Docker SDK drives login/char/worldserver containers via docker.sock (mounted
read-only into webadmin); live logs stream over SSE with nginx buffering
disabled so lines arrive in real time. Broadcast/kick go through a new
admin_queue DB table that the world server polls every ~2s in its existing
WorldProcess tick loop, avoiding a second IPC channel to the game server.
Renaming checks for a name collision first (characters.char_name has
no unique constraint in the schema, so this has to be enforced at the
application level to avoid two characters silently sharing a name),
and also updates list_friend.namefriend for any rows referencing this
character's id -- that column is a denormalized display-name cache in
other players' friend lists and would otherwise go stale on rename.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Traced how login placement actually works: CPlayer login placement
(Src/World Server/worldpackets.cpp:27, pakPlayer) calls
GetRespawnByID(Position->respawn), and Position->respawn is loaded
straight from characters.respawnid (playerdata.cpp:110). So setting
respawnid to a Src/World Server list_respawnzones.id is a real, live
lever over where a character logs in next -- not a vestigial column
(unlike characters.townid, which turned out to be dead: the only
other code path that reads it is commented-out dead code in
pakUserDied, superseded by CPlayer::RespawnPlayer which uses an
in-memory Position->saved instead).
Added to the character edit page: a teleport dropdown grouped by map,
populated from list_respawnzones, wired straight to respawnid (takes
effect on the character's next login same as other stat edits) and a
delete-character action. Added to the account edit page: delete
account (characters are kept) and a "reset online flag" action for
accounts stuck thinking they're still logged in after a crash.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New "webadmin" service (Flask + PyMySQL, port 8081) backing a small
server-rendered admin UI:
- Login gated on an existing game account: only accounts with
accesslevel >= ADMIN_MIN_ACCESSLEVEL (default 900) get in. Password
is MD5-hashed before comparison since the game client hashes it
client-side before it ever hits the wire -- accounts.password is
always an MD5 hex digest, confirmed against existing DB rows.
- Accounts: list/search, create, edit accesslevel/active/password.
- Characters: list/search, create (mirrors the real char-creation
INSERT in Src/Char Server/charpackets.cpp -- only account_name,
char_name, face, hairStyle, sex are set, everything else relies on
the table's own defaults), edit core stats (level, zuly, attributes,
hp/mp, stat/skill points) and isgm/isdev flags directly.
All queries are parameterized (no string-formatted SQL). No CSRF
protection or rate limiting yet -- acceptable for a small
already-behind-a-high-accesslevel-gate private server, worth
revisiting before ever exposing this port publicly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Thomas