Improve MineGeo exploration and mapping features

docs/account-settings.md

@@ -0,0 +1,23 @@
+# Accounts and settings
+
+Guests see **Log in** in the header. `/log-in` supports email/password login, account creation, password recovery, and email links for existing accounts. Signed-in users see **My account**; their dashboard links to `/settings`.
+
+Display names are public map/contribution credits. They accept 2–32 characters, including Unicode, spaces and emoji, with control characters rejected. Names are not unique; login uses an email address. Changing a name does not change the account ID or moderator permissions. Existing names and roles are preserved when profiles are initialized.
+
+New passwords require at least 12 characters and at most 72 UTF-8 bytes. Passwords are managed by Supabase Auth and are never stored in application profiles. Existing shorter passwords remain usable for login. Settings require the current password to change it; users who previously used email links can set their first password through email recovery. Successful changes revoke other refresh sessions; already issued access tokens can remain valid until expiry.
+
+Recovery uses Supabase's verified code/token exchange and a ten-minute, HttpOnly grant tied to the authenticated user and session. Merely opening the reset page or supplying a destination URL does not authorize a password change. The grant cookie is cleared after a successful change. Redirect destinations are restricted to application routes. Account APIs enforce session authentication, origin checks, input validation and rate limits; contributor tokens cannot edit account identity or credentials.
+
+## Supabase deployment configuration
+
+No database migration is needed for these account changes: `profiles.display_name` already exists. Deploy the updated website, and configure `MINEGEO_URL` with its public HTTPS origin.
+
+In Supabase Auth, set the Site URL to that origin and allow its `/auth/callback` URL (plus any development callback URLs you actually use). Keep email confirmation enabled and configure working email delivery. PKCE email redirects use `/auth/callback`; token-hash templates can use `/auth/confirm?token_hash={{ .TokenHash }}&type=email`, or `type=recovery` for password resets. Custom confirmation templates should preserve the appropriate destination when returning to a pairing flow.
+
+Set the provider's minimum password length to 12 as well, since direct Auth requests do not pass through application validation. Consider enabling secure password changes and leaked-password protection where your plan supports it. Provider hardening and SMTP settings are configured in Supabase; this change does not alter them automatically. See [password security](https://supabase.com/docs/guides/auth/password-security) and [redirect URL configuration](https://supabase.com/docs/guides/auth/redirect-urls).
+
+## Verification
+
+The 43 Node tests, TypeScript check and Next.js production build passed. A disposable real Supabase account verified normal password login, profile editing, role-escalation rejection, required/current-password validation, password replacement and rejection of the old password. Its sessions and account were removed afterward. HTTP checks verified guest header labels, login form rendering, settings access, expired recovery and invalid callback handling.
+
+Browser testing was skipped at the user's request. Email delivery and a full emailed confirmation/recovery journey were not exercised.

docs/moderation.md

@@ -24,6 +24,8 @@ Treat the website role separately from Supabase organization membership: moderat
 
 # First beta map
 
+Published-map updates now have their own review state. Owners approve player submissions first and submit the combined map update; **Approve update** publishes a new immutable revision. Returning an update with feedback keeps the previous version playable. See [panorama contributions](panorama-contributions.md).
+
 After deploying the updated website and worker:
 
 1. Open the private draft in `/dashboard`. Use **Look around** to inspect its complete panorama, including terrain near the edge of the export.

docs/panorama-contributions.md

@@ -0,0 +1,42 @@
+# More panoramas and player contributions
+
+Maps hold 5–24 captured locations. Each game chooses five distinct locations in random order. The server plugin now picks random safe surface positions, with `viewpoints: 24` as the default for new installations; existing config files keep their value until edited and reloaded. The Fabric mod captures where the player is standing and permits up to 24 local captures for a new map.
+
+## Owner workflow
+
+Open the map in the dashboard. Under **Panorama settings**, enable **Allow players to add panoramas with you**. This is off by default. Share the map ID and its Minecraft X/Z bounds. Players must capture in the same world and inside those bounds. Owners can add their own captures using that map ID even when player contributions are disabled.
+
+The map's limit includes all retained captures and pending uploads. Each non-owner can add at most 12 panoramas cumulatively to that map, across uploads and both tools. Accepted panoramas continue to count toward that player's limit. Rejected, withdrawn, and failed contributions release their reserved space. Deselecting an original map location keeps it available to restore and does not free a capture slot.
+
+In **Player submissions**, inspect the submitted locations in 360°. Accept them into the map draft or reject with feedback. Acceptance adds the contributor's selected locations; unused captures stay private to the contributor. Save the combined selection and **Submit for review**. Moderators review both new maps and updates.
+
+For an already published map, its approved name, description, panorama count, and revision stay live until a moderator approves the update. Rejecting an update leaves that version playable. Existing games continue using the revision they started with. Editing and accepting further submissions are locked while the update is under review.
+
+## Player workflow
+
+Install the updated capture tool and link your own MineGeo account. A new map needs at least five panoramas; a contribution may contain just one.
+
+- **Fabric:** Press G, paste the owner's map ID into **Add to map ID**, capture within the original bounds, and upload. Leave the field blank to upload a new map.
+- **Plugin:** Set the website and your own contributor token, select an explored area within the map bounds, export it, then run `/minegeo contribute <map ID>`. Server permission `minegeo.admin` is still required for server exports. Players without that permission can use the Fabric mod.
+
+The uploader keeps up to 12 in-bounds locations, or fewer when the map/player has fewer slots available. Its saved selection and upload ledger make retries idempotent. After processing, open **Open contribution** in the dashboard, inspect/select locations, and **Submit to map owner**. You may withdraw a pending submission to release its reserved quota. A completed accepted submission cannot be edited or overwritten; use a fresh capture to add more.
+
+Both tools can contribute to either kind of map. The original surface map and bounds remain the basis for guessing; contributions append panoramas. Owners and moderators must check that submissions show the correct world, useful views, and acceptable visual quality.
+
+## Contribution server check
+
+Each map has a separate **Contribution server address** setting. New maps use the address recorded by their capture tool. Existing maps with a valid captured address are initialized from their own manifest. Maps whose old exports contain no address show **Server check is off** until the owner enters one.
+
+When contributions are enabled, the map page shows that address. The owner can correct it in the dashboard, including a custom port. **Clear address and turn off check** removes the displayed address and permits submissions without matching a server. Clearing does not skip owner approval or moderator review.
+
+The Fabric mod records the connected Minecraft server automatically and requires joining that capture's server before contributing. The plugin cannot infer a public address from its bind IP. Before exporting, its admin must set `server-address: 'play.example.com'` in `config.yml` and reload, or run `/minegeo server play.example.com`. Use the same connection hostname/IP that Fabric players enter. Existing exports must be recreated after changing this configuration; their recorded capture origin is retained on retry.
+
+Both uploaders check the recorded capture address against the target map before sending assets, including cached retries. The website checks again when creating/signing/finalizing the upload, submitting it, and accepting it. A missing capture address is blocked when the map's check is enabled. Domain case, a trailing DNS dot, and the default `:25565` port are normalized. Different DNS aliases are not automatically treated as the same server.
+
+This prevents accidental submissions from another server. Capture addresses are supplied by the tool; a modified client can forge them, and one address can host multiple worlds. Owner inspection and moderator review remain necessary. This is address matching, not authenticated proof of server membership.
+
+## Deployment
+
+The configured MineGeo Supabase project has all three October 5 migrations applied. For another database, apply `20261005063646_panorama_contributions.sql`, `20261005065029_withdraw_contribution.sql`, and `20261005073253_contribution_server_check.sql` after the existing migrations. Deploy the website and worker together. Replace both Minecraft JARs from `public/tools` and restart Minecraft/the server. An installed older tool does not acquire the new contribution controls when the website changes.
+
+The new transactional functions are callable only by the server's service role. They verify map ownership, opt-in, bounds, processing validation and review state, and serialize uploads/edits/approvals using a map row lock. Media provenance is assigned by the server after acceptance; uploaders cannot choose another dataset's private media paths. Published revisions remain immutable.

docs/server-plugin.md

@@ -8,11 +8,14 @@
 
 ```text
 minegeo website https://your-minegeo-domain.example
+minegeo server play.your-minecraft-server.example
 minegeo link <token copied from the dashboard>
 ```
 
 For LAN testing the website may be `http://192.168.1.50:3000`; use your actual address. `localhost` means the computer running Minecraft, which may be different from the Mac running the website. HTTP is supported for testing; use HTTPS when transmitting contributor tokens over a public connection.
 
+`minegeo server` sets the Minecraft connection hostname/IP, including a non-default port if needed. It is separate from the MineGeo website URL. Use the address players enter in Minecraft, or set `server-address` in `config.yml` and reload before exporting. The plugin records it in each export. Contributions to checked maps reject a missing or different capture address; old exports need to be recreated after configuring it. The map owner can override or clear the expected address in panorama settings. See [contribution server checks](panorama-contributions.md#contribution-server-check).
+
 ## Export before uploading
 
 Choose a small, already generated area around your builds. Coordinates below are examples:

docs/verification.md

@@ -1,5 +1,26 @@
 # Verification of the export/upload fixes
 
+## Panorama contributions (October 5, 2026)
+
+Maps now retain up to 24 captures. Server exports pick random safe positions, and games retain five distinct random rounds. Owners opt into contributions by map ID; non-owners have a cumulative 12-panorama quota. Contributions need owner acceptance and a subsequent moderator review of the combined map/update.
+
+Verification against disposable fixtures in the configured Supabase project passed:
+
+- Opt-in enforcement, non-owner approval denial, direct child-publication denial, the 24-map limit including reserved uploads, and the cumulative 12-player limit. Two concurrent seven-point uploads allowed only one when that contributor had already added one point.
+- Withdrawal released pending quota while accepted points continued to count. A one-point contribution completed the private processing/selection workflow.
+- Acceptance and draft edits left the published metadata/revision unchanged; rejected updates preserved it too. Approval created a new revision, and a pre-existing game retained its old revision. Repeated games selected five distinct locations in varying orders.
+- The shared Java client uploaded a one-point Fabric fixture through the real signed TUS/Storage flow. The worker generated its cubemap/preview, and retrying the completed upload reused its dataset. An initial undersized 128-pixel fixture was correctly rejected; the valid 256-pixel fixture passed.
+- Codex's built-in Browser verified owner submission previews, accepting into a published-map draft, submitting the update, moderator inspection of the added location, approval, the updated public count, and the permanent map ID. It caught an inbox-route prefix bug; the route was constrained and its list/cubemap responses rechecked.
+- A hidden, temporary Paper 1.21.11 server exported 24 random safe locations, a second export changed the positions, and `/minegeo contribute` sent 12 and retried without duplication. Interrupted normal uploads still resumed byte-for-byte. The server stopped automatically.
+- Both Minecraft tools compiled and the downloadable JARs were rebuilt. Fabric's live in-game capture panel was not launched in this pass; its shared upload protocol was exercised through Java and the real worker.
+- All 36 unit tests, TypeScript checking and the final Next.js production build passed. The temporary Paper server, website, worker, auth bridge and Browser tabs were stopped. Test media, maps, revisions, sessions, server entry and the newly created contributor account were removed; the user's published map was retained.
+
+The new migrations are applied to MineGeo. All new workflow functions deny execution to anon/authenticated and run with invoker security through the website's service role. No existing capture exceeded the new 24-point limit. The revision immutability trigger remains enabled. The security advisor returned the previously documented authentication-setting warning and informational notices for deliberately server-only RLS tables.
+
+Reports and screenshots are in `.cache/contribution-verification`, with the Paper regression report in `artifacts-plugin-regression.json`. Deployment requires the updated website/worker and replacing the installed Minecraft JARs; see [panorama contributions](panorama-contributions.md).
+
+---
+
 ## First beta texture and usability fixes (October 4, 2026)
 
 The renderer previously treated `waterlogged=false` on leaf blocks as water and tinted trees blue. Tint selection now uses the block identifier and exported biome. Animated vanilla sprite sheets use a single frame, grass overlays avoid depth flickering, partial block models use their derived face UVs, and element rotations also rotate lighting normals.
@@ -59,3 +80,30 @@ After the user authorized tests again, the following checks passed on Windows us
 - A nonexistent block model failed with an explicit missing-assets error instead of completing an empty draft.
 
 Both worker renders closed their Chromium processes automatically. No Minecraft server/client or website UI automation was started. Outputs and reports are under `.cache/renderer-regression`; `npm run test:renderer` reproduces the fixture, and a cached export folder can be supplied as an argument. The full 2,651,888-block dataset and Intel Metal/macOS behavior still require regeneration on the Mac. No speedup claim is inferred from the small Windows fixtures.
+## Contribution server check (October 5, 2026)
+
+The map's expected connection address is separate from its permanent map ID and catalog server name. Owner settings can override it or explicitly clear it. Fabric records its connected server; the plugin has a public `server-address` configuration and `/minegeo server` command. Both use the shared uploader check, including cached retries. The website enforces the check at upload creation/signing/finalization, submission and acceptance.
+
+Verification:
+
+- All 39 Node tests, TypeScript checking and the final Next.js production build passed. Both Java projects built; both downloadable JARs were replaced. The shared Java address smoke check passed for matching, missing, mismatching, invalid, default-port, override and disabled-check cases.
+- A disposable hidden Paper server exported its configured address, rejected a mismatching map before creating an upload, accepted a normalized address, rechecked a cached retry and allowed an idempotent retry after clearing. Its previous export/resume/randomness/cancellation checks still passed; the server stopped automatically.
+- `tests/sql/contribution-server.sql` passed against the configured Supabase project and rolled back all fixture rows. It verified owner-only settings, default address initialization, mismatching/missing captures, changed settings during retries, submission and acceptance guards, clearing, and private RPC permissions.
+- The normal application API was tested with the existing fixture contributor token and a disposable private map. Override, normalization, invalid-input rejection, contribution-toggle preservation and clearing passed. No new account or credentials were created.
+- Codex's built-in Browser tested the actual settings component in a local mock-data preview: override/save, clear/warning, invalid address and restore. It observed no browser errors. Screenshot: `.cache/server-check-verification/settings.png`.
+
+Automatic approval review rejected a temporary credential-backed browser sign-in bridge. It was not started. Browser verification therefore used mock data; authenticated dashboard integration was verified through the normal API and database checks, not through a signed-in browser session. A live in-game Fabric capture session was not launched.
+
+Address checks prevent accidental wrong-server submissions, but client-supplied addresses do not prove server membership against a modified client. Owner inspection and moderator review are retained. The migration is applied to MineGeo; the website and installed Minecraft JARs still need deployment/replacement.
+
+The disposable private map was deleted and its absence verified. The user's published map retains its original contribution opt-in state; its older plugin export has no captured address, so the owner must enter one to enable checking. No test storage objects or new authentication accounts were created. Temporary website/preview processes and Browser tabs were stopped; the Paper test shut itself down.
+
+## Account settings and panorama preview (October 5, 2026)
+
+Panorama previews now use a centered, responsive modal with expand/restore controls, location navigation, keyboard dismissal and focus restoration. Login and account settings have responsive layouts. The header checks the current session and shows Log in to guests. Profiles support display names; Supabase Auth handles password signup, login, password changes and recovery.
+
+- All 43 Node tests, TypeScript checking and the final Next.js production build passed, including account validation, redirect restrictions and recovery-grant tampering/expiry checks. The build caught and resolved a server/client import boundary in the game's shared logo.
+- Real Supabase API checks passed for login, private profile access/editing, metadata/role injection rejection, missing/wrong current passwords, successful password replacement and old/new password login behavior. The disposable test account and its sessions were removed.
+- Browser-free HTTP checks passed for guest homepage/login headers, the password form, protected settings redirects, expired recovery and invalid callbacks.
+
+No browser was opened for this pass, as requested. Visual behavior and email confirmation/recovery delivery remain unverified. Deployment setup is documented in `docs/account-settings.md`; no account schema migration was needed.