Soziales Netz im Spiel: Feed, Werbung, Markt, Kalender und Gewerbe

Jeder Spieler waehlt sich ein Handle mit @, Unternehmen und Behoerden bekommen eigene Profile, fuer die sie Mitarbeiter freigeben. Verwaltet wird ueber dieselbe Anmeldung wie das Webhosting: wer am IC-Computer als Anbieter angemeldet ist, richtet Unternehmensprofile ein. Damit gibt es genau eine Stelle, an der Verwaltungsrechte haengen - ein zweites Rechtesystem daneben waere eine zweite Stelle, an der man jemanden zu entziehen vergisst. Bewusst getrennt: wer fuer ein Unternehmen schreiben darf, kann sich nicht selbst zum Verwalter machen. Behoben gegenueber dem Ausgangsstand: - Die Resource startete nicht. Eine harte Abhaengigkeit zeigte auf eine Resource, die es nicht gibt - das verhindert den Start vollstaendig. - Das Schema war gegenueber dem Code stehengeblieben: eine Tabelle fehlte ganz, sechs Spalten fehlten. Jede Registrierung eines Handles scheiterte deshalb mit einem SQL-Fehler. Zwei Migrationen ziehen das nach. - Die Identitaet kommt jetzt von ESX statt von einem Charaktersystem, das hier nicht laeuft. Ohne das findet das Mailsystem die Postfaecher nicht. - Das Fenster hatte keinen Schliessknopf, nur ESC. Im Computerfenster ist diese Taste aber schon vergeben. - Bilder laden mit referrerpolicy="no-referrer": Bilderdienste sperren Hotlinks anhand der Herkunft, und die eines NUI kennen sie nicht. - Der Schluessel fuer den Bilder-Upload steht nicht mehr im Code, sondern in der server.cfg (set bleeter_imgbb_key). Er gehoert nicht in ein oeffentlich einsehbares Repository. Neu: Unternehmensprofile und Mitarbeiterfreigabe, ueber Netzwerkereignisse und Konsolenbefehle. Dazu eine Oberflaeche im IC-Computer, die dieselbe Gestaltung benutzt - die Stildatei wird dafuer mechanisch gekapselt, statt sie nachzubauen. Enthaelt README.md mit Einrichtung, Rechten und den Fallstricken.
2026-08-09 12:00:48 +00:00 · 2026-08-09 12:00:48 +00:00 · 20076b0aee
commit 20076b0aee
41 changed files with 8652 additions and 0 deletions
--- a/web-backend/lib/account.js
+++ b/web-backend/lib/account.js
@ -0,0 +1,98 @@
+const db = require('../db');
+const { decodeBool, canProfileBeBlocked } = require('./permissions');
+
+// Portiert aus main.lua mapProfile()
+function mapProfile(row) {
+    if (!row) return null;
+    const profile = {
+        id: row.id,
+        account_id: row.account_id,
+        profile_type: row.profile_type,
+        handle: row.handle,
+        display_name: row.display_name,
+        avatar_url: row.avatar_url || '',
+        banner_url: row.banner_url || '',
+        bio: row.bio || '',
+        location: row.location || '',
+        email_contact: row.email_contact || '',
+        phone_contact: row.phone_contact || '',
+        is_verified: decodeBool(row.is_verified),
+        is_lifeinvader_staff: decodeBool(row.is_lifeinvader_staff),
+        is_active: row.is_active === undefined || row.is_active === null || decodeBool(row.is_active),
+        is_locked: decodeBool(row.is_locked),
+        can_post: decodeBool(row.can_post),
+        can_edit_profile: decodeBool(row.can_edit_profile),
+        can_be_blocked: canProfileBeBlocked(row.profile_type, row.is_lifeinvader_staff),
+    };
+    if (row.followers_count !== undefined) profile.followers_count = Number(row.followers_count) || 0;
+    if (row.following_count !== undefined) profile.following_count = Number(row.following_count) || 0;
+    return profile;
+}
+
+// Alle Profile, auf die der Account zugreifen kann (eigene + Mitgliedschaften)
+async function getAccessibleProfiles(account) {
+    const profiles = [];
+    const seen = new Set();
+
+    const ownRows = await db.q(
+        `SELECT p.*, 1 AS can_post, 1 AS can_edit_profile
+         FROM bleeter_profiles p
+         WHERE p.account_id = ? AND p.is_active = 1 AND p.is_locked = 0
+         ORDER BY FIELD(p.profile_type, 'private','small_business','company','authority','lifeinvader'), p.display_name`,
+        [account.id]
+    );
+    for (const row of ownRows) {
+        const profile = mapProfile(row);
+        profiles.push(profile);
+        seen.add(profile.id);
+    }
+
+    const memberRows = await db.q(
+        `SELECT p.*, m.can_post, m.can_edit_profile
+         FROM bleeter_profile_members m
+         JOIN bleeter_profiles p ON p.id = m.profile_id
+         WHERE m.char_id = ? AND p.is_active = 1 AND p.is_locked = 0
+         ORDER BY p.display_name`,
+        [account.char_id]
+    );
+    for (const row of memberRows) {
+        if (!seen.has(row.id)) {
+            const profile = mapProfile(row);
+            profiles.push(profile);
+            seen.add(profile.id);
+        }
+    }
+
+    return profiles;
+}
+
+// Das aktuell handelnde Profil (per profileId vom Client, sonst erstes).
+// Gibt { profile, profiles } zurueck. profile=null wenn kein Profil vorhanden.
+async function resolveActingProfile(account, profileId) {
+    const profiles = await getAccessibleProfiles(account);
+    let profile = null;
+    if (profileId) {
+        profile = profiles.find(p => Number(p.id) === Number(profileId)) || null;
+    }
+    if (!profile) profile = profiles[0] || null;
+    return { profile, profiles };
+}
+
+// Zielprofil fuer Follow/Block/Moderation laden.
+// includeLocked=true fuer Moderationsaktionen.
+async function findTargetProfile(payload, includeLocked = false) {
+    const id = Number(payload && (payload.targetId || payload.profileId));
+    const handle = payload && payload.handle ? String(payload.handle).toLowerCase() : null;
+    let row = null;
+    if (id) {
+        row = await db.q1('SELECT * FROM bleeter_profiles WHERE id = ?', [id]);
+    } else if (handle) {
+        row = await db.q1('SELECT * FROM bleeter_profiles WHERE handle = ?', [handle]);
+    }
+    if (!row) return null;
+    if (!decodeBool(row.is_active)) return null;
+    if (!includeLocked && decodeBool(row.is_locked)) return null;
+    return mapProfile(row);
+}
+
+module.exports = { mapProfile, getAccessibleProfiles, resolveActingProfile, findTargetProfile };
--- a/web-backend/lib/media.js
+++ b/web-backend/lib/media.js
@ -0,0 +1,39 @@
+require('dotenv').config();
+
+const ALLOWED_EXT = ['jpg', 'jpeg', 'png'];
+
+function extFromUrl(url) {
+    const m = /\.([a-z0-9]+)(\?|$)/i.exec(String(url || ''));
+    return m ? m[1].toLowerCase() : null;
+}
+
+// Portiert aus adapters/media.lua IsAllowedExternalUrl
+function isAllowedExternalUrl(url) {
+    url = String(url || '');
+    if (!/^https:\/\//i.test(url)) return { ok: false, reason: 'url_must_be_https' };
+    if (/^https:\/\/i\.ibb\.co\//i.test(url) || /^https:\/\/ibb\.co\//i.test(url)) return { ok: true };
+    const ext = extFromUrl(url);
+    if (ext && ALLOWED_EXT.includes(ext)) return { ok: true };
+    return { ok: false, reason: 'unsupported_image_url' };
+}
+
+// Upload eines Buffers zu imgbb -> { url }
+async function uploadToImgbb(buffer, filename) {
+    const key = process.env.IMGBB_KEY;
+    if (!key) throw new Error('imgbb_key_missing');
+    const form = new FormData();
+    form.append('image', buffer.toString('base64'));
+    if (filename) form.append('name', filename.replace(/\.[^.]+$/, ''));
+
+    const resp = await fetch(`https://api.imgbb.com/1/upload?key=${encodeURIComponent(key)}`, {
+        method: 'POST',
+        body: form,
+    });
+    const data = await resp.json();
+    if (!data || !data.success || !data.data || !data.data.url) {
+        throw new Error('imgbb_upload_failed');
+    }
+    return { url: data.data.url };
+}
+
+module.exports = { isAllowedExternalUrl, uploadToImgbb, ALLOWED_EXT };
--- a/web-backend/lib/permissions.js
+++ b/web-backend/lib/permissions.js
@ -0,0 +1,39 @@
+// Portiert aus bleeter/server/permissions.lua + main.lua
+
+// Wer darf in welchem Feed posten (feed_type: 'home' | 'advertising')
+const feedPostRights = {
+    private:        { home: true },
+    small_business: { advertising: true },
+    company:        { advertising: true },
+    authority:      { home: true, advertising: true },
+    lifeinvader:    {},
+};
+
+function canPost(profileType, feedType) {
+    const rights = feedPostRights[profileType || ''] || {};
+    return rights[feedType || ''] === true;
+}
+
+function decodeBool(v) {
+    return v === true || v === 1 || v === '1';
+}
+
+// Behoerden / Lifeinvader / Staff koennen nicht blockiert werden
+function canProfileBeBlocked(profileType, isLifeinvaderStaff) {
+    return profileType !== 'authority'
+        && profileType !== 'lifeinvader'
+        && !decodeBool(isLifeinvaderStaff);
+}
+
+// Lifeinvader-Moderationsrechte eines Charakters (char_id) aus DB
+async function hasLifeinvaderPermission(db, charId, permission) {
+    if (!charId) return false;
+    const row = await db.q1(
+        `SELECT allowed FROM bleeter_lifeinvader_permissions
+         WHERE char_id = ? AND permission = ? LIMIT 1`,
+        [charId, permission]
+    );
+    return !!(row && decodeBool(row.allowed));
+}
+
+module.exports = { feedPostRights, canPost, decodeBool, canProfileBeBlocked, hasLifeinvaderPermission };
--- a/web-backend/lib/queries.js
+++ b/web-backend/lib/queries.js
@ -0,0 +1,281 @@
+const db = require('../db');
+const { decodeBool, canProfileBeBlocked } = require('./permissions');
+
+// ── Kommentare eines Posts ────────────────────────────────────────────────
+async function loadCommentsForPost(postId, viewerProfileId) {
+    const v = viewerProfileId || 0;
+    const rows = await db.q(
+        `SELECT c.id, c.body, c.created_at, c.author_profile_id,
+                p.handle AS author_handle,
+                (SELECT COUNT(*) FROM bleeter_likes l WHERE l.target_type='comment' AND l.target_id=c.id) AS likes,
+                EXISTS(SELECT 1 FROM bleeter_likes l WHERE l.target_type='comment' AND l.target_id=c.id AND l.profile_id=?) AS liked_by_viewer
+         FROM bleeter_comments c
+         JOIN bleeter_profiles p ON p.id = c.author_profile_id
+         WHERE c.post_id = ? AND c.self_deleted_at IS NULL AND c.hidden_at IS NULL AND c.deleted_at IS NULL
+           AND p.is_active = 1 AND p.is_locked = 0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY c.created_at ASC`,
+        [v, postId, v, v]
+    );
+    return rows.map(row => ({
+        id: row.id,
+        author_profile_id: row.author_profile_id,
+        author: row.author_handle,
+        body: row.body,
+        created_at: String(row.created_at || ''),
+        likes: Number(row.likes) || 0,
+        liked_by_viewer: decodeBool(row.liked_by_viewer),
+        can_delete: Number(row.author_profile_id) === Number(viewerProfileId),
+    }));
+}
+
+// ── Feed-Posts ────────────────────────────────────────────────────────────
+async function loadPosts(viewerProfileId, feedType) {
+    const v = viewerProfileId || 0;
+    const params = [v, v, v];
+    let feedClause = '';
+    if (feedType === 'home' || feedType === 'advertising') {
+        feedClause = ' AND posts.feed_type = ?';
+        params.push(feedType);
+    }
+    const rows = await db.q(
+        `SELECT posts.id, posts.feed_type, posts.body, posts.created_at, posts.author_profile_id,
+                media.url AS media_url,
+                author.id AS author_id, author.handle AS author_handle, author.display_name AS author_name,
+                author.avatar_url AS author_avatar, author.is_verified AS author_verified,
+                author.is_lifeinvader_staff AS author_lifeinvader_staff,
+                (SELECT COUNT(*) FROM bleeter_likes l WHERE l.target_type='post' AND l.target_id=posts.id) AS likes,
+                EXISTS(SELECT 1 FROM bleeter_likes l WHERE l.target_type='post' AND l.target_id=posts.id AND l.profile_id=?) AS liked_by_viewer
+         FROM bleeter_posts posts
+         JOIN bleeter_profiles author ON author.id = posts.author_profile_id
+         LEFT JOIN bleeter_media media ON media.id = posts.media_id
+         WHERE posts.self_deleted_at IS NULL AND posts.hidden_at IS NULL AND posts.deleted_at IS NULL
+           AND author.is_active = 1 AND author.is_locked = 0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=author.id)
+                   OR (b.blocker_profile_id=author.id AND b.blocked_profile_id=?))
+           ${feedClause}
+         ORDER BY posts.created_at DESC
+         LIMIT 80`,
+        params
+    );
+
+    const posts = [];
+    for (const row of rows) {
+        const comments = await loadCommentsForPost(row.id, viewerProfileId);
+        posts.push({
+            id: row.id,
+            feed_type: row.feed_type,
+            body: row.body || '',
+            media_url: row.media_url,
+            created_at: String(row.created_at || ''),
+            likes: Number(row.likes) || 0,
+            liked_by_viewer: decodeBool(row.liked_by_viewer),
+            can_delete: Number(row.author_profile_id) === Number(viewerProfileId),
+            comments: comments.length,
+            comments_list: comments,
+            author: {
+                id: row.author_id,
+                handle: row.author_handle,
+                display_name: row.author_name,
+                avatar_url: row.author_avatar || '',
+                is_verified: decodeBool(row.author_verified),
+                is_lifeinvader_staff: decodeBool(row.author_lifeinvader_staff),
+            },
+        });
+    }
+    return posts;
+}
+
+// ── Profil-Verzeichnis (mit Follower-Zahlen) ──────────────────────────────
+async function loadProfileDirectory(viewerProfileId, includeLocked) {
+    const v = viewerProfileId || 0;
+    const rows = await db.q(
+        `SELECT p.*, 0 AS can_post, 0 AS can_edit_profile,
+                (SELECT COUNT(*) FROM bleeter_follows f WHERE f.followed_profile_id=p.id) AS followers_count,
+                (SELECT COUNT(*) FROM bleeter_follows f WHERE f.follower_profile_id=p.id) AS following_count
+         FROM bleeter_profiles p
+         WHERE p.is_active = 1 AND (? = 1 OR p.is_locked = 0)
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY p.display_name
+         LIMIT 180`,
+        [includeLocked ? 1 : 0, v, v]
+    );
+    const { mapProfile } = require('./account');
+    return rows.map(mapProfile);
+}
+
+function mapSocialProfile(row) {
+    return {
+        id: row.id,
+        handle: row.handle,
+        display_name: row.display_name,
+        avatar_url: row.avatar_url || '',
+        profile_type: row.profile_type,
+        is_verified: decodeBool(row.is_verified),
+        is_lifeinvader_staff: decodeBool(row.is_lifeinvader_staff),
+        can_be_blocked: canProfileBeBlocked(row.profile_type, row.is_lifeinvader_staff),
+    };
+}
+
+// ── Following / Followers / Blocked ───────────────────────────────────────
+async function loadSocial(activeProfileId) {
+    const a = activeProfileId || 0;
+    const following = await db.q(
+        `SELECT p.id,p.handle,p.display_name,p.avatar_url,p.profile_type,p.is_verified,p.is_lifeinvader_staff
+         FROM bleeter_follows f JOIN bleeter_profiles p ON p.id=f.followed_profile_id
+         WHERE f.follower_profile_id=? AND p.is_active=1 AND p.is_locked=0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY p.display_name`,
+        [a, a, a]
+    );
+    const followers = await db.q(
+        `SELECT p.id,p.handle,p.display_name,p.avatar_url,p.profile_type,p.is_verified,p.is_lifeinvader_staff
+         FROM bleeter_follows f JOIN bleeter_profiles p ON p.id=f.follower_profile_id
+         WHERE f.followed_profile_id=? AND p.is_active=1 AND p.is_locked=0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY p.display_name`,
+        [a, a, a]
+    );
+    const blocked = await db.q(
+        `SELECT p.id,p.handle,p.display_name,p.avatar_url,p.profile_type,p.is_verified,p.is_lifeinvader_staff
+         FROM bleeter_blocks b JOIN bleeter_profiles p ON p.id=b.blocked_profile_id
+         WHERE b.blocker_profile_id=? ORDER BY p.display_name`,
+        [a]
+    );
+    return {
+        following: following.map(mapSocialProfile),
+        followers: followers.map(mapSocialProfile),
+        blocked: blocked.map(mapSocialProfile),
+    };
+}
+
+// ── Kalender (28 Tage) ────────────────────────────────────────────────────
+const germanWeekdays = ['Sonntag','Montag','Dienstag','Mittwoch','Donnerstag','Freitag','Samstag'];
+
+function dateKeyFromOffset(offset) {
+    const d = new Date();
+    d.setDate(d.getDate() + offset);
+    return d.toISOString().slice(0, 10);
+}
+function dateTitleFromKey(dateKey) {
+    const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(dateKey);
+    if (!m) return dateKey;
+    const d = new Date(Number(m[1]), Number(m[2]) - 1, Number(m[3]), 12);
+    return `${germanWeekdays[d.getDay()]} ${m[3]}.${m[2]}.${m[1]}`;
+}
+
+async function loadCalendarDays(activeProfileId) {
+    const rows = await db.q(
+        `SELECT e.id, DATE_FORMAT(e.starts_at,'%Y-%m-%d') AS date_key,
+                DATE_FORMAT(e.starts_at,'%H:%i') AS time_text,
+                e.title, e.location, e.author_profile_id, p.handle AS author_handle
+         FROM bleeter_events e JOIN bleeter_profiles p ON p.id=e.author_profile_id
+         WHERE e.deleted_at IS NULL AND e.status='active'
+           AND e.starts_at >= CURDATE() AND e.starts_at < DATE_ADD(CURDATE(), INTERVAL 28 DAY)
+           AND p.is_active=1 AND p.is_locked=0
+         ORDER BY e.starts_at ASC, e.id ASC`
+    );
+    const byDate = {};
+    for (const row of rows) {
+        (byDate[row.date_key] = byDate[row.date_key] || []).push({
+            id: row.id,
+            time: row.time_text,
+            title: row.title,
+            location: row.location || '',
+            author: row.author_handle,
+            can_delete: Number(row.author_profile_id) === Number(activeProfileId),
+        });
+    }
+    const days = [];
+    for (let offset = 0; offset < 28; offset++) {
+        const dateKey = dateKeyFromOffset(offset);
+        days.push({ offset, date: dateKey, title: dateTitleFromKey(dateKey), events: byDate[dateKey] || [] });
+    }
+    return days;
+}
+
+// ── Gewerbe (Open/Closed) ─────────────────────────────────────────────────
+async function loadBusinesses(viewerProfileId) {
+    const v = viewerProfileId || 0;
+    const rows = await db.q(
+        `SELECT p.handle,p.display_name,p.avatar_url,p.banner_url,p.is_verified,p.is_lifeinvader_staff,
+                COALESCE(s.status,'closed') AS status
+         FROM bleeter_profiles p
+         LEFT JOIN bleeter_business_status s ON s.profile_id=p.id
+         WHERE p.profile_type IN ('small_business','company','authority')
+           AND p.is_active=1 AND p.is_locked=0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY FIELD(COALESCE(s.status,'closed'),'open','closed'), p.display_name
+         LIMIT 80`,
+        [v, v]
+    );
+    return rows.map(row => ({
+        handle: row.handle,
+        display_name: row.display_name,
+        avatar_url: row.avatar_url || '',
+        banner_url: row.banner_url || '',
+        status: row.status || 'closed',
+        is_verified: decodeBool(row.is_verified),
+        is_lifeinvader_staff: decodeBool(row.is_lifeinvader_staff),
+    }));
+}
+
+// ── Marktplatz ────────────────────────────────────────────────────────────
+async function loadMarketplace(activeProfileId) {
+    const a = activeProfileId || 0;
+    const rows = await db.q(
+        `SELECT m.id,m.title,m.description,m.price_label,m.created_at,m.author_profile_id,
+                media.url AS media_url,
+                p.handle AS author_handle,p.display_name AS author_name,p.avatar_url AS author_avatar,
+                p.email_contact AS author_email,p.is_verified AS author_verified,
+                p.is_lifeinvader_staff AS author_lifeinvader_staff
+         FROM bleeter_marketplace m
+         JOIN bleeter_profiles p ON p.id=m.author_profile_id
+         LEFT JOIN bleeter_media media ON media.id=m.media_id
+         WHERE m.deleted_at IS NULL AND m.status='active' AND p.is_active=1 AND p.is_locked=0
+           AND NOT EXISTS (SELECT 1 FROM bleeter_blocks b
+                WHERE (b.blocker_profile_id=? AND b.blocked_profile_id=p.id)
+                   OR (b.blocker_profile_id=p.id AND b.blocked_profile_id=?))
+         ORDER BY m.created_at DESC
+         LIMIT 100`,
+        [a, a]
+    );
+    return rows.map(row => {
+        const priceNumber = Number((String(row.price_label || '').match(/\d+/) || [0])[0]) || 0;
+        return {
+            id: row.id,
+            title: row.title,
+            body: row.description,
+            price: priceNumber,
+            price_label: row.price_label || '',
+            created_at: String(row.created_at || ''),
+            media_url: row.media_url,
+            can_delete: Number(row.author_profile_id) === Number(activeProfileId),
+            author: {
+                id: row.author_profile_id,
+                handle: row.author_handle,
+                display_name: row.author_name,
+                avatar_url: row.author_avatar || '',
+                email: row.author_email || '',
+                is_verified: decodeBool(row.author_verified),
+                is_lifeinvader_staff: decodeBool(row.author_lifeinvader_staff),
+            },
+        };
+    });
+}
+
+module.exports = {
+    loadCommentsForPost, loadPosts, loadProfileDirectory,
+    loadSocial, loadCalendarDays, loadBusinesses, loadMarketplace,
+};