Ryuu/AetherOnline
Watch
1
0
Fork
You've already forked AetherOnline
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Page: admin actions and internal auth
Pages
Authoring Debugging Home Operations Protocol Reference Runtime Systems abilities loadouts and progression ability rotation and combo planner active realtime session actor directory admin actions and internal auth animation workbench operator guide aoi snapshot replication app mode bootstrap and lifecycle architecture guardrails and module tree tests asset loading routing and vfs authored ui surface renderer authoring command bus and transaction history authoring reference registry contributor extension contract authoring reference registry authoritative audit event schema and projections authoritative world time calendar and environmental scheduler bake product registry build strategy and loadout optimizer campaign journey and progression simulator catalog source map and record routing character gameplay state json store character paperdoll assets character stats and equipment modifiers chat presence and social client local offline save and bootstrap cache client local user preferences and account sync client multiplayer connection flow and session cleanup client realtime authority store and frame projection client scene presentation and player preview client snapshot staging and repair receipts client ui focus and text input planning combat action resolution and mob ai semantics combat presentation cues and transient effects combat rewards and progression persistence content dependency graph and scenario playtests content migration and catalog refactors control agent api and remote service runner control panel config and secret persistence control panel service build invalidation and log normalization control panel service lifecycle and quality gates control plane allocation and zone transfer routing control plane and service ops control plane route policy and coordination api control service supervisor manifest and stale process recovery crafting recipes and service integration dependency aware content health deterministic combat balance lab developer workspace doctor and readiness report diagnostics provider input lanes and failure isolation dialogue quest localization handoff dialogue runtime state and choice authority duplicate realtime claim takeover durable retry and session cleanup durable work queue consumer contract dynamic world state and scene phasing editor authored content workspace manifest and cache editor event console and asset debug dashboards editor extension and contribution registries editor scene snapshot lane demand editor settings registry and workspace presets editor viewport and world tools editor workbench and dock encounter difficulty mutators and reward scaling encounter instance and wave director encounter lobby ready check and entry encounter mechanics and boss timelines encounter memory persistence encounter reward eligibility lockouts and pity enemy archetypes combat kits and encounters engine report log and recovery routing environment configuration reference external engine patterns and boundaries farming footstep surface audio materials forgejo wiki publishing and docs check game data catalog game data generated item family adapters game database schema readiness game server catalog load health and fallback policy game server reconciliation and transfer marker cleanup game server startup readiness and registration game transport endpoints and quic exposure gameplay action authority and command audit gameplay action replay ledger and idempotency gameplay authority replay fixtures and drift gates gameplay conditions effects and events gameplay system slice scaffold gameplay ui runtime and bevy sync generated artifact drift and repair generated artifact registry and quality gate integration glossary hotbar hud runtime projection and input in process zone transfer phase journal input profiles and keybinds interactive world map minimap and cartography internal auth and admin delegation chain inventory items and stack limit safety item authoring lifecycle and reference repairs json catalog hot reload batch and candidate revalidation legacy compatibility and migration register local player input control and reconciliation local playtest and standalone preview localization extraction and runtime catalog login account admin repository and cascades login database migrations and schema contracts login server auth sessions and character entry login session cache throttle and revocation loot table authoring and drop audits mob animation presentation events and projectile cues mob encounters and scene combat movement authority networking tick health and zone pressure npc ai schedules and deterministic behavior npc definition catalog npc schedules routines and contextual behavior npc services npc state memory and interactions pack export content gate party composition roles and synergy simulator passive traits and procs persistent interactive world objects placed light runtime budget and preview heatmap player appearance equipment persistence player economy authority player homesteads housing and property auctions player journal and codex player navigation tracking and world guidance player notification inbox authority and delivery player preview animation profile player preview debug gizmos and collision overlays player preview render cache and keyed entity lifecycle player preview weather masks and effect budget player snapshot assembly and durable row normalization post process volume blending and preview overlays project files import profiles and asset change impact public endpoint detection and upnp exposure quality gate jsonl events and panel failure summaries quest runtime projection and turn in authority quic reliable stream topology and negotiation realtime admission throttling and load shedding realtime bootstrap manifest and snapshot service realtime bootstrap wire sections and compression realtime client reconnect journal and command replay realtime datagram codecs and ingress policy realtime egress mailboxes and lane scheduling realtime ingress validation and failure policy realtime packet debug capture and triage realtime protocol registry realtime registry and wire contract realtime resume ledger record format realtime rollout policy and compatibility negotiation realtime runtime profile and transport adaptation realtime session activation hydration boundary realtime timebases tick ordering and clock ownership redis keyspace ttls and cleanup targets regions points of interest and exploration discovery relationship reputation gates and service deltas remote avatar replica binding and interpolation render surface guard and window safety runtime actor identity and authority contract runtime camera arrival and cutscene overrides runtime debug overlays and developer options runtime environment registry and startup config validation runtime path roots and packaged asset resolution runtime profiling tracy captures and budget gates runtime scene manifests and zone authoring runtime ui fonts and localized text presentation scenario sandbox and timeline inspector scene audio runtime routing scene command center and visual graph tools scene cutscene authoring scene documents scene layer schema depth and bands scene lighting post process and placed lights scene navigation and collision scene preview scenario replay cli scene runtime media weather and camera phases scene runtime schedule and frame budget scene trigger authority and reconciliation scene triggers scene validation and repairs service json rpc contracts service observability and metrics contract service registry heartbeats drain and shutdown session handoff and transfer shared content workspace shared test fixtures and fixture workspaces shared validation report schema source inventory and engine health standalone account realm and character flow standalone asset pack and preflight standalone loading pause death and recovery screens standalone shell flow and ui lifecycle standalone ui preview root and transient lifecycle starter character economy bootstrap status effects and combat modifiers story content loop text asset migration journals and atomic rollback tiled prefab import and placement tilemap asset import contracts tileset atlas preview surfaces trigger permissions targeting and action pipelines typed disconnect codes and transport advisories ui layout binding graph and editor workflow ui layout ui skins validation and bake validation errors validation provider registry and strict preflight vendor stock and shop economy authoring viewport spatial planning overlays vscode dev tasks and generated launch profiles workspace package roles and scoped quality profiles world entry smoke harness and soak telemetry world events and scenario director world gameplay assemblies world interactions and activity boards world mechanism and puzzle graphs world overlay gizmos and culling world travel waypoints and zone transitions xtask content gates and plans
2 admin actions and internal auth
forgejo-actions edited this page 2026-07-11 10:33:50 +00:00
Table of contents

Admin Actions And Internal Auth

This page documents the operator-facing admin actions and the signed internal request contract used by control surfaces when they talk to services. It covers the actions that are routed today and the broader game-server admin action handler that is compiled ahead of its HTTP routing rollout.

Operator Surfaces

The control panel has three distinct admin paths:

  • Recovery actions in the admin panel run directly against Redis or Postgres from the panel process: clear presence, clear login handoffs, clear service registry keys, and revoke login sessions.
  • Account actions run through the login-server account admin repository from the panel process: refresh, create account, toggle admin, seed starter characters, and delete account.
  • Game-server operations use signed internal HTTP endpoints when routed. Today the game server wires POST /v1/internal/chat/system, session-lifecycle dead-letter inspect/requeue endpoints, and persistence-retry dead-letter inspect/requeue endpoints.

The broader world::AdminActionRequest handler in services/game-server/src/admin_actions.rs supports system chat, chat mute/unmute, kick, inspect, and encounter-calendar actions, but that handler is not routed as a public HTTP endpoint yet. Treat it as the server-side policy contract for the next routed admin action surface, not as an already callable panel route.

Dry Runs

Panel recovery actions support AdminActionExecutionMode::DryRun and AdminActionExecutionMode::Execute. Dry run formats the same target set the execute path would touch and explicitly reports that no Redis keys or database rows were changed. The UI exposes dry run separately from execute and keeps the destructive execute path behind typed confirmation.

Dry-run support currently belongs to the panel recovery actions. Account admin operations and the signed game-server system chat endpoint do not carry a dry-run field. The staged world::AdminActionRequest model also does not define dry-run semantics, so do not assume a rejected or unauthorized admin action is a dry run.

Recovery Actions

Redis recovery actions scan descriptor-owned key families and delete the matches:

  • Presence cleanup targets presence:accounts, presence:account:*, and presence:character:*.
  • Handoff cleanup targets login:handoff:* and login:handoff-consumed:*.
  • Registry cleanup targets registry:service:* and registry:instance:*.

Each report includes the number of deleted keys, matched keys, target count, and scan iteration count. A cancelled scan reports the cancellation with whatever partial work was already completed.

Session revocation updates login sessions with:

UPDATE login_sessions SET revoked_at = NOW() WHERE revoked_at IS NULL

That makes the operation naturally repeatable: a second execute should affect only sessions that were still active after the first run.

Account Operations

Login account admin is repository-backed and schema-gated. Before any operation, the repository verifies that login migrations have been recorded and that the accounts.is_admin column exists with the expected BOOLEAN NOT NULL DEFAULT FALSE shape.

Supported operations are:

  • Refresh: reload account summaries.
  • Create: normalize username, reject blank passwords, hash the password, insert the account with the requested admin claim, and seed starter characters in the same transaction.
  • SetAdmin: update accounts.is_admin for an existing username.
  • SeedStarterCharacters: seed default characters for an existing account.
  • Delete: delete the account and rely on database cascades for related characters and sessions.

Create is all-or-nothing with starter character seeding. If seeding fails, the account insert rolls back. Delete is intentionally destructive; recover it from backup or a recreated account, not from a local undo path.

Game-Server Admin Operations

The currently routed game-server operation is system chat. SystemChatBroadcastRequest accepts a message and optional zone_id, rejects empty messages with 400 invalid_request, and returns the number of delivered sessions.

The staged AdminActionRequest handler additionally defines these server-owned actions:

  • SystemChat: broadcast a server-authored chat message to a zone or all zones.
  • MuteChat and UnmuteChat: update server chat moderation state for a character.
  • KickSession: remove an active session and send a typed disconnect with the supplied reason or admin_kick.
  • InspectSession: return online character, zone, and admin-claim facts for a session token.
  • Encounter-calendar inspect, announce, and refresh actions.

For staged admin actions, the server resolves operator claims from an active session token before authorization. Client-supplied operator fields are not trusted. If session lookup is missing or fails, the server forces operator.is_admin = false and rejects with operator_claim_untrusted. If the session is trusted but not admin, it rejects with operator_not_admin.

Audit Logs

Panel recovery actions append to control-panel-admin-audit.log under the configured workspace root. Each line includes timestamp, mode (dry-run or execute), action label, and a newline-collapsed result. If the action succeeds but audit writing fails, the panel returns the success text plus an Audit log failed warning. If the action fails, the failure is still audited when possible.

The staged game-server admin action path builds an AdminActionAuditRecord, emits an authoritative_audit event, and persists request and response payload JSON into admin_action_audit_log. Audit records include request id, operator account id, operator username, trusted admin flag, action kind, target, reason, accepted flag, failure reason, and creation time.

Account admin operations return refreshed account summaries to the panel, but they are not backed by the game-server admin action audit table. When account changes are part of an incident, preserve panel logs, database migration state, and the operator command record alongside any database backup or restore notes.

Signed Internal Requests

Internal service requests use these headers:

  • x-aether-internal-service
  • x-aether-internal-key-id
  • x-aether-internal-timestamp
  • x-aether-internal-nonce
  • x-aether-internal-content-sha256
  • x-aether-internal-signature

sign_request signs the shared secret, uppercase method, path and query, service identity, timestamp, nonce, and SHA-256 body hash. The timestamp must be within 300 seconds of the verifier clock. Signature comparison is length-checked and byte-compared without early success.

Known service identities are login-server, game-server, and control-panel. Game-server internal routes currently allow the control panel identity and use a 1 MiB body limit. Control-plane and game-server protected routes share the same verifier shape.

Use AETHER_CONTROL_AUTH_SECRET for the shared secret. The development default secret is rejected for remote control-plane use unless insecure local behavior is explicitly allowed. Keep AETHER_CONTROL_ALLOW_INSECURE_HTTP limited to local or LAN workflows where that tradeoff is intentional.

Nonces And Replay Protection

The verifier rejects missing or disallowed service identities, stale timestamps, content-hash mismatches, bad signatures, and replayed nonces. Nonces are registered in Redis with SET ... EX ... NX under:

{scope}:internal-request-nonce:{service}:{nonce}

The nonce scope separates services such as control-plane and game-server. A duplicate nonce returns unauthorized. A Redis failure while registering a nonce is a service error because replay protection could not be proven.

Partial Failure Recovery

Prefer dry run before destructive recovery actions, then execute only after the target list matches the incident. Redis cleanup and session revocation are repeatable, but a cancelled Redis scan can leave a partially cleaned keyspace; rerun dry run to inspect the remaining targets before executing again.

For account operations, use schema readiness errors as a stop sign. Start the login server, run migrations, or repair drift before retrying the operation. Account creation rolls back on starter-character seeding failure, while account delete depends on database backup or a new account creation path.

For signed system chat, an ambiguous timeout can mean the message was already delivered. Check game-server logs and player reports before retrying to avoid duplicate announcements.

For staged game-server admin actions, side effects execute before durable audit persistence. If the handler returns an error after executing the action, treat it as "possibly applied, audit failed." Inspect authoritative audit logs, admin_action_audit_log, and current runtime state before replaying a kick, mute, unmute, or system chat.

Session lifecycle dead letters are inspected and requeued through signed internal endpoints. Inspect defaults to a bounded page, and requeue requires a non-empty dead-letter id. Requeue only after confirming the failed lifecycle work is still desired for the affected session.

Related Pages