From 315f64cf950c3d843d262d587bcbc7c769438961 Mon Sep 17 00:00:00 2001
From: Thomas <claude@zneb.to>
Date: Thu, 9 Jul 2026 07:54:00 +0200
Subject: [PATCH] Add character teleport, delete, and account kick/delete to
 admin panel

Traced how login placement actually works: CPlayer login placement
(Src/World Server/worldpackets.cpp:27, pakPlayer) calls
GetRespawnByID(Position->respawn), and Position->respawn is loaded
straight from characters.respawnid (playerdata.cpp:110). So setting
respawnid to a Src/World Server list_respawnzones.id is a real, live
lever over where a character logs in next -- not a vestigial column
(unlike characters.townid, which turned out to be dead: the only
other code path that reads it is commented-out dead code in
pakUserDied, superseded by CPlayer::RespawnPlayer which uses an
in-memory Position->saved instead).

Added to the character edit page: a teleport dropdown grouped by map,
populated from list_respawnzones, wired straight to respawnid (takes
effect on the character's next login same as other stat edits) and a
delete-character action. Added to the account edit page: delete
account (characters are kept) and a "reset online flag" action for
accounts stuck thinking they're still logged in after a crash.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 webadmin/app.py                        | 71 +++++++++++++++++++++++++-
 webadmin/templates/edit_account.html   | 15 +++++-
 webadmin/templates/edit_character.html | 21 +++++++-
 3 files changed, 103 insertions(+), 4 deletions(-)

diff --git a/webadmin/app.py b/webadmin/app.py
index 8ba23e1..f382694 100644
--- a/webadmin/app.py
+++ b/webadmin/app.py
@@ -27,9 +27,14 @@ ADMIN_MIN_ACCESSLEVEL = int(os.environ.get("ADMIN_MIN_ACCESSLEVEL", "900"))
 
 CHAR_STAT_FIELDS = [
     "level", "zuly", "str", "con", "dex", "_int", "cha", "sen",
-    "curHp", "curMp", "statp", "skillp", "stamina",
+    "curHp", "curMp", "statp", "skillp", "stamina", "exp", "classid",
 ]
 
+# Column edited via its own <select> (populated from list_respawnzones) rather
+# than a bare number input, but it's a plain int column just like the ones
+# above, so the generic CHAR_STAT_FIELDS UPDATE loop handles it unchanged.
+CHAR_STAT_FIELDS.append("respawnid")
+
 
 def get_db():
     return pymysql.connect(
@@ -276,12 +281,74 @@ def edit_character(char_id):
         with db.cursor() as cur:
             cur.execute("SELECT * FROM characters WHERE id=%s", (char_id,))
             char = cur.fetchone()
+            cur.execute(
+                "SELECT id, map, x, y FROM list_respawnzones ORDER BY map, id"
+            )
+            respawn_zones = cur.fetchall()
     finally:
         db.close()
     if not char:
         flash("Charakter nicht gefunden.")
         return redirect(url_for("characters"))
-    return render_template("edit_character.html", char=char, stat_fields=CHAR_STAT_FIELDS)
+    zones_by_map = {}
+    for z in respawn_zones:
+        zones_by_map.setdefault(z["map"], []).append(z)
+    return render_template(
+        "edit_character.html",
+        char=char,
+        stat_fields=[f for f in CHAR_STAT_FIELDS if f != "respawnid"],
+        zones_by_map=zones_by_map,
+    )
+
+
+@app.route("/characters/<int:char_id>/delete", methods=["POST"])
+@login_required
+def delete_character(char_id):
+    db = get_db()
+    try:
+        with db.cursor() as cur:
+            cur.execute("SELECT char_name FROM characters WHERE id=%s", (char_id,))
+            row = cur.fetchone()
+            if row:
+                cur.execute("DELETE FROM characters WHERE id=%s", (char_id,))
+    finally:
+        db.close()
+    if row:
+        flash(f"Charakter '{row['char_name']}' gelöscht.")
+    return redirect(url_for("characters"))
+
+
+@app.route("/accounts/<int:account_id>/delete", methods=["POST"])
+@login_required
+def delete_account(account_id):
+    db = get_db()
+    try:
+        with db.cursor() as cur:
+            cur.execute("SELECT username FROM accounts WHERE id=%s", (account_id,))
+            row = cur.fetchone()
+            if row:
+                cur.execute("DELETE FROM accounts WHERE id=%s", (account_id,))
+    finally:
+        db.close()
+    if row:
+        flash(f"Account '{row['username']}' gelöscht (Charaktere bleiben erhalten).")
+    return redirect(url_for("accounts"))
+
+
+@app.route("/accounts/<int:account_id>/kick", methods=["POST"])
+@login_required
+def kick_account(account_id):
+    # Resets the DB's stale "online" flag -- useful after a crash/kill -9
+    # left an account stuck thinking it's still logged in and unable to
+    # log back in. Does not disconnect a currently-live session.
+    db = get_db()
+    try:
+        with db.cursor() as cur:
+            cur.execute("UPDATE accounts SET online=0 WHERE id=%s", (account_id,))
+    finally:
+        db.close()
+    flash("Online-Status zurückgesetzt.")
+    return redirect(url_for("edit_account", account_id=account_id))
 
 
 if __name__ == "__main__":
diff --git a/webadmin/templates/edit_account.html b/webadmin/templates/edit_account.html
index 6480656..ed9c226 100644
--- a/webadmin/templates/edit_account.html
+++ b/webadmin/templates/edit_account.html
@@ -2,7 +2,9 @@
 {% block title %}{{ account.username }} - ROSS Admin{% endblock %}
 {% block content %}
 <div class="card" style="max-width:480px;">
-  <h2 style="margin-top:0;">Account: {{ account.username }}</h2>
+  <h2 style="margin-top:0;">Account: {{ account.username }}
+    {% if account.online %}<span class="badge ok">online</span>{% else %}<span class="badge off">offline</span>{% endif %}
+  </h2>
   <form method="post">
     <label>Accesslevel (100 = normaler Spieler, 900 = Admin)</label>
     <input type="number" name="accesslevel" value="{{ account.accesslevel }}">
@@ -30,4 +32,15 @@
     {% endfor %}
   </table>
 </div>
+<div class="card" style="max-width:480px;border-color:#5a2530;">
+  <h3 style="margin-top:0;color:var(--danger);">Gefahrenzone</h3>
+  <form method="post" action="{{ url_for('kick_account', account_id=account.id) }}" style="margin-bottom:12px;">
+    <button type="submit" class="secondary">Online-Status zurücksetzen</button>
+    <p style="color:var(--muted);font-size:12px;">Nützlich wenn der Account nach einem Server-Crash als "online" hängen geblieben ist und sich nicht neu einloggen kann.</p>
+  </form>
+  <form method="post" action="{{ url_for('delete_account', account_id=account.id) }}"
+        onsubmit="return confirm('Account {{ account.username }} wirklich unwiderruflich löschen? (Charaktere bleiben erhalten)');">
+    <button type="submit" style="background:var(--danger);">Account löschen</button>
+  </form>
+</div>
 {% endblock %}
diff --git a/webadmin/templates/edit_character.html b/webadmin/templates/edit_character.html
index 30bfdde..0e6f759 100644
--- a/webadmin/templates/edit_character.html
+++ b/webadmin/templates/edit_character.html
@@ -4,7 +4,19 @@
 <div class="card" style="max-width:600px;">
   <h2 style="margin-top:0;">Charakter: {{ char.char_name }} <span class="badge ok">Account: {{ char.account_name }}</span></h2>
   <form method="post">
-    <div class="grid">
+    <label>Standort (wirkt beim nächsten Login)</label>
+    <select name="respawnid">
+      <option value="{{ char.respawnid }}">-- aktuell: Zone #{{ char.respawnid }} --</option>
+      {% for map, zones in zones_by_map.items() %}
+      <optgroup label="Map {{ map }}">
+        {% for z in zones %}
+        <option value="{{ z.id }}">Map {{ z.map }} - Zone #{{ z.id }} ({{ '%.0f' % z.x }}, {{ '%.0f' % z.y }})</option>
+        {% endfor %}
+      </optgroup>
+      {% endfor %}
+    </select>
+
+    <div class="grid" style="margin-top:12px;">
       {% for field in stat_fields %}
       <div>
         <label>{{ field.lstrip('_') }}</label>
@@ -20,4 +32,11 @@
     </div>
   </form>
 </div>
+<div class="card" style="max-width:600px;border-color:#5a2530;">
+  <h3 style="margin-top:0;color:var(--danger);">Gefahrenzone</h3>
+  <form method="post" action="{{ url_for('delete_character', char_id=char.id) }}"
+        onsubmit="return confirm('Charakter {{ char.char_name }} wirklich unwiderruflich löschen?');">
+    <button type="submit" style="background:var(--danger);">Charakter löschen</button>
+  </form>
+</div>
 {% endblock %}