Crate sl_map_web 

sl-map-web

Web UI and JSON API for the SL map renderer. Same capabilities as sl-map-cli (render from a grid rectangle, render from a USB notecard with route overlay), exposed over HTTP via axum.

Authentication

All UI and render endpoints require a logged-in session. The expected flow is:

1. The avatar clicks an in-world LSL object.
2. The object calls POST /api/auth/register with Authorization: Bearer <pre-shared token> and a JSON body containing the avatar’s UUID (agent_key), legacy_name (e.g. "Foo Resident"), and username (e.g. "foo.resident").
3. The server upserts the user (UUID is the stable primary key; legacy name and username are refreshed on every call), generates a single-use time-limited token, and returns { set_password_url, expires_at, user }.
4. The LSL script chats the set_password_url back to the avatar.
5. The avatar opens the URL, picks a password, and the token is consumed.
6. Subsequent visits sign in at /login with the chosen password against either the UUID, the firstname.lastname username, or the legacy Firstname Lastname display.

Running a password-set flow on an existing account doubles as a password reset — all of that user’s existing sessions are revoked when a new password is set.

Required configuration

These environment variables (or matching CLI flags) must be set; the binary refuses to start if any of them is missing or invalid.

Variable	Purpose
SL_MAP_WEB_CACHE_DIR	tile / region cache directory shared with the CLI
SL_MAP_WEB_STORAGE_DIR	directory for saved render images and uploaded logos (subdirectories are created on startup)
SL_MAP_WEB_FONTS_DIR	directory of selectable .ttf fonts for text overlays (GLW labels/legend, region names, text labels); must exist and contain at least one .ttf at startup (the workspace ships DejaVuSans.ttf)
SL_MAP_WEB_LSL_REGISTRATION_BEARER_TOKEN	pre-shared secret presented by the LSL registration object
SL_MAP_WEB_SESSION_SIGNING_KEY	base64-encoded ≥ 64 bytes used to sign the session cookie
SL_MAP_WEB_PUBLIC_BASE_URL	external base URL (e.g. https://maps.example.org) used to build set-password links

The remaining settings have sensible defaults — see --help for the full list, including the trusted-proxy / forwarded-header settings (SL_MAP_WEB_TRUSTED_PROXIES, SL_MAP_WEB_FORWARDED_HEADER) used when the server runs behind a reverse proxy.

The service does not terminate TLS. Run it behind a reverse proxy (nginx, Caddy, Traefik, …) that terminates HTTPS — the default cookie_secure=true means the session cookie will only be sent over HTTPS connections.

Modules

auth

Authentication primitives: extractors, middleware, password hashing, token generation, and session helpers.

client_ip

Axum extractor that resolves the real client IP address, honouring X-Forwarded-For or Forwarded only when the direct peer is in the configured trusted_proxies list.

config

Runtime configuration for the sl-map-web server.

csrf

Cross-site request forgery defense.

db

SQLite pool setup and migration runner.

error

Application error type and HTTP mapping.

fonts

Discovery of TrueType fonts under the configured crate::config::Config::fonts_directory.

groups

Database-level helpers for groups, memberships, and invitations.

jobs

In-memory store of render jobs and the per-job state used by handlers.

library

Saved notecards and saved renders: scope/destination types, permission helpers, and the orphan-file sweeper.

rate_limit

Token-bucket rate limiter for authenticated-user create endpoints, persisted in the rate_buckets table.

routes

HTTP route handlers.

state

Shared application state passed to every handler.

storage

On-disk storage of saved render image bytes.

usb_notecard

Helpers for accepting a USB notecard from either an upload, a textarea, or a reference to a previously-saved notecard by id.