Skip to content

TFMCWeb: realm allow-list with the will routes (stage 6b) #213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ryanbarlow97 merged 2 commits into from
Oct 13, 2026
Merged

TFMCWeb: realm allow-list with the will routes (stage 6b) #213

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ee09f54
TFMCWeb: list the routes that get the realm injected
ryanbarlow97 Oct 13, 2026
d0ac2af
TFMCWeb: say callers must send their own realm, not a literal
ryanbarlow97 Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions projects/TFMCWeb/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,18 @@ patreon:

LuckPerms storage is shared, so set `apply-ranks: true` on exactly one server; leave it false elsewhere. See the [Patreon integration guide](../ProvinceSystem/docs/integrations/patreon.md) for the writer setup and operations.

## Realm on gateway requests

`ProvinceSystemGateway` adds this server's `realm.id` to allow-listed plugin routes. A request that already names `realm_id` (in the query, or at the top level of the JSON body) keeps its own value, so a plugin that sends its realm is never overridden. The gateway does not check that value, so callers must send `TFMCWeb.getRealmId()`, never a literal realm.

| Method | Route | `realm_id` goes in |
|---|---|---|
| GET | `/characters/plugin/pending`, `/skins/plugin/approved`, `/drinks/plugin/pending-apply`, `/characters/plugin/lore-items/pending`, `/characters/plugin/wills/pending` | query |
| PUT | `/characters/plugin/roster`, `/characters/plugin/rpc-player-meta` | body |
| POST | `/wars/declare-codes/validate`, `/wars/declare-codes/redeem`, `/characters/plugin/wills/applied` | body |

RPCharacters sends `realm_id=TFMCWeb.getRealmId()` itself on the will pull and ack; the allow-list is a second guard. Other routes pass through unchanged.

## Build and dependencies

Run Maven with **JDK 21** from the source checkout. The POM sets `maven.compiler.release=21` and resolves `io.papermc.paper:paper-api:1.21.10-R0.1-SNAPSHOT` with `provided` scope from the PaperMC Maven repository. The plugin descriptor declares `api-version: 1.21.10`.
Expand Down