Repository navigation
Add profiles, progress, friends, discovery, creator hub, leagues, kit, wardrobe and email - #18
Merged
Merged
Conversation
…tions Groundwork from the PRD so each owner builds in their own folder without editing the same files. - app/features/: one folder per feature (copy _template), listed with one line in FEATURES. Each feature's tables, routes and admin permissions are loaded from there. - Feature flags: FEATURES env (comma separated, "*" for all locally). A feature's routes answer 404 until its flag is on. GET /features lists what's on. - app/events.py: publish/subscribe in process. Every event and its payload is listed in EVENTS; a failing handler is logged, never raised. game_published, game_updated and tournament_finished are now published. - app/manifest.py: startng.json as registered sections, each parsed (and optionally saved on publish) by its owner. leaderboard and description work as before. - admin.register_permissions: features add their own admin permissions.
Phase 0 scaffolding: feature folders, flags, events, startng.json sections
…s are upgraded and dependency graph is enabled
…; dependency review blocks again
…ures still fail the job
ci: pip-audit, dependency review, CodeQL, Dependabot, CodeRabbit
…nown vulnerabilities
deps: upgrade vulnerable packages flagged by pip-audit
… link and race on their own standings
…e maker can swap the link
Private tournaments: friends pick games and a time, share a link, follow their own standings
…ards and the rules registry PRD D1. Ships dark behind the progress flag. Every score submission is logged, the player's day (Nigeria time) is updated, and registered award rules are evaluated; the score response gains an optional unlocked list. Adds GET /me/progress and /me/awards, migration 0020, and publishes run_recorded and award_unlocked. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…st leaderboard layer PRD D2. Ships dark behind the integrity flag. startng.json stats can set a max (score_out_of_range), scores are rate limited per player per game, and the leaderboard is sorted in the database with a 30 second cache, with the same output as before. Adds integrity.ranked and integrity.rank_of (contract C5, with only_users). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ublic progress and run retention
PRD D1-b. Streaks earn a freeze every 7 days (max 2) that a missed day spends
automatically. Signed-in plays record game_opens (C4); runs remember the tournament
they counted for. Adds GET /players/{id}/progress with a visibility hook for the profile
feature, a backfill command that makes runs from existing scores, and 180-day run
retention. Migration 0021.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…for D2-b Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…h their own reasons The hiding the admin page does (off lists and pages, offline at its own address, out of tournaments) moves into app/admin.py as hide_game and show_game, so features hide games the same way. register_hide_reason adds a feature's own reason, ranked among reported, flagged and blocked.
app/features/moderation (flag "moderation"): - check_text(text) returns the blocked word or None; require_clean raises a 422 (text_not_allowed) naming the field, not the word. Other features (crews, wardrobe) call these. - Default lists in words.py: "strong" words caught even inside other words, the rest as whole words with simple endings (-s, -es, -ed, -ing), and an allow list for innocent names (Scunthorpe). Look-alikes, accents, spaced-out and stretched spellings (sh1t, $hit, s.h.i.t, shiiit) are undone first. - Admins add blocked or allowed words (moderation_words, migration 0022), try a name, and see names already on start.ng that fail. Permission moderation.words. While the flag is on, start.ng checks new game names, the description in startng.json (a description it found in the page or README is just left out), character names and Creators listings. Live game names are left alone and listed for admins instead.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nk-held rule and record_beaten PRD D2-b. A run far beyond the player's previous best or the game's 99th percentile is held for review: logged as flagged, kept off the board, out of tournaments, XP, awards and events, and answered like any other run. Owners see their game's flags; admins with scores.review clear or confirm them. Runs record the place reached so a rank counts only once held across two runs, and record_beaten fires when the top spot changes hands. Migration 0022. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Found by running the engine on Postgres: 8 runs sent at once by a new player were all logged, but the day's activity row said 2 runs, because each request read the row, added to it and wrote it back. The day's row is now read with FOR UPDATE, so runs queue up. Adds a Postgres-only regression test (skipped unless TEST_DATABASE_URL is set). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ore rows correctly Running the leaderboard on Postgres with 50,000 scores showed the top 10 at p95 63 ms (over the 50 ms goal) because the tied rows were fetched and sorted in Python. The whole ordering is now done by the database in one query that follows the (game, best) index: p95 16 ms. Also fixes a plain-score row stored as the JSON value null being ranked last. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Measured on Postgres, logging a run was adding about 53 ms at p95 per score, mostly the six queries that build the snapshot after every run. They are only needed to evaluate award rules, so with none registered (today) they are not run. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
A2 spotlight: Game of the Week and the daily challenge
Merge dev into feat/m1-kit-sessions (for #69), migration -> 0038
M1 Kit: game_sessions (how long people play Kit games), behind the kit flag
Merge dev into feat/m2-leagues (for #71), migration -> 0039
M1 Kit: the publish check counts the Kit for the game standards, and publish sets games.uses_kit
feat: M2 Leagues backend (Sprint, Daily and Weekly tracks)
…1_creator_hub, so alembic had two heads)
Fix: two alembic heads (games.uses_kit migration 0031 -> 0040)
…y difficulty Players earn coins and items by playing any start.ng game (event handlers on runs, tournaments, challenges and league promotions; no game changes). Coins are earn-only, kept in a ledger with a guarded balance and a daily cap on coins from playing. Games can list goals in a startng.json `rewards` section; start.ng sets what each pays from the share of players who reach it. 21 items in six rarities; epic, legendary and limited can't be bought. The Hangout's live room sends what each player wears. Flag `wardrobe`, off by default. Migration 0040 follows dev's 0039; renumber to 0041 if fix/uses-kit-migration-0040 merges first. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dev now has 0040_games_uses_kit (#93), so the wardrobe migration follows it (one alembic head). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The cache started as (0.0, {}) and counted as fresh while time.monotonic() was under SHARE_TTL, so on a machine
up for less than 10 minutes (a new CI runner) every item read 0%. It now starts empty (None).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…g refresh, daily challenger badge listed
Wardrobe: coins, rarity items, the daily shop and game goals priced by difficulty
Support authenticated SMTP with STARTTLS or implicit SSL alongside the existing log and Brevo providers. Document the required environment variables for deployment. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…and addresses, and tests with a fake server
H1 email: send through SMTP (EMAIL_PROVIDER=smtp)
Polish from the end-to-end test: league names, plurals, faster ranking refresh, daily challenger badge
Promote dev to main
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…n, health-check URL
Fix CodeQL alerts before the upstream PR
dav3exe
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this adds
Brings
startng-beup to date with the Cybertron-HNG fork'smain(169 commits). New since the last upstream sync:Players and progress
Games and discovery
games.uses_kit)Quality, safety and email
CI and security
Deploy notes
0040(a single head): runalembic upgrade head..env.example.Checks
pytest(658 passed),malware-scan,Dependency auditandAnalyze (python)pass.Dependency reviewfails only because the dependency graph isn't enabled on this repo; a maintainer has been asked to turn it on.