feat: Draw Steel system module with dynamic Foundry sync and admin CORS management

Draw Steel System Module:
- Full manifest with 24 character fields and Foundry path annotations
- foundry_actor_type: "hero" matching Draw Steel's actor type
- Creature preset with EV, role, and Draw Steel-specific combat fields
- CC-BY reference data: 8 abilities, 6 creatures, 10 ancestries, 6 kits

Dynamic Actor Type Support:
- Added foundry_actor_type to manifest system (EntityPresetDef + API response)
- Generic adapter reads actor type from character-fields API
- actor-sync.mjs uses adapter's actorType instead of hardcoded 'character'
- All existing adapters (dnd5e, pf2e) updated with actorType exports

CORS Origin Whitelist:
- Dynamic CORS middleware reads allowed origins from site_settings DB table
- Admin API endpoints (GET/POST /admin/api/cors) for managing origins
- CORS management card added to sync admin dashboard
- Settings service with validation for origin URLs

Bug Fixes:
- Fixed SYSTEM_MAP_FALLBACK key: 'draw-steel' instead of 'drawsteel'
- Fixed hardcoded actor type checks throughout actor-sync.mjs

https://claude.ai/code/session_01NnKM8NqJzGz8756CZ4PEGg

Author: claude

.ai/status.md

@@ -8,7 +8,13 @@
 <!-- ====================================================================== -->
 
 ## Last Updated
-2026-03-17 -- **Sprint: F-6 Armory/Inventory, F-7 Shop Enhancement, Sync Dashboard, Foundry Config.**
+2026-03-17 -- **Sprint: Draw Steel System Module + Foundry Infrastructure Fixes.**
+
+44. **Sprint: Draw Steel System Module + Infrastructure.**
+    - **Draw Steel System (COMPLETE)** — Full manifest expansion: 24-field character preset with Foundry path annotations, creature preset with EV/role/role_type, kit preset. Reference data: 8 abilities, 6 creatures, 10 ancestries, 6 kits (CC-BY-4.0). Status changed from `coming_soon` to `available`.
+    - **Dynamic Foundry Actor Types (COMPLETE)** — Added `foundry_actor_type` to `EntityPresetDef` struct and `CharacterFieldsResponse` API. Draw Steel uses `"hero"` (not `"character"`). Generic adapter reads `actorType` from API. `actor-sync.mjs` uses `this._actorType` everywhere instead of hardcoded `'character'`.
+    - **CORS Admin Whitelist (COMPLETE)** — `cors.allowed_origins` in `site_settings`. `GetCORSOrigins()`/`UpdateCORSOrigins()` on SettingsService. CORS middleware accepts `DynamicOrigins` function that reads from DB. Admin UI on `/admin/api` page with textarea for managing origins. Fixes Foundry VTT CORS-blocked connections.
+    - **SYSTEM_MAP_FALLBACK Fix (COMPLETE)** — Changed `drawsteel` key to `'draw-steel'` to match the Foundry system ID.
 
 43. **Sprint: F-6 + F-7 (Armory, Inventory, Transactions, Shop Enhancement).**
     - **A-2: Chronicle Sync Dashboard Expansion (COMPLETE)** — Owner API Keys page expansion with sync status overview, mappings table, error display. Admin API Monitor expansion with per-campaign sync stats.

.ai/todo.md

@@ -313,7 +313,7 @@ is truly modular and self-service._
 ### Deferred to Phase S+ (or community contributions)
 
 - [ ] **Module Builder UI** — Guided wizard that helps users create custom game system modules through the web UI. Step-by-step: name/metadata → define categories → define fields per category → paste/upload reference data → preview tooltips → export as module directory. Eliminates need to hand-write manifest.json + data files.
-- [ ] Draw Steel module (system data + Foundry adapter)
+- [x] Draw Steel module (system data + Foundry adapter)
 - [ ] Dagger Heart module (system data + Foundry adapter)
 - [ ] Whiteboards / freeform canvas (Tldraw/Excalidraw)
 - [ ] Offline mode / service worker caching

foundry-module/scripts/actor-sync.mjs

@@ -9,8 +9,9 @@
  * - Chronicle → Foundry: Entity changes arrive via WebSocket, create/update Actor.
  * - Foundry → Chronicle: Actor changes detected via Hooks, push to Chronicle API.
  *
- * System-specific field mapping is delegated to adapter modules
- * (dnd5e-adapter.mjs, pf2e-adapter.mjs).
+ * System-specific field mapping is delegated to adapter modules. The adapter's
+ * actorType property (e.g., "character" for D&D 5e, "hero" for Draw Steel)
+ * determines which Foundry actor type to sync.
  */
 
 import { getSetting } from './settings.mjs';
@@ -45,6 +46,15 @@ export class ActorSync {
     this._onDeleteActor = this._handleDeleteActor.bind(this);
   }
 
+  /**
+   * Returns the Foundry actor type this sync handles (from the adapter).
+   * Defaults to "character" if no adapter is loaded.
+   * @returns {string}
+   */
+  get _actorType() {
+    return this._adapter?.actorType || 'character';
+  }
+
   /**
    * Initialize the actor sync module.
    * Loads the appropriate system adapter and registers hooks.
@@ -73,7 +83,7 @@ export class ActorSync {
     Hooks.on('updateActor', this._onUpdateActor);
     Hooks.on('deleteActor', this._onDeleteActor);
 
-    console.log(`Chronicle: Actor sync initialized (adapter: ${this._adapter.systemId})`);
+    console.log(`Chronicle: Actor sync initialized (adapter: ${this._adapter.systemId}, actorType: ${this._actorType})`);
   }
 
   /**
@@ -172,6 +182,7 @@ export class ActorSync {
   /**
    * Handle a new character entity from Chronicle.
    * Creates a new Foundry Actor if one isn't already linked.
+   * Uses the adapter's actorType to create the correct type (e.g., "hero").
    * @param {object} entity
    * @private
    */
@@ -187,7 +198,7 @@ export class ActorSync {
 
       const actorData = {
         name: entity.name,
-        type: 'character',
+        type: this._actorType,
         flags: {
           [FLAG_SCOPE]: {
             entityId: entity.id,
@@ -309,7 +320,7 @@ export class ActorSync {
 
   /**
    * Handle Foundry createActor hook.
-   * Only processes character-type actors created by the current user.
+   * Only processes actors matching the adapter's actorType.
    * @param {Actor} actor
    * @param {object} options
    * @param {string} userId
@@ -318,7 +329,7 @@ export class ActorSync {
   async _handleCreateActor(actor, options, userId) {
     if (this._syncing) return;
     if (userId !== game.user.id) return;
-    if (actor.type !== 'character') return;
+    if (actor.type !== this._actorType) return;
     if (!this._adapter || !this._characterTypeId) return;
 
     // Skip if already linked (came from Chronicle).
@@ -369,7 +380,7 @@ export class ActorSync {
   async _handleUpdateActor(actor, change, options, userId) {
     if (this._syncing) return;
     if (userId !== game.user.id) return;
-    if (actor.type !== 'character') return;
+    if (actor.type !== this._actorType) return;
     if (!this._adapter) return;
 
     const entityId = actor.getFlag(FLAG_SCOPE, 'entityId');
@@ -537,13 +548,16 @@ export class ActorSync {
 
   /**
    * Get all synced actors with their status for dashboard display.
+   * Filters by the adapter's actor type so Draw Steel shows heroes,
+   * D&D 5e shows characters, etc.
    * @returns {Array<{id: string, name: string, entityId: string|null, synced: boolean, lastSync: string|null}>}
    */
   getSyncedActors() {
     if (!this._adapter) return [];
 
+    const targetType = this._actorType;
     return game.actors.contents
-      .filter((a) => a.type === 'character')
+      .filter((a) => a.type === targetType)
       .map((a) => {
         const entityId = a.getFlag(FLAG_SCOPE, 'entityId') || null;
         const lastSync = a.getFlag(FLAG_SCOPE, 'lastSync') || null;

foundry-module/scripts/adapters/dnd5e-adapter.mjs

@@ -17,6 +17,12 @@ export const systemId = 'dnd5e';
  */
 export const characterTypeSlug = 'dnd5e-character';
 
+/**
+ * The Foundry VTT actor type that corresponds to characters.
+ * @type {string}
+ */
+export const actorType = 'character';
+
 /**
  * Extract Chronicle-compatible fields_data from a Foundry dnd5e Actor.
  * Reads from the Actor's system data paths and returns a flat object

foundry-module/scripts/adapters/generic-adapter.mjs

@@ -56,6 +56,14 @@ export async function createGenericAdapter(api, chronicleSystemId) {
     /** Character entity type slug from the manifest. */
     characterTypeSlug: fieldDefs.preset_slug || `${chronicleSystemId}-character`,
 
+    /**
+     * Foundry actor type string from the manifest (e.g., "character", "hero").
+     * Different game systems use different actor types — D&D 5e uses "character",
+     * Draw Steel uses "hero". Defaults to "character" if not specified.
+     * @type {string}
+     */
+    actorType: fieldDefs.foundry_actor_type || 'character',
+
     /**
      * Extract Chronicle-compatible fields_data from a Foundry Actor.
      * Reads each mapped field from the actor using its foundry_path.

foundry-module/scripts/adapters/pf2e-adapter.mjs

@@ -17,6 +17,12 @@ export const systemId = 'pathfinder2e';
  */
 export const characterTypeSlug = 'pf2e-character';
 
+/**
+ * The Foundry VTT actor type that corresponds to characters.
+ * @type {string}
+ */
+export const actorType = 'character';
+
 /**
  * Extract Chronicle-compatible fields_data from a Foundry pf2e Actor.
  * PF2e stores ability modifiers rather than raw scores. It uses

foundry-module/scripts/sync-manager.mjs

@@ -18,7 +18,7 @@ import { getSetting, setSetting, isConfigured, getSyncDirections, getExcludedTag
 const SYSTEM_MAP_FALLBACK = {
   dnd5e: 'dnd5e',
   pf2e: 'pathfinder2e',
-  drawsteel: 'drawsteel',
+  'draw-steel': 'drawsteel',
 };
 
 /**

internal/app/app.go

@@ -5,6 +5,7 @@ package app
 
 import (
 	"archive/zip"
+	"context"
 	"database/sql"
 	"encoding/json"
 	"errors"
@@ -15,6 +16,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	"github.com/labstack/echo/v4"
 	echomw "github.com/labstack/echo/v4/middleware"
@@ -25,6 +27,7 @@ import (
 	"github.com/keyxmakerx/chronicle/internal/database"
 	"github.com/keyxmakerx/chronicle/internal/extensions"
 	"github.com/keyxmakerx/chronicle/internal/middleware"
+	"github.com/keyxmakerx/chronicle/internal/plugins/settings"
 	"github.com/keyxmakerx/chronicle/internal/templates/pages"
 )
 
@@ -133,9 +136,23 @@ func (a *App) setupMiddleware() {
 
 	// CORS -- allow cross-origin requests for the REST API.
 	// Only relevant for external clients (Foundry VTT module, etc.).
+	// BaseURL is always allowed. Additional origins are loaded dynamically
+	// from site_settings (managed by admin via /admin/api/cors).
+	settingsRepo := settings.NewSettingsRepository(a.DB)
+	settingsSvc := settings.NewSettingsService(settingsRepo)
 	a.Echo.Use(middleware.CORS(middleware.CORSConfig{
 		AllowedOrigins:   []string{a.Config.BaseURL},
 		AllowCredentials: true,
+		DynamicOrigins: func() []string {
+			ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+			defer cancel()
+			origins, err := settingsSvc.GetCORSOrigins(ctx)
+			if err != nil {
+				slog.Warn("failed to load dynamic CORS origins", slog.Any("error", err))
+				return nil
+			}
+			return origins
+		},
 	}))
 
 	// CSRF -- double-submit cookie pattern on all state-changing requests.

internal/app/routes.go

@@ -1001,6 +1001,7 @@ func (a *App) RegisterRoutes() {
 	syncMappingRepoEarly := syncapi.NewSyncMappingRepository(a.DB)
 	syncMappingSvcEarly := syncapi.NewSyncMappingService(syncMappingRepoEarly)
 	syncHandler.SetSyncMappingService(syncMappingSvcEarly)
+	syncHandler.SetCORSOriginLister(settingsService)
 	if a.PluginHealth.IsHealthy("syncapi") {
 		syncapi.RegisterAdminRoutes(adminGroup, syncHandler)
 		syncapi.RegisterCampaignRoutes(e, syncHandler, campaignService, authService)

internal/middleware/cors.go

@@ -19,6 +19,11 @@ type CORSConfig struct {
 	// and auth headers in cross-origin requests. Required for session-based
 	// auth from a different origin (e.g., Foundry VTT module).
 	AllowCredentials bool
+
+	// DynamicOrigins is an optional function that returns additional allowed
+	// origins at runtime. Called per-request to support admin-managed origin
+	// whitelists stored in the database. May return nil.
+	DynamicOrigins func() []string
 }
 
 // CORS returns middleware that handles Cross-Origin Resource Sharing headers.
@@ -31,14 +36,14 @@ type CORSConfig struct {
 // all requests are same-origin. But the API must support cross-origin access for
 // external integrations.
 func CORS(cfg CORSConfig) echo.MiddlewareFunc {
-	// Build a set for fast origin lookup.
+	// Build a set for fast origin lookup of static origins.
 	allowAll := false
-	originSet := make(map[string]bool)
+	staticOrigins := make(map[string]bool)
 	for _, o := range cfg.AllowedOrigins {
 		if o == "*" {
 			allowAll = true
 		}
-		originSet[o] = true
+		staticOrigins[o] = true
 	}
 
 	// SECURITY: Wildcard origin with credentials is a dangerous misconfiguration.
@@ -60,8 +65,16 @@ func CORS(cfg CORSConfig) echo.MiddlewareFunc {
 				return next(c)
 			}
 
-			// Check if the origin is allowed.
-			allowed := allowAll || originSet[origin]
+			// Check if the origin is allowed: static list first, then dynamic.
+			allowed := allowAll || staticOrigins[origin]
+			if !allowed && cfg.DynamicOrigins != nil {
+				for _, o := range cfg.DynamicOrigins() {
+					if o == origin {
+						allowed = true
+						break
+					}
+				}
+			}
 			if !allowed {
 				// Origin not in whitelist -- proceed without CORS headers.
 				// The browser will block the response on the client side.