Skip to content

v4.4.0

Choose a tag to compare

View all tags
@et-nik et-nik released this 01 Aug 16:57
· 67 commits to main since this release
v4.4.0
3eacd55
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A plugin-platform release: plugins can now schedule work, manage roles and permissions, ship translations and frontend files, and implement their own RCON/Query protocols. Alongside that — four new built-in RCON protocols, a CDN-backed game catalog, and a fully tokenized, themable UI.

Plugin platform

  • Scheduler (gameap-scheduler) — plugins register periodic tasks that are persisted in the database and survive restarts and reloads. Runs are aligned to Unix-epoch slots and coordinated with distributed locks, so in a multi-instance deployment each slot fires on exactly one instance. Per-task timeouts, retry policy with jitter, and panel-side caps (PLUGIN_SCHEDULER_*).
  • Permissions (gameap-authz, gameap-rbac) — read-only ability checks are available to every plugin; role and ability management is gated behind the new manage_rbac grant. A plugin declares what it needs in its manifest, the admin dry-run endpoint shows the list before install, and confirming the install records the grant. Grants are re-read per call, so revoking one takes effect without a restart.
  • RCON/Query protocol extension — the new optional ProtocolService lets a plugin map a game onto a built-in protocol, override a built-in mapping, or implement a wire protocol end to end. Socket I/O goes through the gameap-net host library on connections the host opens and guards — plugins never dial (PLUGIN_NET_*).
  • Assets — plugins can contribute translation files (/lang/) and frontend static files, layered over the built-in filesystems by the new pkg/mergefs. Resolved per request, so a plugin installed at runtime contributes immediately.
  • Plugin page — descriptions and summaries in both lists, wrapping fixes for long names and label rows, and checkGame so a plugin's server tab appears only for matching games or engines.

RCON & Query

  • New built-in protocols: Quake 2, Quake 3, SA-MP and BattlEye — enabling RCON for Quake 2/3, Call of Duty 4, SA-MP, Arma 2/2 OA and Arma 3, with player list, kick and ban support.
  • Capabilities reported separately: playersList, playersKick and playersBan replace the single playersManage flag (kept as a deprecated alias). The UI now hides actions a protocol cannot perform instead of offering ones that fail.
  • Command injection hardening: player identity and reason fields containing line breaks, ; or NUL are rejected with 400 — previously they could smuggle an extra console command into a kick/ban packet.

Servers

  • Public address — the reserved public_ip server metadata key publishes an address in place of server_ip for every viewer, so a node behind NAT no longer exposes its LAN address. Admin responses gained internal_server_ip with the address the daemon actually connects to.
  • Metadata editing — metadata is now accepted on server update, and the key/value editor ships a reference of documented keys (panel and Docker/Podman) with descriptions and examples that insert straight into the form.

Games catalog

Games and mods are now seeded and upgraded from the GameAP CDN (GAMES_CDN_URLS, with mirror fallback) instead of the Global API. The bundled catalog was refreshed: Windows Steam AppIDs, HTTPS CDN repository links, normalized engine names, and Hytale added.

Localization

GET /lang lists the available locales with display names, read from the merged i18n filesystem — the language switcher and the boot-time detection are no longer hardcoded to en/ru, and plugin-shipped locales appear automatically.

Interface

  • Theme tokens — @gameap/ui 1.5.0 ships theme.css as /theme.css. All Tailwind colors and naive-ui overrides resolve through --gameap-* variables, so a plugin stylesheet can re-theme the whole panel, naive-ui components included.
  • Icons — the gicon webfont is gone; icons (game icons included) are SVG through the @gameap/ui registry.
  • Polish — login and 2FA forms show a submit state and reject double submits, and pages with chained initial requests no longer blink between loading steps.

Panel ↔ daemon protocol

The gateway contract gained file hashing (MD5, SHA-1, SHA-256, SHA-512, CRC32, CRC64) and archive create/extract operations — zip, tar and tar.gz/bz2/xz/zstd, single-file gz/bz2/xz/zstd, plus 7z/rar extraction — with progress reporting, cancellation, and limits guarding against path traversal and decompression bombs.

What's Changed

Full Changelog: v4.3.5...v4.4.0

Contributors

et-nik
Assets 18
Loading