Improve admin stats and restore Cloudflare visitor IPs #1000

Merged

jimmyb merged 1 commit from codex/admin-registration-improvements into master

2026-10-27 11:45:09 -05:00

Codex commented

2026-10-27 11:25:50 -05:00

Member

Restyle admin game usage counts, highlight suspicious and banned users, and restore real visitor IPs behind Cloudflare.

Use responsive shared borders for Lists, Wishlists, and Favorites totals, with light and dark theme styling.
Highlight users with retained suspicious-registration audit records in amber and banned accounts in red, with banned status taking precedence. Fetch alert markers in one query for the displayed page.
Accept visitor-IP headers only from published Cloudflare ranges so registration throttling and suspicious-account matching use the visitor IP. Cloudflare addresses are not blocked.
Refresh both official range lists daily at 03:20 UTC, validating both before atomically replacing the snapshot. Retain the last good snapshot on failure and bundle initial ranges for first startup.

Verification: 105 focused/regression tests pass; the full suite passes with 1,394 passed and 2 skipped (512 MB test-process memory limit). PHPStan, Pint, frontend build, and diff checks pass. The Cloudflare updater also successfully fetched 15 IPv4 and 7 IPv6 ranges from the live official endpoints during isolated testing.

Deployment: Enable the Laravel scheduler runner, perform an initial range refresh with the explicit deployment environment, and retain the writable range snapshot across releases. Setup commands are documented in README.md. No database migrations or dependency changes. Historical stored IPs and alerts are unchanged.

Related: #49 and #937.

Restyle admin game usage counts, highlight suspicious and banned users, and restore real visitor IPs behind Cloudflare. - Use responsive shared borders for Lists, Wishlists, and Favorites totals, with light and dark theme styling. - Highlight users with retained suspicious-registration audit records in amber and banned accounts in red, with banned status taking precedence. Fetch alert markers in one query for the displayed page. - Accept visitor-IP headers only from published Cloudflare ranges so registration throttling and suspicious-account matching use the visitor IP. Cloudflare addresses are not blocked. - Refresh both official range lists daily at 03:20 UTC, validating both before atomically replacing the snapshot. Retain the last good snapshot on failure and bundle initial ranges for first startup. Verification: 105 focused/regression tests pass; the full suite passes with 1,394 passed and 2 skipped (512 MB test-process memory limit). PHPStan, Pint, frontend build, and diff checks pass. The Cloudflare updater also successfully fetched 15 IPv4 and 7 IPv6 ranges from the live official endpoints during isolated testing. Deployment: Enable the Laravel scheduler runner, perform an initial range refresh with the explicit deployment environment, and retain the writable range snapshot across releases. Setup commands are documented in README.md. No database migrations or dependency changes. Historical stored IPs and alerts are unchanged. Related: #49 and #937.

Rows
Columns