Merge pull request 'Hide Playerbot accounts from search, character pages and guild rosters' (#2) from hide-bot-accounts into master

Reviewed-on: #2

config.default.json

@@ -9,6 +9,8 @@
 	},
 	"loadDbcs": true,
 	"hideGameMasters": true,
+	"hideBotAccounts": true,
+	"botAccountPattern": "RNDBOT%",
 	"transmogModule": false,
 	"useZamCdn": false,
 	"realms": [

docker-compose.mythica.yml

@@ -40,7 +40,16 @@ services:
 
             # --- behaviour -----------------------------------------------------
             ACORE_ARMORY_LOAD_DBCS: ${ARMORY_LOAD_DBCS:-1}
-            ACORE_ARMORY_HIDE_GAME_MASTERS: ${ARMORY_HIDE_GMS:-1}
+            # Off by default here: GM accounts on this realm belong to real
+            # players who should appear in the armory like anyone else. Set to
+            # 1 to hide them from search and 404 their character pages.
+            ACORE_ARMORY_HIDE_GAME_MASTERS: ${ARMORY_HIDE_GMS:-0}
+
+            # Playerbots are ordinary accounts, not game masters, so the GM
+            # filter does not touch them. Without this the armory lists ~1350
+            # bots against ~29 real characters.
+            ACORE_ARMORY_HIDE_BOT_ACCOUNTS: ${ARMORY_HIDE_BOTS:-1}
+            ACORE_ARMORY_BOT_ACCOUNT_PATTERN: ${ARMORY_BOT_PATTERN:-RNDBOT%}
             ACORE_ARMORY_TRANSMOG_MODULE: ${ARMORY_TRANSMOG:-0}
 
             # 0 = serve 3D model assets from the local data directory.

docs/mythica-deploy.md

@@ -129,5 +129,10 @@ FLUSH PRIVILEGES;
   page rather than shipping both.
 - **The Dockerfile builds from `node:16`**, which is end-of-life. It builds and
   runs fine; bumping it is a separate change from getting this deployed.
-- **`hideGameMasters` defaults to on** here, so GM characters are hidden from
+- **`hideGameMasters` is off** in this stack, unlike upstream. GM accounts on
-  search and return 404.
+  this realm belong to real players — `Spinnaker` among them — so hiding them
+  would hide people who should be listed. Set `ARMORY_HIDE_GMS=1` to restore
+  upstream behaviour.
+- **Playerbots are hidden** via `hideBotAccounts` / `botAccountPattern`
+  (`RNDBOT%`). They are ordinary accounts rather than game masters, so the GM
+  filter never touched them. `ARMORY_HIDE_BOTS=0` shows them again.

src/armory/Config.ts

@@ -31,6 +31,8 @@ export class Config {
 	public iframeMode: IIframeModeConfig;
 	public loadDbcs: boolean;
 	public hideGameMasters: boolean;
+	public hideBotAccounts: boolean;
+	public botAccountPattern: string;
 	public transmogModule: boolean;
 	public useZamCdn: boolean;
 	public realms: IRealmConfig[];

src/armory/Utils.ts

@@ -60,4 +60,17 @@ export class Utils {
 			background: obj.background.toString().padStart(padLength, "0"),
 		};
 	}
+
+	/**
+	 * Quote a configuration-supplied string for inline use in SQL.
+	 *
+	 * The bot-account filter has to be spliced into join clauses that the query
+	 * builder emits as raw SQL, so it cannot be passed as a bound parameter the
+	 * way a normal value would be. The value comes from the operator's own
+	 * config rather than from a request, but quoting it keeps a stray apostrophe
+	 * from producing a broken or surprising query.
+	 */
+	public static quoteSqlString(value: string): string {
+		return `'${String(value).replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+	}
 }

src/armory/controllers/CharacterController.ts

@@ -342,6 +342,16 @@ export class CharacterController {
 
 	private async getCharacterData(realm: IRealmConfig, character: string | number): Promise<ICharacterData> {
 		const where = typeof character === "string" ? "LOWER(`characters`.`name`) = LOWER(?)" : "`characters`.`guid` = ?";
+
+		// Bot accounts are hidden the same way game masters are: left join the
+		// rows we do not want, then require the join to have missed. Keeping the
+		// pattern inline rather than bound avoids disturbing the positional
+		// values below.
+		const botJoin = this.armory.config.hideBotAccounts
+			? `LEFT JOIN \`${realm.authDatabase}\`.\`account\` AS \`bot_account\` ON \`bot_account\`.\`id\` = \`characters\`.\`account\` AND \`bot_account\`.\`username\` LIKE ${Utils.quoteSqlString(this.armory.config.botAccountPattern)}`
+			: "";
+		const botWhere = this.armory.config.hideBotAccounts ? "AND `bot_account`.`id` IS NULL" : "";
+
 		const [rows] = await this.armory.getCharactersDb(realm.name).query({
 			sql: `
 				SELECT \`characters\`.\`guid\`, \`characters\`.\`name\`, \`race\`, \`class\`, \`gender\`, \`level\`, \`skin\`, \`face\`, \`hairStyle\`, \`hairColor\`, \`facialStyle\`, \`playerFlags\`, \`online\`, \`guild\`.\`name\` AS \`guild\`
@@ -349,9 +359,11 @@ export class CharacterController {
 				LEFT JOIN \`guild_member\` ON \`guild_member\`.\`guid\` = \`characters\`.\`guid\`
 				LEFT JOIN \`guild\` ON \`guild\`.\`guildid\` = \`guild_member\`.\`guildid\`
 				LEFT JOIN \`${realm.authDatabase}\`.\`account_access\` ON \`account_access\`.\`id\` = \`characters\`.\`account\` AND \`account_access\`.\`RealmID\` IN (-1, ${realm.realmId}) AND \`account_access\`.\`gmlevel\` > 0
+				${botJoin}
 				WHERE
 					${where}
 					AND (\`account_access\`.\`id\` IS NULL OR ? = 0)
+					${botWhere}
 			`,
 			values: [character, this.armory.config.hideGameMasters ? 1 : 0],
 			timeout: this.armory.config.dbQueryTimeout,

src/armory/controllers/GuildController.ts

@@ -93,6 +93,19 @@ export class GuildController {
 			ssp = ssp.where("`account_access`.`id` IS NULL");
 		}
 
+		if (this.armory.config.hideBotAccounts) {
+			ssp.joins.push({
+				table1: "characters",
+				column1: "account",
+				table2: "account",
+				column2: "id",
+				database2: realm.authDatabase,
+				kind: "LEFT",
+				where: `AND \`${realm.authDatabase}\`.\`account\`.\`username\` LIKE ${Utils.quoteSqlString(this.armory.config.botAccountPattern)}`,
+			});
+			ssp = ssp.where(`\`${realm.authDatabase}\`.\`account\`.\`id\` IS NULL`);
+		}
+
 		const result = await ssp.where("`guildid` = ?", guildId).where("`deleteInfos_Account` IS NULL").run(this.armory.config.dbQueryTimeout);
 
 		const ranks = await this.getGuildRanks(realm, guildId);

src/armory/controllers/IndexController.ts

@@ -55,6 +55,19 @@ export class IndexController {
 			ssp = ssp.where("`account_access`.`id` IS NULL");
 		}
 
+		if (this.armory.config.hideBotAccounts) {
+			ssp.joins.push({
+				table1: "characters",
+				column1: "account",
+				table2: "account",
+				column2: "id",
+				database2: realm.authDatabase,
+				kind: "LEFT",
+				where: `AND \`${realm.authDatabase}\`.\`account\`.\`username\` LIKE ${Utils.quoteSqlString(this.armory.config.botAccountPattern)}`,
+			});
+			ssp = ssp.where(`\`${realm.authDatabase}\`.\`account\`.\`id\` IS NULL`);
+		}
+
 		const result = await ssp.where("`deleteInfos_Account` IS NULL").run(this.armory.config.dbQueryTimeout);
 
 		res.json({