A third listener that serves one fullscreen map (#146)

[CaYatur]

Closes #146.

A third web surface whose entire design is the map: canvas edge to edge, controls floating over it, nothing else on the screen.

A listener, not a route

WebConfig already carries a port and an enabled flag per surface, and following that shape here is not about symmetry. A separate port is what lets an operator hand the map to people who must not reach the shop or the panel — with a firewall rule rather than with trust. "Yönetici kısıtlayabilmeli" has to mean something at the network layer, not only in a template.

Not a fourth map

It pastes MAP_CSS / MAP_HTML / MAP_JS from @shared/mapUi and restyles the wrapper. #129 was about three maps that had drifted apart; writing another here would undo it. The one thing the engine needed was a hook for the areas URL — this page has neither an admin id nor the public site's routes, so the existing guess would have 404ed on both branches.

The gate refuses the data, not the markup

mapPageAllows is the single answer, called by the state route and every feed. A page that gates only its HTML is a page whose feed anyone can fetch directly.

The passphrase is stored in the clear on purpose: it is a shared doorcode an operator has to read back and hand out, not a credential belonging to a person. Hashing it would only stop them looking it up, while anyone who can read the config can already change it. The cookie is a hash of it and an in-memory salt, so restarting MSMS signs everyone out — a cheap way to shut a leaked link without changing the code and telling everybody the new one.

Eleven settings for what the page may show, every one enforced server-side: world: false makes the tile route a 404, not a hidden layer.

What the self-review found

The players mode was a door that never opened. It reached for the public site's session, which lives in localStorage under msms_ptoken — and localStorage is per origin, so a different port could never read it. Three modes shipped, two had tests, and the untested one did not work. The page signs players in itself now, against the same accounts, with a cookie on its own origin.

Also: the page title is operator text interpolated inside a <script> block, and JSON.stringify escapes quotes while leaving < alone — a title containing </script> ended the block. The two HTML positions were already escaped; this one had been missed.

Verification

12/12 gates. Three checks proved failable:

Reintroduced	Gate says
the data gate removed	protected /api/map answered 200
the old cookie name	a signed-in player still could not read the map

One test defect fixed on the way: the route-coverage check isolated handlePanel by slicing to startWebServer, which held only while handlePanel was the last thing before it. handleMapPage landed in between and its routes — a different listener, deliberately outside the /api/v1 surface — were read as undocumented panel routes. It now slices to the next top-level function, and asserts the slice is big enough to be the real router, because a slice that is too short reads exactly like success.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.