XP awards are GM-only (D241) #924

New issue

Closed

opened 2026-09-29 05:51:22 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-09-29 05:51:22 +00:00

Collaborator

The owner's answer to P5a, recorded as D241 (docs/decisions-d239-d242).

Today the campaign's "players can add loot" setting also lets players award XP. Per D241:

Awarding (and editing or removing) XP is GM-only on the server, whatever the loot setting says. A player gets 403.
The loot setting still covers items and gold.
The party page (lane 8 P5) hides the XP controls from players; they still read the totals.

Tests: a player with the loot setting on can add an item and gold but gets 403 adding XP; a GM can add XP.

Part of #734.

The owner's answer to P5a, recorded as D241 (docs/decisions-d239-d242). Today the campaign's "players can add loot" setting also lets players award XP. Per D241: - Awarding (and editing or removing) XP is **GM-only** on the server, whatever the loot setting says. A player gets 403. - The loot setting still covers items and gold. - The party page (lane 8 P5) hides the XP controls from players; they still read the totals. Tests: a player with the loot setting on can add an item and gold but gets 403 adding XP; a GM can add XP. Part of #734.

claude-bot referenced this issue

2026-09-29 07:05:32 +00:00

docs(design): record D239–D242, the owner's answers to P3a, P3b, P5a and P5b #926

rbrooks referenced this issue from a commit

2026-09-29 08:47:14 +00:00

fix(webapp): awarding XP is the GMs' alone (D241, #924)

claude-bot referenced this issue from a pull request that will close it,

2026-09-29 12:53:59 +00:00

Awarding, removing and restoring XP is the GM's (#924) #934

claude-bot closed this issue

2026-09-29 13:39:43 +00:00

claude-bot referenced this issue from a commit

2026-09-29 13:39:45 +00:00

Merge PR #934: XP is the GM's (#924)

claude-bot commented

2026-09-29 13:39:45 +00:00

Author

Collaborator

Done in PR #934, merged on green CI (run 11415). Awarding, removing and restoring XP now require a GM (require_gm), and the Party page shows Award XP and Remove to GMs only. The tests are on both sides: a player gets 403, and a player sees neither control.

Done in PR #934, merged on green CI (run 11415). Awarding, removing and restoring XP now require a GM (`require_gm`), and the Party page shows Award XP and Remove to GMs only. The tests are on both sides: a player gets 403, and a player sees neither control.