Skip to content

Bans block the website, no self-ban, Mojang decides player names, case-insensitive admin names, CI - #7

Merged
faolan-exe merged 6 commits into
mainfrom
fix/bans-and-accounts
Oct 22, 2026
Merged

faolan-exe merged 6 commits into
mainfrom
fix/bans-and-accounts

Conversation

@faolan-exe

Copy link
Copy Markdown
Owner

Why

Follow-up decisions after the test audit (#6).

What

  • Banned players (website or in-game ban on this server) cannot use anything that needs a login, also with a login from before the ban: APIs answer 403, pages show "Du bist gebannt" with reason and end. Public pages stay readable; an expired ban or a ban on another server does not block.
  • Moderators may ban other moderators, but not themselves, and cannot warn themselves (website and /verwarnen; warnings can end in a ban).
  • Player names are shared by all servers, so a plugin could rename any player everywhere. Now Mojang decides (ADR 0003): Mojang's name for its accounts (official session server instead of playerdb.co), the name an offline-mode uuid is made from, otherwise (Bedrock, Mojang unreachable) only the first name.
  • Admin usernames and e-mail addresses are unique regardless of case, login works with any case. Migration 31 drops clashing unverified accounts without servers and adds unique indexes (skipped if verified accounts clash, then the code alone keeps new clashes out).
  • CI: GitHub Actions runs ruff check (only real mistakes, ruff.toml) and the tests against postgres 13 on every PR and on main. The linter found 10 unused imports/variables in tests, removed.

Tests

757 passed locally, lint clean.

…t ban themselves

A ban (website or game, on this server) blocks every page and API that needs a login, also for logins
from before the ban; looking at public pages stays possible. Moderators may ban other moderators but
not themselves, and cannot warn themselves (warnings can end in a ban).
…ase (schema 31)

- names a plugin reports are checked: Mojang's name for its accounts (session server instead of
  playerdb.co), the name an offline-mode uuid is made from, otherwise only the first name
- usernames and e-mail addresses of admins are unique regardless of case; login with any case;
  migration 31 drops clashing unverified accounts and adds the indexes (ADR 0003)
GitHub Actions runs ruff (ruff.toml: only real mistakes) and the test suite against postgres 13.
@faolan-exe
faolan-exe merged commit 43144d0 into main Oct 22, 2026
2 checks passed
@faolan-exe
faolan-exe deleted the fix/bans-and-accounts branch October 22, 2026 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant