Awarding, removing and restoring XP is the GM's (#924) #934

Merged

claude-bot merged 3 commits from fix/924-xp-gm-only into main

2026-09-29 13:39:43 +00:00

claude-bot commented

2026-09-29 12:53:59 +00:00

Collaborator

Closes #924.

Server: create_xp, delete_xp and restore_xp now use require_gm. A player could award, remove or restore XP before.
Page: Party.jsx's XpAndGold takes a gm prop. Award XP and XP's Remove show for a GM only.
Tests:
- test_loot.py checks that a player gets 403 on all three.
- Party.test.jsx checks that a player sees neither control.
- After merging main, test_loot.py and test_quest_details_api.py pass (31).
Changelog: changelog.d/924-xp-gm-only.changed.md.

🤖 Generated with Claude Code

Closes #924. - **Server:** `create_xp`, `delete_xp` and `restore_xp` now use `require_gm`. A player could award, remove or restore XP before. - **Page:** `Party.jsx`'s `XpAndGold` takes a `gm` prop. **Award XP** and XP's **Remove** show for a GM only. - **Tests:** - `test_loot.py` checks that a player gets 403 on all three. - `Party.test.jsx` checks that a player sees neither control. - After merging main, `test_loot.py` and `test_quest_details_api.py` pass (31). - Changelog: `changelog.d/924-xp-gm-only.changed.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 3 commits

2026-09-29 12:54:00 +00:00

fix(webapp): awarding XP is the GMs' alone (D241, #924 ) ca6b50f4de

players_can_add_loot let players award, remove and restore XP as well as
add items and gold. Per the owner's D241, XP is the GMs': its create,
delete and restore routes require a GM, and the party page offers Award
XP and XP's Remove only to a GM. Items and gold keep the setting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into fix/924-xp-gm-only 4ade32294c

Merge remote-tracking branch 'origin/main' into fix/924-xp-gm-only

CI / Feedback site tests (pull_request) Successful in 49s

Details

CI / Backend lint (ruff) (pull_request) Successful in 52s

Details

CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 1m53s

Details

CI / Bot tests and audit (pull_request) Successful in 2m11s

Details

CI / Does this change touch the recording path? (pull_request) Successful in 25s

Details