# Spectator monitor

A separate loopback service serves a public, read-only projection of the realm.
It never forwards viewer paths, methods, cookies, authorization headers or query
parameters to the administrative application. It uses a fixed local GET to
`http://127.0.0.1:8787/api/state`, caches the sanitized result for ten seconds, and
marks delayed observations. Visitors refresh every fifteen seconds.

Published fields: online bot names, class, race, level, faction, zone, guild;
observed bot parties; guild goals and progress; confirmed social activity.
Only autonomous bot-to-bot reply transcripts are public. Human conversations,
whispers, memories, account/character IDs, tokens, configuration and PC telemetry
are excluded. All text is rendered with textContent, never HTML interpolation.
The HTTP service allows explicit public assets and read-only projections described
below. Mutation methods return 405; administrative command paths return 404.

## Install and publish

Run as the realm owner from the repository:

```sh
python3 scripts/test-spectator.py
python3 deploy/playable/install-spectator.py
```

The user service restarts automatically and listens only on `127.0.0.1:8790`.
User lingering, already used by runtime recovery, is required for boot startup.
Keep the existing private Tailscale Serve dashboard on HTTPS 443. Publish only
the spectator service on a separate HTTPS port:

```sh
sudo tailscale funnel --bg --https=8443 http://127.0.0.1:8790
```

If Tailscale presents a Funnel enablement link, the tailnet owner must complete
that authorization. Verify `tailscale funnel status` lists **only port 8443** as
public and port 443 remains tailnet-only. Share the printed HTTPS URL including
`:8443`. Visitors do not need Tailscale. This is a public link, without a password.
The host PC, Ubuntu VM and Tailscale must remain running.

Do not publish port 8787 or 8788, or change the administrative listener into a
Funnel. Hiding controls in the browser would not protect their APIs.

To turn public access off without disturbing the private dashboard:

```sh
sudo tailscale funnel --https=8443 off
```

To stop the local spectator service:

```sh
systemctl --user disable --now azerothai-spectator
```

After changing spectator source or assets, restart its service:

```sh
systemctl --user restart azerothai-spectator
```

## Shared dashboard (visitor edition)

The public root now serves the application's `/visitor` route, which uses the
same React dashboard and CSS as the administrator. Navigation, filters, profiles,
recipe details and the world monitor remain usable. Editing forms and GM inputs
are disabled; the action dispatcher also refuses writes in visitor mode.
The public server independently rejects every mutation method, including server
actions, and never proxies a viewer-selected backend route or request headers.

`/api/state` is an explicit public projection shaped for the shared UI. Bot memory
views contain confirmed shared social history, not private player conversations
or operator-injected memories. The event stream is a polling view of that public
history. `/api/health`, `/api/world-monitor` and `/api/operations` return selected
read-only indicators. Native account identifiers, raw command queues, credentials,
endpoint URLs and private maintenance logs are omitted. Built JavaScript/CSS/font
assets are served from `dist/client` with traversal and source-map requests denied.

Build with `pnpm build` before restarting `azerothai-runtime` and
`azerothai-spectator`. The existing Funnel address and private admin address stay
separate. No cache actions are added.