lumbridge-public/tera
Archived
1
0
Fork 0
Code Activity

The sky is not something an account grants you

Browse Source 
`liveData` was one flag meaning two unrelated things, and it was set to
`tier !== "anon"`. That reasoning does not survive asking what the data actually
is. Cloud cover over San Francisco is a reading from a government sensor. The
aircraft are broadcasting their positions, unencrypted, to anyone within range
who owns a forty-dollar receiver. Neither is withheld from anybody by anybody,
so neither is a thing an account can grant access to — and putting them behind a
sign-in cost the only moment that makes this project land: real fog rolling off
the Pacific onto a city you recognise, at the real time of day, on a first
visit. On an SSO-gated deployment it cost that moment for every visitor there
currently is.

So `liveData` splits. `liveEnvironment` is public and unconditional.
`liveMarkers` is asked for by everyone and granted by the server, because the
marker set is the one feed here that can carry something private — a company's
pipeline, a person's job search — and whether it is public is a property of the
deployment, not of a file in this repo.

`TERA_MARKERS_ACCESS` is therefore a server switch and its default is `members`,
which is the safe answer rather than the common one. The failure mode of getting
this wrong is silent: nothing throws, nothing looks broken, the data is simply
readable by the internet. An operator who wires real markers up gets the shut
door without having chosen it and has to say `public` out loud — and saying it
appends a line to `degraded[]`, so `/api/v1/health` reports that this box is
publishing its map without anyone having to go and read the env file. Same
reasoning as `TERA_ADMIN_SUBJECTS=*`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Kartios
2026-08-06 03:36:12 -07:00
parent e41c90fe8d
commit 1db868ad70
6 changed files with 146 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+17 -2
View File
@@ -33,9 +33,24 @@ Three tiers, resolved once at boot by `src/access.ts`:
| | anonymous | signed in | admin |
|---|---|---|---|
| the map, the plan view, the named chapters | ✅ | ✅ | ✅ |
| observed weather and live aircraft | ✅ | ✅ | ✅ |
| the office | public depth — shell, furniture, viewpoints, nobody home | full depth, with presence | full depth |
| live markers and live traffic | — | ✅ | ✅ |
| the godmode panel (`G`) — clock, weather override, counters | — | — | ✅ |
| the marker feed | per `TERA_MARKERS_ACCESS` | ✅ | ✅ |
| the godmode panel (`G`) — date, season, weather override, counters, pose editor | — | — | ✅ |
The sky is public on purpose. Cloud cover over San Francisco is a government
sensor reading, and the aircraft are broadcasting their positions unencrypted to
anyone with a receiver; neither is something an account can grant you access to.
Gating them cost the only moment that makes this project land — real fog rolling
off the Pacific onto a city you recognise, at the real time of day, on a first
visit.
The **markers** are the one feed that can carry something private, so the server
decides. `TERA_MARKERS_ACCESS` is `members` by default and an operator has to
say `public` out loud, which `/api/v1/health` then announces in `degraded[]`.
The default is the safe answer rather than the common one, because the failure
mode is silent: nothing errors, nothing looks broken, the data is just readable
by the internet.
**These are drawing decisions, not a security boundary**, and `src/access.ts`
says so at length. Live data and office presence are withheld by the *API*, from