- Credentials provider now resolves two distinct accounts from env:
SUPERADMIN_USERNAME / SUPERADMIN_PASSWORD → role "superadmin"
ADMIN_USERNAME / ADMIN_PASSWORD → role "admin"
The role is carried through the JWT and Session callbacks so the UI
and API can gate on it. Types extended via types/next-auth.d.ts.
- lib/auth.ts exports requireRole(minRole) and sessionRole(session).
- /api/players POST rejects "op" and "deop" with 403 unless the caller
is superadmin. All other player actions (whitelist add/remove, ban,
pardon) remain available to both roles.
- lib/use-role.ts (client hook) exposes role / isSuperadmin / authed
for UI gating without duplicating session typing.
- PlayerManager: Add-OP button and per-row Deop action are hidden or
disabled for non-superadmin; when a regular admin is viewing the
Ops tab, a banner explains the read-only state.
- PlayerDrawer: Make Op / Deop button disabled with tooltip for
non-superadmin; whitelist, ban, pardon unchanged.
- Navbar: subtle role pill next to the user name ("Super" for
superadmin amber-tinted, "Admin" for admin).
- Migration note: the existing ADMIN_* credentials now log in as the
restricted admin role. Set SUPERADMIN_USERNAME + SUPERADMIN_PASSWORD
in .env.local to retain operator-management ability. A placeholder
superadmin account was generated in .env.local; the password is in
the commit terminal output only, not the repo.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- lib/player-stats.ts: single computePlayerStats() reads every
world/stats/<uuid>.json plus world/advancements/<uuid>.json and joins
with usercache.json. Returns a flat PlayerStats record per player:
playtime, longest life, mob/player kills, deaths, K/D, damage dealt
and taken (HP-scaled), blocks mined, items used / crafted / picked up
(+ unique), distance (summed across all _one_cm stats), chest opens,
nether/end trips, villager trades, fish caught, animals bred, and
advancements (non-recipe) / recipes unlocked.
- New GET /api/players/stats (authed, 60s memo). Existing
/api/players/playtime now returns a thin projection of the same
computed data (shared cache key keeps both endpoints cheap).
- New components/Leaderboard.tsx with a metric select grouped into
Time / Combat / World / Exploration / Progression / Economy (22
metrics). Sorts descending, top 10 with "show all" toggle, smart
number formatting (1.2k / 3.4M / HP / km). Replaces the old
PlaytimeLeaderboard in the Players tab.
- PlayerDrawer upgraded: uses the full stats payload, shows small
tiles for Kills / Deaths / K/D / Advs / Mined / Crafted / Distance
alongside Playtime + Last seen.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- New GET /api/players/playtime (authed): reads each vanilla stats file
under /home/minecraft/server/world/stats and maps uuid→name via
usercache.json. Returns playtime in ticks and hours, plus file mtime
as "last seen". Memoized 60s via lib/cache#memoAsync.
- New PlaytimeLeaderboard card in the Players tab:
- Rank, avatar (click → PlayerDrawer), relative last-seen, hours.
- Top 10 by default with toggle to show all; combined hours badge.
- PlayerDrawer surfaces the player's total hours + last-seen using the
same cached playtime query, plus fills in UUID if the player is not
in ops/whitelist/banned.
- lib/time.ts: formatHours() — minutes under 1h, "H.Hh" under a day,
"Dd Hh" above.
- Analytics sparklines gain hover/touch tooltips:
- Timestamps threaded through from each MetricEntry.
- SVG overlay captures onMouseMove/onTouchMove, computes nearest
index by x, draws a dashed guide line + focus dot.
- Floating tooltip shows HH:MM + formatted value with unit; edge
clamping keeps it in-frame at the extremes.
- Per-chart formatValue so RAM shows GB, CPU 0 decimals, Players
integer, TPS 1 decimal. Keeps the peak-player marker intact.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Bundle analyzer: @next/bundle-analyzer wired through next.config.ts,
new `bun run analyze` script (ANALYZE=true next build).
- Scheduled tasks gain:
- enabled flag round-tripped via a #DISABLED prefix on the crontab line
(preserves the mc-task marker + payload for re-enable).
- PATCH /api/schedule/tasks to toggle enabled.
- POST /api/schedule/tasks/run to execute a task immediately via
the same buildCommand used for the cron line (60s timeout, kills
child on client abort).
- Weekly preset in the UI (day-of-week selector), broader aria-labels
on all form selects. Human-readable cron renders "Tue at 04:30"
and next-run calc accounts for weekly.
- Hover-reveal Run now / Enable / Disable / Remove actions; disabled
tasks render at 60% opacity with a "disabled" badge and no next-run.
- /api/errors: minimal append-only JSONL reporter (200ms throttle, UA
and IP captured, fields length-bounded). Falls back to a stable
path under /home/minecraft/logs/ and never fails the client on
logging errors.
- ErrorReporter client (production-only) listens to window.error and
unhandledrejection, fingerprint-dedups via a bounded in-memory set,
sends with keepalive so unloads still flush.
- app/opengraph-image.tsx: 1200x630 dynamic PNG with live status dot
(green/red), player count, address. 60s memo on the status probe.
- A11y: aria-labels on log-line count select, scheduled-restart hour
and minute selects, copy-server-address button (plus focus-visible
ring). ModManager selected-mod pill upgraded to role=button with a
real accessible name and a proper × glyph.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- scripts/run-task.sh: dispatcher for say / backup / snapshot-prune with
safe arg handling (message stripped of CR/LF, integer-clamped keep
count). Logs to ~/logs/mc-dashboard/tasks.log (falls back to /tmp).
- New /api/schedule/tasks GET/POST/DELETE route: stores tasks as
crontab lines with `# mc-task:<base64(json)>` marker so the UI can
round-trip them. Strict server-side validation:
- Cron expression regex (5 fields, * / N / N-N / N,N / */N)
- say message: 1–120 chars, no newlines/backticks/shell quotes
- snapshot-prune keep: integer 1–50
- task id: 16-hex only
Single-quote-escaped message in the generated shell command.
- ScheduledTasks UI under ServerControls (alongside the existing single
ScheduledRestart): pick type (Announce / Backup / Prune snapshots),
preset schedule (daily at HH:MM or every N hours), adds with one
click. Tasks list shows human-readable schedule + "next in Xh" hint
computed client-side. Hover-reveal Remove action.
- Admin keyboard shortcuts: when not typing,
r — refetch the active tab's query keys (toast feedback)
/ — focus the first input/contenteditable in the active panel
? — toast the shortcuts cheat sheet
Chord-free, mirrors existing ⌘K palette and Esc handlers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- New /api/events SSE endpoint (authed): pushes status every 5s and chat
on log-file mtime change (~1.5s poll). Heartbeat every 15s, hard-caps
each stream at 10min so the browser gets a clean auth refresh on
reconnect. Auto-aborts on client disconnect.
- Factored shared helpers out of the existing routes:
- lib/server-status.ts (probeStatus, reused by /api/status + SSE)
- lib/chat-log.ts (parseLogLine, readChatMessages, logMtime, reused by
/api/chat + SSE)
- EventsBridge client (mounted in Providers) opens one EventSource per
authed session and writes live data into the TanStack Query cache for
["status"] and ["chat"] — no refactor needed in consuming components,
they keep reading their usual query keys.
- Now that SSE pushes updates, polling intervals bumped: StatusCard and
ServerControls 10s -> 60s, ChatBridge 5s -> 30s. SSE handles realtime,
polling is safety fallback.
- OfflineBanner: sticky amber bar when navigator.onLine flips false.
- PWA: minimal public/sw.js with shell + asset cache (network-first for
HTML, stale-while-revalidate for static assets, never touches /api/*
or text/event-stream). ServiceWorkerRegister client registers it in
production only.
- AdminTabs now uses next/dynamic with skeleton fallbacks for Players /
Chat / Mods / Backups / Logs, keeping initial /admin bundle smaller.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Snapshots now include recursive sizeBytes (lib/snapshots.ts dirSize),
rendered as a badge next to mod count.
- Snapshot restore/delete is now type-to-confirm: click Restore/Delete,
type the literal snapshot name, press Enter or click Confirm. Esc
cancels, matches the existing wizard Esc handler.
- Analytics card:
- Uptime ring showing % of datapoints with tps>0 (color-graded
green/amber/red) + numeric % over selected range.
- Peak-player marker dot on the Players sparkline + peak caption.
- "Online now" player list (up to 8) with small PlayerAvatar badges,
sourced from the latest analytics entry's players[] array.
- Player profile drawer (new):
- Slide-in right panel opened by clicking any PlayerAvatar.
- Shows Online / Op / Whitelisted / Banned badges, UUID, ban reason.
- Quick toggles for op/deop, whitelist add/remove, ban (with reason
input) and pardon — reuses /api/players POST contract.
- Global event bus (lib/events.ts) decouples avatars from drawer.
- Esc / backdrop / close-button dismiss.
- PlayerAvatar now renders as a <button> by default (stopPropagation on
click, focus-visible ring); pass interactive={false} to opt out (used
inside the drawer itself).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- New POST /api/mods/update SSE route: per-file Modrinth lookup → snapshot →
download latest → swap old jar → restart + verify (if server-side) →
rebuild modpack, with automatic rollback on any failure.
- ModManager: "Update" button next to each mod with an available update,
plus "Update all (N)" in the installed list header. Reuses the existing
install timeline UI (same event shape). SSE reader extracted as
consumeSSE helper.
- Error boundaries: app/error.tsx (scoped), app/admin/error.tsx (admin
subtree retry), app/not-found.tsx, app/global-error.tsx (hard-fail
fallback with inline styles, no app shell dependency).
- A11y sweep: aria-pressed + aria-label on LogViewer level chips and
ModManager side filter; aria-label on admin TabsList; skip-to-content
link in Navbar targeting <main id="main"> on public + admin pages;
role/aria-live on install/update timeline; global Esc in ModManager
clears open confirm prompts and exits search/review wizard steps.
- Command palette (cmdk): global Ctrl/⌘+K dialog mounted in Providers.
Navigate admin tabs, toggle theme, start/stop/restart server, create
backup, re-check mod updates, jump to any cached mod/player/snapshot/
backup. Auth-aware — public users see only Home / Log in / Theme.
- AdminTabs listens to hashchange so palette navigation updates the
active tab live.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Install sonner; <Toaster> mounted in Providers, auto-tracks theme.
- Toasts replace inline result Alerts across ServerControls, PlayerManager,
BackupManager, ModManager (install/remove/restore/delete/start/stop).
- PlayerManager: optimistic op/deop/whitelist/ban/pardon via onMutate +
rollback; UI updates instantly before RCON round-trip.
- Modrinth search results now show author + "updated Xd ago" with full
timestamp on hover; downloads on its own row.
- New /api/mods/updates endpoint: per-installed-mod Modrinth latest-version
lookup (parallel, 30min memo). Amber "Update available" badge rendered
next to installed mod rows when filenames differ.
- PlayerAvatar + Modrinth icons migrated to next/image (unoptimized, size
hints) — fewer layout shifts.
- Login page surfaces ?error= + NextAuth error codes (CredentialsSignin,
SessionRequired, etc.), preserves callbackUrl, adds autocomplete hints
and role="alert". Wrapped in Suspense per Next 16 requirement.
- Snapshots + backups show relative "Xh ago" with exact timestamp on hover
via new lib/time.ts helper.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Admin page split into tabs (Server/Players/Chat/Mods/Backups/Logs) with
hash + localStorage persistence; inactive tabs no longer mount.
- Log viewer: level color-coding, search, level filter chips, auto-scroll
toggle, copy button, visible-line count.
- Installed mods list: search field + side filter (all/both/server/client)
with live count; public ModList gets skeleton + empty states and search.
- Theme toggle with no-flash inline init, localStorage + system preference.
- Layout: full OG / Twitter metadata, title template, keywords,
dual-theme themeColor, metadataBase.
- lib/mods.ts: per-jar mtime+size parse cache (cold 6s -> warm ~45ms on
/api/mods for the full mod list); cache eviction on mod removal.
- ChatBridge polling eased 3s -> 5s with 2s stale window.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Next.js 16 + Tailwind v4 + shadcn v4 dashboard for managing a modded
Forge 1.20.1 server. Includes server controls, player management, mod
manager with Modrinth search and dependency resolution, world backups,
snapshots, analytics, logs, and chat bridge.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
