A plan view in the corner, a night you can actually see, and three kinds of visitor

The right half of the screen was empty sky. It holds the board now, drawn flat,
with the footprint of the camera's own frustum on it — the one part of a minimap
that earns its place, because it answers "where am I looking from" without
leaving the shot. Click it, drag it, scroll it. It is a 2D canvas rather than a
second WebGL context, cached per city and redrawn only when something moved.

Night was black. Not dark — black: at 3 a.m. the coastline, the hills and the
bay were one shape, and the frame read as a failed render rather than as
darkness. The sky already had a floor for exactly this reason and nothing did
the equivalent for the ground, so the ground has one now. The moon still has to
be worth computing, so the gap between a moonlit night and a moonless one is
preserved rather than filled in.

Three tiers, resolved once in the new src/access.ts: anonymous, signed in,
admin. Anonymous gets the map and a public office — the shell, the furniture,
the named viewpoints, nobody home — built without the private objects rather
than with them hidden, because scene.traverse makes hiding a leak with a bow on
it. The time scrubber and the debug readouts are admin only, and admin is
granted by TERA_ADMIN_SUBJECTS on the server and inferred nowhere else. An
unreachable API means member, never god: the promise is "clone it and it works",
not "clone it and you are an administrator of a deployment you did not
configure".

Three things this run found and fixed rather than shipped:

  - entryUrl came off the wire and went straight into an href with no scheme
    check, and a CSP of script-src 'self' 'unsafe-inline' does not stop a
    javascript: URL from navigating. One rejection point in access.ts now.
  - A 5xx from /health was the same null as "no API at all" and therefore the
    opposite conclusion. Eight seconds of tera-api restarting would have told
    every anonymous visitor they were a member. A 5xx is an answer; it fails
    closed.
  - decodeURIComponent in cookieToken was the one path in auth/index.ts that
    threw rather than returning ANONYMOUS, so one malformed cookie header from
    an unauthenticated caller turned /api/v1/session into a 500.

Also: keyboard shortcuts, focus rings, a boot state instead of a blank 2.3
seconds, a collapsible panel under 900px, and no horizontal overflow at 375,
768, 1440 or 2560.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

server/src/routes/session.ts

@@ -25,8 +25,10 @@
 import type { FastifyInstance } from "fastify";
 import {
   clearedSessionCookie,
+  grantsAdmin,
   issueSessionToken,
   sessionCookie,
+  type Viewer,
 } from "../auth/index.ts";
 import { MAX_PASSWORD_LENGTH, credentialsMatch } from "../auth/password.ts";
 import type { ErrorBody } from "../../../src/server/wire.ts";
@@ -42,6 +44,14 @@ export interface SessionBody {
   authenticated: boolean;
   /** The signed-in subject, or `null`. Never a token. */
   subject: string | null;
+  /**
+   * The god tier, decided by `TERA_ADMIN_SUBJECTS` on the server. The client
+   * reads it to decide what to draw — the time scrubber, the debug panel — and
+   * that is all it is for. It is not a capability: everything gated on it is
+   * gated again where it is enforced, because a boolean that arrived over the
+   * wire is a rendering hint and nothing more.
+   */
+  admin: boolean;
   /** Whether `POST` to this endpoint can sign somebody in on this deployment. */
   passwordLogin: boolean;
 }
@@ -71,6 +81,14 @@ const RATE_LIMITED: ErrorBody = {
 
 const MAX_USERNAME_LENGTH = 256;
 
+/**
+ * What `DELETE` reports. Signing out drops the tier with the session, and it
+ * has to be said explicitly rather than left to the client: a page that cached
+ * `admin: true` and only ever hears "authenticated: false" would keep drawing
+ * the god-only controls until the next reload.
+ */
+const SIGNED_OUT: Viewer = { authenticated: false, subject: null, admin: false };
+
 export function registerSession(app: FastifyInstance, services: Services): void {
   const { auth } = services.config;
   // Per app instance rather than per module, so two servers in one process —
@@ -82,7 +100,7 @@ export function registerSession(app: FastifyInstance, services: Services): void
 
   app.get("/api/v1/session", async (req) => {
     const viewer = await services.auth.resolve(req);
-    return body(viewer.authenticated, viewer.subject, auth.passwordLogin !== null);
+    return body(viewer, auth.passwordLogin !== null);
   });
 
   app.post("/api/v1/session", async (req, reply) => {
@@ -118,7 +136,16 @@ export function registerSession(app: FastifyInstance, services: Services): void
     limiter.succeed(req.ip);
     const token = issueSessionToken(auth, login.username, login.sessionTtlSeconds);
     reply.header("set-cookie", sessionCookie(auth, token, login.sessionTtlSeconds));
-    return body(true, login.username, true);
+    // The real grant for the account that just signed in, not `false` and not a
+    // guess. `issueSessionToken` put `login.username` in the `sub` claim, so
+    // `grantsAdmin` is being asked the same question about the same string that
+    // `resolve()` will ask on the very next request with this cookie — a login
+    // that answered differently from the GET a moment later would be a flicker
+    // nobody could reproduce.
+    return body(
+      { authenticated: true, subject: login.username, admin: grantsAdmin(auth, login.username) },
+      true,
+    );
   });
 
   // Signing out is available in every mode, including the ones where this box
@@ -126,12 +153,22 @@ export function registerSession(app: FastifyInstance, services: Services): void
   // something about how the deployment is configured and helps nobody.
   app.delete("/api/v1/session", async (_req, reply) => {
     reply.header("set-cookie", clearedSessionCookie(auth));
-    return body(false, null, auth.passwordLogin !== null);
+    return body(SIGNED_OUT, auth.passwordLogin !== null);
   });
 }
 
-function body(authenticated: boolean, subject: string | null, passwordLogin: boolean): SessionBody {
-  return { authenticated, subject, passwordLogin };
+/**
+ * The one place the session shape is written. All three handlers go through it,
+ * so `admin` cannot be present on one response and missing from another — which
+ * is the bug a client's `s.admin === true` would read as "demoted" and act on.
+ */
+function body(viewer: Viewer, passwordLogin: boolean): SessionBody {
+  return {
+    authenticated: viewer.authenticated,
+    subject: viewer.subject,
+    admin: viewer.admin,
+    passwordLogin,
+  };
 }
 
 /**