party-seat-role {
font-size: 10px;
font-weight: 700;
text-transform: uppercase;
letter-spacing: 0.08em;
border-radius: 9999px;
padding: 0.15rem 0.45rem;
color: color-mix(in srgb, var(--ink) 55%, transparent);
background: color-mix(in srgb, var(--ink) 8%, var(--card));
white-space: nowrap;
}
.party-seat-leader {
color: color-mix(in srgb, #6d4bd8 70%, var(--ink));
background: color-mix(in srgb, #6d4bd8 12%, var(--card));
}
/* An opted-out player's seat. It stays on the roster because the party size is
load-bearing — the supply burn and the threat level printed on this same page
felt that body — but it carries no name and no link. Italic and recessed so
it reads as withheld rather than as missing data. */
.party-seat-anon {
font-style: italic;
color: color-mix(in srgb, var(--ink) 45%, transparent);
}
}
@layer components {
/* "While you were away" (adventure section, signed-in owner only). Rows are
quiet by default; the two kinds of line worth an eye — a realm first, a death
— carry a marker. Same plain-selector purge discipline as everything above. */
.away-line {
padding: 0.3rem 0.55rem;
border-radius: 0.75rem;
border-left: 3px solid transparent;
}
.away-line:hover {
background: color-mix(in srgb, var(--ink) 4%, transparent);
}
.away-line-notable {
border-left-color: color-mix(in srgb, #c9a227 60%, transparent);
background: color-mix(in srgb, #c9a227 6%, transparent);
}
}
@layer components {
/* The board row on /adventure and the channel page. It was four flex columns
that never collapsed, and at phone width it fell apart: "lv 14 human cleric"
wrapped onto three lines and the where-column onto three more, beside the
"send trouble" button. Pre-existing — a board pushed with no region and a
short zone name wrapped exactly the same way — so this is a layout fix, not
a regression fix for anything the adventure plan added.
Below sm the row is a small grid: the icon and the name on the top line with
the button pinned right, and the two descriptive columns stacked underneath
the name where they have the whole width to themselves. At sm and up it is
the single line it always was.
It lives here as component classes rather than as utilities in the markup
because the SAME row is built twice — server-side in channel.html and again
in that page's JS twin, which re-renders the list every poll. Two copies of a
utility soup drift; two copies of one class name cannot. */
.roster-row {
display: grid;
grid-template-columns: auto minmax(0, 1fr) auto;
align-items: center;
column-gap: 0.75rem;
row-gap: 0.1rem;
padding: 0.75rem 1.25rem;
}
/* Fixed width, because the two glyphs are not the same size: the house is
wider than the crossed swords, so an auto column indented the stacked lines
under an idle adventurer further than those under a live one. Only visible
once the row stacks, which is why it took a phone-width shot to see. */
.roster-row-icon { grid-column: 1; grid-row: 1; width: 1.35rem; text-align: center; font-size: 1.125rem; line-height: 1.75rem; }
.roster-row-name { grid-column: 2; grid-row: 1; min-width: 0; }
.roster-row-act { grid-column: 3; grid-row: 1; }
.roster-row-meta { grid-column: 2; grid-row: 2; }
.roster-row-where { grid-column: 2; grid-row: 3; }
@media (min-width: 640px) {
.roster-row {
grid-template-columns: auto auto auto minmax(0, 1fr) auto;
column-gap: 1rem;
}
.roster-row-meta { grid-column: 3; grid-row: 1; }
/* The where-column keeps the ml-auto behaviour it had as a flex child: it is
the only 1fr track, so it takes the slack, and the text sits at its end. */
.roster-row-where { grid-column: 4; grid-row: 1; text-align: right; }
.roster-row-act { grid-column: 5; grid-row: 1; }
}
}
internal/web/static/css/output.css
+1 -1
View File
File diff suppressed because one or more lines are too long
internal/web/static/js/adventure-actions.js
+314
View File
@@ -0,0 +1,314 @@
// The action queue, owner side — the first buttons on this site that play the
// game rather than read it.
//
// Same honesty rule as the equip queue: clicking records an intent, and the game
// box acts on its next poll. So nothing here ever says "done" on its own. It says
// "asked for", then shows whatever verdict gogobee filed, including a refusal.
//
// Shared by the adventurer page (pull out, go back in, set out, hire the sitter)
// and the war room (take today's bout), which is why it lives in a file rather
// than inline in either.
//
// Three of the verbs spend euros, so those confirm the cost and the resulting
// balance first — the equip panel's rule, and for the same reason: a button that
// quietly moves money is a button people stop pressing.
(function () {
var panels = Array.prototype.slice.call(document.querySelectorAll('.adv-actions'));
if (!panels.length) return; // not an owner, or not a page with actions
var list = document.getElementById('adv-action-orders');
var box = document.getElementById('adv-action-orders-box');
// How each terminal status reads. gogobee's own detail line is preferred when
// it sent one — it names the zone, the day, the damage — and these are the
// fallback for a verdict that arrived without prose.
var STATUS = {
pending: 'asked for…',
applied: 'done',
rejected_not_running: "couldn't, you weren't on an expedition",
rejected_not_leader: "couldn't, only the party leader can call it",
rejected_no_siege: "couldn't, no Siege is camped outside town",
rejected_already_fought: "couldn't, today's bout is already spent",
rejected_unavailable: "couldn't right now",
rejected_busy: "couldn't, you're already out there",
rejected_insufficient_funds: "couldn't cover it",
rejected_zone_locked: "couldn't, that zone isn't open to you",
rejected_nothing_to_resume: "couldn't, there's nothing waiting for you",
rejected_is_leader: "couldn't, you're the one leading it",
rejected_nothing_to_cancel: "couldn't, no sitter is engaged"
};
// syncOffers keeps the panel's own copy from outliving the truth. Watching it
// run for real is what put this here: after a bout landed, the page went on
// saying "your bout is unspent" above a dead button, under a verdict that said
// the fight was over.
//
// Applied hides the offer, because the thing on offer has happened. A REFUSAL
// puts the button back, and that asymmetry is the point: a refusal is often
// about a stale page, and taking away the retry would leave them nothing to do
// about it.
// INVALIDATES is what an applied verb makes untrue about the OTHER verbs on
// the page. Hiding only the offer that was taken is not enough, and watching it
// run is what showed why: after "Call the whole thing off" landed, the panel
// went on offering "Pull out of the run" — directly under a verdict saying the
// expedition had been abandoned. That is the same lie W5a fixed for the bout,
// in a new place.
//
// The one asymmetry worth keeping: an applied EXTRACT does not hide the
// abandon. An extracted run is still the owner's to close — that is exactly
// what the abandon verb is for from town — so taking the button away there
// would remove the next thing they might legitimately want.
var INVALIDATES = {
expedition_abandon: ['extract', 'expedition_leave'],
expedition_leave: ['extract', 'expedition_abandon'],
extract: ['expedition_leave']
};
function hideOffer(action) {
var btn = document.querySelector('.adv-action-btn[data-action="' + action + '"]');
if (!btn) return;
(btn.closest('[data-offer]') || btn).classList.add('hidden');
}
function syncOffers(orders) {
var newest = {};
orders.forEach(function (o) { if (!(o.action in newest)) newest[o.action] = o; });
Object.keys(newest).forEach(function (action) {
var o = newest[action];
if (o.status === 'pending') return; // still out; leave the button disabled
var btn = document.querySelector('.adv-action-btn[data-action="' + action + '"]');
if (!btn) return;
var offer = btn.closest('[data-offer]') || btn;
if (o.status === 'applied') {
offer.classList.add('hidden');
(INVALIDATES[action] || []).forEach(hideOffer);
return;
}
// All three halves of the restore matter, and each is easy to forget.
// Un-hiding the wrapper: re-enabling a button inside a wrapper an earlier
// pass hid gives back a control nobody can see. Restoring the LABEL: the
// clicked button still says "asked for". And doing it to every button in
// the offer, not just the one whose action matched — placeOrder disables
// the whole group (three loadouts, or the sitter's two durations), so
// restoring one would leave the rest greyed out for good.
offer.classList.remove('hidden');
var group = offer.querySelectorAll('.adv-action-btn[data-action="' + action + '"]');
Array.prototype.forEach.call(group, function (b) {
b.disabled = false;
b.classList.remove('opacity-50');
b.textContent = b.getAttribute('data-label') || b.textContent;
});
});
}
var VERB = {
extract: 'Pull out',
siege_join: 'Join the defence',
expedition_start: 'Set out',
expedition_resume: 'Go back in',
babysit: 'Hire the sitter',
expedition_abandon: 'Call it off',
expedition_leave: 'Turn back',
babysit_cancel: 'Send the sitter home'
};
// The owner's euro balance as of the render, for the money confirms. Absent on
// the war room, whose one verb is free — euroFmt(NaN) never runs there because
// no button on that page carries a data-cost.
var panelBalance = (function () {
var el = document.querySelector('.adv-actions[data-balance]');
return el ? parseFloat(el.getAttribute('data-balance') || '0') : 0;
})();
function euroFmt(n) {
return (Math.round(n * 100) / 100).toLocaleString(undefined, { maximumFractionDigits: 2 });
}
// The zone picker shows one loadout row at a time: prices are per tier, so each
// zone gets its own server-rendered row and this only swaps which is visible.
// Pete never reprices anything in the browser.
(function initZonePicker() {
var pick = document.getElementById('adv-zone-pick');
if (!pick) return;
var groups = Array.prototype.slice.call(document.querySelectorAll('.adv-zone-loadouts'));
function show() {
groups.forEach(function (g) {
g.classList.toggle('hidden', g.getAttribute('data-zone') !== pick.value);
});
}
pick.addEventListener('change', show);
show();
})();
var pollTimer = null;
function render(orders) {
if (!list || !box) return;
list.innerHTML = '';
if (!orders || !orders.length) { box.classList.add('hidden'); return; }
box.classList.remove('hidden');
var anyPending = false;
orders.forEach(function (o) {
if (o.status === 'pending') anyPending = true;
// Stacked, not the equip strip's justify-between row. That layout is right
// for a two-word verdict and wrong here: gogobee answers a bout with a
// whole sentence of damage numbers, which squeezed into a right-hand column
// and pushed the verb itself onto two lines.
var li = document.createElement('li');
var verb = document.createElement('div');
verb.className = 'font-semibold text-[color:var(--ink)]/70';
verb.textContent = VERB[o.action] || o.action;
var said = document.createElement('div');
said.className = 'mt-0.5 leading-snug ' + (o.status === 'pending'
? 'text-[color:var(--ink)]/45'
: (o.status === 'applied' ? 'text-theme-adventure font-semibold' : 'text-[color:var(--warn)]'));
said.textContent = o.detail || STATUS[o.status] || o.status;
li.appendChild(verb); li.appendChild(said);
list.appendChild(li);
});
syncOffers(orders);
// Keep refreshing while anything is unanswered so the verdict lands without a
// reload; stop once everything is terminal. A Siege bout runs a whole combat
// on the game box, so this can legitimately sit on "asked for" for a while.
if (anyPending && !pollTimer) {
pollTimer = setInterval(loadOrders, 10000);
} else if (!anyPending && pollTimer) {
clearInterval(pollTimer); pollTimer = null;
}
}
function loadOrders() {
fetch('/api/adventure/orders', { headers: { 'Accept': 'application/json' } })
.then(function (r) { return r.ok ? r.json() : null; })
.then(function (o) { if (o) render(o); })
.catch(function () { /* transient — a later tick will do */ });
}
// siblings are every button in the same offer — the three loadouts of a zone,
// the sitter's week and month. All of them are disabled together, because the
// game allows one outstanding order per verb and a second click would be
// refused with "already asked", which reads as a broken button rather than as
// the guard it is.
function siblings(btn) {
var offer = btn.closest('[data-offer]');
if (!offer) return [btn];
return Array.prototype.slice.call(offer.querySelectorAll('.adv-action-btn'));
}
function placeOrder(btn) {
var group = siblings(btn);
group.forEach(function (b) { b.disabled = true; b.classList.add('opacity-50'); });
var was = btn.textContent;
btn.textContent = 'asking…';
var body = { action: btn.getAttribute('data-action') };
// Only the verbs that take arguments send any. An attribute that is not on
// the button is simply absent from the body, which is what extract and
// siege_join mean.
if (btn.hasAttribute('data-zone')) body.zone = btn.getAttribute('data-zone');
if (btn.hasAttribute('data-loadout')) body.loadout = btn.getAttribute('data-loadout');
if (btn.hasAttribute('data-days')) body.days = parseInt(btn.getAttribute('data-days'), 10);
fetch('/api/adventure/order', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify(body)
})
.then(function (r) { return r.json().then(function (j) { return { ok: r.ok, body: j }; }); })
.then(function (res) {
if (!res.ok) {
group.forEach(function (b) { b.disabled = false; b.classList.remove('opacity-50'); });
btn.textContent = (res.body && res.body.error) || 'try again';
setTimeout(function () { btn.textContent = was; }, 4000);
return;
}
btn.textContent = 'asked for';
loadOrders();
})
.catch(function () {
group.forEach(function (b) { b.disabled = false; b.classList.remove('opacity-50'); });
btn.textContent = 'try again';
setTimeout(function () { btn.textContent = was; }, 4000);
});
}
// Every verb confirms. The two free ones are one-way (an extraction ends the
// run for the whole party; a bout is the only one you get today) and the three
// W5b ones spend euros, so those also print the cost and the balance it leaves
// — the equip panel's money gate, lifted.
//
// Built in the DOM rather than with confirm(), which would block the event loop
// and, on this site's own evidence, wedge an automated browser.
function askConfirm(btn) {
// Anchor the confirm to the OFFER, not to the panel. With one offer on the
// page those were the same element; with four they are not, and appending to
// the panel put the "set out?" box at the bottom of the section, under the
// sitter, detached from the button that raised it.
var panel = btn.closest('[data-offer]') || btn.closest('.adv-actions') || btn.parentElement;
var existing = document.querySelector('.adv-action-confirm');
if (existing) existing.remove();
var boxEl = document.createElement('div');
boxEl.className = 'adv-action-confirm mt-3 rounded-xl bg-[color:var(--ink)]/5 p-3 text-sm';
var p = document.createElement('p');
p.className = 'text-[color:var(--ink)]/70';
p.textContent = btn.getAttribute('data-confirm') || 'Are you sure?';
var cost = parseFloat(btn.getAttribute('data-cost') || '0');
if (cost > 0) {
var money = document.createElement('p');
money.className = 'mt-1.5 font-semibold text-[color:var(--ink)]/80';
if (panelBalance - cost < 0) {
// No arrow when it does not cover. The game can carry a small debt, so
// the resulting figure is not always nonsense — but printing "€-6,300"
// next to "that won't cover it" is one number too many, and the minus
// lands on the wrong side of the sign.
money.textContent = '€' + euroFmt(cost) + " — you have €" + euroFmt(panelBalance) +
". That won't cover it.";
money.className += ' text-[color:var(--warn)]';
} else {
money.textContent = '€' + euroFmt(cost) + ' — balance €' + euroFmt(panelBalance) +
' → €' + euroFmt(panelBalance - cost) + '.';
}
boxEl.appendChild(p);
boxEl.appendChild(money);
p = null; // already placed; the tail below appends whatever is left
}
var row = document.createElement('div');
row.className = 'mt-2 flex gap-1.5';
var yes = document.createElement('button');
yes.type = 'button';
// A destructive verb gets the red the mischief storefront already uses for
// "this is the one that does something to somebody". "Call the whole thing
// off" throws away a whole party's day and was raising a confirm identical to
// the one for hiring a pet sitter — the two most different decisions on the
// page, in the same purple.
//
// Red rather than the button's own --warn, and that is not a style
// preference: --warn is a dark amber in every light theme and a LIGHT amber
// in the dark one (it is the only dark card), so white on it is unreadable in
// exactly the theme this was first tried in. Seen, not reasoned about.
yes.className = btn.getAttribute('data-confirm-tone') === 'warn'
? 'rounded-full bg-red-500 text-white px-3 py-1 font-semibold'
: 'rounded-full bg-theme-adventure text-white px-3 py-1 font-semibold';
yes.textContent = (btn.getAttribute('data-confirm-label') || 'Yes, do it') +
(cost > 0 ? ' · €' + euroFmt(cost) : '');
yes.addEventListener('click', function () { boxEl.remove(); placeOrder(btn); });
var no = document.createElement('button');
no.type = 'button';
no.className = 'rounded-full border border-[color:var(--ink)]/20 text-[color:var(--ink)]/60 px-3 py-1';
no.textContent = 'Not yet';
no.addEventListener('click', function () { boxEl.remove(); });
row.appendChild(yes); row.appendChild(no);
if (p) boxEl.appendChild(p);
boxEl.appendChild(row);
panel.appendChild(boxEl);
}
panels.forEach(function (panel) {
panel.addEventListener('click', function (e) {
var btn = e.target.closest('.adv-action-btn');
if (!btn || btn.disabled) return;
askConfirm(btn);
});
});
loadOrders();
})();
internal/web/static/js/blackjack.js
+4 -7
View File
@@ -265,13 +265,10 @@
verdictEl.textContent = text; verdictEl.textContent = text;
verdictEl.classList.remove("hidden"); verdictEl.classList.remove("hidden");
// The one thing in this room that gets confetti. A natural is rare, it pays // Every win gets it to rain, because a win should feel like one. A natural is
// 3:2, and if everything celebrated then nothing would. // rarer and pays 3:2, so it keeps the confetti on top of the money as well.
// if (v.outcome === "blackjack") { FX.burst(verdictEl, { count: 34 }); FX.moneyRain({ count: 30 }); }
// The *sound* is not so precious: a win is a win and you should hear it. So else if (v.net > 0) FX.moneyRain();
// the fanfare rides on the money, not on the confetti.
if (v.outcome === "blackjack") FX.burst(verdictEl, { count: 34 });
else if (v.net > 0) FX.sfx("win");
else if (v.net < 0) FX.sfx("lose"); else if (v.net < 0) FX.sfx("lose");
else FX.sfx("push"); else FX.sfx("push");
} }
internal/web/static/js/casino-fx.js
+60
View File
@@ -319,6 +319,65 @@
return Promise.all(done); return Promise.all(done);
} }
// moneyRain: it rains money. The big finish on a win — bills and coins tumbling
// the whole height of the window, swaying and spinning as they fall. Louder than
// confetti, and it carries its own sound (a coin cascade) so it can stand in for
// the plain win fanfare wherever a table decides a win is worth the theatre.
//
// Like burst, the sound comes before the reduced-motion bail: no rain still
// deserves to be heard.
function moneyRain(opts) {
opts = opts || {};
if (opts.sound !== false) sfx(opts.sound || "jackpot");
if (reduced) return Promise.resolve();
var n = opts.count || 22;
var glyphs = opts.glyphs || ["💶", "💰", "🪙", "💵", "💴", "🤑"];
var vw = window.innerWidth || document.documentElement.clientWidth;
var vh = window.innerHeight || document.documentElement.clientHeight;
var done = [];
for (var i = 0; i < n; i++) {
var bit = document.createElement("div");
bit.className = "pete-money";
bit.textContent = glyphs[i % glyphs.length];
stage().appendChild(bit);
// Spread across the width in even lanes, each nudged off its lane so the
// curtain doesn't read as a grid. It sways sideways and spins on the way down.
var x = ((i + 0.5) / n) * vw + jitter(i, vw / n / 2);
var drift = jitter(i + 5, 80);
var startY = -50 - Math.abs(jitter(i + 2, 180));
var spin = jitter(i, 300);
var scale = 0.85 + Math.abs(jitter(i + 3, 0.55));
done.push(
bit
.animate(
[
{ transform: t(x, startY, scale, 0), opacity: 0, offset: 0 },
{ transform: t(x + drift, startY + 40, scale, spin * 0.2), opacity: 1, offset: 0.1 },
{ transform: t(x - drift, vh * 0.55, scale, spin * 0.6), opacity: 1, offset: 0.6 },
{ transform: t(x + drift * 0.5, vh + 60, scale, spin), opacity: 1, offset: 1 },
],
{
duration: 1600 + Math.abs(jitter(i + 9, 1)) * 900,
easing: "cubic-bezier(0.35, 0.15, 0.55, 1)",
fill: "both",
delay: Math.abs(jitter(i, 320)),
}
)
.finished.catch(function () {})
.then(
(function (b) {
return function () { b.remove(); };
})(bit)
)
);
}
return Promise.all(done);
}
// count rolls a number to a new value instead of swapping it. A chip count that // count rolls a number to a new value instead of swapping it. A chip count that
// jumps is a variable; one that climbs is a payout. // jumps is a variable; one that climbs is a payout.
function count(el, to, opts) { function count(el, to, opts) {
@@ -359,6 +418,7 @@
flyMany: flyMany, flyMany: flyMany,
spot: spot, spot: spot,
burst: burst, burst: burst,
moneyRain: moneyRain,
count: count, count: count,
centre: centre, centre: centre,
}; };
internal/web/static/js/casino-sfx.js
+163 -10
View File
@@ -1,12 +1,18 @@
// The noise the room makes. // The noise the room makes.
// //
// There are no audio files here and there is nothing to download. Every sound in // The room speaks in two voices. The cards and chips are *recorded* — real clay
// this casino is *made* — an oscillator, a burst of filtered noise, an envelope — // and real card stock, CC0 foley from Kenney's casino pack, sitting as small ogg
// the same bargain the weather engine takes with its clouds. A card is a short // files under /static/audio/casino. Synthesis never quite caught the grain of a
// slap of noise through a bandpass; a chip is two detuned sines with a click on // chip landing on a chip, so for those we stopped trying. Everything melodic —
// the front; a win is four notes going up. It costs about six kilobytes and no // the wins, the losses, the little ticks — is still *made*: an oscillator, a
// round trips, and it means a sound can be pitched, stretched and detuned per // burst of filtered noise, an envelope, the same bargain the weather engine takes
// call instead of being the same wav 300 times. // with its clouds. A win is four notes going up; a chip is a recording of a chip.
//
// A name is a recording if it appears in SAMPLES and synthesised if it appears in
// SOUNDS. The recordings guard against the one weakness of a sample — the same wav
// 300 times is a machine gun — by keeping several takes per sound and rotating
// through them, and by nudging every play a few percent off pitch. The synthesised
// half was always immune to that; it varies itself.
// //
// Two rules hold the whole file up. // Two rules hold the whole file up.
// //
@@ -21,6 +27,10 @@
// default-off switch for the entire file, checked before anything else happens. // default-off switch for the entire file, checked before anything else happens.
// //
// Exposed as window.PeteSFX. Nothing in here knows what blackjack is. // Exposed as window.PeteSFX. Nothing in here knows what blackjack is.
//
// If a recording hasn't finished decoding on the frame it's first needed, that one
// call falls through to the synthesised version — so the table is never silent
// while the ogg loads, and by the second card everything is real.
(function () { (function () {
"use strict"; "use strict";
@@ -108,6 +118,95 @@
src.stop(t0 + (o.attack || 0.003) + (o.decay || 0.09) + 0.02); src.stop(t0 + (o.attack || 0.003) + (o.decay || 0.09) + 0.02);
} }
// ---- the recordings --------------------------------------------------------
//
// The foley. Each name maps to a handful of takes; `v` (the index of the card or
// chip in a run) picks which one and how far off pitch it lands, so a dealt hand
// is four different cards rather than one card four times. `gain` is per-sound
// and multiplies the master, exactly like the synthesised sounds' peak does.
var SAMPLE_BASE = "/static/audio/casino/";
var SAMPLES = {
// A card thrown down onto the table. `vary` is the largest fraction a take is
// ever pitched by, up or down — 0.20 means a play can land anywhere from a fifth
// slower (deeper) to a fifth faster (brighter).
card: { files: ["cardPlace1", "cardPlace2", "cardPlace3", "cardPlace4"], gain: 0.6, vary: 0.20 },
// A card slid into place — softer, longer than a throw.
deal: { files: ["cardSlide1", "cardSlide2", "cardSlide3", "cardSlide4", "cardSlide5", "cardSlide6"], gain: 0.5, vary: 0.20 },
// A card flicked over.
flip: { files: ["cardFan1", "cardFan2"], gain: 0.5, vary: 0.18 },
// The riffle — one take, so the pitch wobble is all that keeps two shuffles apart.
shuffle: { files: ["cardShuffle"], gain: 0.6, vary: 0.10 },
// A clay chip set down on a stack.
chip: { files: ["chipLay1", "chipLay2"], gain: 0.6, vary: 0.22 },
// Chips gathered and slid away.
sweep: { files: ["chipsHandle2", "chipsHandle4", "chipsHandle6"], gain: 0.5, vary: 0.14 },
};
// Decoded buffers by filename. A value of null means "claimed, in flight or
// decoding"; false means "we tried and it failed, never bother again"; an
// AudioBuffer means ready.
var buffers = {};
var warmed = false;
// A rotating cursor per sound, so that even a run of identical calls walks
// through the takes rather than replaying the first one. Callers pass `v` to
// separate simultaneous sounds (the cards of one deal), but many pass the same
// constant every time — the cursor is what keeps a stack of chips from being the
// same click over and over.
var turn = {};
// decode fetches a file and turns it into a buffer, exactly once per filename.
// decodeAudioData exists in a modern promise flavour and an old callback one;
// this handles both so the foley works on older Safari too.
function decode(file) {
if (file in buffers) return; // ready, in flight, or known-bad
buffers[file] = null;
fetch(SAMPLE_BASE + file + ".ogg")
.then(function (r) { return r.ok ? r.arrayBuffer() : Promise.reject(); })
.then(function (ab) {
return new Promise(function (res, rej) {
var p = ctx.decodeAudioData(ab, res, rej);
if (p && p.then) p.then(res, rej);
});
})
.then(function (buf) { buffers[file] = buf; })
.catch(function () { buffers[file] = false; });
}
// warm pulls every take down once the context is awake, so that after the first
// click the whole set is decoded and ready and nothing has to fall back.
function warm() {
if (warmed || !ctx) return;
warmed = true;
for (var name in SAMPLES) SAMPLES[name].files.forEach(decode);
}
// sample plays one recorded take. It returns false — rather than making a noise —
// when the name isn't a recording or its buffer isn't decoded yet, which is the
// caller's signal to reach for the synthesised version instead.
function sample(name, t0, v) {
var cfg = SAMPLES[name];
if (!cfg) return false;
// Advance the cursor, then offset it by v. The cursor guarantees consecutive
// calls move to the next take; v spreads apart sounds fired together (one
// deal's cards) so they don't all land on the same take at once.
var k = (turn[name] = (turn[name] || 0) + 1) + Math.abs(Math.round(v));
var buf = buffers[cfg.files[k % cfg.files.length]];
if (!buf) return false; // not decoded yet, or failed: let synth cover it
var src = ctx.createBufferSource();
src.buffer = buf;
// Pitch, walking with the same cursor across seven steps between -vary and
// +vary, so even a single-take sound like the shuffle isn't identical twice in
// a row. Seven steps rather than a couple means the runs don't read as a loop.
if (cfg.vary) src.playbackRate.value = 1 + (((k % 7) - 3) / 3) * cfg.vary;
var g = ctx.createGain();
g.gain.value = cfg.gain == null ? 0.6 : cfg.gain;
src.connect(g).connect(master);
src.start(t0);
return true;
}
// ---- the sounds ------------------------------------------------------------ // ---- the sounds ------------------------------------------------------------
// //
// Each one takes the time it starts at, and a `v` — a small per-call variation, // Each one takes the time it starts at, and a `v` — a small per-call variation,
@@ -165,6 +264,17 @@
}); });
}, },
// It rains money. A bright run of coins spilling out over the win fanfare —
// ten metallic pings climbing a pentatonic scale, each with a tick on the
// front of it so it lands as coin rather than as bell.
jackpot: function (t) {
var notes = [784, 988, 1175, 1319, 1568, 1760];
for (var i = 0; i < 10; i++) {
tone(t + i * 0.05, notes[i % notes.length], { type: "triangle", decay: 0.13, gain: 0.09 });
hiss(t + i * 0.05, { freq: 5200, q: 3, decay: 0.02, gain: 0.05 });
}
},
// Two notes down, and the second one is flat. Nobody needs telling twice. // Two notes down, and the second one is flat. Nobody needs telling twice.
lose: function (t) { lose: function (t) {
tone(t, 311.13, { type: "triangle", decay: 0.24, gain: 0.22 }); tone(t, 311.13, { type: "triangle", decay: 0.24, gain: 0.22 });
@@ -208,6 +318,43 @@
tick: function (t) { tick: function (t) {
hiss(t, { freq: 3200, q: 3, decay: 0.02, gain: 0.14 }); hiss(t, { freq: 3200, q: 3, decay: 0.02, gain: 0.14 });
}, },
// The mercy rule buries someone. Four ways to go, one sound each — uno.js
// rolls which animation plays and asks for the sound that matches it.
//
// Rocks coming down: a low rumble with tumbling knocks over the top, and a
// second slump as the pile settles.
rockslide: function (t) {
hiss(t, { filter: "lowpass", freq: 320, sweepTo: 140, decay: 0.5, gain: 0.34, q: 0.6 });
for (var i = 0; i < 6; i++) {
tone(t + i * 0.055, 128 - i * 9, { type: "square", decay: 0.1, gain: 0.09 });
}
hiss(t + 0.3, { filter: "lowpass", freq: 200, decay: 0.32, gain: 0.3, q: 0.5 });
},
// A headstone dropping in: one heavy stone thud that rings a little as it sets.
tombstone: function (t) {
tone(t, 92, { type: "sine", to: 58, glide: 0.16, decay: 0.42, gain: 0.32 });
hiss(t, { filter: "lowpass", freq: 520, decay: 0.12, gain: 0.34, q: 0.6 });
tone(t + 0.02, 184, { type: "triangle", decay: 0.5, gain: 0.08 });
},
// The Mega Man death: the pieces zip outward and the pitch falls away as they go.
zap: function (t) {
tone(t, 1250, { type: "sawtooth", to: 170, glide: 0.34, decay: 0.36, gain: 0.12 });
for (var i = 0; i < 4; i++) {
tone(t + i * 0.02, 940 - i * 130, { type: "square", decay: 0.06, gain: 0.06 });
}
hiss(t, { freq: 3000, sweepTo: 600, decay: 0.3, gain: 0.1, q: 0.8 });
},
// A coffin lid: two flat wooden knocks, the second lower and heavier.
coffin: function (t) {
tone(t, 150, { type: "triangle", decay: 0.14, gain: 0.26 });
hiss(t, { filter: "lowpass", freq: 820, decay: 0.05, gain: 0.24, q: 0.7 });
tone(t + 0.17, 108, { type: "triangle", decay: 0.22, gain: 0.28 });
hiss(t + 0.17, { filter: "lowpass", freq: 600, decay: 0.06, gain: 0.24, q: 0.7 });
},
}; };
// ---- the door -------------------------------------------------------------- // ---- the door --------------------------------------------------------------
@@ -217,6 +364,7 @@
// gesture — after which play() can schedule freely. // gesture — after which play() can schedule freely.
function wake() { function wake() {
if (ctx && ctx.state === "suspended") ctx.resume().catch(function () {}); if (ctx && ctx.state === "suspended") ctx.resume().catch(function () {});
warm();
} }
["pointerdown", "keydown", "touchstart"].forEach(function (ev) { ["pointerdown", "keydown", "touchstart"].forEach(function (ev) {
window.addEventListener(ev, wake, { passive: true }); window.addEventListener(ev, wake, { passive: true });
@@ -231,13 +379,18 @@
// lands in 400ms can say so rather than sleeping. // lands in 400ms can say so rather than sleeping.
function play(name, opts) { function play(name, opts) {
if (muted) return; if (muted) return;
var s = SOUNDS[name]; if (!SOUNDS[name] && !SAMPLES[name]) return; // known to neither voice
if (!s) return;
if (!boot()) return; if (!boot()) return;
wake(); wake();
if (ctx.state !== "running") return; // not yet touched: no sound, and no error if (ctx.state !== "running") return; // not yet touched: no sound, and no error
var t0 = ctx.currentTime + ((opts && opts.delay) || 0);
var v = (opts && opts.v) || 0;
try { try {
s(ctx.currentTime + ((opts && opts.delay) || 0), ((opts && opts.v) || 0)); // A recording if we have one decoded; the synthesised take otherwise — both
// for names that are only ever synthesised, and for the first call of a
// recorded name while its ogg is still loading.
if (sample(name, t0, v)) return;
if (SOUNDS[name]) SOUNDS[name](t0, v);
} catch (e) { } catch (e) {
/* a sound is never worth throwing over */ /* a sound is never worth throwing over */
} }
internal/web/static/js/hangman.js
+4 -4
View File
@@ -293,10 +293,10 @@
verdictEl.textContent = text; verdictEl.textContent = text;
verdictEl.classList.remove("hidden"); verdictEl.classList.remove("hidden");
// Confetti for a phrase guessed outright — the one call you make on your own // A phrase guessed outright keeps the confetti — the one call you make on your
// rather than by grinding the alphabet. // own rather than by grinding the alphabet — and any win at all makes it rain.
if (v.outcome === "solved" && v.net > 0) FX.burst(verdictEl, { count: 30 }); if (v.outcome === "solved" && v.net > 0) { FX.burst(verdictEl, { count: 30 }); FX.moneyRain({ count: 28 }); }
else if (v.net > 0) FX.sfx("win"); else if (v.net > 0) FX.moneyRain();
else if (v.net < 0) FX.sfx("lose"); else if (v.net < 0) FX.sfx("lose");
} }
internal/web/static/js/holdem.js
+6 -1
View File
@@ -370,7 +370,12 @@
return pot.sweep(s.plate, e.amount, { gap: 55 }).then(function () { return pot.sweep(s.plate, e.amount, { gap: 55 }).then(function () {
potTotal.textContent = money(pot.amount); potTotal.textContent = money(pot.amount);
moveStack(e.seat, e.amount); moveStack(e.seat, e.amount);
if (e.seat === me && e.amount > 0) FX.burst(s.plate, { count: 18 }); if (e.seat === me && e.amount > 0) {
FX.burst(s.plate, { count: 18 });
// A real haul makes it rain; a blind-steal doesn't, or poker would be
// raining money every thirty seconds. Twenty big blinds is a pot.
if (view && view.tier && e.amount >= 20 * view.tier.bb) FX.moneyRain({ count: 24 });
}
return wait(260); return wait(260);
}); });
internal/web/static/js/prefs.js
+7 -1
View File
@@ -10,7 +10,13 @@
(function () { (function () {
// The localStorage keys we sync. The weather *cache* is deliberately excluded: // The localStorage keys we sync. The weather *cache* is deliberately excluded:
// it's transient and per-device. // it's transient and per-device.
var SYNCED = ["pete.disabledSources.v1", "pete.weather.loc.v1", "pete-weather-off", "pete.sfx.off"]; // pete.advPush.v1 is read by the *server* — the adventure alert sender parses
// it out of the stored blob to decide who to notify — where every other key
// here is only ever read back by a feature script. If it stops syncing, the
// toggles keep working locally and no alert is ever sent, which is the kind of
// failure nobody reports.
var SYNCED = ["pete.disabledSources.v1", "pete.weather.loc.v1", "pete-weather-off", "pete.sfx.off",
"pete.advPush.v1"];
var user = window.PETE_USER || null; var user = window.PETE_USER || null;
var serverPrefs = window.PETE_PREFS || null; var serverPrefs = window.PETE_PREFS || null;
internal/web/static/js/pwa.js
+91
View File
@@ -50,6 +50,33 @@
}); });
} }
// A subscription stored before the server learned to record the Matrix handle
// can never match an owner-scoped adventure alert, and nothing re-subscribes on
// its own — subscribe() only runs on a click. So an existing subscription gets
// its handle topped up once, silently, from the page it is already on.
//
// Once per endpoint, not once per load: the marker is the endpoint itself, so a
// rotated subscription heals again and a browser that has already done it never
// asks twice. The server's update is a no-op on an already-healed row, so a lost
// marker costs one wasted request and nothing else.
var HEAL_KEY = "pete.pushHeal.v1";
function healLocalpart(sub) {
if (!sub || !sub.endpoint) return;
try {
if (localStorage.getItem(HEAL_KEY) === sub.endpoint) return;
} catch (e) { /* private mode: heal every load rather than never */ }
fetch("/api/push/heal", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ endpoint: sub.endpoint }),
credentials: "same-origin",
}).then(function (res) {
if (!res.ok) return;
try { localStorage.setItem(HEAL_KEY, sub.endpoint); } catch (e) {}
}).catch(function () { /* transient — the next load will do */ });
}
function unsubscribe() { function unsubscribe() {
return currentSub().then(function (sub) { return currentSub().then(function (sub) {
if (!sub) return; if (!sub) return;
@@ -65,6 +92,68 @@
}); });
} }
// ---- adventure alert categories -------------------------------------------
// Stored as a JSON string under a synced prefs key, because this is the one
// preference the *server* reads back: the alert sender parses the same blob to
// decide who to notify. Absent key means nothing enabled, on both sides.
var ADV_KEY = "pete.advPush.v1";
function advRead() {
try {
var raw = localStorage.getItem(ADV_KEY);
if (!raw) return {};
var v = JSON.parse(raw);
return v && typeof v === "object" ? v : {};
} catch (e) { return {}; }
}
function advWrite(set) {
try { localStorage.setItem(ADV_KEY, JSON.stringify(set)); } catch (e) {}
if (window.PetePrefs) window.PetePrefs.push();
}
// initAdvUI wires the category boxes. `on` is whether a push subscription
// currently exists — a category switch with no subscription behind it is wired
// to nothing, so the block stays hidden until there is one.
function initAdvUI(slot, on) {
var box = slot.querySelector("[data-adv-push]");
if (!box) return;
box.hidden = !on;
if (!on) return;
var note = box.querySelector("[data-adv-push-note]");
var inputs = box.querySelectorAll("[data-adv-cat]");
var set = advRead();
function paintNote() {
if (!note) return;
var n = 0;
for (var i = 0; i < inputs.length; i++) if (inputs[i].checked) n++;
note.textContent = n === 0
? "Nothing selected. You'll only get the news digest."
: (n === 1 ? "1 alert type on." : n + " alert types on.");
}
for (var i = 0; i < inputs.length; i++) {
(function (el) {
el.checked = !!set[el.getAttribute("data-adv-cat")];
// This function re-runs every time the subscription state changes; bind
// the listener once or a toggle-off-toggle-on writes the pref twice.
if (!el.dataset.advBound) {
el.dataset.advBound = "1";
el.addEventListener("change", function () {
var cur = advRead();
var key = el.getAttribute("data-adv-cat");
if (el.checked) cur[key] = true; else delete cur[key];
advWrite(cur);
paintNote();
});
}
})(inputs[i]);
}
paintNote();
}
// ---- settings-panel toggle ------------------------------------------------ // ---- settings-panel toggle ------------------------------------------------
function initPushUI() { function initPushUI() {
var slot = document.querySelector("[data-push-section]"); var slot = document.querySelector("[data-push-section]");
@@ -80,6 +169,7 @@
btn.setAttribute("aria-pressed", on ? "true" : "false"); btn.setAttribute("aria-pressed", on ? "true" : "false");
btn.textContent = on ? "Notifications on" : "Turn on notifications"; btn.textContent = on ? "Notifications on" : "Turn on notifications";
if (note && text != null) note.textContent = text; if (note && text != null) note.textContent = text;
initAdvUI(slot, on);
} }
function refresh() { function refresh() {
@@ -90,6 +180,7 @@
} }
currentSub().then(function (sub) { currentSub().then(function (sub) {
paint(!!sub, sub ? "You'll get a nudge when new stories land." : "Get a nudge when new stories land."); paint(!!sub, sub ? "You'll get a nudge when new stories land." : "Get a nudge when new stories land.");
healLocalpart(sub);
}); });
} }
internal/web/static/js/solitaire.js
+273 -12
View File
@@ -44,7 +44,10 @@
var playing = root.querySelector("[data-playing]"); var playing = root.querySelector("[data-playing]");
var betting = root.querySelector("[data-betting]"); var betting = root.querySelector("[data-betting]");
var playControls = root.querySelector("[data-play-controls]");
var wonControls = root.querySelector("[data-won-controls]");
var autoBtn = root.querySelector("[data-auto]"); var autoBtn = root.querySelector("[data-auto]");
var finishBtn = root.querySelector("[data-finish]");
var cashBtn = root.querySelector("[data-cash]"); var cashBtn = root.querySelector("[data-cash]");
var cashAmountEl = root.querySelector("[data-cash-amount]"); var cashAmountEl = root.querySelector("[data-cash-amount]");
var startBtn = root.querySelector("[data-start]"); var startBtn = root.querySelector("[data-start]");
@@ -237,20 +240,45 @@
// meter is what the board is worth. Every number in it comes off the server — // meter is what the board is worth. Every number in it comes off the server —
// this file does no arithmetic about money, which is the point. // this file does no arithmetic about money, which is the point.
function meter(v) { //
// `home` overrides how many cards it says are home, and nothing else. It is
// there so the count can walk up behind the cards instead of arriving with
// them: see tally. It only ever names a count the board has genuinely passed
// through on its way to v.home, so the meter is never quoting a board that
// didn't exist.
function meter(v, home) {
if (!v) { if (!v) {
homeEl.innerHTML = '0<span class="text-white/40">/' + FULL + "</span>"; homeEl.innerHTML = '0<span class="text-white/40">/' + FULL + "</span>";
perCardEl.textContent = "—"; perCardEl.textContent = "—";
breakEvenEl.textContent = ""; breakEvenEl.textContent = "";
return; return;
} }
homeEl.innerHTML = v.home + '<span class="text-white/40">/' + FULL + "</span>"; var n = home === undefined ? v.home : home;
homeEl.innerHTML = n + '<span class="text-white/40">/' + FULL + "</span>";
perCardEl.textContent = "+" + v.per_card.toFixed(1); perCardEl.textContent = "+" + v.per_card.toFixed(1);
breakEvenEl.textContent = breakEvenEl.textContent =
v.home >= v.break_even n >= v.break_even
? "You're ahead of the house" ? "You're ahead of the house"
: v.break_even - v.home + " more to break even"; : v.break_even - n + " more to break even";
meterEl.dataset.cold = v.home === 0 ? "1" : "0"; meterEl.dataset.cold = n === 0 ? "1" : "0";
}
// tally walks the home count up one card at a time, in step with the cards
// actually landing. The chips on this table are already held back until the
// payout has physically swept home — a counter that pays you before the chips
// arrive is a counter that has told you the ending — and the card count was
// the one number still jumping straight to the answer while fifty-one cards
// were visibly still in the air.
function tally(v, arrivals, from) {
if (!v || !arrivals.length) return;
var order = arrivals.slice().sort(function (a, b) { return a.at - b.at; });
meter(v, from);
order.forEach(function (a, i) {
setTimeout(function () { meter(v, from + i + 1); }, a.at);
});
// Whatever the steps added up to, the board is the board: the last word goes
// to the server's own count rather than to this file's running total.
setTimeout(function () { meter(v); }, order[order.length - 1].at);
} }
function controls(v) { function controls(v) {
@@ -258,6 +286,11 @@
playing.classList.toggle("hidden", !live); playing.classList.toggle("hidden", !live);
betting.classList.toggle("hidden", live); betting.classList.toggle("hidden", live);
if (!live) return; if (!live) return;
// A won board has nothing left to decide, so the ordinary controls step aside
// for the one button that finishes it.
var won = !!v.won;
wonControls.classList.toggle("hidden", !won);
playControls.classList.toggle("hidden", won);
autoBtn.disabled = !v.can_auto; autoBtn.disabled = !v.can_auto;
cashAmountEl.textContent = (v.stands || 0).toLocaleString(); cashAmountEl.textContent = (v.stands || 0).toLocaleString();
} }
@@ -292,12 +325,13 @@
} }
// animate plays every card from where it was to where it is. // animate plays every card from where it was to where it is.
function animate(before, plan) { function animate(before, plan, flying) {
if (reduced) return Promise.resolve(); if (reduced) return Promise.resolve();
var waits = []; var waits = [];
root.querySelectorAll(".pete-card[data-key]").forEach(function (el) { root.querySelectorAll(".pete-card[data-key]").forEach(function (el) {
var key = el.dataset.key; var key = el.dataset.key;
if (flying && flying[key]) return; // a ghost of it is already making the trip
var now = el.getBoundingClientRect(); var now = el.getBoundingClientRect();
var was = before[key]; var was = before[key];
var delay = plan.delays[key] || 0; var delay = plan.delays[key] || 0;
@@ -328,6 +362,86 @@
return Promise.all(waits); return Promise.all(waits);
} }
// Cards going home are the one move the after-picture can't describe. A
// foundation only ever draws its top card, so an auto-finish that sends eleven
// cards home is ten cards blinking out of existence and one appearing — which
// is exactly what a finished board used to look like.
//
// So they fly as ghosts: copies lifted out of the old DOM into a fixed layer,
// where they can still be in the air while the board underneath them
// re-renders all at once. The real card that lands on each foundation is held
// invisible until its ghost gets there, so the destination doesn't give away
// the ending before the journey is over.
function homeOut(events) {
var none = { flying: {}, arrivals: [], done: Promise.resolve() };
if (reduced) return none;
var flights = [], at = 0;
(events || []).forEach(function (e) {
if (e.kind === "move") { at += STEP_MS; return; }
if (e.kind !== "home") return;
var delay = at;
at += STEP_MS;
if (!e.to) return;
var dest = foundEl.querySelector('[data-pile="' + e.to + '"]');
if (!dest) return;
var to = dest.getBoundingClientRect();
(e.cards || []).forEach(function (c) {
var el = root.querySelector('.pete-card[data-key="' + c.label + '"]');
if (!el) return;
flights.push({ label: c.label, pile: e.to, delay: delay, from: el.getBoundingClientRect(), to: to, el: el });
});
});
if (!flights.length) return none;
var layer = document.createElement("div");
layer.className = "pete-flight-layer";
document.body.appendChild(layer);
var flying = {}, arrivals = [], waits = [];
flights.forEach(function (f) {
flying[f.label] = true;
arrivals.push({ label: f.label, pile: f.pile, at: f.delay + MOVE_MS });
var ghost = f.el.cloneNode(true);
ghost.style.position = "fixed";
ghost.style.left = f.from.left + "px";
ghost.style.top = f.from.top + "px";
ghost.style.width = f.from.width + "px";
ghost.style.height = f.from.height + "px";
ghost.style.margin = "0";
ghost.style.animation = "none";
layer.appendChild(ghost);
waits.push(
ghost.animate(
[
{ transform: "none" },
{ transform: "translate(" + (f.to.left - f.from.left) + "px," + (f.to.top - f.from.top) + "px)" },
],
{ duration: MOVE_MS, delay: f.delay, easing: "cubic-bezier(0.22, 1, 0.36, 1)", fill: "both" }
).finished.catch(noop)
);
});
return {
flying: flying,
arrivals: arrivals,
done: Promise.all(waits).then(function () { layer.remove(); }),
};
}
// land holds each freshly-rendered foundation card back until the ghost of it
// has finished its flight, then swaps one for the other.
function land(arrivals) {
arrivals.forEach(function (a) {
var el = foundEl.querySelector('[data-pile="' + a.pile + '"] .pete-card[data-key="' + a.label + '"]');
if (!el) return;
el.style.visibility = "hidden";
setTimeout(function () { el.style.visibility = ""; }, a.at);
});
}
function slide(el, dx, dy, delay) { function slide(el, dx, dy, delay) {
return el.animate( return el.animate(
[{ transform: "translate(" + dx + "px," + dy + "px)" }, { transform: "none" }], [{ transform: "translate(" + dx + "px," + dy + "px)" }, { transform: "none" }],
@@ -399,8 +513,9 @@
// noises is the board's soundtrack, walked off the *same* STEP_MS ladder the // noises is the board's soundtrack, walked off the *same* STEP_MS ladder the
// animation is walked off. That matters more than which sound goes where: a // animation is walked off. That matters more than which sound goes where: a
// card you hear land a step before it lands is worse than a card that lands in // card you hear land a step before it lands is worse than a card that lands in
// silence, so this counts its way through the script exactly as planOf and // silence, so this counts its way through the script exactly as planOf,
// flashHome do, and any change to their timing has to be made here too. // homeOut and flashHome do, and any change to their timing has to be made here
// too.
function noises(events) { function noises(events) {
var at = 0; var at = 0;
(events || []).forEach(function (e) { (events || []).forEach(function (e) {
@@ -488,6 +603,7 @@
// something else. Which means you never have to put a card down before choosing // something else. Which means you never have to put a card down before choosing
// a different one. // a different one.
root.querySelector(".pete-felt").addEventListener("click", function (e) { root.querySelector(".pete-felt").addEventListener("click", function (e) {
if (swallowClick) { swallowClick = false; return; } // that was the end of a drag
if (busy || !board || board.phase !== "playing") return; if (busy || !board || board.phase !== "playing") return;
if (e.target.closest("[data-stock]")) return; // the stock has its own handler if (e.target.closest("[data-stock]")) return; // the stock has its own handler
@@ -518,6 +634,143 @@
} }
}); });
// ---- dragging --------------------------------------------------------------
//
// Tapping is the friendly way to play and it stays exactly as it was. Dragging
// is the *other* way, and some hands want it: picking a run up and putting it
// down is one gesture rather than two, and it's the one every physical deck of
// cards has taught. The two share everything below the surface — a drag picks a
// run up with the same pick() and asks the same accepts() — so what lights up
// and what a move means never depends on how you did it.
//
// Nothing happens until the pointer has actually moved. Under the threshold this
// is a tap and the click handler above gets it untouched; over it, the click that
// browsers fire after a drag is swallowed so a drag never also counts as a tap.
var SLOP = 6; // px of travel before a press becomes a drag
var drag = null; // {pile, idx, x0, y0, dx, dy, ghost, live}
var swallowClick = false;
// ghost is the run in your hand, drawn once and moved with the pointer. It's a
// copy: the real cards stay on the felt, faded, so you can see where you lifted
// from and where you'd be putting it back.
function ghostFor(cards, from) {
var felt = getComputedStyle(root.querySelector(".pete-felt"));
var g = document.createElement("div");
g.className = "pete-drag";
["--card-w", "--card-h", "--fan-up", "--fan-down"].forEach(function (v) {
g.style.setProperty(v, felt.getPropertyValue(v));
});
var col = document.createElement("div");
col.className = "pete-col";
cards.forEach(function (c) {
var el = CARDS.el(c, { deal: false, tilt: false });
col.appendChild(el);
});
g.appendChild(col);
g.style.width = from.width + "px";
document.body.appendChild(g);
return g;
}
function dragTo(x, y) {
drag.ghost.style.transform =
"translate3d(" + (x - drag.dx) + "px," + (y - drag.dy) + "px,0)";
// What's under the pointer, and would it take this? The ghost doesn't answer
// to hit tests, so this sees the felt underneath it.
var under = document.elementFromPoint(x, y);
var pileEl = under && under.closest ? under.closest("[data-pile]") : null;
var pile = pileEl ? pileEl.dataset.pile : null;
if (pileEl && pileEl.classList.contains("pete-card")) {
pileEl = pileEl.parentElement && pileEl.parentElement.closest("[data-pile]");
}
var ok = pile && pile !== drag.pile && accepts(pile, held.cards);
root.querySelectorAll('[data-over="1"]').forEach(function (el) { delete el.dataset.over; });
if (ok && pileEl) pileEl.dataset.over = "1";
drag.ghost.dataset.ok = ok ? "1" : "0";
drag.target = ok ? pile : null;
drag.targetEl = ok ? pileEl : null;
}
function dragEnd(commit) {
if (!drag) return;
var d = drag;
drag = null;
root.querySelectorAll('[data-over="1"]').forEach(function (el) { delete el.dataset.over; });
delete root.dataset.dragging;
if (d.ghost) d.ghost.remove();
if (!d.live) return; // never crossed the threshold: it was a tap
swallowClick = true;
setTimeout(function () { swallowClick = false; }, 0); // in case no click follows
if (commit && d.target && held) {
var move = { kind: "move", from: d.pile, to: d.target, count: held.count };
drop();
send(move);
return;
}
// Dropped on nothing, or somewhere it doesn't go. The run goes back where it
// came from and stays in your hand, so the drop targets are still lit and a
// tap can finish what the drag started.
if (commit && d.targetEl) nope(d.targetEl);
}
root.querySelector(".pete-felt").addEventListener("pointerdown", function (e) {
if (busy || !board || board.phase !== "playing") return;
if (e.button !== 0 && e.pointerType === "mouse") return;
var cardEl = e.target.closest('.pete-card[data-live="1"]');
if (!cardEl) return;
var r = cardEl.getBoundingClientRect();
drag = {
pile: cardEl.dataset.pile,
idx: parseInt(cardEl.dataset.idx, 10),
x0: e.clientX,
y0: e.clientY,
dx: e.clientX - r.left,
dy: e.clientY - r.top,
width: r.width,
live: false,
target: null,
targetEl: null,
id: e.pointerId,
el: cardEl,
};
});
root.querySelector(".pete-felt").addEventListener("pointermove", function (e) {
if (!drag || e.pointerId !== drag.id) return;
if (!drag.live) {
if (Math.abs(e.clientX - drag.x0) < SLOP && Math.abs(e.clientY - drag.y0) < SLOP) return;
// It's a drag. Pick the run up — the same pick a tap would have made — and
// if it isn't liftable there's nothing to drag and this goes back to being
// an ordinary press.
pick(drag.pile, drag.idx);
if (!held || held.pile !== drag.pile) { drag = null; return; }
drag.live = true;
drag.ghost = ghostFor(held.cards, drag);
root.dataset.dragging = "1";
// Capture only now that it's a drag, so the pointer stays ours even off the
// felt. Doing it on the press instead would retarget the click that a *tap*
// ends with, and tapping would quietly stop working.
try { drag.el.setPointerCapture(e.pointerId); } catch (_) {}
}
e.preventDefault();
dragTo(e.clientX, e.clientY);
});
root.querySelector(".pete-felt").addEventListener("pointerup", function (e) {
if (drag && e.pointerId === drag.id) dragEnd(true);
});
root.querySelector(".pete-felt").addEventListener("pointercancel", function (e) {
if (drag && e.pointerId === drag.id) dragEnd(false);
});
// Double-click sends a card home. It's the idiom every solitaire has used for // Double-click sends a card home. It's the idiom every solitaire has used for
// thirty years, and the alternative is asking the player which foundation — a // thirty years, and the alternative is asking the player which foundation — a
// question with exactly one right answer. // question with exactly one right answer.
@@ -545,6 +798,10 @@
autoBtn.addEventListener("click", function () { drop(); send({ kind: "auto" }); }); autoBtn.addEventListener("click", function () { drop(); send({ kind: "auto" }); });
// The finish button. On a won board a single auto drains every card home in one
// cascade, and the board settles cleared on the far end of it.
finishBtn.addEventListener("click", function () { drop(); send({ kind: "auto" }); });
cashBtn.addEventListener("click", function () { cashBtn.addEventListener("click", function () {
drop(); drop();
send({ kind: "concede" }); send({ kind: "concede" });
@@ -576,9 +833,9 @@
verdictEl.textContent = text; verdictEl.textContent = text;
verdictEl.classList.remove("hidden"); verdictEl.classList.remove("hidden");
// Clearing 52 cards out of a Vegas deal is the rarest thing that happens in // Clearing 52 cards out of a Vegas deal is the rarest thing that happens in
// this room, so it's the one that gets the confetti. // this room, so it keeps the confetti — but any win now makes it rain.
if (v.outcome === "cleared") FX.burst(verdictEl, { count: 40 }); if (v.outcome === "cleared") { FX.burst(verdictEl, { count: 40 }); FX.moneyRain({ count: 34 }); }
else if (v.net > 0) FX.sfx("win"); else if (v.net > 0) FX.moneyRain();
else if (v.net < 0) FX.sfx("lose"); else if (v.net < 0) FX.sfx("lose");
else FX.sfx("push"); else FX.sfx("push");
} }
@@ -600,11 +857,15 @@
return pre return pre
.then(function () { .then(function () {
var before = snapshot(); var before = snapshot();
var wasHome = board ? board.home : 0;
var home = homeOut(events);
render(v); render(v);
land(home.arrivals);
tally(v, home.arrivals, wasHome);
var plan = planOf(events); var plan = planOf(events);
flashHome(events); flashHome(events);
noises(events); noises(events);
return animate(before, plan); return Promise.all([animate(before, plan, home.flying), home.done]);
}) })
.then(function () { .then(function () {
if (!v) { money(); return; } if (!v) { money(); return; }
internal/web/static/js/trivia.js
+3 -2
View File
@@ -307,8 +307,9 @@
verdictEl.textContent = text; verdictEl.textContent = text;
verdictEl.classList.remove("hidden"); verdictEl.classList.remove("hidden");
// Confetti only for clearing all twelve — the one thing in here worth it. // Clearing all twelve keeps the confetti on top; any win at all makes it rain.
if (v.outcome === "cleared") FX.burst(verdictEl, { count: 34 }); if (v.outcome === "cleared") { FX.burst(verdictEl, { count: 34 }); FX.moneyRain({ count: 30 }); }
else if (v.net > 0) FX.moneyRain();
} }
function setPhase(v) { function setPhase(v) {
internal/web/static/js/uno.js
+95 -7
View File
@@ -304,12 +304,22 @@
colourEl.textContent = ""; colourEl.textContent = "";
if (feltEl) feltEl.dataset.c = ""; if (feltEl) feltEl.dataset.c = "";
} }
pending(live(v) ? (v.pending || 0) : 0); pending(live(v) ? (v.pending || 0) : 0, v);
} }
function pending(n) { // Who the running stack lands on next: during a stack phase that's whoever's
// turn it is. Fall back to the view the caller passed, then to the live game.
function pendingTarget(v) {
var src = v || game;
if (!src) return "you";
if (src.turn === me) return "you";
var s = (src.seats && src.seats[src.turn]) || null;
return (s && s.name) || "them";
}
function pending(n, v) {
if (billEl) { if (billEl) {
billEl.textContent = n > 0 ? "+" + n + " on you" : ""; billEl.textContent = n > 0 ? "+" + n + " on " + pendingTarget(v) : "";
billEl.classList.toggle("hidden", n <= 0); billEl.classList.toggle("hidden", n <= 0);
} }
if (takeN) takeN.textContent = String(n); if (takeN) takeN.textContent = String(n);
@@ -355,7 +365,7 @@
if (!text) { verdictEl.classList.add("hidden"); return; } if (!text) { verdictEl.classList.add("hidden"); return; }
verdictEl.textContent = text; verdictEl.textContent = text;
verdictEl.classList.remove("hidden"); verdictEl.classList.remove("hidden");
if (v.winner === me && v.outcome !== "tie") FX.burst(verdictEl, { count: 34 }); if (v.winner === me && v.outcome !== "tie") { FX.burst(verdictEl, { count: 34 }); FX.moneyRain({ count: 30 }); }
else if (v.winner >= 0 && v.winner !== me) FX.sfx("lose"); else if (v.winner >= 0 && v.winner !== me) FX.sfx("lose");
} }
@@ -475,6 +485,80 @@
return new Promise(function (r) { setTimeout(function () { b.remove(); r(); }, 900); }); return new Promise(function (r) { setTimeout(function () { b.remove(); r(); }, 900); });
} }
// bury gives the mercy rule some ceremony. It rolls one of four send-offs and
// drops it over the buried seat — or over your hand, if it's you going down —
// with the noise that goes with it. Every piece is built from scratch and
// clears itself, so a repaint that lands mid-fall just cuts it short. Resolves
// on the dramatic beat, not on cleanup: the hand shouldn't wait for the dust.
var BURIALS = ["rocks", "tomb", "zap", "coffin"];
function bury(seat) {
var host = seat === me ? handEl : seatEl(seat);
if (!host) return Promise.resolve();
var wrap = document.createElement("div");
wrap.className = "pete-uno-bury";
host.appendChild(wrap);
// No theatre for reduced motion: a single static headstone marks the grave,
// with the stone-drop thud so it isn't silent either.
if (reduced) {
FX.sfx("tombstone");
var stone = document.createElement("div");
stone.className = "pete-uno-tomb";
stone.textContent = "🪦";
wrap.appendChild(stone);
setTimeout(function () { wrap.remove(); }, 1400);
return Promise.resolve();
}
var kind = BURIALS[Math.floor(Math.random() * BURIALS.length)];
wrap.dataset.kind = kind;
if (kind === "rocks") {
FX.sfx("rockslide");
[
{ dx: "-1.15rem", dy: "0.55rem", rot: "-20deg", d: 0 },
{ dx: "0.95rem", dy: "0.7rem", rot: "24deg", d: 70 },
{ dx: "-0.15rem", dy: "0.15rem", rot: "8deg", d: 150 },
{ dx: "-1.5rem", dy: "1.0rem", rot: "-34deg", d: 220 },
{ dx: "1.45rem", dy: "0.95rem", rot: "16deg", d: 300 },
{ dx: "0.35rem", dy: "1.05rem", rot: "-10deg", d: 360 },
].forEach(function (r) {
var el = document.createElement("div");
el.className = "pete-uno-rock";
el.textContent = "🪨";
el.style.setProperty("--dx", r.dx);
el.style.setProperty("--dy", r.dy);
el.style.setProperty("--rot", r.rot);
el.style.setProperty("--d", r.d + "ms");
wrap.appendChild(el);
});
} else if (kind === "zap") {
FX.sfx("zap");
var flash = document.createElement("div");
flash.className = "pete-uno-zap-flash";
wrap.appendChild(flash);
for (var a = 0; a < 8; a++) {
var bit = document.createElement("div");
bit.className = "pete-uno-zap-bit";
bit.style.setProperty("--ang", (a * 45) + "deg");
wrap.appendChild(bit);
}
} else {
// tomb or coffin: one heavy thing drops in and sets.
FX.sfx(kind === "tomb" ? "tombstone" : "coffin");
var mark = document.createElement("div");
mark.className = kind === "tomb" ? "pete-uno-tomb" : "pete-uno-coffin";
mark.textContent = kind === "tomb" ? "🪦" : "⚰️";
wrap.appendChild(mark);
}
// The zap is gone in half a second; the graves linger before they clear.
setTimeout(function () { wrap.remove(); }, kind === "zap" ? 650 : 1500);
return new Promise(function (r) { setTimeout(r, kind === "zap" ? 480 : 640); });
}
// play walks the server's script for a move the acting player just made. // play walks the server's script for a move the acting player just made.
function play(view) { function play(view) {
var events = view.uno_events || []; var events = view.uno_events || [];
@@ -570,7 +654,7 @@
} }
case "stack": case "stack":
pending(e.n); pending(e.n, final);
spotlight(e.seat); spotlight(e.seat);
FX.sfx("bad"); FX.sfx("bad");
return badge(e.seat, "+" + e.n, "bad").then(function () { return wait(140); }); return badge(e.seat, "+" + e.n, "bad").then(function () { return wait(140); });
@@ -614,8 +698,12 @@
bump(e.seat, 0); bump(e.seat, 0);
showHand(e.hand); showHand(e.hand);
pending(0); pending(0);
FX.sfx("bad"); // bury() rolls the send-off and makes its own noise; the badge rides
return badge(e.seat, "Buried on " + e.n, "bad").then(function () { return wait(460); }); // alongside it so you still see what count did them in.
return Promise.all([
bury(e.seat),
badge(e.seat, "Buried on " + e.n, "bad"),
]).then(function () { return wait(300); });
} }
case "skip": case "skip":
internal/web/static/sw.js
+12 -6
View File
@@ -4,7 +4,7 @@
// //
// Bump CACHE_VERSION whenever the precached shell assets change; activate() // Bump CACHE_VERSION whenever the precached shell assets change; activate()
// drops every cache that doesn't match the current version. // drops every cache that doesn't match the current version.
var CACHE_VERSION = "v4"; var CACHE_VERSION = "v5";
var SHELL_CACHE = "pete-shell-" + CACHE_VERSION; var SHELL_CACHE = "pete-shell-" + CACHE_VERSION;
var RUNTIME_CACHE = "pete-runtime-" + CACHE_VERSION; var RUNTIME_CACHE = "pete-runtime-" + CACHE_VERSION;
@@ -117,18 +117,24 @@ self.addEventListener("fetch", function (event) {
return; return;
} }
// Static assets: cache-first (they're versioned by deploy), fill the cache on // Static assets: network-first. Our asset URLs are NOT content-hashed
// first miss so a later offline visit has them. // (/static/js/weather-gl.js stays the same URL across deploys), so a
// cache-first strategy would pin whatever bytes were first cached and never
// notice a redeployed file changed — leaving stale JS/CSS in place until the
// CACHE_VERSION bump below. Go's FileServer sets ETag/Last-Modified, so an
// online refetch is a cheap 304 when nothing changed. We still fill the cache
// on every success and fall back to it when the network is unreachable, so
// offline reading keeps the shell it needs.
if (url.pathname.indexOf("/static/") === 0) { if (url.pathname.indexOf("/static/") === 0) {
event.respondWith( event.respondWith(
caches.match(req).then(function (hit) { fetch(req).then(function (res) {
return hit || fetch(req).then(function (res) {
if (res && res.ok) { if (res && res.ok) {
var copy = res.clone(); var copy = res.clone();
caches.open(SHELL_CACHE).then(function (cache) { cache.put(req, copy); }); caches.open(SHELL_CACHE).then(function (cache) { cache.put(req, copy); });
} }
return res; return res;
}); }).catch(function () {
return caches.match(req);
}) })
); );
return; return;
internal/web/status.go
+29 -1
View File
@@ -50,6 +50,16 @@ type statusPage struct {
Sources []sourceStatus Sources []sourceStatus
DegradedCnt int // sources currently failing DegradedCnt int // sources currently failing
Admin bool // viewer is an admin: show the full diagnostic columns Admin bool // viewer is an admin: show the full diagnostic columns
// Untemplated adventure event types seen since boot, busiest first. Admin-only:
// it names game internals, and it is a to-do list for Pete's vocabulary rather
// than anything a reader wants. Empty in the healthy case.
UnknownAdv []unknownAdvType
}
// unknownAdvType is one event type gogobee sent that Pete had no template for.
type unknownAdvType struct {
EventType string
Count int
} }
// handleStatus renders the source-health page. It's public: everyone sees a // handleStatus renders the source-health page. It's public: everyone sees a
@@ -126,7 +136,25 @@ func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
return rows[i].Name < rows[j].Name return rows[i].Name < rows[j].Name
}) })
// Untemplated dispatch types, admin-only. These publish on the neutral
// fallback rather than being rejected (see handleAdventureIngest), so nothing
// is lost by not noticing — but a type sitting here with a rising count means
// the section is carrying thin cards Pete could be writing properly.
var unknownAdv []unknownAdvType
if admin {
for t, n := range AdvUnknownTypeCounts() {
unknownAdv = append(unknownAdv, unknownAdvType{EventType: t, Count: n})
}
sort.SliceStable(unknownAdv, func(i, j int) bool {
if unknownAdv[i].Count != unknownAdv[j].Count {
return unknownAdv[i].Count > unknownAdv[j].Count
}
return unknownAdv[i].EventType < unknownAdv[j].EventType
})
}
base := s.base(r) base := s.base(r)
base.Active = "status" base.Active = "status"
s.render(w, "status", statusPage{pageData: base, Sources: rows, DegradedCnt: degraded, Admin: admin}) s.render(w, "status", statusPage{pageData: base, Sources: rows, DegradedCnt: degraded, Admin: admin,
UnknownAdv: unknownAdv})
} }
internal/web/templates/_card.html
+11
View File
@@ -10,6 +10,11 @@
data-ch-title="{{$ch.Title}}" data-ch-emoji="{{$ch.Emoji}}" data-ch-theme="{{$ch.Theme}}" data-ch-title="{{$ch.Title}}" data-ch-emoji="{{$ch.Emoji}}" data-ch-theme="{{$ch.Theme}}"
data-posted="{{if .Story.Posted}}1{{end}}" data-posted="{{if .Story.Posted}}1{{end}}"
data-paywalled="{{if .Story.Paywalled}}1{{end}}" data-paywalled="{{if .Story.Paywalled}}1{{end}}"
{{/* An adventure card borrows its event family's colour for the border, and
a realm-first gets a heavier ring on top of it. Inline style rather than
a class: the palette is a Go table of hex values, and a generated
Tailwind class would be purged out of the stylesheet and fail silently. */}}
{{if .Story.Accent}}style="border-color:{{.Story.Accent}}{{if .Story.Ceremony}};box-shadow:0 0 0 4px {{.Story.Accent}}33, 0 10px 30px -12px {{.Story.Accent}}{{end}}"{{end}}
class="group relative block rounded-3xl bg-[color:var(--card)] border-2 {{if .Story.Posted}}border-theme-{{.Theme}} glow-theme-{{.Theme}}{{else}}border-[color:var(--ink)]/10{{end}} shadow-pete overflow-hidden hover:-translate-y-1 hover:shadow-pete-lg transition"> class="group relative block rounded-3xl bg-[color:var(--card)] border-2 {{if .Story.Posted}}border-theme-{{.Theme}} glow-theme-{{.Theme}}{{else}}border-[color:var(--ink)]/10{{end}} shadow-pete overflow-hidden hover:-translate-y-1 hover:shadow-pete-lg transition">
<span role="button" tabindex="0" data-bookmark-btn data-story-id="{{.Story.ID}}" <span role="button" tabindex="0" data-bookmark-btn data-story-id="{{.Story.ID}}"
aria-label="Bookmark this story" aria-pressed="false" aria-label="Bookmark this story" aria-pressed="false"
@@ -36,6 +41,12 @@
{{.Story.Source}} {{.Story.Source}}
</span> </span>
{{end}} {{end}}
{{if .Story.Ceremony}}
<span class="inline-flex items-center rounded-full px-2.5 py-0.5 font-bold uppercase tracking-wider text-white"
style="background-color:{{.Story.Accent}}" title="First time this has ever happened in the realm">
<span aria-hidden="true" class="mr-1">★</span>Realm first
</span>
{{end}}
<span class="text-[color:var(--ink)]/50">{{timeAgo .Story.SeenAt}}</span> <span class="text-[color:var(--ink)]/50">{{timeAgo .Story.SeenAt}}</span>
{{if .Story.ReadMins}}<span class="text-[color:var(--ink)]/45">· {{.Story.ReadMins}} min read</span>{{end}} {{if .Story.ReadMins}}<span class="text-[color:var(--ink)]/45">· {{.Story.ReadMins}} min read</span>{{end}}
{{if .Story.Views}}<span class="ml-auto inline-flex items-center gap-1 text-[color:var(--ink)]/45 tabular-nums" title="{{.Story.Views}} reads"> {{if .Story.Views}}<span class="ml-auto inline-flex items-center gap-1 text-[color:var(--ink)]/45 tabular-nums" title="{{.Story.Views}} reads">
internal/web/templates/_realmnav.html
+21
View File
@@ -0,0 +1,21 @@
{{/* The realm nav, shared by the map, the board, the hall of firsts and the war
room, so the four read as one place rather than four orphans hanging off the
dispatch feed.
It lives in its own partial rather than in realm.html because each page gets
its own parsed template set (see server.go): a {{define}} in one page's file
is invisible to the others, and the only way to share a block is to list it
as a shared file. Passed the whole pageData, so it can mark the current tab
off .Path. */}}
{{define "realmnav"}}
<nav class="mb-5 flex flex-wrap items-center gap-x-4 gap-y-2 text-sm">
<a href="/adventure" class="inline-flex items-center gap-1.5 font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)] transition">
<span aria-hidden="true">←</span> All dispatches
</a>
<span class="text-[color:var(--ink)]/20" aria-hidden="true">·</span>
<a href="/adventure/realm" class="realm-tab{{if eq .Path "/adventure/realm"}} realm-tab-on{{end}}">The map</a>
<a href="/adventure/standings" class="realm-tab{{if eq .Path "/adventure/standings"}} realm-tab-on{{end}}">The board</a>
<a href="/adventure/firsts" class="realm-tab{{if eq .Path "/adventure/firsts"}} realm-tab-on{{end}}">Hall of firsts</a>
<a href="/adventure/siege" class="realm-tab{{if eq .Path "/adventure/siege"}} realm-tab-on{{end}}">The Siege</a>
</nav>
{{end}}
internal/web/templates/channel.html
+73 -12
View File
@@ -14,6 +14,62 @@
</section> </section>
{{if .ShowRoster}} {{if .ShowRoster}}
{{/* While you were away. First thing on the page when it renders at all, and it
renders for exactly one reader: the signed-in owner of an adventurer something
has happened to since their last visit. Above the Siege because everything
below this line is the realm's news and this is the reader's own. */}}
{{if .Away.Has}}
<section class="mb-6 rounded-3xl bg-[color:var(--card)] border-2 border-theme-adventure/30 p-5 sm:p-6 shadow-pete">
<div class="flex items-baseline justify-between gap-3 flex-wrap">
<h2 class="font-display text-xl font-bold">While you were away</h2>
<span class="text-xs uppercase tracking-wider text-[color:var(--ink)]/45">{{.Away.Name}} · past {{.Away.Since}}</span>
</div>
<ul class="mt-3 space-y-2">
{{range .Away.Lines}}
<li class="away-line{{if .Notable}} away-line-notable{{end}}">
<a href="{{.Permalink}}" class="flex items-baseline gap-2.5 group">
<span class="shrink-0" aria-hidden="true">{{.Emoji}}</span>
<span class="flex-1 text-sm">
<span class="font-semibold group-hover:text-theme-adventure group-hover:underline">{{.Label}}</span>
{{if .Line}}<span class="text-[color:var(--ink)]/60"> — {{.Line}}</span>{{end}}
</span>
<span class="text-xs text-[color:var(--ink)]/40 shrink-0 tabular-nums">{{.When}}</span>
</a>
</li>
{{end}}
</ul>
{{if .Away.Token}}
<a href="/adventure/who/{{.Away.Token}}" class="mt-3 inline-flex items-center gap-1.5 text-sm font-semibold text-theme-adventure hover:opacity-80 transition">
{{if .Away.HasMore}}More, and the rest of the trail{{else}}Your adventurer{{end}} <span aria-hidden="true">→</span>
</a>
{{end}}
</section>
{{end}}
{{/* The Siege strip. Above the board on purpose: the board is where everyone is,
the Siege is where everyone should be. When one is camped this is a live bar
and a door into the war room; when none is, it stays as the quiet doorway to
the history, which is the other half of making the next one feel like it
counts. */}}
{{if .Siege.Active}}
<a href="/adventure/siege" class="block mb-6 rounded-3xl bg-theme-adventure text-white p-5 sm:p-6 shadow-pete relative overflow-hidden group {{if not .Siege.Stale}}siege-live{{end}}">
<div class="absolute -top-6 -right-4 text-[8rem] opacity-20 select-none" aria-hidden="true">🏰</div>
<div class="relative">
<p class="text-xs uppercase tracking-[0.2em] opacity-80">🏰 The Siege · now</p>
<h2 class="font-display text-2xl font-bold mt-1 group-hover:underline">{{.Siege.BossName}} is at the gates</h2>
<div class="mt-3 siege-track">
<div class="siege-fill" style="width: {{.Siege.HPPercent}}%"></div>
</div>
<p class="mt-2 text-sm opacity-90 tabular-nums">{{.Siege.HPCurrent}} / {{.Siege.HPMax}} HP · {{.Siege.HPPercent}}% standing · {{len .Siege.Waiting}} bout{{if ne (len .Siege.Waiting) 1}}s{{end}} still going spare</p>
</div>
</a>
{{else if .Siege.History}}
<a href="/adventure/siege" class="flex items-center gap-3 mb-6 rounded-2xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 px-5 py-3 shadow-pete hover:border-theme-adventure/40 transition">
<span class="text-lg" aria-hidden="true">🏰</span>
<span class="text-sm text-[color:var(--ink)]/70">Nothing camped outside town right now — <span class="font-semibold text-theme-adventure">the sieges we've fought</span></span>
</a>
{{end}}
<section class="mb-10" id="roster" data-stale="{{.RosterStale}}"> <section class="mb-10" id="roster" data-stale="{{.RosterStale}}">
<div class="flex items-baseline justify-between mb-3"> <div class="flex items-baseline justify-between mb-3">
<h2 class="font-display text-2xl font-bold">Out there right now</h2> <h2 class="font-display text-2xl font-bold">Out there right now</h2>
@@ -25,15 +81,18 @@
<div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete overflow-hidden {{if .RosterStale}}opacity-60{{end}}" id="roster-card"> <div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete overflow-hidden {{if .RosterStale}}opacity-60{{end}}" id="roster-card">
<ul class="divide-y divide-[color:var(--ink)]/10" id="roster-list"> <ul class="divide-y divide-[color:var(--ink)]/10" id="roster-list">
{{range .Roster}} {{range .Roster}}
<li class="flex items-center gap-4 px-5 py-3" data-token="{{.Token}}" data-name="{{.Name}}"> {{/* The layout is .roster-row, not utilities: this markup has a twin in the
<span class="text-lg" aria-hidden="true">{{if .OnRun}}⚔{{else}}🏠{{end}}</span> script below that re-renders the same list on every poll, and the two
<a href="/adventure/who/{{.Token}}" class="font-semibold hover:text-theme-adventure hover:underline">{{.Name}}</a> have to agree at every width. See the .roster-row block in input.css. */}}
<span class="text-sm text-[color:var(--ink)]/60">lv {{.Level}} {{.ClassRace}}</span> <li class="roster-row" data-token="{{.Token}}" data-name="{{.Name}}">
<span class="ml-auto text-sm {{if .OnRun}}font-semibold{{else}}text-[color:var(--ink)]/60{{end}}"> <span class="roster-row-icon" aria-hidden="true">{{if .OnRun}}⚔{{else}}🏠{{end}}</span>
<a href="/adventure/who/{{.Token}}" class="roster-row-name font-semibold truncate hover:text-theme-adventure hover:underline">{{.Name}}</a>
<span class="roster-row-meta text-sm text-[color:var(--ink)]/60">lv {{.Level}} {{.ClassRace}}</span>
<span class="roster-row-where text-sm {{if .OnRun}}font-semibold{{else}}text-[color:var(--ink)]/60{{end}}">
{{.Where}}{{if .Idle}} <span class="text-[color:var(--ink)]/45">· {{.Idle}}</span>{{end}} {{.Where}}{{if .Idle}} <span class="text-[color:var(--ink)]/45">· {{.Idle}}</span>{{end}}
</span> </span>
{{if and $.User .OnRun}} {{if and $.User .OnRun}}
<button type="button" class="mischief-send shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="{{.Token}}" data-name="{{.Name}}">send trouble</button> <button type="button" class="mischief-send roster-row-act shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="{{.Token}}" data-name="{{.Name}}">send trouble</button>
{{end}} {{end}}
</li> </li>
{{else}} {{else}}
@@ -102,14 +161,16 @@
function row(a) { function row(a) {
var idle = a.Idle ? ' <span class="text-[color:var(--ink)]/45">· ' + esc(a.Idle) + '</span>' : ''; var idle = a.Idle ? ' <span class="text-[color:var(--ink)]/45">· ' + esc(a.Idle) + '</span>' : '';
// The server-rendered twin of this row is above, in the {{"{{range .Roster}}"}}
// block. Keep the class names identical: the layout is all in .roster-row.
var button = (signedIn && a.OnRun) var button = (signedIn && a.OnRun)
? '<button type="button" class="mischief-send shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">send trouble</button>' ? '<button type="button" class="mischief-send roster-row-act shrink-0 rounded-full bg-[color:var(--ink)]/5 hover:bg-red-500 hover:text-white border border-[color:var(--ink)]/15 px-3 py-1 text-xs font-semibold transition" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">send trouble</button>'
: ''; : '';
return '<li class="flex items-center gap-4 px-5 py-3" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">' + return '<li class="roster-row" data-token="' + esc(a.Token) + '" data-name="' + esc(a.Name) + '">' +
'<span class="text-lg" aria-hidden="true">' + (a.OnRun ? '⚔' : '🏠') + '</span>' + '<span class="roster-row-icon" aria-hidden="true">' + (a.OnRun ? '⚔' : '🏠') + '</span>' +
'<a href="/adventure/who/' + esc(a.Token) + '" class="font-semibold hover:text-theme-adventure hover:underline">' + esc(a.Name) + '</a>' + '<a href="/adventure/who/' + esc(a.Token) + '" class="roster-row-name font-semibold truncate hover:text-theme-adventure hover:underline">' + esc(a.Name) + '</a>' +
'<span class="text-sm text-[color:var(--ink)]/60">lv ' + esc(a.Level) + ' ' + esc(a.ClassRace) + '</span>' + '<span class="roster-row-meta text-sm text-[color:var(--ink)]/60">lv ' + esc(a.Level) + ' ' + esc(a.ClassRace) + '</span>' +
'<span class="ml-auto text-sm ' + (a.OnRun ? 'font-semibold' : 'text-[color:var(--ink)]/60') + '">' + '<span class="roster-row-where text-sm ' + (a.OnRun ? 'font-semibold' : 'text-[color:var(--ink)]/60') + '">' +
esc(a.Where) + idle + '</span>' + button + '</li>'; esc(a.Where) + idle + '</span>' + button + '</li>';
} }
internal/web/templates/firsts.html
+76
View File
@@ -0,0 +1,76 @@
{{define "title"}}Hall of firsts — {{.SiteTitle}}{{end}}
{{define "main"}}
<article class="mt-2 mb-10 max-w-3xl mx-auto">
{{template "realmnav" .}}
<header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
<div class="absolute -top-10 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">📜</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] opacity-80">📜 Hall of firsts</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">Everything that has only ever happened once.</h1>
<p class="mt-3 opacity-90 max-w-2xl">
The first time anyone walked out of a place alive. The first time a thing
came out of the ground. Each of these happened exactly once in the history
of the realm and can't happen again.
</p>
{{if .Firsts.Total}}
<div class="mt-6 flex flex-wrap gap-x-8 gap-y-3 text-xs uppercase tracking-wider opacity-85">
<span>Entries · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Firsts.Total}}</span></span>
<span>Places opened · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Firsts.Zones}}</span></span>
{{if .Firsts.Others}}<span>Things found · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Firsts.Others}}</span></span>{{end}}
</div>
{{end}}
{{if and .Firsts.Known .Firsts.Stale}}
<p class="mt-4 text-xs bg-black/25 rounded-xl px-3 py-2">
Ledger as of {{.Firsts.LastSeenAgo}}. Nothing in a history book goes stale exactly, but a new entry might not be here yet.
</p>
{{end}}
</div>
</header>
{{if .Firsts.Years}}
{{range .Firsts.Years}}
<section class="mt-8">
<h2 class="font-display text-2xl font-bold mb-4 tabular-nums">
{{if .Year}}{{.Year}}{{else}}Before the records{{end}}
</h2>
<ol class="firsts-ledger">
{{range .Firsts}}
<li class="firsts-entry firsts-entry-{{.Kind}}">
<div class="flex flex-wrap items-baseline gap-x-2 gap-y-1">
<span class="text-[11px] uppercase tracking-wider text-[color:var(--ink)]/40 font-semibold">{{.Label}}</span>
<span class="font-display font-bold text-base">{{.Display}}</span>
{{if .Tier}}<span class="text-[11px] text-[color:var(--ink)]/35 tabular-nums">T{{.Tier}}</span>{{end}}
</div>
<p class="mt-0.5 text-sm text-[color:var(--ink)]/60">
{{if .Token}}<a href="/adventure/who/{{.Token}}" class="font-semibold text-[color:var(--ink)]/80 hover:text-theme-adventure transition">{{.Holder}}</a>
{{else if .Holder}}<span class="font-semibold text-[color:var(--ink)]/80">{{.Holder}}</span>
{{else}}<span class="italic text-[color:var(--ink)]/40">nobody left who'll admit to it</span>{{end}}
{{if .When}}<span class="text-[color:var(--ink)]/35"> · {{.When}}</span>{{end}}
</p>
</li>
{{end}}
</ol>
</section>
{{end}}
<p class="mt-8 text-xs text-[color:var(--ink)]/40 text-center max-w-xl mx-auto">
An entry with no name is one where the record has outlived the record-holder —
a thing found and long since given away, or somebody who'd rather I didn't say.
The claim still stands.
</p>
{{else}}
<div class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<p class="text-sm text-[color:var(--ink)]/60">
{{if .Firsts.Known}}
Nothing's happened for the first time yet. Everything is about to be a first.
{{else}}
Haven't had the ledger through from the field yet.
{{end}}
</p>
</div>
{{end}}
</article>
{{end}}
internal/web/templates/layout.html
+29
View File
@@ -201,6 +201,35 @@
Turn on notifications Turn on notifications
</button> </button>
</div> </div>
{{if .AdvEnabled}}
<!-- Adventure alerts. Revealed by pwa.js only once a subscription exists,
because a category toggle with no subscription behind it is a switch
wired to nothing. Every box starts unchecked: turning on news
notifications is not consent to be told about the game. -->
<div data-adv-push hidden class="mt-2 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-3">
<div class="text-sm font-bold">⚔️ Adventure alerts</div>
<div class="text-xs text-[color:var(--ink)]/60">Pick what's worth a buzz. Off unless you say so.</div>
<div class="mt-2 space-y-1.5">
<label class="flex items-start gap-2 text-xs cursor-pointer">
<input type="checkbox" data-adv-cat="siege" class="mt-0.5 accent-[color:var(--accent)]">
<span><span class="font-semibold">The Siege</span>: when a world boss camps outside town, and when it's settled.</span>
</label>
<label class="flex items-start gap-2 text-xs cursor-pointer">
<input type="checkbox" data-adv-cat="run" class="mt-0.5 accent-[color:var(--accent)]">
<span><span class="font-semibold">Your expeditions</span>: cleared, backed out, or worse.</span>
</label>
<label class="flex items-start gap-2 text-xs cursor-pointer">
<input type="checkbox" data-adv-cat="departure" class="mt-0.5 accent-[color:var(--accent)]">
<span><span class="font-semibold">Wandering off</span>: your adventurer got bored and left without you.</span>
</label>
<label class="flex items-start gap-2 text-xs cursor-pointer">
<input type="checkbox" data-adv-cat="contract" class="mt-0.5 accent-[color:var(--accent)]">
<span><span class="font-semibold">Contracts on you</span>: somebody paid to have something sent after you.</span>
</label>
</div>
<div data-adv-push-note class="mt-2 text-xs text-[color:var(--ink)]/50"></div>
</div>
{{end}}
</div> </div>
{{end}}{{end}} {{end}}{{end}}
<p class="px-5 pt-3 text-xs text-[color:var(--ink)]/60">Uncheck a feed to hide its stories. <span data-storage-note>Saved in this browser.</span></p> <p class="px-5 pt-3 text-xs text-[color:var(--ink)]/60">Uncheck a feed to hide its stories. <span data-storage-note>Saved in this browser.</span></p>
internal/web/templates/realm.html
+113
View File
@@ -0,0 +1,113 @@
{{define "title"}}The realm — {{.SiteTitle}}{{end}}
{{/* One zone. The whole design problem of this page is in this block: a zone
nobody has ever beaten has to LOOK different, not just say so in small
text, because "nobody has ever done this" is the single most interesting
fact the realm has to offer. */}}
{{define "realmzone"}}
<li class="realm-zone{{if .Unbeaten}} realm-zone-unbeaten{{end}}{{if .Busy}} realm-zone-busy{{end}}">
<div class="flex items-baseline justify-between gap-3">
<h3 class="font-display font-bold text-base flex-1 min-w-0 truncate">{{.Display}}</h3>
{{if .Levels}}<span class="text-[11px] uppercase tracking-wider text-[color:var(--ink)]/40 shrink-0">{{.Levels}}</span>{{end}}
</div>
{{if .Atmosphere}}
<p class="mt-1 text-xs text-[color:var(--ink)]/55 leading-relaxed">{{.Atmosphere}}</p>
{{end}}
<div class="mt-2.5 text-xs">
{{if .Unbeaten}}
<p class="realm-unbeaten-line">Nobody has ever come back out of it.</p>
{{else}}
<p class="text-[color:var(--ink)]/60">
{{/* FirstClearBy empty with Clears > 0 is the anonymised case: the zone
has been beaten, the clearer opted out. It must not read as unbeaten. */}}
First through:
{{if .FirstClearToken}}<a href="/adventure/who/{{.FirstClearToken}}" class="font-semibold hover:text-theme-adventure transition">{{.FirstClearBy}}</a>
{{else if .FirstClearBy}}<span class="font-semibold">{{.FirstClearBy}}</span>
{{else}}<span class="italic text-[color:var(--ink)]/45">somebody who'd rather not say</span>{{end}}
{{if .FirstWhen}}<span class="text-[color:var(--ink)]/40"> · {{.FirstWhen}}</span>{{end}}
</p>
<p class="mt-0.5 text-[color:var(--ink)]/45 tabular-nums">
{{.Clears}} clear{{if ne .Clears 1}}s{{end}} by {{.Clearers}} adventurer{{if ne .Clearers 1}}s{{end}}
</p>
{{end}}
</div>
{{if .Occupants}}
<div class="mt-2.5 pt-2.5 border-t border-[color:var(--ink)]/10">
<p class="text-[11px] uppercase tracking-wider text-theme-adventure font-semibold">In there now</p>
<p class="mt-1 text-xs">
{{range $i, $o := .Occupants}}{{if $i}}<span class="text-[color:var(--ink)]/30">, </span>{{end}}<!--
-->{{if $o.Token}}<a href="/adventure/who/{{$o.Token}}" class="font-semibold hover:text-theme-adventure transition">{{$o.Name}}</a>{{else}}<span class="font-semibold">{{$o.Name}}</span>{{end}}<!--
-->{{if $o.Day}}<span class="text-[color:var(--ink)]/40"> (day {{$o.Day}})</span>{{end}}{{end}}
</p>
</div>
{{end}}
</li>
{{end}}
{{define "main"}}
<article class="mt-2 mb-10 max-w-5xl mx-auto">
{{template "realmnav" .}}
<header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
<div class="absolute -top-10 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">🗺️</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] opacity-80">🗺️ The realm</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">Everywhere you can go, and what came back.</h1>
<p class="mt-3 opacity-90 max-w-2xl">
Every place in the world, in the order it gets harder. Some of these have been
walked a hundred times. Some of them have never been walked at all.
</p>
{{if .Realm.Known}}
<div class="mt-6 flex flex-wrap gap-x-8 gap-y-3 text-xs uppercase tracking-wider opacity-85">
<span>Places · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Realm.ZoneCount}}</span></span>
<span>Beaten · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Realm.ClearedZones}}</span></span>
<span>Never beaten · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Realm.Unbeaten}}</span></span>
<span>Out there now · <span class="font-semibold tabular-nums normal-case tracking-normal text-base">{{.Realm.OutThere}}</span></span>
</div>
{{end}}
{{if and .Realm.Known .Realm.Stale}}
<p class="mt-4 text-xs bg-black/25 rounded-xl px-3 py-2">
The wire's been quiet — this is the realm as of {{.Realm.LastSeenAgo}}. The places
haven't moved, but who's out in them might have.
</p>
{{end}}
</div>
</header>
{{if not .Realm.Known}}
<div class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<p class="text-sm text-[color:var(--ink)]/60">
I haven't had the survey through from the field yet. When it lands, the whole
world lives on this page.
</p>
</div>
{{end}}
{{range .Realm.Tiers}}
<section class="mt-8{{if .Postgame}} realm-band-postgame rounded-3xl p-5 sm:p-6{{end}}">
<div class="flex flex-wrap items-baseline justify-between gap-x-4 gap-y-1 mb-1">
<h2 class="font-display text-xl sm:text-2xl font-bold">{{.Label}}</h2>
<span class="text-xs text-[color:var(--ink)]/45 tabular-nums shrink-0">
{{.Cleared}} of {{len .Zones}} beaten
</span>
</div>
{{if .Blurb}}<p class="text-sm text-[color:var(--ink)]/55 mb-4 max-w-2xl">{{.Blurb}}</p>{{end}}
<ul class="grid gap-4 sm:grid-cols-2 lg:grid-cols-3">
{{range .Zones}}{{template "realmzone" .}}{{end}}
</ul>
</section>
{{end}}
{{if .Realm.Known}}
<p class="mt-8 text-xs text-[color:var(--ink)]/40 text-center">
Say <code class="rounded bg-[color:var(--ink)]/8 px-1.5 py-0.5 font-mono">!expedition start</code>
to me in Matrix to pick one and go.
</p>
{{end}}
</article>
{{end}}
internal/web/templates/run_report.html
+83
View File
@@ -0,0 +1,83 @@
{{define "title"}}{{.Name}} in {{.Zone}} — {{.SiteTitle}}{{end}}
{{define "main"}}
<article class="mt-2 mb-10 max-w-3xl mx-auto">
<nav class="mb-4 flex items-center gap-4">
<a href="/adventure" class="inline-flex items-center gap-1.5 text-sm font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)] transition">
<span aria-hidden="true">←</span> All dispatches
</a>
{{if .WhoURL}}
<a href="{{.WhoURL}}" class="inline-flex items-center gap-1.5 text-sm font-semibold text-[color:var(--ink)]/60 hover:text-[color:var(--ink)] transition">
{{.Name}}'s sheet <span aria-hidden="true">→</span>
</a>
{{end}}
</nav>
<header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
<div class="absolute -top-6 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">{{.Emoji}}</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] opacity-80">{{.Emoji}} {{.Verdict}}</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">{{.Name}} in {{.Zone}}</h1>
<p class="mt-4 text-xs uppercase tracking-wider opacity-75">
{{if .When}}{{.When}}{{end}}{{if .Level}} · level {{.Level}}{{end}}{{if .Elapsed}} · {{.Elapsed}} down there{{end}}{{if .Rooms}} · {{.Rooms}}{{end}}
</p>
</div>
</header>
{{if .Summary}}
<!-- The one paragraph on this page nobody in the realm wrote down as it
happened: the game's own model reading the finished run back. Guarded at
ingest, and absent entirely when the model is off — which is why it sits
above the numbers rather than instead of them. -->
<section class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 sm:p-8 shadow-pete">
<p class="text-lg leading-relaxed text-[color:var(--ink)]/90 whitespace-pre-line">{{.Summary}}</p>
</section>
{{end}}
{{if .Stats}}
<section class="mt-6 grid grid-cols-2 sm:grid-cols-3 gap-2">
{{range .Stats}}
<div class="rounded-2xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 px-2 py-3 text-center shadow-pete">
<div class="font-display text-2xl font-bold leading-none tabular-nums">{{.Value}}</div>
<div class="text-[10px] uppercase tracking-wider text-[color:var(--ink)]/50 mt-1.5">{{.Label}}</div>
</div>
{{end}}
</section>
{{end}}
{{if .Turning}}
<!-- The worst single thing that happened, pulled out of the middle of the log
where it would otherwise read as one line among forty. -->
<section class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<h2 class="font-display text-xl font-bold mb-3">Where it turned</h2>
<p class="flex items-baseline gap-2.5">
<span aria-hidden="true">{{.Turning.Emoji}}</span>
<span class="flex-1 font-semibold">{{.Turning.Text}}</span>
<span class="runlog-meta">{{if .Turning.Room}}{{.Turning.Room}} · {{end}}{{.Turning.When}}</span>
</p>
</section>
{{end}}
<section class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<div class="flex items-baseline justify-between mb-4 gap-3">
<h2 class="font-display text-xl font-bold">Room by room</h2>
{{if .Live}}<span class="text-sm text-[color:var(--ink)]/50">still under way</span>{{end}}
</div>
<ol class="runlog runlog-full">
{{range .Lines}}
<li class="runlog-line{{if .Hurt}} runlog-hurt{{end}}{{if .Good}} runlog-good{{end}}">
<span class="runlog-emoji" aria-hidden="true">{{.Emoji}}</span>
<span class="runlog-text">{{.Text}}</span>
<span class="runlog-meta">{{if .Room}}{{.Room}} · {{end}}{{.When}}</span>
</li>
{{end}}
</ol>
{{if .Truncated}}
<p class="mt-4 text-xs text-[color:var(--ink)]/45">Only the last {{len .Lines}} moments of this run are shown — it beat out more than the report keeps.</p>
{{end}}
<p class="mt-8 pt-6 border-t border-[color:var(--ink)]/10 text-sm italic text-theme-adventure font-semibold">
Reporting from the realm, this is Pete.
</p>
</section>
</article>
{{end}}
internal/web/templates/siege.html
+242
View File
@@ -0,0 +1,242 @@
{{define "title"}}{{if .Siege.Active}}The Siege — {{.Siege.BossName}}{{else}}The Siege{{end}} — {{.SiteTitle}}{{end}}
{{/* One row of the defender board. Same shape whether they fought today or are
still to go; the column they're in is the message. An opted-out defender
carries no token, so they get no link — their damage still counts and still
holds its rank, they just aren't named. */}}
{{define "defenderrow"}}
<li class="flex items-baseline gap-3 py-1.5 border-b border-[color:var(--ink)]/5 last:border-0">
<span class="flex-1 min-w-0">
{{if .Token}}<a href="/adventure/who/{{.Token}}" class="font-semibold hover:text-theme-adventure transition truncate">{{.Name}}</a>
{{else}}<span class="font-semibold text-[color:var(--ink)]/55 italic truncate">{{.Name}}</span>{{end}}
{{if .Level}}<span class="text-xs text-[color:var(--ink)]/40 ml-1.5">lv {{.Level}}</span>{{end}}
</span>
{{if .Fights}}
<span class="text-xs text-[color:var(--ink)]/50 shrink-0 tabular-nums">{{.Damage}} dmg · {{.Fights}} bout{{if ne .Fights 1}}s{{end}}</span>
{{else}}
<span class="text-xs text-[color:var(--ink)]/35 shrink-0">not yet in it</span>
{{end}}
</li>
{{end}}
{{define "main"}}
<article class="mt-2 mb-10 max-w-3xl mx-auto" id="siege"
data-active="{{if .Siege.Active}}1{{else}}0{{end}}" data-ends-at="{{.Siege.EndsAt}}">
{{/* The war room joined the realm nav when the realm pages landed: it is one
of the four standing pages about this place, not a one-off. */}}
{{template "realmnav" .}}
{{if .Siege.Active}}
<header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden {{if not .Siege.Stale}}siege-live{{end}}">
<div class="absolute -top-8 -right-4 text-[12rem] opacity-20 select-none" aria-hidden="true">🏰</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] opacity-80">🏰 The Siege · Tier {{.Siege.Tier}}</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">{{.Siege.BossName}}</h1>
<p class="mt-2 opacity-90">Camped outside town. One bout each, every day, until it falls or the window closes.</p>
<!-- The bar. This is the page. -->
<div class="mt-6 siege-track" role="progressbar" aria-label="Siege boss health"
aria-valuemin="0" aria-valuemax="100" aria-valuenow="{{.Siege.HPPercent}}" id="siege-bar-track">
<div class="siege-fill" id="siege-bar" style="width: {{.Siege.HPPercent}}%"></div>
</div>
<div class="mt-2 flex items-baseline justify-between text-sm">
<span class="font-semibold tabular-nums"><span id="siege-hp">{{.Siege.HPCurrent}}</span> / <span id="siege-hpmax">{{.Siege.HPMax}}</span> HP</span>
<span class="opacity-80 tabular-nums"><span id="siege-pct">{{.Siege.HPPercent}}</span>% standing</span>
</div>
<div class="mt-5 flex flex-wrap gap-x-6 gap-y-2 text-xs uppercase tracking-wider opacity-85">
<span>Time left · <span class="font-semibold normal-case tracking-normal" id="siege-countdown">—</span></span>
<span>Bouts today · <span class="font-semibold tabular-nums" id="siege-bouts">{{.Siege.BoutsToday}}</span></span>
<span>Mustered · <span class="font-semibold tabular-nums" id="siege-mustered">{{.Siege.Mustered}}</span></span>
</div>
{{if .Siege.Stale}}
<p class="mt-4 text-xs bg-black/25 rounded-xl px-3 py-2">
We've lost the wire to the field — this is where the pool stood {{.Siege.LastSeenAgo}}. Treat the number as history until it comes back.
</p>
{{end}}
</div>
</header>
<!-- How to actually join in. A signed-in adventurer can do it from here; the
Matrix command stays on the page for everyone else, because it is still
the only door for a visitor who isn't signed in — and the blow-by-blow of
the fight arrives there whichever door you came through. -->
<div id="adv-actions" class="adv-actions mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-theme-adventure/30 p-5 shadow-pete">
{{if .YouOnBoard}}
{{if .YouFought}}
<p class="text-sm text-[color:var(--ink)]/75">
<span class="font-semibold text-theme-adventure">You've taken your bout today.</span>
Come back tomorrow. One fight each, per day, and everyone in the right-hand column below still has theirs.
</p>
{{else}}
{{/* data-offer marks the half of this panel that stops being true the
moment the bout lands. The script hides it on an applied verdict, so
the page can't go on saying "unspent" over a fight that just
happened. */}}
<div data-offer>
<p class="text-sm text-[color:var(--ink)]/75 mb-3">
<span class="font-semibold text-theme-adventure">Your bout is unspent.</span>
Damage counts whether you win the fight or not. Turning up is the mechanic, and the blow-by-blow lands in Matrix.
</p>
<button type="button"
class="adv-action-btn rounded-full bg-theme-adventure text-white px-4 py-1.5 text-sm font-semibold hover:opacity-90 transition"
data-action="siege_join"
data-label="Take your bout"
data-confirm-label="Yes, take my bout"
data-confirm="Take your bout against this boss now? It's the only one you get today, and it costs real HP, though you can't die from it. The damage comes off the pool whether you win or lose.">Take your bout</button>
</div>
{{end}}
{{else}}
<p class="text-sm text-[color:var(--ink)]/75">
<span class="font-semibold text-theme-adventure">Taking your bout:</span>
say <code class="rounded bg-[color:var(--ink)]/8 px-1.5 py-0.5 font-mono text-xs">!adventure siege fight</code>
to me in Matrix. One a day, each. Damage counts whether you win the fight or not; turning up is the mechanic.
</p>
{{end}}
<div id="adv-action-orders-box" class="mt-4 hidden">
<ul id="adv-action-orders" class="space-y-1.5 text-xs"></ul>
</div>
</div>
<!-- The muster. Two columns, and the right-hand one is the point: a bout not
taken today is damage the pool never sees. -->
<section class="mt-6 grid gap-6 sm:grid-cols-2">
<div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<div class="flex items-baseline justify-between mb-3">
<h2 class="font-display text-xl font-bold">In it today</h2>
<span class="siege-chip siege-chip-fought">{{len .Siege.Fought}}</span>
</div>
{{if .Siege.Fought}}
<ul class="text-sm">{{range .Siege.Fought}}{{template "defenderrow" .}}{{end}}</ul>
{{else}}
<p class="text-sm text-[color:var(--ink)]/50">Nobody's swung at it yet today. The pool doesn't move on its own.</p>
{{end}}
</div>
<div class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<div class="flex items-baseline justify-between mb-3">
<h2 class="font-display text-xl font-bold">Bout still going spare</h2>
<span class="siege-chip siege-chip-waiting">{{len .Siege.Waiting}}</span>
</div>
{{if .Siege.Waiting}}
<ul class="text-sm">{{range .Siege.Waiting}}{{template "defenderrow" .}}{{end}}</ul>
<p class="mt-3 text-xs text-[color:var(--ink)]/45">Each of these is a free hit the town hasn't taken.</p>
{{else}}
<p class="text-sm text-[color:var(--ink)]/50">Everyone's been out. Good turnout.</p>
{{end}}
</div>
</section>
{{else}}
<header class="rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 sm:p-10 shadow-pete relative overflow-hidden">
<div class="absolute -top-8 -right-4 text-[12rem] opacity-10 select-none" aria-hidden="true">🏰</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] text-[color:var(--ink)]/50">🏰 The Siege</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">Nothing's camped outside town.</h1>
<p class="mt-3 text-[color:var(--ink)]/70">
{{if .Siege.Known}}
Quiet month so far. One comes for the town every month — a named thing with a shared health pool, and everybody gets a swing a day at it.
{{else}}
I haven't heard from the field about a Siege yet. When one turns up, the bar lives here.
{{end}}
</p>
</div>
</header>
{{end}}
{{if .Siege.History}}
<!-- The history is what makes the live bar mean something. A won siege ends
at zero and draws as an empty track; a lost one shows exactly how much
was left standing when the window shut. -->
<section class="mt-8 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<h2 class="font-display text-xl font-bold mb-4">Sieges past</h2>
<ul class="space-y-4">
{{range .Siege.History}}
<li>
<div class="flex items-baseline justify-between gap-3">
<span class="font-semibold flex-1 min-w-0 truncate">{{.BossName}} <span class="text-xs font-normal text-[color:var(--ink)]/40">T{{.Tier}}</span></span>
<span class="siege-chip {{if .Won}}siege-chip-held{{else}}siege-chip-fell{{end}} shrink-0">{{if .Won}}town held{{else}}broke through{{end}}</span>
</div>
<div class="mt-1.5 siege-track siege-track-sm">
<div class="siege-fill {{if .Won}}siege-fill-spent{{end}}" style="width: {{.HPPercent}}%"></div>
</div>
<div class="mt-1.5 flex flex-wrap items-baseline justify-between gap-x-3 text-xs text-[color:var(--ink)]/50">
<span>
{{if .Won}}Felled by {{.Defenders}} defender{{if ne .Defenders 1}}s{{end}}{{else}}{{.HPRemaining}} HP still standing when the window shut{{end}}{{if .MVP}} · most bouts: <span class="font-semibold text-[color:var(--ink)]/70">{{.MVP}}</span>{{if .MVPFights}} ({{.MVPFights}}){{end}}{{end}}
</span>
{{if .When}}<span class="shrink-0">{{.When}}</span>{{end}}
</div>
</li>
{{end}}
</ul>
</section>
{{end}}
</article>
<script>
// The war room is state, like the board — an open tab should stay honest without
// a reload. Two moving parts:
//
// 1. The countdown, which ticks locally every second off the pushed ends_at.
// No network for that; the deadline is fixed the moment the Siege spawns.
// 2. The pool, re-polled every 15s. The bar's width is set here and CSS does
// the animating (a width transition), so a poll that lands a lower pool
// *slides* rather than snapping. That slide is the whole reason this page
// exists: it is what turns a number into the town chipping something down.
(function () {
var root = document.getElementById('siege');
if (!root) return;
var active = root.getAttribute('data-active') === '1';
var endsAt = parseInt(root.getAttribute('data-ends-at') || '0', 10);
function txt(id, v) { var el = document.getElementById(id); if (el && v != null) el.textContent = v; }
function tickCountdown() {
var el = document.getElementById('siege-countdown');
if (!el) return;
if (!endsAt) { el.textContent = '—'; return; }
var left = endsAt - Math.floor(Date.now() / 1000);
if (left <= 0) { el.textContent = 'window closed'; return; }
var h = Math.floor(left / 3600), m = Math.floor((left % 3600) / 60), s = left % 60;
el.textContent = h > 0 ? (h + 'h ' + m + 'm') : (m + 'm ' + s + 's');
}
if (!active) return; // nothing camped: no countdown, no poll, nothing to move
tickCountdown();
setInterval(tickCountdown, 1000);
var pollTimer = null;
function refresh() {
fetch('/api/adventure/siege', { headers: { 'Accept': 'application/json' } })
.then(function (r) { return r.ok ? r.json() : null; })
.then(function (data) {
if (!data) return;
if (!data.active) {
// It resolved while we were watching. The page we're holding is now a
// different page — reload rather than fake an ending, so the result and
// the fresh history come from the server that knows them.
if (pollTimer) clearInterval(pollTimer);
window.location.reload();
return;
}
var bar = document.getElementById('siege-bar');
if (bar) bar.style.width = data.hp_percent + '%';
var track = document.getElementById('siege-bar-track');
if (track) track.setAttribute('aria-valuenow', data.hp_percent);
txt('siege-hp', data.hp_current);
txt('siege-hpmax', data.hp_max);
txt('siege-pct', data.hp_percent);
txt('siege-bouts', data.bouts_today);
txt('siege-mustered', data.mustered);
if (data.ends_at) endsAt = data.ends_at;
})
.catch(function () { /* transient — the next tick will do */ });
}
pollTimer = setInterval(refresh, 15000);
})();
</script>
{{end}}
{{define "scripts"}}<script src="/static/js/adventure-actions.js" defer></script>{{end}}
internal/web/templates/solitaire.html
+20 -2
View File
@@ -86,7 +86,9 @@
<!-- Playing: shown while a board is live. --> <!-- Playing: shown while a board is live. -->
<section data-playing class="hidden rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10"> <section data-playing class="hidden rounded-3xl bg-[color:var(--card)] p-5 sm:p-6 shadow-pete border-2 border-[color:var(--ink)]/10">
<div class="flex flex-wrap items-center gap-3">
<!-- The ordinary controls, while there's still a game to play. -->
<div data-play-controls class="flex flex-wrap items-center gap-3">
<button type="button" data-auto <button type="button" data-auto
class="rounded-full bg-[color:var(--ink)]/5 px-5 py-2.5 font-display font-bold border-2 border-[color:var(--ink)]/10 class="rounded-full bg-[color:var(--ink)]/5 px-5 py-2.5 font-display font-bold border-2 border-[color:var(--ink)]/10
hover:bg-[color:var(--ink)]/10 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition"> hover:bg-[color:var(--ink)]/10 active:translate-y-px disabled:opacity-40 disabled:pointer-events-none transition">
@@ -94,7 +96,7 @@
</button> </button>
<p class="text-xs text-[color:var(--ink)]/45"> <p class="text-xs text-[color:var(--ink)]/45">
Click a card, then where it goes. Double-click sends it home. Drag a card where it goes, or click it and then click the spot. Double-click sends it home.
</p> </p>
<button type="button" data-cash <button type="button" data-cash
@@ -103,6 +105,22 @@
Cash the board · <span data-cash-amount class="tabular-nums">0</span> Cash the board · <span data-cash-amount class="tabular-nums">0</span>
</button> </button>
</div> </div>
<!-- The board's won: every card's face up and the piles are drained, so
there's nothing left to decide. One press sends the lot home. -->
<div data-won-controls class="hidden">
<div class="flex flex-wrap items-center gap-3">
<button type="button" data-finish
class="pete-finish rounded-full bg-[color:var(--accent)] px-8 py-3 font-display text-lg font-bold text-white shadow-pete
hover:brightness-105 active:translate-y-px disabled:pointer-events-none transition">
You've cracked it. Send them all home 🎉
</button>
<p class="text-xs text-[color:var(--ink)]/45">
The whole board's face up now, so the rest plays itself.
</p>
</div>
</div>
<p data-game-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p> <p data-game-msg class="hidden mt-3 rounded-2xl bg-[color:var(--ink)]/5 px-4 py-2 text-sm font-semibold"></p>
</section> </section>
internal/web/templates/standings.html
+107
View File
@@ -0,0 +1,107 @@
{{define "title"}}The board — {{.SiteTitle}}{{end}}
{{define "main"}}
<article class="mt-2 mb-10 max-w-4xl mx-auto">
{{template "realmnav" .}}
<header class="rounded-3xl bg-theme-adventure text-white p-6 sm:p-10 shadow-pete relative overflow-hidden">
<div class="absolute -top-10 -right-6 text-[12rem] opacity-20 select-none" aria-hidden="true">🏆</div>
<div class="relative">
<p class="text-sm uppercase tracking-[0.2em] opacity-80">🏆 The board</p>
<h1 class="font-display text-3xl sm:text-4xl font-bold mt-2 leading-tight">Who's actually been getting on with it.</h1>
<p class="mt-3 opacity-90 max-w-2xl">
Ranked by how deep anyone has got, then by how much of the realm they've
put behind them. Lifetime totals — nothing here decays, and nothing here
moves while you're not playing.
</p>
{{if and .Standings.Known .Standings.Stale}}
<p class="mt-4 text-xs bg-black/25 rounded-xl px-3 py-2">
Last count came in {{.Standings.LastSeenAgo}}. Nothing on this board moves fast, but it isn't live either.
</p>
{{end}}
</div>
</header>
{{if .Standings.Rows}}
<div class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete overflow-hidden">
<div class="overflow-x-auto">
<table class="w-full text-sm">
<thead>
<tr class="text-[11px] uppercase tracking-wider text-[color:var(--ink)]/45 border-b-2 border-[color:var(--ink)]/10">
<th class="text-left font-semibold px-4 py-3 w-10">#</th>
<th class="text-left font-semibold px-2 py-3">Adventurer</th>
<th class="text-right font-semibold px-2 py-3" title="The deepest tier they have actually beaten a boss in">Deepest</th>
<th class="text-right font-semibold px-2 py-3" title="Distinct zones cleared">Zones</th>
<th class="text-right font-semibold px-2 py-3" title="Total successful clears, repeats included">Clears</th>
<th class="text-right font-semibold px-2 py-3" title="Things nobody in the realm had ever done before">Firsts</th>
<th class="text-right font-semibold px-2 py-3" title="Total damage dealt to every Siege boss, all time">Siege</th>
<th class="text-right font-semibold px-4 py-3" title="Deaths I've reported">Deaths</th>
</tr>
</thead>
<tbody>
{{range .Standings.Rows}}
<tr class="border-b border-[color:var(--ink)]/5 last:border-0 hover:bg-[color:var(--ink)]/[0.03] transition">
<td class="px-4 py-3 tabular-nums text-[color:var(--ink)]/35 font-semibold">{{.Rank}}</td>
<td class="px-2 py-3 min-w-0">
{{if .Token}}<a href="/adventure/who/{{.Token}}" class="font-semibold hover:text-theme-adventure transition">{{.Name}}</a>
{{else}}<span class="font-semibold">{{.Name}}</span>{{end}}
<span class="block text-xs text-[color:var(--ink)]/40">
lv {{.Level}}{{if .ClassRace}} · {{.ClassRace}}{{end}}
</span>
</td>
<td class="px-2 py-3 text-right tabular-nums">
{{if .DeepestTier}}<span class="standings-tier standings-tier-{{.DeepestTier}}">T{{.DeepestTier}}</span>
{{else}}<span class="text-[color:var(--ink)]/25">—</span>{{end}}
</td>
<td class="px-2 py-3 text-right tabular-nums{{if not .Zones}} text-[color:var(--ink)]/25{{end}}">{{if .Zones}}{{.Zones}}{{else}}—{{end}}</td>
<td class="px-2 py-3 text-right tabular-nums{{if not .Clears}} text-[color:var(--ink)]/25{{end}}">{{if .Clears}}{{.Clears}}{{else}}—{{end}}</td>
<td class="px-2 py-3 text-right tabular-nums">
{{if .Firsts}}<span class="standings-firsts">{{.Firsts}}</span>{{else}}<span class="text-[color:var(--ink)]/25">—</span>{{end}}
</td>
<td class="px-2 py-3 text-right tabular-nums{{if not .SiegeDamage}} text-[color:var(--ink)]/25{{end}}">
{{if .SiegeDamage}}{{.SiegeDamage}}{{else}}—{{end}}
</td>
<td class="px-4 py-3 text-right tabular-nums{{if not .Deaths}} text-[color:var(--ink)]/25{{end}}">{{if .Deaths}}{{.Deaths}}{{else}}—{{end}}</td>
</tr>
{{end}}
</tbody>
</table>
</div>
</div>
<p class="mt-3 text-xs text-[color:var(--ink)]/40 px-1">
Deepest is the hardest tier they've actually put a boss down in, not the hardest
one they've walked into. Deaths is my own count, off the dispatches I've filed.
</p>
{{else}}
<div class="mt-6 rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 p-6 shadow-pete">
<p class="text-sm text-[color:var(--ink)]/60">
{{if .Standings.Known}}
Nobody on the board yet. Make a character and it fills up.
{{else}}
Haven't had the count through from the field yet.
{{end}}
</p>
</div>
{{end}}
{{/* Pete keeps score on himself. He can be hired onto an expedition and he
duels; a paper that ranks everybody else and quietly leaves itself off the
table is doing something slightly dishonest. */}}
<section class="mt-8 rounded-3xl bg-[color:var(--card)] border-2 border-theme-adventure/30 p-6 shadow-pete">
<h2 class="font-display text-xl font-bold">And my own record, since you asked</h2>
{{if .Standings.PeteFought}}
<p class="mt-2 text-sm text-[color:var(--ink)]/70">
<span class="font-semibold text-theme-adventure tabular-nums text-lg">{{.Standings.PeteWins}}</span> won,
<span class="font-semibold tabular-nums text-lg">{{.Standings.PeteLosses}}</span> lost.
I file those myself, which you're welcome to hold against me.
</p>
{{else}}
<p class="mt-2 text-sm text-[color:var(--ink)]/60">
No bouts yet. I'll report them when there are, wins and the other kind.
</p>
{{end}}
</section>
</article>
{{end}}
internal/web/templates/status.html
+23
View File
@@ -27,6 +27,29 @@
</div> </div>
</section> </section>
{{/* Adventure dispatch types gogobee sent that Pete has no template for. These
published on the neutral fallback — nothing was dropped — so this is a
vocabulary to-do, not an incident. Admin-only; absent when there are none. */}}
{{if and $admin .UnknownAdv}}
<section class="mb-8">
<div class="rounded-3xl bg-amber-500/10 border-2 border-amber-500/30 p-6">
<h2 class="font-display text-xl font-bold">Dispatches with no template</h2>
<p class="mt-1 text-sm text-[color:var(--ink)]/70 max-w-2xl">
gogobee sent these event types since the last restart and Pete published them on the
generic fallback. Nothing was lost — they just read thin until he learns the words.
</p>
<ul class="mt-3 flex flex-wrap gap-2">
{{range .UnknownAdv}}
<li class="inline-flex items-center gap-2 rounded-full bg-[color:var(--card)] border border-amber-500/40 px-3 py-1 text-sm">
<code class="font-mono">{{.EventType}}</code>
<span class="tabular-nums text-[color:var(--ink)]/60">×{{.Count}}</span>
</li>
{{end}}
</ul>
</div>
</section>
{{end}}
<div class="overflow-x-auto rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete"> <div class="overflow-x-auto rounded-3xl bg-[color:var(--card)] border-2 border-[color:var(--ink)]/10 shadow-pete">
<table class="w-full {{if $admin}}min-w-[52rem]{{else}}min-w-[28rem]{{end}} text-sm"> <table class="w-full {{if $admin}}min-w-[52rem]{{else}}min-w-[28rem]{{end}} text-sm">
<thead> <thead>

Some files were not shown because too many files have changed in this diff Show More