Staff playtime figures on the staff panel only

Signed-in staff now see the public Playtime page and player drawers as
everyone else does; the staff panels, names, sessions and locations stay
on /admin#playtime and its drawers. The public API no longer sends them.

README.md

@@ -52,7 +52,7 @@ RCON. Without it the panel still works, but shows the server as offline and can'
   | Raw console commands (Server settings > Console; sent without waiting, output only logged) | `@css/rcon` |
   | See the Staff & ranks page | `@zio/webpanel` |
   | Give and remove verification overrides | `@zio/verify` (not on themselves, unless Root) |
-  | Staff playtime figures (Playtime page, player drawers, and on the public site when signed in) | `@css/generic` |
+  | Staff playtime figures (the staff panel's Playtime page and player drawers) | `@css/generic` |
   | PlaytimeHistory's own status on the Playtime page | `@css/root` |
   | Ranks, staff, SimpleAdmin settings, reload admins, GroupVerify's group and on/off | `@css/root` |
 
@@ -174,11 +174,12 @@ SAW_PT_DSN=pt_web:<password>@tcp(<db-host>:3306)/playtime_history
   are between players only, from `pt_events`: kills of bots, deaths to bots and suicides don't
   count, so they start with PlaytimeHistory 0.2.0.
 - **Staff** with `@css/generic` (PlaytimeHistory's own default for looking up others) get, on the
-  staff panel's Playtime page and on the public site while signed in: who's on now with how long,
-  team, ping and location; each staff member's time in the last 7 or 30 days; disconnect reasons;
-  countries; and in player drawers, the names they've used, recent sessions and location.
-  Root also sees whether the plugin is loaded and what `css_pt_status` says. Who's on comes from
-  the live status, so admins hidden with `css_hide` stay hidden.
+  staff panel only (its Playtime page, `/admin#playtime`, and its player drawers): who's on now
+  with how long, team, ping and location; each staff member's time in the last 7 or 30 days;
+  disconnect reasons; countries; and the names a player has used, their recent sessions and
+  location. Root also sees whether the plugin is loaded and what `css_pt_status` says. Who's on
+  comes from the live status, so admins hidden with `css_hide` stay hidden. Signed in or not,
+  the public site shows everyone the same.
 - **Days and hours of the day** are in the viewer's own time zone (the browser sends it). An hour
   goes to the day it starts on, which is exact for zones a whole number of hours from UTC.
 - **Locations** come from DB-IP City Lite, credited (CC BY 4.0) wherever they're shown. No IP

internal/web/assets/admin.js

@@ -944,7 +944,7 @@ async function act(path, method, body) {
 
 /* ---------- Routing & events ---------- */
 
-const playtime = () => ptPage(state.me, () => state.page === "playtime");
+const playtime = () => ptPage(state.me, () => state.page === "playtime", true);
 
 const RENDER = { overview, players, bans, comms, playtime, staff, verify, settings, notifications };
 

internal/web/assets/playtime.js

@@ -1,6 +1,7 @@
 // Playtime from PlaytimeHistory, shared by the public site and the staff panel: the Playtime page
-// and the Playtime sections of a player's drawer. Staff with @css/generic (me.playtimeStaff) also
-// get the staff-only figures, on either site. Needs common.js.
+// and the Playtime sections of a player's drawer. On the staff panel, staff with @css/generic
+// (me.playtimeStaff) also get the staff-only figures; the public site shows everyone the same.
+// Needs common.js.
 
 const PT_TZ = (() => { try { return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; } catch { return "UTC"; } })();
 const PT_PERIODS = [["7d", "Last 7 days"], ["30d", "Last 30 days"], ["all", "All time"]];
@@ -266,11 +267,12 @@ function ptStaffPanels(a) {
 
 /* ---------- Page ---------- */
 
-// ptPage draws the Playtime page into #view: the staff panels first when this viewer may see them,
-// then the public ones. isCurrent says whether the user is still on the page when data arrives.
-async function ptPage(me, isCurrent) {
+// ptPage draws the Playtime page into #view: with staff (the staff panel, for staff who may see
+// them), the staff panels first, then the public ones. isCurrent says whether the user is still on
+// the page when data arrives.
+async function ptPage(me, isCurrent, staffPanels = false) {
   const v = $("#view");
-  const staff = !!me?.playtimeStaff;
+  const staff = staffPanels && !!me?.playtimeStaff;
   v.innerHTML = `
   <div class="page-head"><div><h1>Playtime</h1></div></div>
   ${staff ? `<div id="pt-staff">${loading()}</div><h2 class="crew-sep">${me.playtime === "on" ? "On the public site" : ""}</h2>` : ""}

internal/web/assets/public.js

@@ -1,11 +1,11 @@
 // Public, read-only site: the live server, bans, gags/mutes, staff with their rank changes, and
 // playtime (playtime.js). The API leaves out who issued penalties and IPs; nothing here can change
-// anything. Signed-in staff with @css/generic also see staff playtime figures here.
+// anything. Signed-in staff see the same as everyone; their extras are on the staff panel.
 
 const PAGES = [
   { id: "server", label: "Server" },
-  // Once PlaytimeHistory has recorded something, or for staff who see its staff figures.
-  { id: "playtime", label: "Playtime", show: () => state.me?.playtime === "on" || !!state.me?.playtimeStaff },
+  // Once PlaytimeHistory has recorded something. Staff figures are on the staff panel only.
+  { id: "playtime", label: "Playtime", show: () => state.me?.playtime === "on" },
   { id: "bans", label: "Bans" },
   { id: "comms", label: "Gags & Mutes" },
   { id: "staff", label: "Staff" },

internal/web/public.go

@@ -292,13 +292,9 @@ func (s *Server) publicPlayer(w http.ResponseWriter, r *http.Request) {
 		"steamid": steamid, "name": d.Name, "online": online, "rank": s.rankOf(x, steamid),
 		"bans": toPublic(bans), "comms": toPublic(comms),
 	}
-	// Signed-in staff get the staff playtime figures here too, as on the staff panel.
-	id, _, err := s.identity(r)
-	if err != nil {
-		internal(w, r, err)
-		return
-	}
-	if pt := s.playerPlaytime(r, steamid, s.ptStaff(r.Context(), id)); pt != nil {
+	// Everyone gets the public playtime here, signed-in staff included; the staff figures are on
+	// the staff panel only.
+	if pt := s.playerPlaytime(r, steamid, false); pt != nil {
 		resp["playtime"] = pt
 	}
 	writeJSON(w, http.StatusOK, resp)