NeoFrag Reborn 1.2.12

The Discord bot moves to version 0.2.0. To update it: replace its folder with the one from the new archive, keeping the .env file, run npm ci --omit=dev, then restart it. Then create a new access key in Administration → Discord — the page asks for it — and replace the old one in .env: without it, the bot lacks the Bugtracker permissions. Server setup also needs the Discord "Manage Channels" permission: re-invite a bot invited with 1.2.11 through the "Invite the bot" button, or give its role that permission in the server settings.

Added

• Discord bot: features that turn on one by one. Discord → Features lists what the bot can do (it declares this itself). Each one is turned on, off and configured from the administration; the change applies within a minute, without restarting the bot. The Resynchronize button brings everything back in line, and on startup the forum catches up on what was written on Discord while the bot was away.
• Discord bot: it catches up with the site when it returns. What is written on the site while the bot is off goes to Discord when it restarts, within the 30 days of events the site keeps. Until now it started again from the latest event, and what had been written in the meantime never reached Discord.
• Discord bot: server setup. From the administration, the bot creates a category on Discord, one Forum channel per chosen forum (with its prefixes as tags) and one role per chosen group, sets up the mappings itself, and reuses what already exists instead of duplicating it. A preview comes first, and the last setup can be undone.
• Discord bot: /forum. /forum account link gives a single-use link that links your Discord account to your site account; you can also choose to move what you had posted from Discord under your name. /forum account unlink unlinks it. Without a linked account, /forum visibility lets you choose how you appear on the forum: your Discord username, an anonymous name, or a username of your choice, which can be changed every seven days — messages already posted follow suit.
• Discord bot: forum prefixes ↔ Forum channel tags, in both directions: setting a prefix on a topic sets the tag on the thread, and vice versa.
• Discord bot: the Bugtracker in a Forum channel (feature to turn on in Discord → Features). Each ticket becomes a thread: its type and status are its tags, which the bot creates in the channel and keeps up to date. Title, description and priority follow; the thread is archived when the ticket is closed, and a duplicate points to its original ticket. Comments go both ways. From Discord, /bug and /idee open a ticket through a small dialog (title, description), and a thread opened by hand in the channel becomes a ticket — for a member who has linked their account. Tickets still open get their thread when the channel is chosen. The site is authoritative: a tag changed by hand on Discord is set back to what the ticket says.
• Discord bot: timed roles (feature to turn on). The /role command, reserved for those who can manage roles, gives a member a role for a set time (a sanction, trial access, an event role), removes it or shows the active ones. The bot removes it when it expires, even after a restart, and gives it back to a member who leaves then rejoins the server to escape it. Roles linked to a site group, roles managed by Discord and roles placed at or above the highest role of the bot or of whoever gives them are refused. The Discord → Timed roles page lists them, with "Remove now".
• API: two new permissions, "Read the Bugtracker" (bugtracker:read) and "Write to the Bugtracker" (bugtracker:write). They let a program read tickets (GET bugtracker/tickets, only the open ones with open=1) and their comments, open a ticket on behalf of a member, comment on it on behalf of a member or a Discord account, and edit or delete those comments. A forum topic's prefix can also be changed through the API (PATCH forum/topics/{id}). The bot gets the discord/* endpoints of its new features: timed roles (discord/timed-roles), server setup, account linking.

Security

• A title written through the API can no longer inject code into the site's pages. The title of a topic created through the API — for example the name of a Discord thread copied by the bot — was stored as is, while the forum displays its titles without re-encoding them: an HTML tag in that title ran on the forum page. The API now stores its texts the way the site stores its own, and the tab title is always encoded.

Fixed

• Accents in the Bugtracker were displayed as "réagit" on the page of a ticket opened through the form, and the "Already reported?" search found no accented word. The texts the API returns — usernames, titles, descriptions, comments — are also in plain text: the Discord bot copied them encoded. Link sharing previews (Discord included) no longer show "é".
• Bugtracker: choosing the "Duplicate" status without a valid ticket number kept the old status while announcing "Ticket updated"; the message now says what was not applied.
• Discord bot: deleting on Discord the copy of a site message no longer erases the original. When the bot no longer had that message in memory (after a restart), deleting on Discord the copy of a message written on the site by a member with a linked account also erased the message on the site. In that case, the bot now only erases on the site the messages that came from Discord.
• The wiki: on the wiki home page, a top-level page without subpages showed as an empty section; it now shows its first sections (or the start of its text) and a link to read it, and the sidebar turns it into a link.
• Not-found and forbidden pages are no longer empty pages. On all public themes, an address that leads nowhere (404) or a restricted page (403) showed only the header and the footer, without a word — a defect inherited from NeoFrag. They now say what is happening, in all six languages, with a button back to the home page (to the dashboard in the administration), and the browser tab reads "Page not found" or "Unauthorized access" instead of the module name.