isadmin() — Super Admin only (users.user_level === 0).
Checked three times: the CMS ▾ sidebar entry (itself wrapped in a redundant nested @if (isadmin())),
LaunchUrlController::index() (abort(404) on failure), and both write endpoints
save() / delete() (ajaxError(backend.permission_error)). No skin
feature flag is involved, and the routes carry no route-level permission middleware — the controller is the gate.
);
const LaunchUrls = () => {
window.useLocale && window.useLocale();
const feed = useHrsFetch(() => window.sb.list("launchUrls", { limit: 200 }), []);
const save = useHrsSave(feed);
const rows = React.useMemo(() => (feed.data || []).map(hluRow), [feed.data]);
const [drafts, setDrafts] = useStateLU({});
const [pending, setPending] = useStateLU([]); // not-yet-saved rows, each its own draft
const [expanded, setExpanded] = useStateLU(() => new Set());
const [invalid, setInvalid] = useStateLU({}); // row id / pending key → offending field (the campierrati highlight)
const [search, setSearch] = useStateLU("");
/* Drafts are seeded from the server rows once they arrive, and re-seeded on
every refetch. Any row the operator has since edited keeps its draft — a
background refresh must not silently discard typing. */
useEffectLU(() => {
setDrafts(d => {
const next = {};
rows.forEach(r => { next[r.id] = d[r.id] || { name: r.name, url: r.url }; });
return next;
});
}, [rows]);
const toggleExpand = (id) => setExpanded(s => {
const n = new Set(s);
n.has(id) ? n.delete(id) : n.add(id);
return n;
});
const clearInvalid = (key) => setInvalid(v => (v[key] ? { ...v, [key]: null } : v));
const setDraft = (id, field, val) => { clearInvalid(id); setDrafts(d => ({ ...d, [id]: { ...(d[id] || {}), [field]: val } })); };
const isDirty = (id) => {
const d = drafts[id];
const r = rows.find(x => x.id === id);
if (!d || !r) return false;
return d.name !== r.name || d.url !== r.url;
};
/* POST launchurls.save with {id, name, url}. LaunchUrlService::update()
forgets the launch_urls.all cache and dispatches LaunchUrlUpdated. */
const handleSave = (id) => {
const d = drafts[id];
if (!d) return;
const err = hluValidate(d.name, d.url);
if (err) {
setInvalid(v => ({ ...v, [id]: err.field }));
hrsToast("Save failed", `${err.msg} — StoreLaunchUrlRequest::failedValidation() answers with ajaxError(message, {campierrati: ["${err.field}"]}), which red-outlines the field in the shared AJAX modal.`); /* label inferred — backend.save_failed */
return;
}
clearInvalid(id);
const name = d.name.trim(), url = d.url.trim();
save.run(() => window.sb.update("launchUrls", id, { name, url }),
{ done: "Operation performed successfully.", fail: "Save failed" });
};
/* POST launchurls.delete with {id}. Refused when is_system (controller +
service) or when a provider still references the row (controller only) —
the button is pre-disabled in both cases, exactly as the Blade view does. */
const handleDelete = (row) => {
if (row.isSystem || (row.providers || 0) > 0) return; // guarded — button is disabled in this case
if (!confirm(`Delete "${row.name}"? This can't be undone.`)) return; /* label inferred — backend.confirm_delete_launch_url */
/* Both guards already passed to get here: is_system is false and
providers(count) is 0. The row carries deleted_at, so sb.remove soft
deletes — a launch URL a provider once pointed at stays resolvable. */
save.run(() => window.sb.remove("launchUrls", row.id),
{ done: "Operation performed successfully.", fail: "Delete failed" });
};
/* "Add Launch URL" prepends a .lu-new row with the ID cell reading "New";
the same save endpoint upserts on the absence of `id`. Every click opens
another independent pending row, so several environments can be drafted
and saved in any order. */
const addPendingRow = () => setPending(p => [...p, { key: `p${Date.now()}${Math.random().toString(36).slice(2)}`, name: "", url: "" }]);
const setPendingField = (key, field, val) => { clearInvalid(key); setPending(p => p.map(x => x.key === key ? { ...x, [field]: val } : x)); };
const discardPending = (key) => { clearInvalid(key); setPending(p => p.filter(x => x.key !== key)); };
const savePendingRow = (key) => {
const draft = pending.find(x => x.key === key);
if (!draft) return;
const err = hluValidate(draft.name, draft.url);
if (err) {
setInvalid(v => ({ ...v, [key]: err.field }));
hrsToast("Save failed", `${err.msg} — StoreLaunchUrlRequest::failedValidation() answers with ajaxError(message, {campierrati: ["${err.field}"]}), which red-outlines the field in the shared AJAX modal.`); /* label inferred — backend.save_failed */
return;
}
clearInvalid(key);
/* is_system is not sent: it defaults to false, and only the migration's
seeded environments are system rows. The identity column assigns the id. */
save.run(() => window.sb.create("launchUrls", { name: draft.name.trim(), url: draft.url.trim() }),
{ done: "Operation performed successfully.", fail: "Save failed" })
.then(res => { if (res && res.ok) setPending(p => p.filter(x => x.key !== key)); });
};
const copyUrl = (url) => {
if (!url) return;
/* Both failure paths used to be silent: no `else` when the Clipboard API is
absent (it needs a secure context), and no `catch` when the write is
refused. Either way the operator clicked and nothing at all happened. */
const failed = () => hrsToast("Could not copy", "The browser refused clipboard access — select the URL in the row and copy it manually.");
if (navigator.clipboard?.writeText) {
navigator.clipboard.writeText(url)
.then(() => hrsToast("URL copied", "Clipboard only — the copy button sends no request.")) /* label inferred — backend.copy_url */
.catch(failed);
} else {
failed();
}
};
// Client-side substring filter on name OR url, exactly like the real #lu-search.
const q = search.trim().toLowerCase();
const filteredRows = q ? rows.filter(r => r.name.toLowerCase().includes(q) || r.url.toLowerCase().includes(q)) : rows;
const totalProviders = rows.reduce((s, r) => s + (r.providers || 0), 0);
const inv = (key, field) => (invalid[key] === field ? " lu-invalid" : "");
return (
providers.custom_launch_url stores this
row's id, and 0 means "use the integration's default host". Changes apply to game launches on all
servers as soon as they save — LaunchUrlService caches the list for an hour and busts that cache on
every write. URLs must start with http:// or https:// and must not end with a slash.
The six seeded environments are system rows and can never be deleted; any other entry can, but only once no
provider references it. Every save and delete is written to launch_url_logs, which no screen reads back.
| ID | Name | URL | {/* label inferred — backend.url */}Providers using | {/* label inferred — backend.providers_using */}Last updated | {/* label inferred — backend.last_updated */}||
|---|---|---|---|---|---|---|
| New | setPendingField(p.key, "name", e.target.value)} /> |
setPendingField(p.key, "url", e.target.value)} />
|
— | — |
|
|
| {r.id} | setDraft(r.id, "name", e.target.value)} /> |
setDraft(r.id, "url", e.target.value)} />
|
{r.providers} | {r.updated} |
|
|
|
ID{r.id}
Providers using{r.providers}
Last updated{r.updated}
|
||||||
{q ? <>No environments match "{search}".
: <>No launch URLs in launch_urls. The six LaunchUrlEnvironment
rows are seeded by the migration, so an empty table here usually means the read
was filtered to nothing rather than that the table is empty — check the session.}
|