Public view and visitors

A town is private: nobody sees it without an account. Two exceptions exist, and you choose both.

The public view of a town

The owner of a town can make a public link. Anyone who has it sees the map of the town, without an account, in any browser. It is off until you make one.

• Read-only. The page has no panel, no mail, no button that does anything, and no connection to the socket of the town. The town hall answers it on one route only, GET /api/v1/spectate, with the token in the header Authorization: Spectator <token>.
• Anonymised. Citizens show their kind, their state and since when (to the minute), their building and the counts of a task in progress. They have no name: each one is named by its kind and a short tag, which changes with every new link. Their seats in a building are given in the order of those tags, so they never follow the real names. The names of the districts and buildings stay, as your town plan names them: rename one that names a person, a workstation or a client before you make a link (a local district usually names the workstation of a person, and then every citizen in it is that person’s).
• Never shown: logs, mail items, decisions, actions, events, members, e-mail addresses, agents, couriers, links, messages and secrets. The town hall removes them before the answer leaves; nothing is hidden by the browser.
• Late. The view shows the town as it was a few minutes ago: no delay, 5, 15 (the default), 30 or 60 minutes. Right after a link is made, or after the town hall restarts, the page says when it will start showing the town rather than show it live.
• Revocable. Making a new link ends the old one. Turning the view off revokes the link at once.
• Limited and audited. Each address reads the view at most 30 times a minute (the page reads it every 30 seconds). Making, replacing and revoking a link, changing the delay, and the views (counted, one entry an hour) are written to the audit log. A wrong link is refused like an unknown one.

Make a link

1. Sign in as the owner of the town.
2. Open Public view in the bar of the town.
3. Choose the delay, then Make a public link.
4. Copy the link at once: it is shown only once. It looks like https://your-town.example/spectate#<token>. The token is after #, so the browser never sends it in an address: the page sends it to the town hall in a header, which proxies do not write in their access logs.

The same calls are in the API, for the owner: GET /api/v1/spectator, POST /api/v1/spectator/link, PUT /api/v1/spectator (the delay) and DELETE /api/v1/spectator/link.

The link is not part of a town export (myrtille export): a town imported elsewhere has its public view off.

Visitors of the demo town

The demo town of the mock mode (myrtille dev --mock, and the hosted demo at demo.myrtille.eu) lets anyone in without a password, to look around: Visit the demo town on its sign-in page, or the address /?visit, which the Try the demo link of this site opens.

• A visitor sees the demo town, its mail and its report, like a viewer of every district.
• A visitor cannot open logs, decide a mail item, run an action, give a mission, or set anything up: the town hall refuses it, and writes the refusal to the audit log. All the visitors together share one budget of audited refusals a minute; beyond it, the minute is summed up in one entry.
• A visit ends after an hour without use, or after eight hours. One address holds at most 20 visits (its least recently used one ends first), at most 300 visits start a minute in all, and the town keeps 10,000 at most, ending the one idle the longest. A visitor opens at most 2 sockets, and all the visitors together 500.
• The demo account, printed on the console of the mock town hall, is still the owner of the demo town. The hosted demo never gives it to its visitors.

Only the mock mode takes visitors. A self-hosted or cloud town hall answers 404 to /api/v1/auth/visit, and lets nobody in without an account unless its owner made a public link.