Open Tabletop 0.21.0

Upgrade notes

• From 0.20.0, startup applies additive migration 023_account_recovery.sql using the existing
  migration-role connection. Existing accounts, assets and saved games are preserved; existing
  email addresses are not automatically verified. With automatic migration disabled, apply
  pending numbered migrations using the schema-owner connection before starting this version.
• Back up the database and uploads, restart the server and refresh all browsers. Source installs
  should run npm ci first. SMTP is optional; email recovery requires additional configuration,
  while saved recovery codes work without SMTP. No new service or exposed port is required.
  See 0.21.0 upgrade instructions.
• Includes security fixes for room admission/save ownership, asset serving and action-menu HTML
  injection. Native installer live-distro/reboot acceptance and website publishing/user acceptance
  remain pending; feature-specific user-reported testing is recorded below.

Added

• Native Linux uninstall and confirmed purge modes with offline execution and --dry-run,
  plus reinstall/resume for retained or interrupted installations. Recovery preserves stored
  credentials, uploads and configuration; purge retains database backups and shared dependencies,
  refuses mounted/redirected storage, and removes only the app's PostgreSQL authentication rule.
  Shared installer tests cover both Linux and Proxmox profiles. Live distro/reboot acceptance
  remains pending; no application migration or browser UI change is required.

• Replaced the website header and footer text branding with the existing Open Tabletop
  logo on the landing page and all 17 wiki guides, with accessible names and responsive sizing.

• Captured four gameplay/library screenshots from two dedicated, saved showcase rooms.
  Applied the approved chess hero, responsive cards/dice gallery, and library image in the
  Assets and scenes guide. Recorded capture provenance and chess-model attribution.

• A standalone static website in website/, with the approved landing page, GitHub link,
  inactive public demo label, and 17 linked wiki guides for installation, configuration,
  gameplay, assets, recovery, and maintenance. The wiki has desktop and mobile navigation
  and works without JavaScript. Existing project artwork is reused. Local link/content and
  browser layout tests are provided; see website/README.md for preview and maintenance.
  The game server is unchanged. Publishing and user acceptance remain pending.

• Account security with masked password confirmation at signup and password setting, a dedicated
  in-app password form replacing the native hosting prompt, and current-password verification for
  changes. Password setting remains independent of host approval. Verified-email recovery and ten
  single-use saved recovery codes support passwordless accounts and existing-account password reset.
  Credential changes revoke old sessions/proofs/codes; recovery preserves account ownership and roles.
  Optional TLS SMTP uses Nodemailer; migration 023 and a server restart/client refresh are required.
  See docs/ACCOUNT_SECURITY.md for configuration, behavior and validation status.
  Documented bare-metal and Docker SMTP setup, provider credentials, exact password-file contents,
  restart requirements and recovery smoke tests. User reported feature, layout and SMTP success.

• Contributor guidance in CONTRIBUTING.md and private vulnerability reporting
  instructions in SECURITY.md, using admin@open-tabletop.com.

• A source security audit with isolated reproductions of unauthenticated duplicate-room
  creation/save overwrite, admin-only legacy inline-image script hosting, and an encoded-URL
  bypass of the asset JSON guard. See docs/SECURITY_AUDIT_2026-09-28.md; remediation is recorded under Fixed and in the audit.

• A regular Linux host installer for systemd Debian 12/13, Ubuntu 22.04/24.04/26.04 LTS,
  Fedora and Arch. It shares the Proxmox native deployment flow, adds distro package/cache
  selection and PostgreSQL initialization, and allocates a system account without claiming
  UID 1000. Source revisions/archives, separate database roles, credentials, release switching,
  backup-before-update and readiness checks are retained. Proxmox keeps its existing package
  pins and NFS UID mapping. Command-mocked tests are provided; live distro installation and
  reboot acceptance remain pending. No application migration or browser UI change is required.

• GM-configured piece fog auras, with the approved circle menu entry, room-unit radius and local
  preview. Moving a visible tabletop piece reveals a persistent circular path through map fog;
  hidden pieces pause their auras. Settings survive scene/game saves. Manual fog controls remain
  available; auras neither reveal explicitly hidden objects nor enforce walls or movement rules.
  Restart the server and refresh clients; no migration or new dependency is required.

• Manual map fog for image, procedural and 3D boards, with approved cloud-fog entry, circular Reveal/Cover brushes,
  room-unit radii, session undo, Cover all/Reveal all, and a local player fog preview. GMs see
  translucent coverage; other players see opaque coverage. Exploration is saved with scenes/games
  and survives disabling fog. Painting supports mouse, touch and keyboard through the input router.
  A shared, saved Fog thickness slider grows a closed volume with masked top/bottom caps and
  walls along outer and revealed boundaries, preventing low-angle views under covered areas.
  Thickness edits preserve exploration and join session undo; older height settings carry over. Piece visibility and
  physics stay independent; piece reveal auras are tracked separately above.
  Restart the server and refresh all clients; no database migration or new dependency is needed.

• GM object Hide/Reveal with approved eye-off/eye controls, batch selection actions, ghosted
  GM-only pieces, and Library Spawn hidden. Hidden pieces are omitted from player state
  and object events, remain non-colliding and parked until revealed, and retain visibility in
  saved scenes/games. Deck/dispenser/notecard-stack table outputs inherit concealment.
  Reveal rejects occupied placements; hiding rejects held/edited pieces and visible supports.
  Private hands retain their separate privacy and explicit sharing/play behavior; personal tray
  dice stay visible. Restart the server and refresh all clients; no database migration is needed.

Changed

• Consolidate browser session-token access, lobby/admin JSON requests, and shared button DOM
  creation. Preserve authentication defaults, request errors, icons, button types, accessible
  labels and room-action guards; specialized upload/package/template request behavior remains
  local. Refresh browsers to load the updated modules; no server restart or migration is needed.

Fixed

• Audited all 17 website wiki pages against current documentation, release history and source.
  Corrected Node setup order and grants, Compose environment forwarding and secret permissions,
  native administrator commands, role restrictions, scene/reset consequences and transient state.
  Expanded current deck, notecard, fog and table-tool instructions; distinguish the new
  features from 0.20.0. Added per-page source links and a review record in website/WIKI_AUDIT.md.
  Updated supporting README, gesture, architecture and reference notes. Documentation only.
• Added step-by-step website instructions for double-sided tile uploads, panorama and cubemap
  skyboxes, and saving and applying custom dice textures. No application behavior changed.
• Corrected the website's Assets and Scenes guide against the current table controls and
  handlers: combined Library categories, admin creation on regular tables, Save/Save + Spawn,
  publication, scene save/load, collections, and portable assets. Updated the first-game,
  controls, pieces, saving, and Node.js guides, plus the source README and architecture/reference
  descriptions. This is a documentation correction; application behavior is unchanged.
• Made SMTP setup documentation and configuration examples provider-neutral.
• Landing account header overlap: moved Account security beside Admin in the page header,
  and allowed identity/actions to wrap without overlap on narrow screens.
• README migration and tuning references, test commands and database-test prerequisites;
  added documentation navigation, notecard/concealment/fog summaries, and scoped security guidance.
• Security audit SEC-01: authenticate matchmaking before room allocation, disable public explicit
  room creation, retain unique transport IDs, and use a separate persistent room ID. One local
  writer holds ownership through its final save; failed/unadmitted instances cannot overwrite
  checkpoints. Connection admission rechecks access and preserves revocation/spectator handling.
• Security audit SEC-02/SEC-03: remove the obsolete saveDeck/inline-image writer and serve only
  approved generated raster/GLB asset paths with explicit safe MIME types and response headers.
  Encoded metadata paths, scripts, HTML and malformed URLs are blocked, including existing files.
  Current editor deck/tile saves and normal uploads are retained. Restart the server; no migration
  or dependency change is required. Manual tests reported green by the user on 2026-09-28.
• Render overflow action labels/notes and touch action-sheet names/metadata as plain text,
  preventing stored room or asset names from injecting HTML. Existing classes, icons, accessible
  labels, confirmation and close behavior are retained. Browser regressions cover desktop/touch
  and compact/full modes. Refresh browsers; no server restart or migration is required.
• Make the native installer test fixture resolve Node from the test runner's executable,
  fixing package-setup checks on CI hosts without /usr/bin/node. Production installer
  paths and runtime validation remain unchanged; no server restart is needed.
• Hidden objects now settle onto the board/mat collider surface (or tabletop) when released,
  after horizontal grid snapping, instead of remaining suspended at drag height. Single and
  group drops remain non-colliding and GM-only. Restart the server; no migration is needed.
• Fix the fog-aura radius +/− buttons throwing InvalidStateError for arbitrary decimal inputs.
  The shared stepper supports step="any" with bounded increments (0.25 displayed units for
  aura radii), preserves typed decimals, and ignores disabled/read-only fields. Refresh clients.

Documentation

• Record the approved and implemented object-concealment slice, its protocol/physics boundaries
  and user-reported manual test pass. Record the manual map-fog user test pass and the implemented volume/thickness follow-up and subsequent user approval separately;
  record the approved piece-aura implementation and subsequent user-reported test pass after
  the radius-stepper fix separately.

• Correct the roadmap to mark the agreed asset/collection export-import scope complete, retaining
  the deliberate scene-package deferral. Refresh the shared browser-helper cleanup scope against
  current code and remove its stale backlog-file reference; record its subsequent implementation
  and user-reported manual functional pass.

• Prepared 0.21.0 release notes, upgrade guidance and aligned package/Docker version references.