213 Commits

Include renames

Author	SHA1	Message	Date
openhands	59a45d2165	refactor: universal logger and remove N+1 catalog queries ... - Replace all 39 console.* calls with universal logger (pino server, console browser) - Set server-only marker on import-badge.ts - Disable DB query logging in production - Add bulkInsertCatalogItems: one transaction instead of N per-item inserts - Add reserveCatalogItemIds helper for bulk ID allocation - Optimize translateCatalogItems: single inArray batch query instead of N per-item selects - Test mock updated for logger.debug - biome clean, tsc clean, 3569 tests passing	2026-10-17 14:29:14 +02:00
openhands	3c8abb6fbf	feat(assets): choose furniture bundle ext via FURNI_BUNDLE_EXT ... Bundle the remaining imaging hardening and the host/CI fixes from the "Doe alles" pass into one release. Furniture: - Resolve the local bundle extension from FURNI_BUNDLE_EXT (".hab" default, ".nitro" for a stock Nitro client). The configured extension is written by imports/repairs and preferred on lookup; the other stays a legacy fallback. Imaging: - Avatar proxy sends s-maxage=86400 + stale-while-revalidate (300/3600 for the fallback path) so the edge can hold a render a day. - Cloudflare cache rule now covers /api/imaging/ (verified MISS->HIT live). - Document that bare /imaging is shadowed by the edge proxy to the renderer. Ops/CI: - docker-update.sh skips a CI-managed host (exit 0) instead of failing cron. - ci-deploy.sh runs the cross-browser imaging gate (chromium+firefox+webkit) against the candidate before cutover; DEPLOY_SKIP_CROSS_BROWSER=1 as escape. - scripts/imager-health-alert.sh alerts (Discord) on imager up/down transitions; runs from cron every 5 minutes. Tests: - Furniture bundle-ext resolver + FURNI_BUNDLE_EXT wiring. - Imaging performance budget (bytes + warm latency). - classifyDdos: /api/imaging/* stays in the api bucket.	2026-10-14 21:46:56 +02:00
openhands	f3407ebfdf	fix(imaging): support .hab assets, cache avatars/badges, harden routes ... The hotel moved from .nitro to .hab bundles, so the imager must treat .hab like .nitro and the public avatar endpoints must accept the figure strings the client sends (including extra trailing segments such as `.0`, which the old FIGURE_RE rejected with a 400). - imager-upstream: relax FIGURE_RE, extend parseAvatarQuery test coverage - api/imaging/avatar + /imaging: shared validation, placeholder and ETag/304 - api/imaging/badge: single-flight upstream fetch and conditional responses - imager-http/imager-png: strong ETag helpers and APNG passthrough guard - csp + next/image: unoptimized external images, tightened CSP - deps: override postcss-selector-parser to ^7.1.6 - also fold in the pending drizzle draft snapshot and stray test cleanup	2026-10-14 20:40:50 +02:00
openhands	7b249a7222	P1-P3 admin cleanup: rank guard, SSRF guard, count caching, dead code removal, pagination rewrite ... - P1: new src/lib/admin/rank-guard.ts with tryGuardRank/guardRank + RankGuardTarget/Result; extracted from users.ts; applied to admin-bans (create/lift + rank redirect) and admin-badges (caps + rank guard + error surfacing); import-url-safety.ts SSRF guard wired into clone save+icon fetch; logAudit await in help-tickets; antiddos mutations SETTINGS_EDIT; markAllAlertsRead NOTIFICATIONS_EDIT; rankError/saveError in all 25 message files; tests rew/new for bans/badges/rank-guard/import-url-safety - P2: ticket-inbox merged pagination reworked to single UNION ALL SQL with LIMIT/OFFSET (avoids O(offset) materialization); getCachedAdminCount with cacheFiltered option applied to devops/errors/photos/items/guilds/help-tickets/moderation pages; admin-theme catches→?error=1+banner+25 locales; logger in silent catches (rare-values/writeable-boxes); catalog-items-loader CAST→plain equality; count caching helper extended with opt-in cacheFiltered - P3: removed dead modules is-staff/notice/recent-furni-resync/log-filters plus load-user-sanctions/user-sanction-timeline; removed orphaned CATALOG_PAGE_COLUMNS re-export; removed getFurniIconUrl from studio-furni-icons Build: lint 0, typecheck 0, 3480 tests pass, i18n:check exit 0, colors exit 0. Circular chunk warning (9452/10535/66463) is webpack code-splitting artifact; build succeeds.	2026-10-12 17:42:19 +02:00
openhands	57529fd1ea	Fix: badge API now reads from Gamedata/c_images/album1584 ... The badge GIF files exist at /var/www/Gamedata/c_images/album1584/ but the /api/imaging/badge endpoint only looked in /swf/c_images/album1584/ (relative to process.cwd()). Added GEDATA_IMAGES_BASE candidate and fetchCandidate handler so badges render correctly in the admin UI and on the site.	2026-10-11 21:14:10 +02:00
openhands	a06db72c65	Update: admin panel fixes, badge icons, studio improvements, gitea runner v5	2026-10-11 18:44:02 +02:00
openhands	43742e8d99	fix(catalog): decode WebP bundle textures so furniture icons resolve again ... Every write path normalises a bundle's texture to WebP Lossless, so the catalog icon was being read back with a PNG-only decoder. decodePng throws on anything that is not a PNG, the callers caught that and returned null, and the user-visible result was "no icon (not in source or bundle)" for every furniture whose source does not serve a standalone icon. Measured against the production asset tree, all 18,505 bundles were WebP; icon extraction succeeded on 0 of them. src/lib/services/imager/ decode-texture.ts keeps PNG on the dependency-free decoder and routes WebP through sharp, which is already a dependency and already encodes these textures. extractFurniIconPng and getPetIconPng become async; the five call sites (upload, clone import, furni import, icon repair and both icon routes) already awaited their surrounding work. Same root cause, second bug: the spritesheet frame key. Converters disagree on packing — some keep a trailing ".png", and some lowercase the whole key while leaving the bundle name mixed-case, so "LTD_fashionistaf" looks up frame "LTD_fashionistaf_LTD_fashionistaf_icon_a" and never finds "ltd_fashionistaf_ltd_fashionistaf_icon_a". Any mixed-case classname could therefore never match, which is most of the catalogue. findFrame tries the two exact spellings, then falls back to one case-insensitive pass. Extraction now succeeds on 18,483 of 18,505 bundles (99.88%); the 22 remainder are data, not code — 9 bundles ship no icon asset, 11 do not parse. Third: three catalogue icons exist only as .gif while catalogueIconUrl hardcoded .png, so the picker offered icons that could only ever 404, and 291 icons that ship as both formats were listed twice. The API now dedupes per id and the two renderers retry with .gif before falling back to the placeholder, matching what catalog-image-picker already did. Verified live: /gamedata/.../icon_1542.png returns 404 while icon_1542.gif returns 200. Separately, close the last hole in the memory cap. Every script in package.json routes through scripts/with-memory-cap.sh, but invoking the builder directly — from a terminal, an IDE or an agent — skipped the wrapper and ran unbounded, on a host with no swap where the OOM killer picks its victim across the whole machine. next.config.ts now refuses a production build that the wrapper has not marked, before anything allocates. next dev and next start are deliberately unaffected. README gains a Memory-capped commands section covering the per-script ceilings, the backends and the ulimit -v trap, and its stale version and script tables are corrected.	2026-10-11 17:01:37 +02:00
openhands	adffac7360	feat(catalog): store furniture bundles as .hab instead of .nitro ... Every bundle the CMS writes — upload, clone, sync, repair and the pet / effect / figure importers — now lands as `<classname>.hab`, the extension this deployment's renderer asks for. `.hab` and `.nitro` are the same container, so an upload of either extension is accepted. Resolution goes through one module, src/lib/furni/bundle-file.ts, so nothing has to know the extension twice. Every existence check probes `.hab` first and falls back to `.nitro`: the on-disk asset set is still predominantly `.nitro`, and without the fallback Studio would report every imported item as missing and the cleanup scan would classify 18k live bundles as fake leftovers. Downloads are unchanged — Habbo's CDN and every configured clone source still serve `.nitro`, so the conversion happens on write, not on request. Deliberately unchanged: the staged-attachment store in furni-attachment.ts keys on a UUID and never reaches the client, so renaming it would break in-flight recovery jobs. Adds scripts/migrate-nitro-to-hab.ts to rename the existing asset set. It refuses to run without --dry-run or --yes, never overwrites an existing .hab, never deletes, and is idempotent. Note: renderer-config.json lives outside this repo and was patched to .hab separately; that file is served with a 30-day max-age, so returning clients need a cms-client cache purge to pick the change up.	2026-10-10 17:09:36 +02:00
openhands	6cc45d7413	feat: harden atoms-nexst against review findings (37 items) ... Second review pass covering security, performance, admin tooling and the public/room flows. All HIGH and MEDIUM findings from the audit are resolved; nothing in this commit changes the visible feature set. Authentication & session security - CSP is now set on the request headers in the proxy, which is what Next.js uses to derive the render nonce, so the nonce is effective. - 2FA: an already-enabled user cannot re-enroll, the setup endpoint is rate-limited per account, and confirmed codes are persisted so the second secret no longer silently never applies. - Password reset revokes the ticket, authTicket and all personal access tokens, and bumps the token version so existing sessions die. The same revocation is now wired into the staff-side password reset. - /reset and /verify return a stable error code instead of raw text; the mail lookups are ordered by id so duplicates cannot vary between runs. - Resending the verification mail gets a per-address cooldown on top of the per-user limit. - Issue API tokens with the narrower radio/ticket ability set instead of "*". Authorization & input handling - Mid-rank staff can no longer keep dynamically granted non-view admin.* permissions: existing grants are revoked by migration and the grant lookup is restricted to "%.view". Rank guards use the dynamic super-admin check. - Alerting a user is permission-checked and audited like the other tools. - Material mutations (giveCredits/giveDuckets/giveDiamonds, the admin user actions route, bulk user actions) are capped and rank-guarded, and bulk ids are bounded. - updateRoom / updateRoomItem write through a field allowlist, and items may only be edited through their own room. - Classnames reaching the filesystem are validated before use so a crafted value cannot escape the asset directories. - The word filter now also covers offline mails, guild forum threads and replies, and user mottos. - Media uploads are validated by magic bytes, /api/media requires the page edit permission, APP_URL must be configured once mail is enabled, and the diagnostics error route checks the fetch site header. Admin tooling - Secret settings render masked and cannot be overwritten with a blank or an arbitrary raw key; radio credentials are new password inputs. - Commandocentrum balance changes are audited. - Admin list pagination reads the caller's per-page instead of the max, and the log exporter caps offset and search length. Performance - Catalog translations are cached per module, with a cheap revision hash; the public online count uses a stale window instead of hammering the DB. - The cache warmup now primes the payload the home route actually reads. - TopHeader batches its queries into one round trip, and LCP avatars load eagerly. - motion/react and sonner are no longer part of the root layout; the nav dropdown and mobile nav panels are lazy client chunks. Anonymous visitors again get the navigation chrome, and public pages get an edge cacheable response. Accessibility - Nested <main> elements in phase pages became <section>; the page entrance and route progress animations are pure CSS that respect reduced motion.	2026-10-09 16:19:48 +02:00
openhands	6c3d81920e	fix(ops): supervise the job worker and stop the health probe from lying ... Four production defects, all found by auditing the running host rather than the code. Each one had a signature that looked like a network or permissions problem and was actually a configuration or ordering bug. jobs-worker never ran `import "./load-env"` sat on line 3 of scripts/jobs-worker.ts, but ESM evaluates a module's imports in source order and the first import reaches `@/env`, which validates process.env at import time. The ZodError on DATABASE_URL therefore fired before load-env ever executed, so the worker could only start from a shell that had already exported the configuration. Nothing supervised it either, so scheduled articles, catalog export, JAR and database backups, disk alerts and the ops health probe have all been dead; `cms:jobs-worker:heartbeat` did not exist. Moved the import to the top and added deployment/systemd/cms-jobs-worker.service with Restart=always. The JAR backup additionally pointed at './emulator/Arcturus.jar', which does not exist and would go stale on the next emulator upgrade. resolveEmulatorJar now accepts a file, a directory or a wildcard and picks the newest JAR, the same way emulator.service picks its build, and reports an unresolvable path once instead of logging an opaque copyFile ENOENT every night. /api/health answered 200 with the database down The route documented this as intentional, and ci-deploy.sh worked around it by grepping the body for '"database":true'. The container healthcheck did not, so Docker reported containers healthy while every page 500'd. The status is now load-bearing: 503 when the database is unreachable, 200 otherwise. Redis and the emulator deliberately do not fail the container — both have in-process fallbacks, so failing them would trade a slow site for an outage. The runtime had no V8 heap cap NODE_OPTIONS existed only in the builder stage. With no cap, V8 sized its heap from host memory (23.5 GB) while the container was limited to 4 GB, so the kernel OOM-killed the process mid-request — the same failure mode as the 14 host-wide `next-build` kills. docker-start.mjs now reads the cgroup limit (v2 with a v1 fallback) and sets 70% of it, respecting an explicit override. Storage ownership was only repaired for one path ci-deploy.sh chowned storage/imaging and nothing else, so storage/catalog-git/hotel-status.json kept coming back root:root and /api/admin/catalog/status kept throwing EACCES. All eight writable storage paths are repaired now. The silent-failure mode is the reason this mattered: these writes sit inside try/catch, so a wrong owner looks like a slow page rather than an error. nginx: robots.txt was a guaranteed 404, and TLS never resumed `index index.html` without a `root` left every try_files resolving against /etc/nginx/html, which sits behind a 0750 directory — the worker got EACCES on each stat and nginx logs a failed stat at crit, which is where 149 crit lines per scan came from. robots.txt answered from that same broken location, so crawlers were pointed at a file they could never read while sitemap.xml kept advertising it. Added `root`, proxied robots.txt to the CMS, added ssl_session_cache (there was no session resumption at all), and set Restart=on-failure in a systemd override, since the packaged unit ships Restart=no and nginx is the only thing serving the site. Verified against the running host: 3379 tests, typecheck and biome clean, nginx -t passes, health returns 200 with every check green, and the worker has run for hours at NRestarts=0 with a heartbeat refreshing each minute.	2026-10-05 20:25:22 +02:00
openhands	e0efbef30d	fix(catalog): make the Builder Club catalog read and write its own offers ... The previous commit taught bulk editing and delete-with-restore about the BC catalog. Neither actually worked, and one of them was destructive. `catalog_items_bc` has six columns: id, item_ids, page_id, catalog_name, order_number, extradata. There is no price, points, currency, offer_id, limit or membership column on it. The bulk path read and wrote columns that do not exist, and the UPDATE was aimed at catalog_items while the SELECT came from catalog_items_bc — so a BC category move wrote into the normal catalog. Two tests now pin that pairing: reads and writes have to stay in the same table. Underneath it the BC table was never being read at all. The inline editor fetched `/api/admin/catalog/items?pageId=N` without the catalog, so opening a BC category showed the normal catalog's offers, and the route selected BC rows directly instead of going through the loader, skipping the furni enrichment the table needs to render anything but a bare caption. Both catalogs now take the same path, and the catalog is in the fetch callback's dependencies — without that, a switch keeps reading the previous catalog's rows through a stale closure. Because a BC offer has no price, the editor no longer offers one. The server refuses price, points and currency changes with a readable message instead of letting them reach the database as an unknown-column error, and a BC bulk edit is what it can actually be: a category move. BC deletions also went through a bare DELETE, which made them the one catalog mutation with no way back. They now keep their rows and hand back a restoreId like the normal ones. The catalog is recorded in the audit target rather than in the payload, so a restore can never put a BC row into the normal offers table.	2026-09-30 19:17:20 +02:00
openhands	cebcf440c5	feat(catalog): record bulk edits, make deletions reversible, unify the tree read ... A bulk offer edit is the catalog mutation that rewrites hundreds of rows at once, and it was the only one writing nothing to the staff activity log: 22 of the 43 catalog actions logged, this one did not. The entry it now writes says what changed, not just that something did, because the log has no undo of its own and "bulk updated 200 offers" cannot answer the question it exists for. Deleting offers had no inverse at all. Every removed row is now kept at delete time and the caller gets a restoreId back, so an accidental multi-select is a click rather than a hand-edit of the table. The undo toast covers the common case; a RecentDeletionsPanel holds the same records so a delete noticed later is still reachable. Three refusals guard it: an id that another offer has since taken, a category that no longer exists (which would leave an offer that sells nowhere and shows under no page), and a delete whose restore record cannot be written — that one rolls back rather than deleting without a way back. Reading the audit row FOR UPDATE is also what stops two restores of one deletion from both inserting. sendCatalogUpdate() overwrote hotel-status.json on every write, so "which imports reached the hotel" was answerable for the last attempt only, and a failure two imports ago was gone by the time anyone looked. That file is now also appended to as a bounded 50-entry tail. The tree route carried four copies of the same page-select-plus-counts shaping, of which the BC branches had already drifted: one counted offers through the VARCHAR-tolerant helper, the other inline and swallowing errors. All of it is one readPages() now, and readFullTree sends both catalogs through one depth computation instead of delegating normal to getTreeFlat while computing BC here — a split that left two implementations behind one function name. getTreeFlat is gone. The BC ancestor walk also went from 20 levels to 50, matching getAncestors, so a deeply nested catalog no longer loses its breadcrumb. Bulk editing reaches the BC catalog, which previously had no way to edit or duplicate offers in bulk. The catalog is part of the operation identity now, so replaying one request key against the other catalog is not mistaken for the same work. Integration tests failed to import: the next/cache mock supplied only revalidatePath, and catalog-totals calls unstable_cache at module scope.	2026-09-30 18:19:36 +02:00
openhandsandClaude Opus 4.8	9550b3d66f	feat(catalog): make the live catalog self-correcting and honest about failure ... The previous commit made imports update the Studio without a reload, but the guarantee only held inside the tab that started the import and only as long as every read succeeded. Four holes were left, and this closes them. A session that mounted the tree before an import kept the pre-import tree for the rest of its life, because ensureCatalogTreeLoaded() was a once-per-session no-op. It now asks the server whether what it holds is still current. The answer is a revision: sendCatalogUpdate() already runs after every catalog write, so it bumps one, and clients read it on mount, on focus, on a 20s poll and from other tabs over a BroadcastChannel. An import that finishes in another tab, another browser or the job worker now lands here too. A failed read used to be swallowed, which is the worst outcome available: the rail kept showing pre-import counts as if they were current and nothing said so. The snapshot now carries the error, the rail shows it with a retry, and the previous tree stays on screen because stale beats empty. Every settled import pulled the entire flat tree, which is the one payload that grows with the size of the catalog. The revision doubles as the ETag on mode=full, so an unchanged catalog answers 304 and the poll costs a file read. An import could also report success for an offer the hotel will never sell: a hidden or disabled page, an item_ids that misses the furni id, a zero amount. importSingleFurni reads its own row back and reports each of those as a warning, where the import report already is, instead of leaving it to surface as "the import did not work" in the client. Finally, the catalog items table no longer falls back to router.refresh() — onRefresh is now required, so every mutation ends in a refresh of the caller's own data instead of a route re-render that threw away editor state and scroll position. useServerAction keeps its default, because 47 callers across the app depend on it. The 750-line CatalogTree in catalog-tree.tsx was dead code that kept its own stale tree and three more router.refresh() calls; only CatalogIcon and LAYOUT_COLORS are still imported, so the rest is gone. Tests: the store now covers revisions, 304s, probe failures and error recovery; a jsdom test mounts a consumer and asserts the tree updates in place with no navigation; the old organize-imports e2e asserted nothing about the endpoints the code actually calls, and is replaced by one that asserts a cross-tab write lands in the mounted categories without a reload. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-09-30 15:15:34 +02:00
openhandsandClaude Opus 4.8	28ce0f911c	fix(catalog): keep the live catalog truthful after every import path ... The live catalog store only covered part of the import surface. A durable job settled, a sync queue drained, a .nitro upload or a clone run left the Studio rail and the stats bar showing pre-import numbers until the page was reloaded, and the Catalog Manager kept a second tree that never saw writes made elsewhere in the session. Every one of those paths now pulls the tree again, and the refresh carries the totals with it: importing writes catalog rows server-side, so the counts the store holds were stale for the rest of the session. - refreshCatalogTree shares one request between concurrent callers and queues a single follow-up read when a write lands mid-flight, so a burst of edits costs at most one extra read. - useFurnitureJobs treats its first payload as a baseline, so a page load no longer replays every past import as "just settled", and hands the settled jobs to the callback. - The Catalog Manager pushes its own mutations into the store and re-reads its active tab when the store changes. - The 30s unstable_cache on the admin totals is now tagged and invalidated from every catalog write, including the import worker, so it no longer survives an import even across a hard reload. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-09-30 14:45:26 +02:00
openhands	d73baf1458	fix(catalog): take furnidata values from the clone source for retro items ... The resync route rebuilt every entry from items_base plus the *official Habbo* furnidata. A classname that only exists on a retro hotel (leet.ws and friends) is absent from the official set, so lookupOfficialHabboFurni returned null and the entry was written with revision 0, category "unknown" and an empty description — even though the clone import had those exact values available at import time from the source's own furnidata. - resync/route.ts: when a classname is genuinely missing from official Habbo, fall back to the configured clone sources. Their furnidata is indexed by normalized classname and each entry is coerced into the OfficialHabboFurniEntry shape, which is the same JSON shape, so it drives the existing buildFurniEntry fallbacks for revision, category, name, description, defaultdir, partcolors, specialtype, furniline, environment, rare and bc. items_base stays authoritative for id, spriteId and dims, and public_name still wins over the source name, matching the import. The index is memoized per request, not at module scope: a module-level cache would pin the source list for the life of the process and a source added later would never be picked up. fetchSourceFurnidata already caches per URL, so this costs one parse rather than a network round-trip. Disabled sources and sources that fail to respond are skipped, so an unreachable hotel degrades to the previous items_base-only behaviour instead of failing the run. Official Habbo still wins whenever it has the classname, so existing behaviour is unchanged for everything but the retro-only case. Applies to every resync mode, so the pre-existing ?missing=1 sweep picks this up too.	2026-09-29 16:02:58 +02:00
openhands	2f7e557d5e	feat(catalog): add a Studio button to fix missing furnidata entries ... "Missing furnidata" was only a filter in the Studio status dropdown, so imported items whose classname was absent from FurnitureData.json could be found but not fixed from that screen. Only the Catalog Audit page could repair them, and only globally. Adds the same shape of quick action that "no nitro" already had: - studio-client.tsx: a "N no furnidata" shortcut next to the "N no nitro" button that sets the missingFurnidata status filter, and a bulk "Add missing furnidata (N)" button for the selected rows. Both only appear when there is something to act on. Rows that come back repaired flip to hasFurnidata: true so the badges and counts update in place; rows the server reported in errors keep their state. - resync/route.ts: accepts an optional { classnames: string[] } body to target exactly the selected rows. classnames are resolved through the same normalized local index the listing uses to decide hasFurnidata, so the rows written are the rows flagged as missing. The upsert is already idempotent, and RCON updateCatalog + updateItems run afterwards so the emulator picks the new entries up. Also clears the Studio furnidata cache after a write, which this route never did: without it the listing kept serving a stale hasFurnidata for up to the 30s cache TTL, so a repair looked like it had done nothing. PERMS is now imported from permission-slugs (identical re-export) so the route no longer pulls next-auth into tests. - studio-filters.test.ts: pins the missingFurnidata branch, in particular that an unchecked item (hasFurnidata undefined) is not treated as missing. The existing ?days / ?missing / ?broken / ?all modes are unchanged; the body is only consulted when it carries a classnames array.	2026-09-29 15:48:32 +02:00
openhands	e4f83a8036	chore: upgrade to pnpm v12, vitest v5 and resolve deprecated subdependencies	2026-09-27 19:42:34 +02:00
openhands	944527e078	feat(nitro-cleanup): dedupe FurnitureData and clean dangling figure entries ... Add a gamedata cleanup to the Nitro Cleanup panel: a read-only preview plus an apply run that dedupes FurnitureData classnames and removes rows and figure entries that reference nothing. Three passes run in a fixed order, because cleanFigureMap has to precede cleanFigureData: dropping the part that points at a set is what makes that set unreferenced. A pass refuses to write when it would delete more than maxRemovals rows (default 500) and reports the reason, a wrong asset directory otherwise turns every row into an orphan and one call would empty the file. Passes that would act on empty input (no libraries, no sets) treat that as a missing file rather than as a reason to delete everything. Every write copies the file to a timestamped backup first, so a pass that turns out to be wrong can be undone by hand. The plan reads FurnitureData once and hands the parsed copy to both furniture passes; the file is tens of megabytes in a real deployment.	2026-09-27 17:14:30 +02:00
openhands	17de94d984	feat(nitro): convert imported SWF bundles to WebP Lossless ... Newly converted .nitro bundles now store their spritesheet as WebP VP8L instead of PNG, so imports land much smaller without changing a single pixel. The texture member and spritesheet.meta.image are both labelled from the actual bytes, never from a caller's assumption. - encode through sharp with lossless and exact, so colour hidden under alpha 0 survives; this mirrors ImageSharp's TransparentColorMode.Preserve - detect PNG/WebP by magic bytes and reject anything the client cannot render, on create, download and upload paths - keep the source format when deriving size-32 sheets, scaling composites and editing metadata, so existing bundles are never silently rewritten - report fidelity in the studio: the compression panel re-encodes with the same options the importer uses, so it cannot drift and invent false warnings, and shows PNG/WebP size estimates convertSwfToNitro and buildSpritesheet are now async, so the worker, the main-thread fallback and every import call site await them. PNG stays supported for existing bundles and icon sidecars are untouched.	2026-09-27 15:42:21 +02:00
openhands	420210ffa0	fix(build): make the production build pass, and stop it eating 20GB ... `next build` had never completed on this host, so three real defects were sitting in the tree untested. All three are now fixed and the build is green. - The build was not memory-bound the way it looked. Turbopack's builder reached 20.5GB RSS and died, and raising `--max-old-space-size` could never have helped: that flag caps the V8 heap, while the 20GB sat in Turbopack's own Rust allocator. The first symptom was misleading because the process doing the allocating is a grandchild of `npx`, so watching the direct child shows a 95MB shim the whole time. Building with `--webpack` puts the build back under the JS heap, where the flag actually applies: peak 5.9GB, 150s, exit 0. - withAdmin's second parameter was typed `{ params?: ... }` and given a `= {}` default, which made it optional and `RouteContext | undefined`. Next's generated route types assert that argument against `ParamCheck<RouteContext>` and reject it, across 113 route files. `tsc --noEmit` cannot see this, because Next only adds `.next/types` to the project during a production build — so the type check that everyone runs locally was structurally incapable of catching the only type error that blocks a deploy. `params` is now required, which is also what the code already assumed: it is awaited with no guard. The 35 test call sites that invoked a handler with one argument now pass a real context, and the await got a guard so a direct internal call cannot turn a missing context into a 500. - `src/app/api/admin/import/furni/route.ts` re-exported `ensureDirectories` and `importSingleFurni` for "backward compatibility" that nothing used; the batch route imports from `@/lib/services/furni-import` directly. Next rejects any value export from a route module that is not an HTTP verb or config, so this had been breaking the build for as long as it existed. Removed. - `isomorphic-dompurify` builds its server-side DOM through jsdom. Bundled, that pulls jsdom's `browser/default-stylesheet.css` into the server chunk, where the path no longer resolves, and page-data collection dies with ENOENT on every page that sanitizes HTML. Marked external so Node resolves it from node_modules and the standalone tracer includes it. The remaining build warning is a pre-existing circular dependency between chunks that share the webpack runtime. It costs hash reuse, not correctness, and is left alone rather than churned here. Verified: build exit 0, 276 static pages generated, 3223 tests pass, tsc and biome clean.	2026-09-25 19:47:10 +02:00
openhands	f81b114b69	perf(cache): single-flight avatar renders, cacheable public reads, cheap row counts ... Three separate things that were each costing more than they needed to on the hot path. - Single-flight avatar renders. The disk cache was checked first and a miss went straight to the upstream, with nothing shared between callers, so a page requesting dozens of avatars at once turned N concurrent requests for one figure into N renders. A render is the most expensive operation this app does, and the duplication happened exactly when the cache had nothing to offer. Eight concurrent requests now cause one render instead of eight. The map lives on globalThis because Next can evaluate the module more than once per process, and two copies would each start their own render. - Let public read-only routes be cached by a shared cache. Every JSON response was `cache-control: no-store`, so a CDN in front of the app could not answer any of it and every request reached the origin. publicCacheControl() opts a route in with s-maxage and stale-while-revalidate, using the same TTL as the server-side cache so the two layers cannot disagree. The default stays no-store: most routes here are personalised, admin-only or auth-dependent. /api/badges/leaderboard is deliberately left alone because it returns per-viewer rank entries to signed-in callers. Note this only takes effect once a cache rule exists for /api/* at the CDN, or the explicit `cache: "no-store"` is dropped from the client fetches (24 files do that today, including the /api/online poll). The headers alone are inert until one of those happens. - Take the homepage row counts from the storage engine estimate instead of COUNT(*), which walks an index and gets slower as the tables grow. A missing or zero estimate falls back to the exact count rather than ever showing a wrong zero. The online count stays exact: it is an indexed read over a small subset and a few seconds of drift reads as broken rather than approximate. The counters move into one module because the homepage and the boot warm-up populate the same cache keys, so two implementations would race to write different values into the same entry. 3223 tests pass.	2026-09-25 18:42:23 +02:00
openhands	203399aab7	fix(cache): true LRU, stale-while-revalidate and cross-process invalidation ... The in-process cache was a FIFO of 500 entries that was never touched on a read, so a key polled on every request could be evicted by an unrelated burst of dynamic keys. That looked exactly like the cache being cleared at random, and it is what made the site fall back to the database unpredictably. - Evict least-recently-used instead, and raise the default budget to 2000 (CACHE_MEMORY_MAX_ENTRIES). Reading a key now marks it as used, so a hot key only leaves when a hotter one takes its place. - Add opt-in stale-while-revalidate (CachedOptions.staleMs). The grace window lives on the entry, so one call site opting in protects every reader of that key. A failed background refresh keeps serving the last good value instead of falling through to the origin, and is reported once rather than per read. - Invalidate across processes. invalidateKey() now clears memory, deletes the Redis key and publishes a signal, so a value written by one process is no longer served stale by the others for the rest of its TTL. A failed Redis delete no longer skips the broadcast. - Guard against a refresh that started before an invalidation writing its outdated result back into the cache. - Read the news revision at most once a second per process instead of on every call, with a pub/sub signal to drop the local copy when it rotates. A Redis outage now degrades to the in-process cache rather than to no cache at all. - Warm the hot public keys on boot, so the first visitors after a deploy do not each pay for a miss. - Count hits, misses, stale serves, errors and evictions per key, exposed at GET /api/admin/devops/cache. Without it a wrong REDIS_URL, a full budget and a dead origin all look identical from the outside. - Enforce the imaging cache budget for real: records are .img/.json pairs, so the old cap counted files and never removed anything while entries were fresh. Sweeps are throttled per directory and prune to a low-water mark. - Cap the JWT version map, and stop per-test scratch roots from littering the runtime imaging cache. Public read-only endpoints get grace windows; admin, account and auth data deliberately stays fresh. Redis TTLs get a little jitter so keys written together no longer expire together. 3209 tests pass. next build could not be verified on this host: the optimized build is OOM-killed before prerender, so this has not run in a real Next runtime yet.	2026-09-25 18:26:45 +02:00
openhands	8a66db4ed7	fix(imaging): make avatar and badge images resilient to upstream outages ... - Add persistent disk cache for rendered avatars/badges (storage/imaging) so repeats never touch the flaky local renderer and cached renders survive upstream downtime - Serve cache-first with stale-on-error; cut primary/fallback timeouts from 10s/6s to 4s/4s so failing images cannot stall pages - Avatar proxy now returns a graceful 200 silhouette instead of 502 when no renderer can produce a figure, so no broken-image glyphs appear - Badge endpoint becomes a caching proxy trying configured CDN, public Habbo CDN and local /swf copy in order, and drops the fragile IP rate limit that could blank badge streams - Route all site badge images (profile, me, badges, apply pages) through the cached proxy instead of hot-linking images.habbo.com	2026-09-20 12:58:55 +02:00
openhands	6c53f4680c	feat(studio): run nitro scans in the background with cancel-re-attach and nightly auto-clean	2026-09-19 13:41:14 +02:00
openhands	9d571e0c29	perf(studio): stream nitro repair progress over SSE and allow cancelling	2026-09-19 13:12:45 +02:00
openhands	ba81d16f00	perf(studio): cache nitro scan, stream progress, virtualize cleanup list	2026-09-19 13:01:59 +02:00
openhands	8638e81444	refactor(db): typed query helpers, shared test FormData helper ... Replace raw db.execute tuple casts with queryRows/rowsFrom/execResult/ affectedRows helpers from lib/db, drop redundant mysql2 casts on typed query builders, and centralize per-test fakeForm into test/fake-form. Update db mocks in tests so helpers resolve against mocked execute.	2026-09-17 21:02:57 +02:00
openhands	438277a17a	feat(studio): expand nitro cleanup with repair, auto-clean, and orphaned assets ... Scan distinguishes fake, broken, and orphaned SWF/icon assets with age metadata, deletes per asset kind, re-downloads broken nitro bundles from configured sources, auto-cleans old fake leftovers, and exports a JSON manifest. Adds rebuild and auto-clean API endpoints with audit coverage and a housekeeping preview route under the hotel domain. Verified: full vitest suite (2213 tests), typecheck, and biome all pass.	2026-09-15 21:59:21 +02:00
openhands	694f87d98c	feat(studio): add nitro cleanup tool for fake and broken bundles	2026-09-15 20:54:10 +02:00
openhands	644d53ca16	Rebuild organize imports: move furniture between categories, 500-item cap	2026-09-14 18:24:48 +02:00
openhands	1df1ffc3e9	Make avatar imager resilient with upstream fallback everywhere	2026-09-14 17:35:36 +02:00
openhands	1bbd809b43	Replace standalone catalog editor with the unified Visual Catalog studio ... Make /admin/catalog a full-screen catalog studio that replaces the old listing plus separate [id]/builder-club detail pages: - Embed CatalogManagerWorkspace on /admin/catalog with a Normal/Builder Club toggle, Catalog Sync status, packages (normal), Organize imports and a diagnostics link to /admin/studio/maintenance. - Manage BC items directly in the studio Items tab (new BcItemsEditor, CRUD via existing bc actions; /api/admin/catalog/items now serves BC). - Inline editor: add pageTextTeaser field for both catalogs and remove the legacy full-editor links. - Remove the 'Open full editor' context action from the tree. - Move catalog-items-table (dir + barrel) and catalog-translate-tab out of the app route into src/components/admin/catalog and update all importers. - Keep /admin/catalog/[id], builder-club/[id] and /admin/catalog/maintenance as redirects into the new studio; consolidate maintenance panels into /admin/studio/maintenance and point the nav item there. - Delete the old listing/table/tabs/forms and the standalone bc-manager.	2026-09-14 17:20:52 +02:00
Simo	fe34d4ac93	fix(news): enforce shared comment publication and moderation rules	2026-09-13 20:14:32 +02:00
Simo	8abfe352ef	fix(security): authorize site uploads and harden tokens, media and request identity	2026-09-13 19:24:43 +02:00
Simo	c977fe95ba	fix(studio): recover uncertain imports with persistent request identities	2026-09-13 18:33:06 +02:00
Simo	1eee6661f9	feat(notifications): add account-scoped inbox and persistent preferences	2026-09-13 17:59:22 +02:00
openhands	ec742a3f72	feat(security): add rate limiting to public POST routes ... Add rateLimit protection to /api/paypal/create, /api/paypal/capture, /api/tokens, /api/radio/shouts, and /api/articles/[slug]/comment to prevent abuse and spamming.	2026-09-13 13:30:29 +02:00
openhands	fb68df3ba9	feat(import): apply translation to successful bulk items ... The interactive batch ignored the client's Translate option, so translated names never landed in the language files during a bulk run. Patch each successful item through patchLocalizedFurniDataEntries (mutex-guarded, best-effort) when translation is requested, surfacing failures as item warnings instead of failing the import.	2026-09-13 12:54:00 +02:00
openhands	ffcd4232d6	feat(import): durable batch checkpoint and transient auto-retry ... Mirror interactive batch runs into the import-job store so interrupted imports (restart, time-out, disconnect) can be resumed from Import History. Items are checkpointed as they settle (coalesced, serialized saves) and the mirror starts 'running' so the boot-time worker marks it 'interrupted' instead of double-importing; done items are never re-imported. Add bounded backoff retry for transient download/connection failures before marking an item failed, and point the client's time-out/network toasts at Import History.	2026-09-13 12:50:17 +02:00
openhands	2a708b01b1	perf(import): adjustable concurrency and skip redundant SWF downloads ... Raise batch concurrency (furni 3->12, clone 10->12) with a Speed control next to Translate. Skip the SWF download when a .nitro bundle already exists on disk (color variants share the base nitro), and stop flagging that as a failed download.	2026-09-13 12:14:52 +02:00
openhands	b92f897ba2	perf(studio): virtualize the furniture table and throttle batch progress ... - Render the table view through a virtualizer too, using a shared grid template so the sticky header and rows keep perfect column alignment - Keep semantic table/row/cell elements while virtualizing - Cap the batch item-details list to the latest 60 rows (newest first) - Coalesce per-item progress events server-side (120ms throttle) in both the exact-import and clone SSE batch runners	2026-09-13 11:53:07 +02:00
openhands	d02aaa0d87	perf(studio): cache furni imports and virtualize the furniture grid ... - Add TTL-based caching for local index lookup, furnidata classnames, catalog id set, nitro file presence and import stats - Invalidate caches after furnace single/batch/clone imports - Rewrite batch progress with elapsed time, rate and verification chips - Virtualize the grid with @tanstack/react-virtual and replace the Load more button with infinite scroll via an IntersectionObserver	2026-09-13 11:40:55 +02:00
openhands	388d8992f8	feat: add CSV/JSON export, advanced bulk filters & selection to Catalog Manager ... - Admin Audit Log: CSV/JSON export via ?format=query param - Catalog Manager: club_only / have_offer filters (multi-filter support) - Offer discovery: refactored discoverOffers() to accept filters object - Translations added for new filter labels - Test updates for all modified paths	2026-09-12 20:40:33 +02:00
openhands	4d720ee03c	fix(furni): generate scale 32 from bundles with .png frame keys ... resolveNitroFrame now matches spritesheet frame keys that carry a .png suffix or namespaced naming, and isScale/scaleName preserve that suffix. Broken source sprites (missing frames or references to icon artwork) are skipped and reported instead of aborting the whole generation, and the studio UI surfaces the skipped count.	2026-09-12 12:46:17 +02:00
openhands	683fee3bd9	fix: resolve layout type errors in organize-imports-dialog	2026-09-11 23:25:53 +02:00
openhands	61c7519bea	fix(studio): show all offers in the imported-furniture tree ... The organize-imports route defaulted to a 500-item limit, silently hiding offers beyond the first batch of imported pages. Remove the effective cap (limit now means 'all', guarded only by a 50k lint cap) so every offer already sitting in the import tree is returned and grouped.	2026-09-11 20:33:27 +02:00
openhands	19dc0347df	fix(studio): harden organize-imports against long-running queries and hangs ... The original GET route used a correlated NOT EXISTS / FIND_IN_SET subquery over the entire catalog_items table for every recent import audit entry, causing server timeouts when the audit log or catalog grew large. The per-item host-page validation inside the create action also issued one SELECT + one UPDATE per moved offer. Changes: - GET /api/admin/import/organize: replace the correlated subquery with a bounded candidate list and a JS-side placed-set check, then resolve all needed base items in a single indexed SELECT. This bounds the query cost regardless of catalog or audit log size. - organizeImportFurni action: validate mover ids in one SELECT, then batch every move per group into a single UPDATE with a CASE expression instead of one UPDATE per item. - OrganizeImportsDialog: add a 45-second abort timeout on the fetch and a distinct load-error state so the UI never silently hangs. - Add 'loadError' translation key (en + nl).	2026-09-11 20:24:38 +02:00
openhands	01a85ebcd0	feat(studio): add organize-imports tool with suggestion review and approval ... Adds a Studio 'Organize imports' dialog that groups recently imported furniture and furniture already sitting in the auto-created import pages into suggested catalog categories. Each group is presented with its suggested name, icon, and layout which can be overridden before approval; approved groups are turned into real catalog pages in a single atomic export run. Offers already inside the import subtree are moved to the new pages; brand-new furniture gets a fresh offer. - groupSuggestedCategories: generic pure helper reusing the same per-item label heuristic that drives suggestCategoryName; items with no label land in a 'Other Furni' remainder bucket - GET /api/admin/import/organize: returns items from the imported furniture tree (catalog_items JOIN items_base via page id set from the imported-furniture root) union audit-logged but not-yet-placed recent imports; marks alreadyPlaced vs new - organizeImportFurni server action: validates import-page membership before moving any offer, creates pages + inserts/moves items in one withCatalogExport snapshot, logs activity - OrganizeImportsDialog: full-featured Studio dialog with price panel (applies to new offers only), parent select, per-group approval, editable name/icon/layout with suggestion reset chips, source tags - import-pages.ts server helper: locates the imported-furniture tree - Studio nav: 'Organize imports' button with FolderTree icon, gated on CATALOG_EDIT, wired next to the catalog manager - en + nl translations for organizeImports.* keys with ICU plurals - groupSuggestedCategories unit tests (deterministic grouping, remainder handling, size+alpha ordering, label consistency)	2026-09-11 19:38:18 +02:00
openhands	f832479e52	feat(catalog): add auto-category wizard with live preview and smart suggestions ... - Add AutoCategoryDialog: pick furni (or empty page), suggest caption/icon/layout, live preview - Add createAutoCategory server action (page + offers in one export) with CatalogKind - Extend furni search API with interactionType - Share ShopTile and refactor inline-editor/items-shop-preview to use it - Add suggestion heuristics (suggestCategoryName/dIcon/layout) with tests - Add autoCategory translations (en/nl)	2026-09-11 18:47:31 +02:00
Simo	88790d1a0d	feat(cms): recover drafts and failed imports with verified UI workflows	2026-09-11 08:58:10 +02:00