Summer Patch Going Live

.clj-kondo/config.edn

@@ -3,7 +3,25 @@
  :exclude-files "resources/public/js/compiled"
  :output {:exclude-files [".*resources/public/js/compiled.*"
                           ".*docker/scripts/.*"]}
- :linters {;; Enabled at :warning so NEW accidental shadows are caught.
+ :linters {;; A BLANK ENVIRONMENT VALUE IS AN ABSENT ONE, and (or (env :k) default)
+           ;; does not implement that: environ returns "" for an exported-but-empty
+           ;; variable and "" is truthy, so the default never applies. That shape
+           ;; was written independently at five sites and cost, among others, JWTs
+           ;; signed and verified against the empty string.
+           ;;
+           ;; orcpub.config already had a correct accessor and routes.clj read
+           ;; (environ/env :signature) raw anyway, four times -- which is why this
+           ;; is a lint rule and not just a helper. Read through orcpub.env/value.
+           ;; :error, not :warning -- `lein lint` runs with --fail-level error, so
+           ;; this is the difference between a rule and a suggestion. The helper
+           ;; it points at already existed once and was bypassed.
+           :discouraged-var
+           {:level :error
+            environ.core/env
+            {:message "Use orcpub.env/value -- (or (env :k) d) treats an empty value as set. See orcpub.env."}
+            java.lang.System/getenv
+            {:message "Use orcpub.env/value -- environ already reads env vars, and this skips the blank check."}}
+           ;; Enabled at :warning so NEW accidental shadows are caught.
            ;; :exclude covers established patterns: core vars used as param names
            ;; (name, key, type, etc.) and domain terms used as both defs and params
            ;; (level, ability, armor, etc.) across modifier/option/character code.
@@ -79,6 +97,13 @@
            :unresolved-symbol
            {:exclude
             [read-string
+             ;; test macros that bind their first argument -- clj-kondo cannot
+             ;; see through them, so each use reads as an unresolved symbol
+             (orcpub.portrait-credit-test/with-conn)
+             (orcpub.portrait-og-test/with-conn)
+             (orcpub.portrait-artists-endpoint-test/with-conn)
+             (orcpub.portrait-store-test/with-conn)
+             (orcpub.page-escape-test/with-conn)
              (clojure.test.check.clojure-test/defspec)
              (clojure.core.match/match)
              (cljs.core.match/match)
@@ -98,6 +123,7 @@
              (orcpub.dnd.e5.modifiers/skill-expertise)
              (orcpub.dnd.e5.modifiers/tool-expertise)
              (orcpub.dnd.e5.modifiers/ac-bonus-fn)
+             (orcpub.dnd.e5.modifiers/ac-formula)
              (orcpub.dnd.e5.modifiers/attack)
              (orcpub.dnd.e5.modifiers/action)
              (orcpub.dnd.e5.modifiers/bonus-action)
@@ -107,10 +133,27 @@
              (orcpub.routes-test/with-conn)
              (orcpub.routes.folder-test/with-conn)
              (orcpub.email-change-test/with-conn)
+             (orcpub.routes.public-reads-test/with-conn)
+             (orcpub.routes.item-save-test/with-conn)
+             (orcpub.routes.share-test/with-conn)
+             (orcpub.routes.party-test/with-conn)
+             (orcpub.heartbeat-test/with-conn)
+             (orcpub.artist-accounts-test/with-conn)
+             (orcpub.artist-credit-test/with-conn)
              (user/with-db)]}}
  ;; native/cljs and web/cljs are separate source roots; kondo doesn't know
  ;; about them so ns names appear to mismatch their file paths.
- :config-in-ns {orcpub.core {:linters {:namespace-name-mismatch {:level :off}}}
+ ;; orcpub.env is the one place allowed to read the environment; the whole
+ ;; point of the namespace is to be the single exception.
+ :config-in-ns {orcpub.env {:linters {:discouraged-var {:level :off}}}
+                ;; These two STUB environ.core/env with with-redefs, which is how
+                ;; you test the accessor and the locale behaviour at all -- kondo
+                ;; counts the var reference as a use. Exempted by namespace rather
+                ;; than for all of test/, so an ordinary bare read in a test is
+                ;; still an error (routes_test.clj had one).
+                orcpub.env-test {:linters {:discouraged-var {:level :off}}}
+                orcpub.config-test {:linters {:discouraged-var {:level :off}}}
+                orcpub.core {:linters {:namespace-name-mismatch {:level :off}}}
                 orcpub.views {:linters {:namespace-name-mismatch {:level :off}}}
                 orcpub.dnd.e5.native-views {:linters {:namespace-name-mismatch {:level :off}}}}
  ;; with-conn macros use bare symbol bindings — handled via

.coderabbit.yaml

@@ -0,0 +1,7 @@
+# CodeRabbit settings for the codeGlaze/orcpub fork only. Leave this file out of pull requests to
+# Orcpub/orcpub. Reviews are requested, never automatic: the allowance is small and shared by every
+# agent (all push as codeGlaze). Ask with `@coderabbitai full review` when a PR is ready.
+# CodeRabbit reads this file from the PR's own branch, so a branch made before a change keeps the old one.
+reviews:
+  auto_review:
+    enabled: false

.devcontainer/post-create.sh

@@ -15,12 +15,10 @@ set -euo pipefail
 
 # Source .env from repo root if present (authoritative config)
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-if [ -f "$REPO_ROOT/.env" ]; then
-  set -a
-  # shellcheck disable=SC1090
-  . "$REPO_ROOT/.env"
-  set +a
-fi
+# Read, never run: scripts/load-env.sh.
+# shellcheck source=scripts/load-env.sh
+. "$REPO_ROOT/scripts/load-env.sh"
+load_env "$REPO_ROOT/.env"
 
 # Redirect all output to persistent logs for visibility during Codespace creation
 LOG="/tmp/orcpub-post-create.log"

.dockerignore

@@ -7,7 +7,7 @@
 # Secrets — never copy into build context
 .env
 .lein-env
-logs/console.log
+logs/
 docker-compose*
 test/*
 *.md

.env.example

@@ -6,6 +6,9 @@
 #
 # Or run the setup script to generate .env with secure random values:
 #   ./run
+#
+# Each line is NAME=value, read exactly as written: spaces and apostrophes are fine without
+# quotes (APP_NAME=Dungeon Master's Vault). Quotes are optional. Use $$ for a literal $.
 # ============================================================================
 
 # --- Application ---
@@ -35,13 +38,32 @@ TZ=America/Chicago
 #   Old URLs with ?password= still work — the embedded password takes priority.
 ADMIN_PASSWORD=change-me-admin
 DATOMIC_PASSWORD=change-me-datomic
-DATOMIC_URL=datomic:dev://datomic:4334/orcpub
+# Left COMMENTED OUT on purpose, so that each way of running picks its own
+# correct value instead of inheriting the other's:
+#
+#   bare metal  -> config.clj/default-datomic-uri = datomic:dev://localhost:4334/orcpub
+#   docker      -> docker-compose.yaml already defaults it to the "datomic"
+#                  service hostname, which only resolves inside that network
+#
+# Setting it here would defeat both. Compose reads this .env for substitution,
+# so an uncommented localhost would override compose's own default and break
+# the container; an uncommented "datomic" hostname breaks every non-Docker
+# install, which is how it used to ship.
+#
+# Uncomment ONLY for a database somewhere else -- a remote transactor, a
+# non-default port, or Datomic SQL storage:
+#   DATOMIC_URL=datomic:dev://localhost:4334/orcpub
+#   DATOMIC_URL=datomic:sql://orcpub?jdbc:postgresql://db:5432/datomic
 
 # --- Transactor Tuning ---
 # These rarely need changing. See docker/transactor.properties.template.
-# ALT_HOST: peer fallback hostname (default: 127.0.0.1, set to service name for Swarm)
+# TRANSACTOR_HOST: address the transactor serves on and gives the app
+#   (Compose: datomic; the Swarm stack from ./run --swarm: 0.0.0.0)
+# ALT_HOST: the second address the app tries (Compose: 127.0.0.1; Swarm stack: datomic)
+# Both default to the right value for each; set them only to override.
 # ENCRYPT_CHANNEL: encrypt peer-transactor communication (default: true)
-ALT_HOST=127.0.0.1
+# TRANSACTOR_HOST=
+# ALT_HOST=
 ENCRYPT_CHANNEL=true
 # Password rotation — set OLD vars during rotation, remove after all peers reconnect
 # ADMIN_PASSWORD_OLD=
@@ -55,11 +77,22 @@ SIGNATURE=change-me-to-something-unique-and-long
 # Content Security Policy (strict|permissive|none)
 CSP_POLICY=strict
 
-# Dev mode: CSP violations are logged (Report-Only) instead of blocked,
-# allowing Figwheel hot-reload scripts to execute.
+# Dev mode: no CSP header is sent at all, so Figwheel's scripts and its
+# websocket (ws://localhost:3449) work. Leave this true for development.
+# With DEV_MODE unset or false, CSP_POLICY=strict sends an ENFORCING policy
+# whose connect-src does not include the Figwheel socket, and hot reload is
+# blocked with no obvious cause.
 # Must be the string "true" (case-insensitive). Any other value is treated as false.
 DEV_MODE=true
 
+# --- Proxies in front of the app ---
+# true only when the site is served through Cloudflare: limits and the security log then see each
+# player's real address. Leave unset otherwise, since anyone can send requests from Cloudflare.
+# TRUST_CLOUDFLARE=true
+# Extra proxies to trust (comma-separated addresses or ranges). Private networks, where Docker and
+# Swarm proxies sit, are always trusted.
+# TRUSTED_PROXIES=203.0.113.10,198.51.100.0/24
+
 # --- Plugins ---
 # URL to fetch server-hosted .orcbrew plugins on first page load.
 # Leave empty to disable (plugins come only from local file imports).
@@ -68,6 +101,16 @@ DEV_MODE=true
 # --- Logs ---
 # Defaults to project logs/ if unset
 LOG_DIR=
+# Docker: the app keeps crash files and unsent admin alerts in /var/log/<this name> on the host,
+# on Compose and Swarm alike. A plain name only; default orcpub.
+# APP_LOGS_NAME=orcpub
+# Docker: each container keeps at most this many log files of this size. Defaults 5 of 10m.
+# LOG_MAX_SIZE=10m
+# LOG_MAX_FILES=5
+
+# --- App memory (Docker) ---
+# Java's memory options for the app. Empty: it uses 25% of its container's memory.
+# JAVA_OPTS=-XX:MaxRAMPercentage=75.0
 
 # --- Remote Dev (optional) ---
 # Figwheel WebSocket port for hot-reload (default: 3449)
@@ -79,29 +122,123 @@ LOG_DIR=
 # FIGWHEEL_CONNECT_URL=
 
 # --- Email (SMTP) ---
-# Leave EMAIL_SERVER_URL empty to disable email functionality
+# EMAIL_SERVER_URL empty means this deployment cannot send mail, and registration
+# then REFUSES to create accounts -- deliberately, because a dropped or typo'd
+# value would otherwise silently turn a public site into open registration.
+#
+# With EMAIL_SERVER_URL empty a deployed server (DEV_MODE not true) will not start
+# unless you say email is not needed: EMAIL_REQUIRED=false (sign-up stays off).
+# EMAIL_REQUIRED=
+#
+# To let people sign up without email, say so: ALLOW_UNVERIFIED_REGISTRATION=true.
+# Accounts are then verified on creation and no mail is ever sent. Only sensible
+# for a private instance where you hand out the accounts, since nobody proves
+# they own the address they typed.
 EMAIL_SERVER_URL=
 EMAIL_ACCESS_KEY=
 EMAIL_SECRET_KEY=
 EMAIL_SERVER_PORT=587
-EMAIL_FROM_ADDRESS=
+# MUST be an address your SMTP provider is authorised to send as (SPF/DKIM),
+# not just any address you own. Left blank it falls back to no-reply@example.com,
+# a placeholder no provider will deliver -- set it.
+EMAIL_FROM_ADDRESS=no-reply@example.com
+# Where admin alerts (server errors, crashes) are emailed. Empty: EMAIL_ADMIN_TO, then
+# APP_SUPPORT_EMAIL; with none set, alerts go to the server log only.
 EMAIL_ERRORS_TO=
 EMAIL_SSL=FALSE
 EMAIL_TLS=FALSE
 
+# Accept registrations without verifying the address. Requires EMAIL_SERVER_URL
+# to be empty; ignored otherwise. Private instances only.
+ALLOW_UNVERIFIED_REGISTRATION=false
+
+# --- Admin alerts (optional) ---
+# Where alerts wait when the mail server is down; they are sent once it is back. Default: a folder
+# in the system temp directory. In Docker, point it at a volume, or a replaced container loses them.
+# ALERT_SPOOL_DIR=/var/lib/orcpub/state/alerts
+# Most alert emails sent in an hour; past it they are only logged. Default 20.
+# ALERT_MAX_PER_HOUR=20
+
+# --- Preferred names and portrait artists ---
+# Encrypts the preferred names people give on My Account. Comma-separated id:key pairs, each
+# key 32 random bytes in base64; the first encrypts, all decrypt (put a new key first to
+# rotate). Keep it safe: lose it and stored names cannot be read. Without it, preferred
+# names cannot be saved. Generate: echo "k1:$(openssl rand -base64 32)"
+PROFILE_ENCRYPTION_KEYS=
+#
+# Portrait artist credits and accounts, as JSON (see ARTISTS.md). An "account" email gets an
+# artist account and a welcome email when the server starts, so leave real addresses out of
+# a test server unless that is wanted. Artist emails link to APP_URL (Branding, below).
+# PORTRAIT_ARTISTS={"house-pack": {"name": "Fusspot", "account": "artist@example.test"}}
+# Who hears about artist account changes (falls back to EMAIL_ERRORS_TO, then APP_SUPPORT_EMAIL).
+# EMAIL_ADMIN_TO=
+#
+# Where the server keeps its drawings of shared-link portraits (default: orcpub-portraits in the
+# system temp directory, which the Docker image's user can write). Point several containers at one shared volume and each portrait is
+# drawn once for all of them. They are derived files: deleting them only means they are drawn again.
+# Mount a shared volume at this path; the image creates it for the app's user.
+# PORTRAIT_STORE_DIR=/var/lib/orcpub/portraits
+
+# --- Capacity (optional) ---
+# Defaults suit most servers; see docs/ENVIRONMENT.md "Capacity" before raising them.
+# Requests of any kind handled at once. Default: Pedestal's own (50 on most machines).
+# ORCPUB_HTTP_MAX_THREADS=50
+# Character sheets generated at once. Default: 8, or twice the CPU cores if more.
+# ORCPUB_PDF_CONCURRENCY=8
+# How long an export waits for a free slot before the player is told to retry, in ms. Default 30000.
+# ORCPUB_PDF_QUEUE_TIMEOUT_MS=30000
+# How many times the busy page retries an export by itself before waiting for a click. Default 3.
+# ORCPUB_PDF_MAX_RETRIES=3
+# Most spellcasting sections one sheet can grow to. Default 13 (every class).
+# ORCPUB_PDF_MAX_CASTER_SECTIONS=13
+# Most cards of each kind one export prints, 9 to a page. Default 198 (22 pages).
+# ORCPUB_PDF_MAX_CARDS=198
+# Shared-link portrait images drawn at once. Default: half the CPU cores, at least 2.
+# ORCPUB_PORTRAIT_CONCURRENCY=2
+# How long a portrait image waits to be drawn before the request is refused, in ms. Default 5000.
+# ORCPUB_PORTRAIT_QUEUE_TIMEOUT_MS=5000
+
+# --- Share links and passwords (optional) ---
+# Largest compressed homebrew one character's share link keeps, in KB. Default 64.
+# ORCPUB_SHARE_MAX_UPLOAD_KB=64
+# Largest that homebrew may be once unpacked, in KB. Default 256.
+# ORCPUB_SHARE_MAX_TEXT_KB=256
+# Shared homebrew one account keeps across all its characters, in KB. Default 1024.
+# ORCPUB_SHARE_MAX_ACCOUNT_KB=1024
+# Days a share link may go unused before it is deleted (the character never is). 0 keeps them. Default 180.
+# ORCPUB_SHARE_PRUNE_DAYS=180
+# Check new passwords against known breaches (Have I Been Pwned). on or off. Default on.
+# ORCPUB_PWNED_CHECK=on
+
 # --- Branding (optional) ---
-# Override app identity for forks. All have sensible defaults in fork/branding.clj.
+# The site's name, logos, links and email identity. Each has a default in fork/branding.clj;
+# a value set here overrides it. See docs/BRANDING-AND-INTEGRATIONS.md.
+# Site name, used in titles, emails and the legal pages.
 # APP_NAME=Dungeon Master's Vault
+# Public address of the site; links in emails and share previews point here.
 # APP_URL=https://www.dungeonmastersvault.com
+# Logo in the header and splash page: a path on this site or a web address.
 # APP_LOGO_PATH=/image/dmv-logo.svg
+# Picture shown when a link to the site is shared on social media.
 # APP_OG_IMAGE=/image/dmv-box-logo.png
+# Name in the footer's copyright line, the year shown, and where the name links to.
 # APP_COPYRIGHT_HOLDER=Dungeon Master's Vault
 # APP_COPYRIGHT_YEAR=2026
+# APP_COPYRIGHT_URL=https://www.dungeonmastersvault.com
+# Name emails come from, and who the friendlier emails are signed by.
 # APP_EMAIL_SENDER_NAME=Dungeon Master's Vault Team
+# APP_EMAIL_SIGNOFF=The Dungeon Master's Vault Team
+# Browser tab title, and the one-line description used in search and link previews.
 # APP_PAGE_TITLE=Dungeon Master's Vault
 # APP_TAGLINE=A D&D 5e character builder and resource compendium
+# Contact address shown to players and on the privacy page. Empty hides it.
 # APP_SUPPORT_EMAIL=thDM@dungeonmastersvault.com
+# Help link in the footer. Empty hides it.
 # APP_HELP_URL=https://www.dungeonmastersvault.com/help/
+# Longest a player may type: character notes, text fields, number fields. Defaults 50000, 255, 7.
+# APP_FIELD_LIMIT_NOTES=50000
+# APP_FIELD_LIMIT_TEXT=255
+# APP_FIELD_LIMIT_NUMBER=7
 
 # --- Social Links (optional) ---
 # Shown in app header. Leave empty to hide a link.