7 Commits

Include renames

Author	SHA1	Message	Date
lobo	2dba863c54	feat(stats): add owners endpoint to list users who own a game	2026-10-06 13:19:58 +02:00
lobo	10b7dc2272	feat(account): reject tokens of blocked users and old roles ... V32 stores the last role change per user, sent by Auth. A token issued before that change, or of a blocked user, gets 401 within about 30 s instead of working until it expires.	2026-10-04 20:09:22 +02:00
lobo	a2ea1e45d3	feat(audit): add audit log endpoint and display names from Auth ... GET /api/library/audit-log for auditors and admins, paged, filter by action. The account state push stores displayName in account_name so the log shows names. Contract test updated.	2026-10-02 09:10:56 +02:00
lobo	349fa40272	feat(rewards): shop, equipped looks and public looks ... Add endpoints to buy items, equip looks by slot and unequip. The shop has 8 whitelisted looks: avatar borders, badges, accents and banner frames. Ownership is a BUY ledger row; PLATFORM_ADMIN owns every catalog item without buying. The public profile endpoint shares only the equipped looks filtered by ownership.	2026-10-01 13:17:04 +02:00
lobo	e347b7aac8	chore(security)!: refuse tokens without aud	2026-09-30 15:00:47 +02:00
lobo	504c935b27	feat(account): Steam ID and blocked state from Auth (V25) ... A blocked user gets no sync and leaves the landing stats. A new or removed Steam ID stops the nightly sync of the old one. No token check in Core: the token lives until it expires.	2026-09-30 15:00:47 +02:00
lobo	73cfcb58e2	refactor(api): one error body, token audiences, contract fixture	2026-09-29 14:48:28 +02:00