Major update 2 / login

routes/api.py

@@ -8,6 +8,38 @@ from flask import make_response
 api = Blueprint('api', __name__)
 
 
+# ------------------------------------------------------------------
+# Helper — look up clan by the X-Clan-Key header.
+# Returns the clan row dict, or None if key is missing / invalid.
+# ------------------------------------------------------------------
+def _get_clan_from_request():
+    key = request.headers.get('X-Clan-Key', '').strip()
+    if not key:
+        return None
+    conn = get_db()
+    clan = conn.execute('SELECT * FROM clans WHERE clan_key = ?', (key,)).fetchone()
+    conn.close()
+    return clan
+
+
+# ------------------------------------------------------------------
+# Helper — auto-register a player_id under a clan on first push.
+# ------------------------------------------------------------------
+def _auto_register_member(clan_id, player_id, player_name):
+    conn = get_db()
+    conn.execute('''
+        INSERT OR IGNORE INTO clan_members (clan_id, player_id, player_name)
+        VALUES (?, ?, ?)
+    ''', (clan_id, str(player_id), player_name or ''))
+    # Update name in case it changed
+    conn.execute('''
+        UPDATE clan_members SET player_name = ?
+        WHERE clan_id = ? AND player_id = ?
+    ''', (player_name or '', clan_id, str(player_id)))
+    conn.commit()
+    conn.close()
+
+
 # ------------------------------------------------------------------
 # POST /api/state
 # Tampermonkey pushes a full town snapshot every poll cycle.
@@ -18,11 +50,16 @@ def receive_state():
     if not data:
         return jsonify({'error': 'no data'}), 400
 
-    towns = data.get('towns', [])
-    player       = data.get('player', '')
-    player_id    = data.get('player_id', '')
-    alliance_id  = str(data.get('alliance_id', '') or '')
-    world_id     = data.get('world_id', '')
+    towns     = data.get('towns', [])
+    player    = data.get('player', '')
+    player_id = data.get('player_id', '')
+    alliance_id = str(data.get('alliance_id', '') or '')
+    world_id  = data.get('world_id', '')
+
+    # Auto-register this player to the clan that matches the key (if any)
+    clan = _get_clan_from_request()
+    if clan:
+        _auto_register_member(clan['id'], player_id, player)
 
     conn = get_db()
     c = conn.cursor()
@@ -260,9 +297,15 @@ def farm_status():
 # ------------------------------------------------------------------
 @api.route('/api/bot', methods=['GET'])
 def serve_bot():
+    # Require a valid clan key — reject unknown clients
+    clan = _get_clan_from_request()
+    if not clan:
+        return make_response('Unauthorized: invalid or missing clan key', 403)
+
     bot_dir = os.path.join(os.path.dirname(os.path.dirname(__file__)), 'bot_modules')
     if not os.path.exists(bot_dir):
         return make_response("Bot modules directory not found", 404)
+
         
     modules = sorted([f for f in os.listdir(bot_dir) if f.endswith('.js')])