murge

.github/workflows/assets.yml

@@ -25,32 +25,46 @@ jobs:
   assets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Check out code
+        uses: actions/checkout@v4
         with:
           submodules: recursive
-      - uses: actions/setup-node@v4
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+      - name: Setup node and restore pnpm cache
+        uses: actions/setup-node@v4
         with:
           node-version: 22
-      - uses: pnpm/action-setup@v4
-        with:
-          run_install: true
-      - uses: actions/checkout@v4
+          cache: 'pnpm'
+      - name: Install pnpm dependencies
+        run: pnpm install
+      - name: Checkout ab (optional)
+        uses: actions/checkout@v4
         with:
           repository: lichess-org/ab
           ssh-key: ${{ secrets.id_rsa_ab }}
           ref: master
           path: ab
-        continue-on-error: true
+        env:
+          HAS_AB: ${{ secrets.id_rsa_ab != '' }}
+        if: env.HAS_AB == 'true'
         id: ab
-      - run: node -v && pnpm -v && pnpm tsc -v
-      - run: pnpm link "$GITHUB_WORKSPACE/ab"
+      - name: Link ab (optional)
+        run: pnpm link "$GITHUB_WORKSPACE/ab"
         if: steps.ab.outcome == 'success'
-      - run: ./ui/build --no-install -p
-      - run: pnpm test
+      - name: Print tool versions
+        run: node -v && pnpm -v && cd ui/.build && pnpm tsc -v
+      - name: Build
+        run: ./ui/build --no-install -p
+      - name: Tests
+        run: pnpm test
         working-directory: ui
-      - run: mkdir assets && mv public assets/ && cp -p bin/download-lifat LICENSE COPYING.md README.md assets/ && git log -n 1 --pretty=oneline > assets/commit.txt
-      - run: cd assets && tar --zstd -cvpf ../assets.tar.zst . && cd -
-      - uses: actions/upload-artifact@v4
+      - name: Prepare asset dir
+        run: mkdir assets && mv public assets/ && cp -p bin/download-lifat LICENSE COPYING.md README.md assets/ && git log -n 1 --pretty=oneline > assets/commit.txt
+      - name: Tar assets
+        run: cd assets && tar --zstd -cvpf ../assets.tar.zst . && cd -
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
         with:
           name: lila-assets
           path: assets.tar.zst

.github/workflows/lint.yml

@@ -22,7 +22,7 @@ jobs:
           run_install: false
       - uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
           cache: 'pnpm'
       - uses: github/codeql-action/init@v3
         with:

.node-version

@@ -0,0 +1 @@
+v22.11.0

app/controllers/Auth.scala

@@ -18,8 +18,7 @@ final class Auth(
     accountC: => Account
 ) extends LilaController(env):
 
-  private def api   = env.security.api
-  private def forms = env.security.forms
+  import env.security.{ api, forms }
 
   private def mobileUserOk(u: UserModel, sessionId: String)(using Context): Fu[Result] = for
     povs  <- env.round.proxyRepo.urgentGames(u)

app/controllers/Coach.scala

@@ -8,7 +8,7 @@ import lila.user.Flags
 
 final class Coach(env: Env) extends LilaController(env):
 
-  private def api = env.coach.api
+  import env.coach.api
 
   def homeLang =
     LangPage(routes.Learn.index)(searchResults("all", CoachPager.Order.Login.key, "all", 1))

app/controllers/Event.scala

@@ -4,7 +4,7 @@ import lila.app.*
 
 final class Event(env: Env) extends LilaController(env):
 
-  private def api = env.event.api
+  import env.event.api
 
   def show(id: String) = Open:
     FoundPage(api.oneEnabled(id))(views.event.show)

app/controllers/Mod.scala

@@ -22,17 +22,16 @@ final class Mod(
 )(using akka.stream.Materializer)
     extends LilaController(env):
 
-  private def modApi    = env.mod.api
-  private def assessApi = env.mod.assessApi
+  import env.mod.{ api, assessApi }
 
   private given Conversion[Me, AsMod] = me => AsMod(me)
 
   def alt(username: UserStr, v: Boolean) = OAuthModBody(_.CloseAccount) { me ?=>
     withSuspect(username): sus =>
       for
-        _ <- modApi.setAlt(sus, v)
+        _ <- api.setAlt(sus, v)
         _ <- (v && sus.user.enabled.yes).so(env.api.accountClosure.close(sus.user))
-        _ <- (!v && sus.user.enabled.no).so(modApi.reopenAccount(sus.user.id))
+        _ <- (!v && sus.user.enabled.no).so(api.reopenAccount(sus.user.id))
       yield sus.some
   }(reportC.onModAction)
 
@@ -41,7 +40,7 @@ final class Mod(
     Source(ctx.body.body.split(' ').toList.flatMap(UserStr.read))
       .mapAsync(1): username =>
         withSuspect(username): sus =>
-          modApi.setAlt(sus, true) >> (sus.user.enabled.yes.so(env.api.accountClosure.close(sus.user)))
+          api.setAlt(sus, true) >> (sus.user.enabled.yes.so(env.api.accountClosure.close(sus.user)))
       .runWith(Sink.ignore)
       .void
       .inject(NoContent)
@@ -50,7 +49,7 @@ final class Mod(
   def engine(username: UserStr, v: Boolean) =
     OAuthModBody(_.MarkEngine) { me ?=>
       withSuspect(username): sus =>
-        modApi.setEngine(sus, v).inject(sus.some)
+        api.setEngine(sus, v).inject(sus.some)
     }(reportC.onModAction)
 
   def publicChat = Secure(_.PublicChatView) { ctx ?=> _ ?=>
@@ -67,19 +66,19 @@ final class Mod(
 
   def booster(username: UserStr, v: Boolean) = OAuthModBody(_.MarkBooster) { me ?=>
     withSuspect(username): prev =>
-      modApi.setBoost(prev, v).map(some)
+      api.setBoost(prev, v).map(some)
   }(reportC.onModAction)
 
   def troll(username: UserStr, v: Boolean) = OAuthModBody(_.Shadowban) { me ?=>
     withSuspect(username): prev =>
-      for suspect <- modApi.setTroll(prev, v)
+      for suspect <- api.setTroll(prev, v)
       yield suspect.some
   }(reportC.onModAction)
 
   def isolate(username: UserStr, v: Boolean) = OAuthModBody(_.Shadowban) { me ?=>
     withSuspect(username): prev =>
       for
-        suspect <- modApi.setIsolate(prev, v)
+        suspect <- api.setIsolate(prev, v)
         _       <- env.relation.api.removeAllFollowers(suspect.user.id)
       yield suspect.some
   }(reportC.onModAction)
@@ -96,7 +95,7 @@ final class Mod(
   }(reportC.onModAction)
 
   def kid(username: UserStr) = OAuthMod(_.SetKidMode) { _ ?=> me ?=>
-    modApi.setKid(me.id.into(ModId), username).map(some)
+    api.setKid(me.id.into(ModId), username).map(some)
   }(actionResult(username))
 
   def deletePmsAndChats(username: UserStr) = OAuthMod(_.Shadowban) { _ ?=> _ ?=>
@@ -110,7 +109,7 @@ final class Mod(
   }(actionResult(username))
 
   def disableTwoFactor(username: UserStr) = OAuthMod(_.DisableTwoFactor) { _ ?=> me ?=>
-    modApi.disableTwoFactor(me.id.into(ModId), username).map(some)
+    api.disableTwoFactor(me.id.into(ModId), username).map(some)
   }(actionResult(username))
 
   def closeAccount(username: UserStr) = OAuthMod(_.CloseAccount) { _ ?=> me ?=>
@@ -119,27 +118,27 @@ final class Mod(
   }(actionResult(username))
 
   def reopenAccount(username: UserStr) = OAuthMod(_.CloseAccount) { _ ?=> me ?=>
-    modApi.reopenAccount(username).map(some)
+    api.reopenAccount(username).map(some)
   }(actionResult(username))
 
   def reportban(username: UserStr, v: Boolean) = OAuthMod(_.ReportBan) { _ ?=> me ?=>
     withSuspect(username): sus =>
-      modApi.setReportban(sus, v).map(some)
+      api.setReportban(sus, v).map(some)
   }(actionResult(username))
 
   def rankban(username: UserStr, v: Boolean) = OAuthMod(_.RemoveRanking) { _ ?=> me ?=>
     withSuspect(username): sus =>
-      modApi.setRankban(sus, v).map(some)
+      api.setRankban(sus, v).map(some)
   }(actionResult(username))
 
   def arenaBan(username: UserStr, v: Boolean) = OAuthMod(_.ArenaBan) { _ ?=> me ?=>
     withSuspect(username): sus =>
-      modApi.setArenaBan(sus, v).map(some)
+      api.setArenaBan(sus, v).map(some)
   }(actionResult(username))
 
   def prizeban(username: UserStr, v: Boolean) = OAuthMod(_.PrizeBan) { _ ?=> me ?=>
     withSuspect(username): sus =>
-      modApi.setPrizeban(sus, v).map(some)
+      api.setPrizeban(sus, v).map(some)
   }(actionResult(username))
 
   def impersonate(username: String) = Auth { _ ?=> me ?=>
@@ -167,15 +166,15 @@ final class Mod(
   }
 
   protected[controllers] def doSetTitle(userId: UserId, title: Option[chess.PlayerTitle])(using Me) = for
-    _ <- modApi.setTitle(userId, title)
+    _ <- api.setTitle(userId, title)
     _ <- title.so(env.mailer.automaticEmail.onTitleSet(userId, _))
   yield ()
 
   def setEmail(username: UserStr) = SecureBody(_.SetEmail) { ctx ?=> me ?=>
     Found(env.user.repo.byId(username)): user =>
       bindForm(env.security.forms.modEmail(user))(
         err => BadRequest(err.toString),
-        email => modApi.setEmail(user.id, email).inject(redirect(user.username, mod = true))
+        email => api.setEmail(user.id, email).inject(redirect(user.username, mod = true))
       )
   }
 
@@ -222,7 +221,7 @@ final class Mod(
 
   def table = Secure(_.Admin) { ctx ?=> _ ?=>
     Ok.async:
-      modApi.allMods.map(views.mod.userTable.mods(_))
+      api.allMods.map(views.mod.userTable.mods(_))
   }
 
   def log = Secure(_.GamifyView) { ctx ?=> me ?=>
@@ -452,7 +451,7 @@ final class Mod(
         _ => BadRequest.page(views.mod.permissions(user)),
         permissions =>
           val newPermissions = Permission.ofDbKeys(permissions).diff(Permission(user))
-          (modApi.setPermissions(user.username, Permission.ofDbKeys(permissions)) >> {
+          (api.setPermissions(user.username, Permission.ofDbKeys(permissions)) >> {
             newPermissions(Permission.Coach).so(env.mailer.automaticEmail.onBecomeCoach(user))
           } >> {
             Permission
@@ -480,7 +479,7 @@ final class Mod(
               for
                 _ <- (!user.everLoggedIn).so {
                   lila.mon.user.register.modConfirmEmail.increment()
-                  modApi.setEmail(user.id, setEmail)
+                  api.setEmail(user.id, setEmail)
                 }
                 email <- env.user.repo.email(user.id)
                 page  <- renderPage(views.mod.ui.emailConfirm("", user.some, email))

app/controllers/Puzzle.scala

@@ -249,6 +249,18 @@ final class Puzzle(env: Env, apiC: => Api) extends LilaController(env):
       )
   }
 
+  def report(id: PuzzleId) = AuthBody { _ ?=> me ?=>
+    NoBot:
+      bindForm(env.puzzle.forms.report)(
+        badJsonFormError,
+        reportText =>
+          env.puzzle.api.puzzle
+            .reportDedup(id)
+            .so(env.irc.api.reportPuzzle(me.light, id, reportText))
+            .inject(jsonOkResult)
+      )
+  }
+
   def voteTheme(id: PuzzleId, themeStr: String) = AuthBody { _ ?=> me ?=>
     NoBot:
       PuzzleTheme

app/controllers/Setup.scala

@@ -17,8 +17,7 @@ final class Setup(
 ) extends LilaController(env)
     with lila.web.TheftPrevention:
 
-  private def forms     = env.setup.forms
-  private def processor = env.setup.processor
+  import env.setup.{ forms, processor }
 
   def ai = OpenBody:
     limit.setupBotAi(ctx.userId | UserId(""), rateLimited, cost = ctx.me.exists(_.isBot).so(1)):

app/controllers/Study.scala

@@ -417,7 +417,7 @@ final class Study(
   def pgn(id: StudyId) = Open:
     pgnWithFlags(id, identity)
 
-  def apiPgn(id: StudyId) = AnonOrScoped(_.Study.Read): ctx ?=>
+  def apiPgn(id: StudyId) = AnonOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     pgnWithFlags(id, identity)
 
   def pgnWithFlags(id: StudyId, flags: Update[WithFlags])(using Context) =
@@ -439,14 +439,15 @@ final class Study(
   def chapterPgn(id: StudyId, chapterId: StudyChapterId) = Open:
     doChapterPgn(id, chapterId, notFound, privateUnauthorizedFu, privateForbiddenFu)
 
-  def apiChapterPgn(id: StudyId, chapterId: StudyChapterId) = AnonOrScoped(_.Study.Read): ctx ?=>
-    doChapterPgn(
-      id,
-      chapterId,
-      fuccess(studyNotFoundText),
-      _ => fuccess(privateUnauthorizedText),
-      _ => fuccess(privateForbiddenText)
-    )
+  def apiChapterPgn(id: StudyId, chapterId: StudyChapterId) =
+    AnonOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
+      doChapterPgn(
+        id,
+        chapterId,
+        fuccess(studyNotFoundText),
+        _ => fuccess(privateUnauthorizedText),
+        _ => fuccess(privateForbiddenText)
+      )
 
   private def doChapterPgn(
       id: StudyId,
@@ -467,7 +468,7 @@ final class Study(
       }
     }
 
-  def exportPgn(username: UserStr) = OpenOrScoped(_.Study.Read): ctx ?=>
+  def exportPgn(username: UserStr) = OpenOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     val name =
       if username.value == "me"
       then ctx.me.fold(UserName("me"))(_.username)
@@ -485,7 +486,7 @@ final class Study(
         .pipe(asAttachmentStream(s"${name}-${if isMe then "all" else "public"}-studies.pgn"))
         .as(pgnContentType)
 
-  def apiListByOwner(username: UserStr) = OpenOrScoped(_.Study.Read): ctx ?=>
+  def apiListByOwner(username: UserStr) = OpenOrScoped(_.Study.Read, _.Web.Mobile): ctx ?=>
     val isMe = ctx.is(username)
     apiC.jsonDownload:
       env.study.studyRepo

app/controllers/Team.scala

@@ -13,9 +13,7 @@ import lila.team.{ Requesting, Team as TeamModel, TeamMember, TeamSecurity }
 
 final class Team(env: Env) extends LilaController(env):
 
-  private def forms     = env.team.forms
-  private def api       = env.team.api
-  private def paginator = env.team.paginator
+  import env.team.{ forms, api, paginator }
 
   def all(page: Int) = Open:
     Reasonable(page):