draft branch for bin/deploy to testy. please ignore

app/Env.scala

@@ -25,6 +25,7 @@ final class Env(
   given translator: lila.core.i18n.Translator = lila.i18n.Translator
   given scheduler: Scheduler                  = system.scheduler
   given lila.core.config.RateLimit            = net.rateLimit
+  given getFile: (String => java.io.File)     = environment.getFile
 
   // wire all the lila modules in the right order
   val i18n: lila.i18n.Env.type          = lila.i18n.Env
@@ -57,6 +58,7 @@ final class Env(
   val tournament: lila.tournament.Env   = wire[lila.tournament.Env]
   val swiss: lila.swiss.Env             = wire[lila.swiss.Env]
   val mod: lila.mod.Env                 = wire[lila.mod.Env]
+  val ask: lila.ask.Env                 = wire[lila.ask.Env]
   val team: lila.team.Env               = wire[lila.team.Env]
   val teamSearch: lila.teamSearch.Env   = wire[lila.teamSearch.Env]
   val forum: lila.forum.Env             = wire[lila.forum.Env]
@@ -94,6 +96,7 @@ final class Env(
   val bot: lila.bot.Env                 = wire[lila.bot.Env]
   val storm: lila.storm.Env             = wire[lila.storm.Env]
   val racer: lila.racer.Env             = wire[lila.racer.Env]
+  val local: lila.local.Env             = wire[lila.local.Env]
   val opening: lila.opening.Env         = wire[lila.opening.Env]
   val tutor: lila.tutor.Env             = wire[lila.tutor.Env]
   val recap: lila.recap.Env             = wire[lila.recap.Env]

app/LilaComponents.scala

@@ -102,6 +102,7 @@ final class LilaComponents(
   lazy val analyse: Analyse               = wire[Analyse]
   lazy val api: Api                       = wire[Api]
   lazy val appealC: appeal.Appeal         = wire[appeal.Appeal]
+  lazy val ask: Ask                       = wire[Ask]
   lazy val auth: Auth                     = wire[Auth]
   lazy val feed: Feed                     = wire[Feed]
   lazy val playApi: PlayApi               = wire[PlayApi]
@@ -126,6 +127,7 @@ final class LilaComponents(
   lazy val irwin: Irwin                   = wire[Irwin]
   lazy val learn: Learn                   = wire[Learn]
   lazy val lobby: Lobby                   = wire[Lobby]
+  lazy val localPlay: Local               = wire[Local]
   lazy val main: Main                     = wire[Main]
   lazy val msg: Msg                       = wire[Msg]
   lazy val mod: Mod                       = wire[Mod]

app/controllers/Ask.scala

@@ -0,0 +1,128 @@
+package controllers
+
+import play.api.data.Form
+import play.api.data.Forms.single
+import views.*
+
+import lila.app.{ given, * }
+import lila.core.id.AskId
+import lila.core.ask.Ask
+
+final class Ask(env: Env) extends LilaController(env):
+
+  def view(aid: AskId, view: Option[String], tally: Boolean) = Open: _ ?=>
+    env.ask.repo.getAsync(aid).flatMap {
+      case Some(ask) => Ok.snip(views.askUi.renderOne(ask, intVec(view), tally))
+      case _         => fuccess(NotFound(s"Ask $aid not found"))
+    }
+
+  def picks(aid: AskId, picks: Option[String], view: Option[String], anon: Boolean) = OpenBody: _ ?=>
+    effectiveId(aid, anon).flatMap:
+      case Some(id) =>
+        val setPicks = () =>
+          env.ask.repo.setPicks(aid, id, intVec(picks)).map {
+            case Some(ask) => Ok.snip(views.askUi.renderOne(ask, intVec(view)))
+            case _         => NotFound(s"Ask $aid not found")
+          }
+        feedbackForm
+          .bindFromRequest()
+          .fold(
+            _ => setPicks(),
+            text =>
+              setPicks() >> env.ask.repo.setForm(aid, id, text.some).flatMap {
+                case Some(ask) => Ok.snip(views.askUi.renderOne(ask, intVec(view)))
+                case _         => NotFound(s"Ask $aid not found")
+              }
+          )
+      case _ => authenticationFailed
+
+  def form(aid: AskId, view: Option[String], anon: Boolean) = OpenBody: _ ?=>
+    effectiveId(aid, anon).flatMap:
+      case Some(id) =>
+        env.ask.repo.setForm(aid, id, feedbackForm.bindFromRequest().value).map {
+          case Some(ask) => Ok.snip(views.askUi.renderOne(ask, intVec(view)))
+          case _         => NotFound(s"Ask $aid not found")
+        }
+      case _ => authenticationFailed
+
+  def unset(aid: AskId, view: Option[String], anon: Boolean) = Open: _ ?=>
+    effectiveId(aid, anon).flatMap:
+      case Some(id) =>
+        env.ask.repo
+          .unset(aid, id)
+          .map:
+            case Some(ask) => Ok.snip(views.askUi.renderOne(ask, intVec(view)))
+            case _         => NotFound(s"Ask $aid not found")
+
+      case _ => authenticationFailed
+
+  def admin(aid: AskId) = Auth: _ ?=>
+    env.ask.repo
+      .getAsync(aid)
+      .map:
+        case Some(ask) => Ok.snip(views.askAdminUi.renderOne(ask))
+        case _         => NotFound(s"Ask $aid not found")
+
+  def byUser(username: UserStr) = Auth: _ ?=>
+    me ?=>
+      Ok.async:
+        for
+          user <- env.user.lightUser(username.id)
+          asks <- env.ask.repo.byUser(username.id)
+          if (me.is(user)) || isGranted(_.ModerateForum)
+        yield views.askAdminUi.show(asks, user.get)
+
+  def json(aid: AskId) = Auth: _ ?=>
+    me ?=>
+      env.ask.repo
+        .getAsync(aid)
+        .map:
+          case Some(ask) =>
+            if (me.is(ask.creator)) || isGranted(_.ModerateForum) then JsonOk(ask.toJson)
+            else JsonBadRequest(jsonError(s"Not authorized to view ask $aid"))
+          case _ => JsonBadRequest(jsonError(s"Ask $aid not found"))
+
+  def delete(aid: AskId) = Auth: _ ?=>
+    me ?=>
+      env.ask.repo
+        .getAsync(aid)
+        .map:
+          case Some(ask) =>
+            if (me.is(ask.creator)) || isGranted(_.ModerateForum) then
+              env.ask.repo.delete(aid)
+              Ok
+            else Unauthorized
+          case _ => NotFound(s"Ask id ${aid} not found")
+
+  def conclude(aid: AskId) = authorized(aid, env.ask.repo.conclude)
+
+  def reset(aid: AskId) = authorized(aid, env.ask.repo.reset)
+
+  private def effectiveId(aid: AskId, anon: Boolean)(using ctx: Context) =
+    ctx.myId match
+      case Some(u) => fuccess((if anon then Ask.anonHash(u.toString, aid) else u.toString).some)
+      case _ =>
+        env.ask.repo
+          .isOpen(aid)
+          .map:
+            case true  => Ask.anonHash(ctx.ip.toString, aid).some
+            case false => none[String]
+
+  private def authorized(aid: AskId, action: AskId => Fu[Option[lila.core.ask.Ask]]) = Auth: _ ?=>
+    me ?=>
+      env.ask.repo
+        .getAsync(aid)
+        .flatMap:
+          case Some(ask) =>
+            if (me.is(ask.creator)) || isGranted(_.ModerateForum) then
+              action(ask._id).map:
+                case Some(newAsk) => Ok.snip(views.askUi.renderOne(newAsk))
+                case _            => NotFound(s"Ask id ${aid} not found")
+            else fuccess(Unauthorized)
+          case _ => fuccess(NotFound(s"Ask id $aid not found"))
+
+  private def intVec(param: Option[String]) =
+    param.map(_.split('-').filter(_.nonEmpty).map(_.toInt).toVector)
+
+  private val feedbackForm =
+    Form[String](single("text" -> lila.common.Form.cleanNonEmptyText(maxLength = 80)))

app/controllers/Feed.scala

@@ -12,7 +12,8 @@ final class Feed(env: Env) extends LilaController(env):
     Reasonable(page):
       for
         updates      <- env.feed.paginator.recent(isGrantedOpt(_.Feed), page)
-        renderedPage <- renderPage(views.feed.index(updates))
+        hasAsks      <- env.ask.repo.preload(updates.currentPageResults.map(_.content.value)*)
+        renderedPage <- renderPage(views.feed.index(updates, hasAsks))
       yield Ok(renderedPage)
 
   def createForm = Secure(_.Feed) { _ ?=> _ ?=>
@@ -29,12 +30,12 @@ final class Feed(env: Env) extends LilaController(env):
   }
 
   def edit(id: String) = Secure(_.Feed) { _ ?=> _ ?=>
-    Found(api.get(id)): up =>
+    Found(api.edit(id)): up =>
       Ok.async(views.feed.edit(api.form(up.some), up))
   }
 
   def update(id: String) = SecureBody(_.Feed) { _ ?=> _ ?=>
-    Found(api.get(id)): from =>
+    Found(api.edit(id)): from =>
       bindForm(api.form(from.some))(
         err => BadRequest.async(views.feed.edit(err, from)),
         data => api.set(data.toUpdate(from.id.some)).inject(Redirect(routes.Feed.edit(from.id)).flashSuccess)

app/controllers/ForumTopic.scala

@@ -54,10 +54,14 @@ final class ForumTopic(env: Env) extends LilaController(env) with ForumControlle
               .soUse: _ ?=>
                 forms.postWithCaptcha(inOwnTeam).some
             _ <- env.user.lightUserApi.preloadMany(posts.currentPageResults.flatMap(_.post.userId))
+            (_, hasAsks) <- env.user.lightUserApi
+              .preloadMany(posts.currentPageResults.flatMap(_.post.userId))
+              .zip(env.ask.repo.preload(posts.currentPageResults.map(_.post.text)*))
             res <-
               if canRead then
                 Ok.page(
-                  views.forum.topic.show(categ, topic, posts, form, unsub, canModCateg, None, replyBlocked)
+                  views.forum.topic
+                    .show(categ, topic, posts, form, unsub, canModCateg, None, replyBlocked, hasAsks)
                 ).map(_.withCanonical(routes.ForumTopic.show(categ.id, topic.slug, page)))
               else notFound
           yield res

app/controllers/Local.scala

@@ -0,0 +1,138 @@
+package controllers
+
+import play.api.libs.json.*
+import play.api.i18n.Lang
+import play.api.mvc.*
+import play.api.data.*
+import play.api.data.Forms.*
+import views.*
+
+import lila.app.{ given, * }
+import lila.common.Json.given
+import lila.user.User
+import lila.rating.{ Perf, PerfType }
+import lila.security.Permission
+import lila.local.{ GameSetup, AssetType }
+
+final class Local(env: Env) extends LilaController(env):
+  def index(
+      white: Option[String],
+      black: Option[String],
+      fen: Option[String],
+      time: Option[String],
+      go: Option[String]
+  ) = Open:
+    val initial   = time.map(_.toFloat)
+    val increment = time.flatMap(_.split('+').drop(1).headOption.map(_.toFloat))
+    val setup =
+      if white.isDefined || black.isDefined || fen.isDefined || time.isDefined then
+        GameSetup(white, black, fen, initial, increment, optTrue(go)).some
+      else none
+    for
+      bots <- env.local.repo.getLatestBots()
+      page <- renderPage(indexPage(setup, bots, none))
+    yield Ok(page).enforceCrossSiteIsolation.withHeaders("Service-Worker-Allowed" -> "/")
+
+  def bots = Open:
+    env.local.repo
+      .getLatestBots()
+      .map: bots =>
+        JsonOk(Json.obj("bots" -> bots))
+
+  def assetKeys = Open: // for service worker
+    JsonOk(env.local.api.assetKeys)
+
+  def devIndex = Auth: _ ?=>
+    for
+      bots   <- env.local.repo.getLatestBots()
+      assets <- getDevAssets
+      page   <- renderPage(indexPage(none, bots, assets.some))
+    yield Ok(page).enforceCrossSiteIsolation.withHeaders("Service-Worker-Allowed" -> "/")
+
+  def devAssets = Auth: ctx ?=>
+    getDevAssets.map(JsonOk)
+
+  def devBotHistory(botId: Option[String]) = Auth: _ ?=>
+    env.local.repo
+      .getVersions(botId.map(UserId.apply))
+      .map: history =>
+        JsonOk(Json.obj("bots" -> history))
+
+  def devPostBot = SecureBody(parse.json)(_.BotEditor) { ctx ?=> me ?=>
+    ctx.body.body
+      .validate[JsObject]
+      .fold(
+        err => BadRequest(Json.obj("error" -> err.toString)),
+        bot =>
+          env.local.repo
+            .putBot(bot, me.userId)
+            .map: updatedBot =>
+              JsonOk(updatedBot)
+      )
+  }
+
+  def devNameAsset(key: String, name: String) = Secure(_.BotEditor): _ ?=>
+    env.local.repo
+      .nameAsset(none, key, name, none)
+      .flatMap(_ => getDevAssets.map(JsonOk))
+
+  def devDeleteAsset(key: String) = Secure(_.BotEditor): _ ?=>
+    env.local.repo
+      .deleteAsset(key)
+      .flatMap(_ => getDevAssets.map(JsonOk))
+
+  def devPostAsset(notAString: String, key: String) = SecureBody(parse.multipartFormData)(_.BotEditor) {
+    ctx ?=>
+      val tpe: AssetType         = notAString.asInstanceOf[AssetType]
+      val author: Option[String] = ctx.body.body.dataParts.get("author").flatMap(_.headOption)
+      val name                   = ctx.body.body.dataParts.get("name").flatMap(_.headOption).getOrElse(key)
+      ctx.body.body
+        .file("file")
+        .map: file =>
+          env.local.api
+            .storeAsset(tpe, key, file)
+            .flatMap:
+              case Left(error) => InternalServerError(Json.obj("error" -> error.toString)).as(JSON)
+              case Right(assets) =>
+                env.local.repo
+                  .nameAsset(tpe.some, key, name, author)
+                  .flatMap(_ => (JsonOk(Json.obj("key" -> key, "name" -> name))))
+        .getOrElse(fuccess(BadRequest(Json.obj("error" -> "missing file")).as(JSON)))
+  }
+
+  private def indexPage(setup: Option[GameSetup], bots: JsArray, devAssets: Option[JsObject] = none)(using
+      ctx: Context
+  ) =
+    given setupFormat: Format[GameSetup] = Json.format[GameSetup]
+    views.local.index(
+      Json
+        .obj("pref" -> pref, "bots" -> bots)
+        .add("setup", setup)
+        .add("assets", devAssets)
+        .add("userId", ctx.me.map(_.userId))
+        .add("username", ctx.me.map(_.username))
+        .add("canPost", isGrantedOpt(_.BotEditor)),
+      if devAssets.isDefined then "local.dev" else "local"
+    )
+
+  private def getDevAssets =
+    env.local.repo.getAssets.map: m =>
+      JsObject:
+        env.local.api.assetKeys
+          .as[JsObject]
+          .fields
+          .collect:
+            case (category, JsArray(keys)) =>
+              category -> JsArray:
+                keys.collect:
+                  case JsString(key) if m.contains(key) =>
+                    Json.obj("key" -> key, "name" -> m(key))
+
+  private def pref(using ctx: Context) =
+    lila.pref.JsonView
+      .write(ctx.pref, false)
+      .add("animationDuration", ctx.pref.animationMillis.some)
+      .add("enablePremove", ctx.pref.premove.some)
+
+  private def optTrue(s: Option[String]) =
+    s.exists(v => v == "" || v == "1" || v == "true")

app/controllers/Push.scala

@@ -15,7 +15,7 @@ final class Push(env: Env) extends LilaController(env):
 
   def webSubscribe = AuthBody(parse.json) { ctx ?=> me ?=>
     val currentSessionId = ~env.security.api.reqSessionId(ctx.req)
-    ctx.body.body
+    ctx.body.body.pp
       .validate[WebSubscription]
       .fold(
         err => BadRequest(err.toString),

app/controllers/RelayRound.scala

@@ -268,20 +268,22 @@ final class RelayRound(
         isSubscribed <- ctx.me.soFu: me =>
           env.relay.api.isSubscribed(rt.tour.id, me.userId)
         videoUrls <- embed match
-          case VideoEmbed.Auto =>
-            fuccess:
-              rt.tour.pinnedStream
-                .ifFalse(rt.round.isFinished)
-                .flatMap(_.upstream)
-                .map(_.urls(netDomain).toPair)
-          case VideoEmbed.No => fuccess(none)
           case VideoEmbed.Stream(userId) =>
             env.streamer.api
               .find(userId)
               .flatMapz(s => env.streamer.liveStreamApi.of(s).dmap(some))
               .map:
                 _.flatMap(_.stream).map(_.urls(netDomain).toPair)
-        crossSiteIsolation = videoUrls.isEmpty
+          case VideoEmbed.PinnedStream =>
+            fuccess:
+              rt.tour.pinnedStream
+                // the below line commented out for testy purposes
+                // .ifFalse(rt.round.isFinished)
+                .flatMap(_.upstream)
+                .map(_.urls(netDomain).toPair)
+          case _ => fuccess(none)
+        crossSiteIsolation = videoUrls.isEmpty || (rt.tour.pinnedStream.isDefined && crossOriginPolicy
+          .supportsCredentiallessIFrames(ctx.req))
         data = env.relay.jsonView.makeData(
           rt.tour.withRounds(rounds.map(_.round)),
           rt.round.id,

app/controllers/Round.scala

@@ -71,7 +71,7 @@ final class Round(
               jsChat <- chat.flatMap(_.game).map(_.chat).soFu(lila.chat.JsonView.asyncLines)
             yield Ok(data.add("chat", jsChat)).noCache
       )
-    yield res
+    yield res.enforceCrossSiteIsolation
 
   def player(fullId: GameFullId) = Open:
     env.round.proxyRepo