Staff avatars from Steam, cached in memory

The public staff page, the staff panel's staff list and the signed-in badge show each member's
Steam avatar over their initial. The panel fetches it from the profile XML (no Web API key),
keeps it in memory for a day (failures for an hour, one shared fetch per player) and serves it
from /avatar/<steamid> with a day's browser caching, so the CSP stays img-src 'self' and
visitors never contact Steam. Only SimpleAdmin admins are served; anything else falls back to the
initial.
This commit is contained in:
Astra 2026-09-28 11:36:05 +01:00
parent 6324fc7f81
commit 861692c534
6 changed files with 196 additions and 21 deletions

View file

@ -167,6 +167,8 @@ a { color: inherit; }
}
.avatar.lg { width: 56px; height: 56px; font-size: 24px; }
.avatar { position: relative; overflow: hidden; }
.avatar img { position: absolute; inset: 0; width: 100%; height: 100%; object-fit: cover; }
/* ---------- Main ---------- */