A player login, so a registered account can claim a house #191

Merged

viberfox-agent merged 1 commit from feat/player-login into main

2026-08-29 20:47:53 +00:00

viberfox-agent commented

2026-08-29 20:30:53 +00:00

Collaborator

/api/houses/* takes any live session, but a browser could only mint one via the verification link (spent once, at sign-up) or /api/admin/login (refuses players by design) — so an already-registered account could never reach the claim screen again.

POST /api/login is the way back in: the admin login's password check minus the admin gate, issuing the ordinary session token. The admin surface still refuses that token (pinned by the new http_surface test). /api/logout joins as an alias, and /api/register's status JSON gains houses_open so the sign-in page can gate its link.

Companion: cartopy PR #5 adds the /house page. Merge order: this first, then a sim redeploy, then cartopy #5 (its merge auto-deploys the web GUI).

`/api/houses/*` takes any live session, but a browser could only mint one via the verification link (spent once, at sign-up) or `/api/admin/login` (refuses players by design) — so an already-registered account could never reach the claim screen again. `POST /api/login` is the way back in: the admin login's password check minus the admin gate, issuing the ordinary session token. The admin surface still refuses that token (pinned by the new `http_surface` test). `/api/logout` joins as an alias, and `/api/register`'s status JSON gains `houses_open` so the sign-in page can gate its link. Companion: [cartopy PR #5](https://code.garage44.eu/jeroen/cartopy/pulls/5) adds the `/house` page. Merge order: this first, then a sim redeploy, then cartopy #5 (its merge auto-deploys the web GUI).

viberfox-agent added 1 commit

2026-08-29 20:30:53 +00:00

feat(http): a player login, so a registered account can claim a house

CI / test cartopolis (pull_request) Successful in 15m52s

Details

CI / wasm & android targets (pull_request) Has been skipped

Details

0e6e602006

The claim-your-house routes take any live session (require_session), but
a browser could only ever mint one in two ways: the verification link,
spent once at sign-up, and /api/admin/login, which refuses players by
design. So an already-registered person could never reach the claim
screen again — cartopy had no option to offer them.

POST /api/login is the way back in: the same password check as the admin
login (extracted into check_password_login) minus the admin gate,
issuing the ordinary session token from the shared store. The admin
surface still refuses that token, which the new test pins alongside the
house routes accepting it. /api/logout joins as an alias of the admin
logout — the handler is a bare token revoke and always was; a player
signing out through a path that says admin was the only wart.

/api/register's status JSON gains houses_open, so the sign-in page can
gate its link to the claim page the way the register link is gated on
open: no button that leads to a refusal.

Companion change: cartopy PR #5 adds the /house page that uses this.

viberfox-agent merged commit d0f87bb25a into main

2026-08-29 20:47:53 +00:00

viberfox-agent referenced this pull request from a commit

2026-08-29 20:47:54 +00:00

Merge pull request 'A player login, so a registered account can claim a house' (#191) from feat/player-login into main