feat: add new matchmake routes for player, event, club, and code

- Implemented Charades word lists management in the admin UI, allowing for unlimited named word lists with difficulty settings.
- Added functionality to bind live card slots to specific word lists, with automatic fallback to built-in lists.
- Introduced a profanity filter toggle in server settings, enabling or disabling the server-side profanity filter.
- Updated database schema to support new features, including additional columns for profanity filter status and charades slot bindings.
- Enhanced documentation to reflect new features and their usage.

.gitignore

@@ -88,3 +88,4 @@ Recovered(*)/
 local-releases/**
 DorkNet.Models/bin-verify/**
 DorkNet.Models/bin-verify2/**
+identityserver-signing.pfx

Dockerfile

@@ -1,14 +1,14 @@
 # DorkNet.Server container image — Coolify deploy target.
 # ────────────────────────────────────────────────────────────────────
 # Multi-stage: SDK image builds + publishes, runtime image is the
-# slimmer aspnet:10.0 with only the published output.
+# slimmer aspnet:9.0 with only the published output.
 #
 # Build context: repo root (so Tools/ and DorkNet.Models/ are visible
 # to ProjectReference + dotnet restore). The .dockerignore at the
 # repo root keeps the bin/, obj/, and other dev junk out of the
 # context.
 
-ARG DOTNET_VERSION=10.0
+ARG DOTNET_VERSION=9.0
 ARG NODE_VERSION=20
 
 # ── admin SPA build stage ──────────────────────────────────────────
@@ -76,13 +76,13 @@ WORKDIR /app
 
 # curl + wget for healthcheck probes — Coolify v4 defaults to wget for
 # its own probe regardless of what the image's HEALTHCHECK uses, so
-# both have to be present. The aspnet:10.0 base image strips both by
+# both have to be present. The aspnet:9.0 base image strips both by
 # default to keep the surface area small.
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl wget \
     && rm -rf /var/lib/apt/lists/*
 
-# Run as a non-root user — aspnet:10.0 ships with the `app` UID 1654.
+# Run as a non-root user — aspnet:9.0 ships with the `app` UID 1654.
 # Coolify mounts persistent volumes with write permission for this UID.
 USER app
 

Dockerfile.service

@@ -1,4 +1,4 @@
-ARG DOTNET_VERSION=10.0
+ARG DOTNET_VERSION=9.0
 ARG NODE_VERSION=20
 
 FROM node:${NODE_VERSION}-alpine AS admin-ui

DorkNet.ClientMod/Mod.cs

@@ -2756,8 +2756,6 @@ internal static class AuthPatches
             var accessToken = __0?.ToString();
             if (LooksLikeJwt(accessToken))
                 _latestAccessToken = accessToken;
-            else if (string.IsNullOrWhiteSpace(__0?.ToString()) && string.IsNullOrWhiteSpace(__1?.ToString()))
-                _latestAccessToken = null;
 
             if (_tokenLogCount++ < 3)
             {
@@ -2784,75 +2782,6 @@ internal static class AuthPatches
 
     private static string Presence(object? value) =>
         string.IsNullOrWhiteSpace(value?.ToString()) ? "missing" : "present";
-
-    public static void ApplyBearerTokenHeader(object? request)
-    {
-        try
-        {
-            if (request is null || string.IsNullOrWhiteSpace(_latestAccessToken)) return;
-            var uri = TryReadUri(request);
-            if (uri is null || !IsDorkNetServiceHost(uri.Host)) return;
-
-            var type = request.GetType();
-            var setHeader = AccessTools.Method(type, "SetHeader", new[] { typeof(string), typeof(string) })
-                            ?? AccessTools.Method(type, "AddHeader", new[] { typeof(string), typeof(string) });
-            setHeader?.Invoke(request, new object[] { "Authorization", "Bearer " + _latestAccessToken });
-        }
-        catch (Exception ex)
-        {
-            if (_tokenLogCount++ < 6)
-                Mod.Log.Warning($"[auth-trace] bearer propagation failed: {ex.Message}");
-        }
-    }
-
-    private static Uri? TryReadUri(object request)
-    {
-        var type = request.GetType();
-        const BindingFlags flags = BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Instance;
-
-        if (TryGetUri(type.GetProperty("Uri", flags), request, out var uri)) return uri;
-        if (TryGetUri(type.GetField("<Uri>k__BackingField", flags), request, out uri)) return uri;
-
-        foreach (var prop in type.GetProperties(flags))
-        {
-            if (prop.Name.IndexOf("Uri", StringComparison.OrdinalIgnoreCase) < 0) continue;
-            if (TryGetUri(prop, request, out uri)) return uri;
-        }
-
-        foreach (var field in type.GetFields(flags))
-        {
-            if (field.Name.IndexOf("Uri", StringComparison.OrdinalIgnoreCase) < 0) continue;
-            if (TryGetUri(field, request, out uri)) return uri;
-        }
-
-        return null;
-    }
-
-    private static bool TryGetUri(PropertyInfo? prop, object request, out Uri? uri)
-    {
-        uri = null;
-        if (prop is null || !prop.CanRead || prop.GetIndexParameters().Length != 0) return false;
-        uri = prop.GetValue(request) as Uri;
-        return uri is not null;
-    }
-
-    private static bool TryGetUri(FieldInfo? field, object request, out Uri? uri)
-    {
-        uri = null;
-        if (field is null) return false;
-        uri = field.GetValue(request) as Uri;
-        return uri is not null;
-    }
-
-    private static bool IsDorkNetServiceHost(string host)
-    {
-        var configuredHost = Mod.Cfg.ServerHost?.Trim().TrimStart('.');
-        if (string.IsNullOrWhiteSpace(configuredHost)) return false;
-
-        return host.Equals(configuredHost, StringComparison.OrdinalIgnoreCase)
-               || host.EndsWith("." + configuredHost, StringComparison.OrdinalIgnoreCase)
-               || host.EndsWith("-" + configuredHost, StringComparison.OrdinalIgnoreCase);
-    }
 }
 
 internal static class HttpTracePatches
@@ -3630,7 +3559,6 @@ internal static class UriPatches
     public static void HttpManagerSendRequestObject_Prefix(object request)
     {
         RewriteRequestUri(request, "httpmanager-request-rewrite");
-        AuthPatches.ApplyBearerTokenHeader(request);
     }
 
     public static void UriStringCtor_Prefix(ref string uriString)
@@ -3642,7 +3570,6 @@ internal static class UriPatches
     public static void HttpRequestSend_Prefix(object __instance)
     {
         RewriteRequestUri(__instance, "http-rewrite");
-        AuthPatches.ApplyBearerTokenHeader(__instance);
     }
 
     private static void RewriteRequestUri(object request, string label)

DorkNet.Contracts/DorkNet.Contracts.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Contracts/DorkNetRouteOwnership.cs

@@ -46,6 +46,12 @@ public static class DorkNetRouteOwnership
                 "/discover",
                 "/featuredrooms",
                 "/goto",
+                // 2023 clients renamed the whole goto/* matchmaking surface
+                // to matchmake/* (matchmake/room, /instance, /invite,
+                // /chatinvite, …). Same controller as /goto, so it belongs
+                // to the match service; without this it fell through to the
+                // Monolith default owner.
+                "/matchmake",
                 "/hot_rooms",
                 "/hot_roomsandplaylists",
                 "/invite",

DorkNet.Gateway/DorkNet.Gateway.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Models/DorkNet.Models.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
   </PropertyGroup>

DorkNet.Server.Tests/CharadesWordListTests.cs

@@ -0,0 +1,88 @@
+using System.Net;
+using System.Text;
+using System.Text.Json;
+
+namespace DorkNet.Server.Tests;
+
+/// <summary>
+/// End-to-end coverage for the 3D Charades word-list feature and the
+/// profanity-filter toggle. Boots the full server (which runs the seeder)
+/// against SQLite via <see cref="DorkNetServerFactory"/> and exercises the
+/// public wire endpoints the March 2023 client actually calls.
+/// </summary>
+public sealed class CharadesWordListTests : IClassFixture<DorkNetServerFactory>
+{
+    private readonly DorkNetServerFactory _factory;
+
+    public CharadesWordListTests(DorkNetServerFactory factory) => _factory = factory;
+
+    private HttpClient ApiClient()
+    {
+        var client = _factory.CreateClient(new() { AllowAutoRedirect = false });
+        client.BaseAddress = new Uri($"http://api.{_factory.ApexDomain}");
+        client.Timeout = TimeSpan.FromSeconds(30);
+        return client;
+    }
+
+    [Theory]
+    [InlineData("Charades")]              // enum-name form
+    [InlineData("CharadesAprilFoolsDay")]
+    [InlineData("Icebreakers")]
+    [InlineData("0")]                     // int form the client may send
+    [InlineData("1")]
+    [InlineData("2")]
+    public async Task Words_endpoint_returns_seeded_deck_in_wire_shape(string source)
+    {
+        using var client = ApiClient();
+        using var res = await client.GetAsync($"/api/activities/charades/v1/words/{source}");
+
+        Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+        using var doc = JsonDocument.Parse(await res.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.True(doc.RootElement.GetArrayLength() > 0, $"expected a non-empty deck for '{source}'");
+
+        var first = doc.RootElement[0];
+        // Exact wire key casing the client's LitJson importer reads.
+        Assert.True(first.TryGetProperty("EN_US", out var en) && en.ValueKind == JsonValueKind.String,
+            "each card must expose a string EN_US field");
+        Assert.True(first.TryGetProperty("Difficulty", out var diff) && diff.ValueKind == JsonValueKind.Number,
+            "each card must expose a numeric Difficulty field");
+    }
+
+    [Fact]
+    public async Task December_noparam_route_serves_the_charades_slot()
+    {
+        using var client = ApiClient();
+        using var res = await client.GetAsync("/api/activities/charades/v1/words");
+
+        Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+        using var doc = JsonDocument.Parse(await res.Content.ReadAsStringAsync());
+        Assert.True(doc.RootElement.GetArrayLength() > 0);
+    }
+
+    [Fact]
+    public async Task Unknown_source_falls_back_to_charades_slot()
+    {
+        using var client = ApiClient();
+        using var res = await client.GetAsync("/api/activities/charades/v1/words/totally-bogus");
+
+        Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+        using var doc = JsonDocument.Parse(await res.Content.ReadAsStringAsync());
+        Assert.Equal(JsonValueKind.Array, doc.RootElement.ValueKind);
+        Assert.True(doc.RootElement.GetArrayLength() > 0);
+    }
+
+    [Fact]
+    public async Task Profanity_filter_is_active_by_default()
+    {
+        using var client = ApiClient();
+        using var res = await client.PostAsync(
+            "/api/sanitize/v1/requestIsStringPure",
+            new StringContent("{\"Value\":\"you piece of shit\"}", Encoding.UTF8, "application/json"));
+
+        Assert.Equal(HttpStatusCode.OK, res.StatusCode);
+        var body = (await res.Content.ReadAsStringAsync()).Trim();
+        // Default state: filter on → the profane string is NOT pure.
+        Assert.Equal("false", body.ToLowerInvariant());
+    }
+}

DorkNet.Server.Tests/DorkNet.Server.Tests.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>
@@ -9,7 +9,7 @@
 
   <ItemGroup>
     <PackageReference Include="coverlet.collector" Version="6.0.2" />
-    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="9.0.4" />
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
     <PackageReference Include="xunit" Version="2.9.2" />
     <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
@@ -17,6 +17,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\DorkNet.Server\DorkNet.Server.csproj" />
+    <ProjectReference Include="..\DorkNet.Contracts\DorkNet.Contracts.csproj" />
   </ItemGroup>
 
   <ItemGroup>

DorkNet.Server.Tests/DorkNetServerFactory.cs

@@ -1,8 +1,11 @@
+using System.Text;
+using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.HostFiltering;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.IdentityModel.Tokens;
 
 namespace DorkNet.Server.Tests;
 
@@ -35,8 +38,8 @@ public sealed class DorkNetServerFactory : WebApplicationFactory<Program>
                 ["S3:Endpoint"] = "",
                 ["S3:AccessKey"] = "",
                 ["S3:SecretKey"] = "",
-                ["DorkNet:DefaultClientVersion"] = "march_2023_03_21",
+                ["DorkNet:DefaultClientVersion"] = "december_2020_12_18",
-                ["DorkNet:SupportedVersions:0"] = "march_2023_03_21",
+                ["DorkNet:SupportedVersions:0"] = "december_2020_12_18",
             });
         });
         builder.ConfigureServices(services =>
@@ -53,6 +56,18 @@ public sealed class DorkNetServerFactory : WebApplicationFactory<Program>
                 options.AllowEmptyHosts = true;
                 options.IncludeFailureMessage = true;
             });
+            services.PostConfigure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
+            {
+                options.TokenValidationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtSecret)),
+                    ValidateIssuer = true,
+                    ValidIssuer = "https://api.rec.net/",
+                    ValidateAudience = false,
+                    ClockSkew = TimeSpan.Zero,
+                };
+            });
         });
     }
 

DorkNet.Server.Tests/GameClientEndpointContractTests.cs

@@ -61,8 +61,8 @@ public sealed class GameClientEndpointContractTests :
             ToHttpMethod(route.Method),
             new Uri($"http://{host}{path}"));
         request.Headers.Accept.ParseAdd("application/json");
-        request.Headers.UserAgent.ParseAdd("RecRoom/2023.03.21");
+        request.Headers.UserAgent.ParseAdd("RecRoom/2020.12.18");
-        request.Headers.TryAddWithoutValidation("X-DorkNet-Version", "march_2023_03_21");
+        request.Headers.TryAddWithoutValidation("X-DorkNet-Version", "december_2020_12_18");
         request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", session.AccessToken);
 
         if (NeedsRequestBody(request.Method))

DorkNet.Server.Tests/GameClientSession.cs

@@ -21,13 +21,11 @@ public static class GameClientSessionFactory
             HttpMethod.Post,
             new Uri($"http://auth.{apexDomain}/connect/token"));
         tokenRequest.Headers.Accept.ParseAdd("application/json");
-        tokenRequest.Headers.UserAgent.ParseAdd("RecRoom/2023.03.21");
+        tokenRequest.Headers.UserAgent.ParseAdd("RecRoom/2020.12.18");
-        tokenRequest.Headers.TryAddWithoutValidation("X-DorkNet-Version", "march_2023_03_21");
+        tokenRequest.Headers.TryAddWithoutValidation("X-DorkNet-Version", "december_2020_12_18");
         tokenRequest.Content = new FormUrlEncodedContent(new Dictionary<string, string>
         {
             ["grant_type"] = "password",
-            ["client_id"] = "recroom",
-            ["client_secret"] = "VxZ53kgbbEaRoZAeMe00MagtgD12GLL2",
             ["username"] = "EndpointContract",
             ["device_id"] = deviceId,
             ["platform"] = "0",
@@ -51,8 +49,8 @@ public static class GameClientSessionFactory
             HttpMethod.Get,
             new Uri($"http://auth.{apexDomain}/connect/userinfo"));
         userInfoRequest.Headers.Accept.ParseAdd("application/json");
-        userInfoRequest.Headers.UserAgent.ParseAdd("RecRoom/2023.03.21");
+        userInfoRequest.Headers.UserAgent.ParseAdd("RecRoom/2020.12.18");
-        userInfoRequest.Headers.TryAddWithoutValidation("X-DorkNet-Version", "march_2023_03_21");
+        userInfoRequest.Headers.TryAddWithoutValidation("X-DorkNet-Version", "december_2020_12_18");
         userInfoRequest.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
 
         using var userInfoResponse = await client.SendAsync(userInfoRequest);

DorkNet.Server.Tests/MatchmakePullInviteTests.cs

@@ -0,0 +1,65 @@
+using System.Net;
+using DorkNet.Contracts;
+
+namespace DorkNet.Server.Tests;
+
+/// <summary>
+/// Regression coverage for the 2023 "pull a player into a private instance"
+/// flow. The 2023 client renamed the matchmaking surface from <c>goto/*</c>
+/// to <c>matchmake/*</c> and added <c>matchmake/chatinvite/{account}/{instance}</c>
+/// for chat party invites; the server had neither the routes nor the gateway
+/// ownership entry, so those requests 404'd.
+/// </summary>
+public sealed class MatchmakePullInviteTests : IClassFixture<DorkNetServerFactory>
+{
+    private readonly DorkNetServerFactory _factory;
+
+    public MatchmakePullInviteTests(DorkNetServerFactory factory) => _factory = factory;
+
+    private HttpClient ApiClient()
+    {
+        var client = _factory.CreateClient(new() { AllowAutoRedirect = false });
+        client.BaseAddress = new Uri($"http://api.{_factory.ApexDomain}");
+        client.Timeout = TimeSpan.FromSeconds(30);
+        return client;
+    }
+
+    [Theory]
+    [InlineData("/matchmake/instance/999")]
+    [InlineData("/matchmake/invite/999")]
+    [InlineData("/matchmake/chatinvite/2/16777216")] // {accountId}/{roomInstanceId}
+    [InlineData("/matchmake/player/2")]
+    [InlineData("/matchmake/event/999")]
+    [InlineData("/matchmake/club/999")]
+    [InlineData("/matchmake/code/5/ABCDEF")] // {roomId}/{code}
+    public async Task Matchmake_pull_routes_exist(string path)
+    {
+        using var client = ApiClient();
+        using var res = await client.PostAsync(path, new StringContent(string.Empty));
+
+        // The bug was a hard 404 (no route). These resolve to a dorm-fallback
+        // matchmaking response when the instance/invite doesn't exist, so any
+        // non-404 status proves the route is now mounted.
+        Assert.NotEqual(HttpStatusCode.NotFound, res.StatusCode);
+    }
+
+    [Theory]
+    [InlineData("/matchmake/instance/999")]
+    [InlineData("/matchmake/invite/999")]
+    [InlineData("/matchmake/chatinvite/2/16777216")]
+    [InlineData("/matchmake/room/5")]
+    [InlineData("/matchmake/player/2")]
+    [InlineData("/matchmake/event/999")]
+    [InlineData("/matchmake/club/999")]
+    [InlineData("/matchmake/code/5/ABCDEF")]
+    public void Matchmake_paths_route_to_same_service_as_goto(string path)
+    {
+        const string apex = "dork.test";
+        var gotoOwner = DorkNetRouteOwnership.ResolvePublicService($"api.{apex}", "/goto/instance/999", apex);
+        var owner = DorkNetRouteOwnership.ResolvePublicService($"api.{apex}", path, apex);
+
+        // matchmake/* must land on the same service that owns goto/* — before
+        // the fix it fell through to the Monolith default owner.
+        Assert.Equal(gotoOwner, owner);
+    }
+}

DorkNet.Server.Tests/VersionCheckControllerTests.cs

@@ -11,11 +11,11 @@ namespace DorkNet.Server.Tests;
 public sealed class VersionCheckControllerTests
 {
     [Fact]
-    public void March_2023_build_is_valid_with_minimal_service_config()
+    public void December_2020_build_is_valid_with_minimal_service_config()
     {
         var controller = CreateController();
 
-        var result = Assert.IsType<OkObjectResult>(controller.Check("20230321", "0"));
+        var result = Assert.IsType<OkObjectResult>(controller.Check("20201210", "0"));
 
         Assert.Equal(0, ReadVersionStatus(result.Value));
     }
@@ -37,9 +37,9 @@ public sealed class VersionCheckControllerTests
             [new Late2020VersionPlugin()],
             new HashSet<string>(StringComparer.OrdinalIgnoreCase)
             {
-                "march_2023_03_21",
+                "december_2020_12_18",
             },
-            "march_2023_03_21");
+            "december_2020_12_18");
 
         return new VersionCheckController(
             config,

DorkNet.Server/Auth/IdentityServerIntegration.cs

@@ -1,785 +0,0 @@
-using System.IdentityModel.Tokens.Jwt;
-using System.Security.Claims;
-using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
-using System.Text;
-using System.Text.Json;
-using Open.IdentityServer;
-using Open.IdentityServer.Models;
-using Open.IdentityServer.ResponseHandling;
-using Open.IdentityServer.Services;
-using Open.IdentityServer.Stores;
-using Open.IdentityServer.Validation;
-using Microsoft.AspNetCore.Http.Features;
-using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.Primitives;
-using Microsoft.IdentityModel.Tokens;
-using DorkNet.Server.Data;
-using DorkNet.Server.Data.Entities;
-using DorkNet.Server.Services;
-
-namespace DorkNet.Server.Auth;
-
-public sealed class IdentityServerSigningKeyProvider
-{
-    private readonly string _legacySecret;
-
-    public IdentityServerSigningKeyProvider(IConfiguration config)
-    {
-        _legacySecret =
-            Environment.GetEnvironmentVariable("DORKNET_JWT_SECRET")
-            ?? Environment.GetEnvironmentVariable("RECNET_JWT_SECRET")
-            ?? config["Jwt:Secret"]
-            ?? throw new InvalidOperationException(
-                "JWT secret not configured. Set DORKNET_JWT_SECRET env var or Jwt:Secret in appsettings.Local.json.");
-
-        CertificatePath = ResolveCertificatePath(config);
-        var password = config["IdentityServer:SigningCertificatePassword"] ?? _legacySecret;
-        var certificateBase64 = config["IdentityServer:SigningCertificateBase64"];
-        if (!string.IsNullOrWhiteSpace(certificateBase64))
-        {
-            LoadedFromBase64 = true;
-            Certificate = LoadCertificateFromBase64(certificateBase64, password);
-        }
-        else
-        {
-            Certificate = LoadOrCreateCertificate(CertificatePath, password);
-        }
-        SigningKey = new X509SecurityKey(Certificate);
-        LegacyJwtKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_legacySecret));
-    }
-
-    public string CertificatePath { get; }
-    public bool LoadedFromBase64 { get; }
-    public string CertificateSource => LoadedFromBase64
-        ? "IdentityServer:SigningCertificateBase64"
-        : CertificatePath;
-    public X509Certificate2 Certificate { get; }
-    public SecurityKey SigningKey { get; }
-    public SecurityKey LegacyJwtKey { get; }
-    public SecurityKey[] ValidationKeys => new[] { SigningKey, LegacyJwtKey };
-
-    private static string ResolveCertificatePath(IConfiguration config)
-    {
-        var path = config["IdentityServer:SigningCertificatePath"];
-        if (string.IsNullOrWhiteSpace(path))
-            path = Path.Combine(AppContext.BaseDirectory, "data", "identityserver-signing.pfx");
-        return path;
-    }
-
-    private static X509Certificate2 LoadCertificateFromBase64(string certificateBase64, string password)
-    {
-        var flags = X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.Exportable;
-        var compact = NormalizeCertificateBase64(certificateBase64);
-        byte[] bytes;
-        try
-        {
-            bytes = Convert.FromBase64String(compact);
-        }
-        catch (FormatException ex)
-        {
-            throw new InvalidOperationException(
-                "IdentityServer signing certificate base64 is invalid. " +
-                "Set IdentityServer__SigningCertificateBase64 to the PFX bytes encoded as base64, " +
-                "without a file path or shell assignment text.",
-                ex);
-        }
-        try
-        {
-            return new X509Certificate2(bytes, password, flags);
-        }
-        catch (CryptographicException ex)
-        {
-            if (TryLoadPemCertificate(bytes, password, flags, out var certificate))
-                return certificate;
-
-            throw new InvalidOperationException(
-                "IdentityServer signing certificate base64 decoded successfully, but it is not a valid PFX/PKCS#12 certificate. " +
-                "Set IdentityServer__SigningCertificateBase64 to the PFX bytes encoded as base64 and make sure " +
-                "IdentityServer__SigningCertificatePassword matches the PFX password.",
-                ex);
-        }
-    }
-
-    private static bool TryLoadPemCertificate(
-        byte[] bytes,
-        string password,
-        X509KeyStorageFlags flags,
-        out X509Certificate2 certificate)
-    {
-        certificate = null!;
-
-        string pem;
-        try
-        {
-            pem = Encoding.UTF8.GetString(bytes);
-        }
-        catch (DecoderFallbackException)
-        {
-            return false;
-        }
-
-        if (!pem.Contains("-----BEGIN", StringComparison.Ordinal))
-            return false;
-
-        try
-        {
-            using var pemCertificate = X509Certificate2.CreateFromPem(pem, pem);
-            if (!pemCertificate.HasPrivateKey)
-                return false;
-
-            var pfxBytes = pemCertificate.Export(X509ContentType.Pfx, password);
-            certificate = new X509Certificate2(pfxBytes, password, flags);
-            return true;
-        }
-        catch (CryptographicException)
-        {
-            return false;
-        }
-    }
-
-    private static string NormalizeCertificateBase64(string value)
-    {
-        var text = value.Trim().Trim('"', '\'');
-        var equals = text.IndexOf('=');
-        if (equals > 0)
-        {
-            var key = text[..equals].Trim();
-            if (key.Equals("IdentityServer__SigningCertificateBase64", StringComparison.OrdinalIgnoreCase) ||
-                key.Equals("IdentityServer:SigningCertificateBase64", StringComparison.OrdinalIgnoreCase))
-                text = text[(equals + 1)..].Trim().Trim('"', '\'');
-        }
-
-        if (text.StartsWith("data:", StringComparison.OrdinalIgnoreCase))
-        {
-            var comma = text.IndexOf(',');
-            if (comma >= 0)
-                text = text[(comma + 1)..];
-        }
-
-        if (text.StartsWith("base64:", StringComparison.OrdinalIgnoreCase))
-            text = text["base64:".Length..];
-
-        var compact = new string(text.Where(c => !char.IsWhiteSpace(c)).ToArray())
-            .Replace('-', '+')
-            .Replace('_', '/');
-        return (compact.Length % 4) switch
-        {
-            2 => compact + "==",
-            3 => compact + "=",
-            _ => compact,
-        };
-    }
-
-    private static X509Certificate2 LoadOrCreateCertificate(string path, string password)
-    {
-        var flags = X509KeyStorageFlags.UserKeySet | X509KeyStorageFlags.Exportable;
-        Directory.CreateDirectory(Path.GetDirectoryName(path)!);
-
-        if (File.Exists(path))
-            return new X509Certificate2(path, password, flags);
-
-        using var rsa = RSA.Create(2048);
-        var request = new CertificateRequest(
-            "CN=DorkNet IdentityServer Signing",
-            rsa,
-            HashAlgorithmName.SHA256,
-            RSASignaturePadding.Pkcs1);
-        request.CertificateExtensions.Add(
-            new X509KeyUsageExtension(X509KeyUsageFlags.DigitalSignature, critical: false));
-
-        using var created = request.CreateSelfSigned(
-            DateTimeOffset.UtcNow.AddDays(-1),
-            DateTimeOffset.UtcNow.AddYears(10));
-        var bytes = created.Export(X509ContentType.Pfx, password);
-        File.WriteAllBytes(path, bytes);
-        return new X509Certificate2(bytes, password, flags);
-    }
-}
-
-public static class RecRoomIdentityServerRegistration
-{
-    public static void AddRecRoomIdentityServer(
-        this IServiceCollection services,
-        IConfiguration config,
-        DomainConfig domain,
-        IdentityServerSigningKeyProvider signingKeyProvider)
-    {
-        services
-            .AddIdentityServer(options =>
-            {
-                options.IssuerUri = domain.AuthIssuer.TrimEnd('/');
-            })
-            .AddInMemoryIdentityResources(RecRoomIdentityServerConfig.IdentityResources)
-            .AddInMemoryApiScopes(RecRoomIdentityServerConfig.ApiScopes)
-            .AddInMemoryClients(RecRoomIdentityServerConfig.Clients)
-            .AddSigningCredential(signingKeyProvider.SigningKey, SecurityAlgorithms.RsaSha256)
-            .AddResourceOwnerValidator<RecRoomPasswordValidator>()
-            .AddExtensionGrantValidator<CachedLoginGrantValidator>()
-            .AddProfileService<RecRoomProfileService>();
-
-        services.AddTransient<ITokenResponseGenerator, RecRoomTokenResponseGenerator>();
-    }
-}
-
-internal static class RecRoomIdentityServerConfig
-{
-    public const string ClientId = "recroom";
-    public const string ClientSecret = "VxZ53kgbbEaRoZAeMe00MagtgD12GLL2";
-    public const string GameClientScope = "gameClient";
-    public const string CachedLoginGrantType = "cached_login";
-
-    public static readonly IdentityResource[] IdentityResources =
-    {
-        new IdentityResources.OpenId(),
-        new IdentityResources.Profile(),
-    };
-
-    public static readonly ApiScope[] ApiScopes =
-    {
-        new(GameClientScope, "Game client")
-        {
-            UserClaims = RecRoomIdentityClaims.UserClaimTypes,
-        },
-        new("api", "DorkNet API")
-        {
-            UserClaims = RecRoomIdentityClaims.UserClaimTypes,
-        },
-    };
-
-    public static readonly Client[] Clients =
-    {
-        new()
-        {
-            ClientId = ClientId,
-            ClientName = "Rec Room game client",
-            RequireClientSecret = true,
-            ClientSecrets = { new Secret(ClientSecret.Sha256()) },
-            AllowedGrantTypes = { GrantType.ResourceOwnerPassword, "refresh_token", CachedLoginGrantType },
-            AllowedScopes = RecRoomScopes(),
-            AllowOfflineAccess = true,
-            AccessTokenLifetime = 60 * 60 * 12,
-            AbsoluteRefreshTokenLifetime = 60 * 60 * 24 * 30,
-            SlidingRefreshTokenLifetime = 60 * 60 * 24 * 30,
-            RefreshTokenUsage = TokenUsage.ReUse,
-            RefreshTokenExpiration = TokenExpiration.Absolute,
-            UpdateAccessTokenClaimsOnRefresh = true,
-            AlwaysIncludeUserClaimsInIdToken = true,
-        },
-    };
-
-    private static ICollection<string> RecRoomScopes() =>
-    [
-        IdentityServerConstants.StandardScopes.OpenId,
-        IdentityServerConstants.StandardScopes.Profile,
-        IdentityServerConstants.StandardScopes.OfflineAccess,
-        GameClientScope,
-        "api",
-    ];
-}
-
-public sealed class IdentityServerGameTokenRequestMiddleware(
-    RequestDelegate next,
-    DomainConfig domain,
-    IConfiguration config,
-    ILogger<IdentityServerGameTokenRequestMiddleware> logger)
-{
-    public async Task InvokeAsync(HttpContext context)
-    {
-        if (!IsTokenRequest(context))
-        {
-            await next(context);
-            return;
-        }
-
-        var form = await context.Request.ReadFormAsync();
-        var values = form.ToDictionary(
-            kvp => kvp.Key,
-            kvp => kvp.Value,
-            StringComparer.OrdinalIgnoreCase);
-        var changed = false;
-
-        if (IsDevicePasswordGrant(values))
-        {
-            if (!values.ContainsKey("username") || string.IsNullOrWhiteSpace(values["username"].ToString()))
-            {
-                values["username"] = First(
-                    values.TryGetValue("deviceId", out var deviceId) ? deviceId.ToString() : null,
-                    values.TryGetValue("device_id", out var deviceIdSnake) ? deviceIdSnake.ToString() : null,
-                    values.TryGetValue("platformId", out var platformId) ? platformId.ToString() : null,
-                    values.TryGetValue("platform_id", out var platformIdSnake) ? platformIdSnake.ToString() : null,
-                    "anonymous");
-                changed = true;
-            }
-
-            if (!values.ContainsKey("password") || string.IsNullOrWhiteSpace(values["password"].ToString()))
-            {
-                values["password"] = "__dorknet_device_login__";
-                values["dorknet_device_login"] = "true";
-                changed = true;
-            }
-        }
-
-        var scopes = values.TryGetValue("scope", out var rawScope)
-            ? rawScope.ToString()
-            : string.Empty;
-        var mergedScopes = MergeScopes(scopes);
-        if (!string.Equals(scopes, mergedScopes, StringComparison.Ordinal))
-        {
-            values["scope"] = mergedScopes;
-            changed = true;
-        }
-
-        if (changed)
-            context.Features.Set<IFormFeature>(new FormFeature(new FormCollection(values)));
-
-        await InvokeAndPersistAccessTokenCookieAsync(context);
-    }
-
-    private async Task InvokeAndPersistAccessTokenCookieAsync(HttpContext context)
-    {
-        var originalBody = context.Response.Body;
-        await using var bufferedBody = new MemoryStream();
-        context.Response.Body = bufferedBody;
-
-        try
-        {
-            await next(context);
-
-            bufferedBody.Position = 0;
-            if (IsSuccessfulJsonResponse(context.Response))
-                TryPersistAccessTokenCookie(context, bufferedBody);
-
-            bufferedBody.Position = 0;
-            await bufferedBody.CopyToAsync(originalBody);
-        }
-        finally
-        {
-            context.Response.Body = originalBody;
-        }
-    }
-
-    private static bool IsSuccessfulJsonResponse(HttpResponse response) =>
-        response.StatusCode is >= 200 and < 300
-        && response.ContentType?.Contains("application/json", StringComparison.OrdinalIgnoreCase) == true;
-
-    private void TryPersistAccessTokenCookie(HttpContext context, Stream responseBody)
-    {
-        try
-        {
-            using var document = JsonDocument.Parse(responseBody);
-            if (!document.RootElement.TryGetProperty("access_token", out var accessTokenElement))
-                return;
-            var accessToken = accessTokenElement.GetString();
-            if (string.IsNullOrWhiteSpace(accessToken))
-                return;
-
-            var expires = DateTimeOffset.UtcNow.AddHours(12);
-            if (document.RootElement.TryGetProperty("expires_in", out var expiresInElement) &&
-                expiresInElement.TryGetInt32(out var expiresIn) &&
-                expiresIn > 0)
-            {
-                expires = DateTimeOffset.UtcNow.AddSeconds(expiresIn);
-            }
-
-            var options = new CookieOptions
-            {
-                HttpOnly = true,
-                Secure = string.Equals(domain.Scheme, "https", StringComparison.OrdinalIgnoreCase),
-                SameSite = SameSiteMode.None,
-                Expires = expires,
-                IsEssential = true,
-            };
-
-            var cookieDomain = ResolveCookieDomain(context.Request.Host.Host);
-            if (cookieDomain is not null)
-                options.Domain = cookieDomain;
-
-            context.Response.Cookies.Append(AuthService.AccessCookieName, accessToken, options);
-            logger.LogInformation(
-                "[auth-cookie] issued access cookie host={Host} domain={Domain} secure={Secure} sameSite={SameSite} essential={IsEssential}",
-                context.Request.Host.Host,
-                cookieDomain ?? "<host-only>",
-                options.Secure,
-                options.SameSite,
-                options.IsEssential);
-        }
-        catch (JsonException)
-        {
-            // Leave the token response untouched if the upstream payload is not JSON.
-        }
-    }
-
-    private string? ResolveCookieDomain(string host)
-    {
-        var configuredCookieDomain =
-            Environment.GetEnvironmentVariable("DORKNET_AUTH_COOKIE_DOMAIN")
-            ?? config["Auth:CookieDomain"]
-            ?? config["IdentityServer:CookieDomain"];
-        if (!string.IsNullOrWhiteSpace(configuredCookieDomain))
-            return configuredCookieDomain.Trim().TrimStart('.') is { Length: > 0 } value ? "." + value : null;
-
-        var apex = domain.Apex.Trim().TrimStart('.');
-        if (string.IsNullOrWhiteSpace(apex) ||
-            apex.Equals("localhost", StringComparison.OrdinalIgnoreCase) ||
-            apex.Equals("127.0.0.1", StringComparison.OrdinalIgnoreCase) ||
-            apex.Equals("::1", StringComparison.OrdinalIgnoreCase))
-        {
-            return null;
-        }
-
-        if (host.Equals(apex, StringComparison.OrdinalIgnoreCase) ||
-            host.EndsWith("." + apex, StringComparison.OrdinalIgnoreCase))
-        {
-            return "." + apex;
-        }
-
-        if (domain.UsesHyphenSubdomains)
-        {
-            var parent = HyphenCookieParent(apex, host);
-            if (parent is not null)
-                return "." + parent;
-        }
-
-        return null;
-    }
-
-    private static string? HyphenCookieParent(string apex, string host)
-    {
-        var parts = apex.Split('.', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
-        if (parts.Length < 3)
-            return null;
-
-        var environmentLabel = parts[0];
-        var parent = string.Join('.', parts.Skip(1));
-        if (!host.EndsWith("." + parent, StringComparison.OrdinalIgnoreCase))
-            return null;
-
-        var hostLabel = host[..^(parent.Length + 1)];
-        return hostLabel.EndsWith("-" + environmentLabel, StringComparison.OrdinalIgnoreCase)
-            ? parent
-            : null;
-    }
-
-    private static bool IsTokenRequest(HttpContext context) =>
-        HttpMethods.IsPost(context.Request.Method)
-        && context.Request.Path.Equals("/connect/token", StringComparison.OrdinalIgnoreCase)
-        && context.Request.HasFormContentType;
-
-    private static bool IsDevicePasswordGrant(Dictionary<string, StringValues> values)
-    {
-        if (!values.TryGetValue("grant_type", out var grantType) ||
-            !string.Equals(grantType.ToString(), GrantType.ResourceOwnerPassword, StringComparison.OrdinalIgnoreCase))
-            return false;
-        return !values.TryGetValue("password", out var password) ||
-               string.IsNullOrWhiteSpace(password.ToString());
-    }
-
-    private static string First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v)) ?? "anonymous";
-
-    private static string MergeScopes(string existing)
-    {
-        var scopes = existing
-            .Split(' ', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries)
-            .ToHashSet(StringComparer.OrdinalIgnoreCase);
-        scopes.Add(IdentityServerConstants.StandardScopes.OpenId);
-        scopes.Add(IdentityServerConstants.StandardScopes.Profile);
-        scopes.Add(IdentityServerConstants.StandardScopes.OfflineAccess);
-        scopes.Add(RecRoomIdentityServerConfig.GameClientScope);
-        return string.Join(' ', scopes);
-    }
-}
-
-public sealed class RecRoomTokenResponseGenerator(
-    TimeProvider clock,
-    ITokenService tokenService,
-    IRefreshTokenService refreshTokenService,
-    IScopeParser scopeParser,
-    IResourceStore resources,
-    IClientStore clients,
-    ILogger<TokenResponseGenerator> logger) : ITokenResponseGenerator
-{
-    private readonly TokenResponseGenerator _inner = new(
-        clock,
-        tokenService,
-        refreshTokenService,
-        scopeParser,
-        resources,
-        clients,
-        logger);
-
-    public async Task<TokenResponse> ProcessAsync(TokenRequestValidationResult request)
-    {
-        var response = await _inner.ProcessAsync(request);
-        AddLegacyGameFields(response);
-        return response;
-    }
-
-    private static void AddLegacyGameFields(TokenResponse response)
-    {
-        if (string.IsNullOrWhiteSpace(response.AccessToken))
-            return;
-
-        response.Custom ??= new Dictionary<string, object>(StringComparer.Ordinal);
-        AddIfMissing(response.Custom, "Access_token", response.AccessToken);
-        AddIfMissing(response.Custom, "accessToken", response.AccessToken);
-        AddIfMissing(response.Custom, "AccessToken", response.AccessToken);
-        AddIfMissing(response.Custom, "token", response.AccessToken);
-        AddIfMissing(response.Custom, "Token", response.AccessToken);
-
-        AddIfMissing(response.Custom, "tokenType", "Bearer");
-        AddIfMissing(response.Custom, "TokenType", "Bearer");
-        AddIfMissing(response.Custom, "expiresIn", response.AccessTokenLifetime);
-        AddIfMissing(response.Custom, "ExpiresIn", response.AccessTokenLifetime);
-
-        if (!string.IsNullOrWhiteSpace(response.RefreshToken))
-        {
-            AddIfMissing(response.Custom, "Refresh_token", response.RefreshToken);
-            AddIfMissing(response.Custom, "refreshToken", response.RefreshToken);
-            AddIfMissing(response.Custom, "RefreshToken", response.RefreshToken);
-        }
-
-        var signingKey = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
-        AddIfMissing(response.Custom, "key", signingKey);
-        AddIfMissing(response.Custom, "Key", signingKey);
-    }
-
-    private static void AddIfMissing(IDictionary<string, object> values, string key, object value)
-    {
-        if (!values.ContainsKey(key))
-            values[key] = value;
-    }
-}
-
-public sealed class RecRoomPasswordValidator(
-    PlayerService playerService,
-    LevelService level,
-    ServerSettingsService settings,
-    DorkNetDbContext db,
-    ILogger<RecRoomPasswordValidator> logger) : IResourceOwnerPasswordValidator
-{
-    public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
-    {
-        var raw = context.Request.Raw;
-        var deviceId = First(raw.Get("deviceId"), raw.Get("device_id"));
-        var platformId = First(raw.Get("platformId"), raw.Get("platform_id"));
-        var platform = int.TryParse(raw.Get("platform"), out var p) ? p : 0;
-        var deviceLogin = string.Equals(raw.Get("dorknet_device_login"), "true", StringComparison.OrdinalIgnoreCase);
-
-        if (!deviceLogin && !string.IsNullOrEmpty(context.Password) && !string.IsNullOrEmpty(context.UserName))
-        {
-            var byName = await playerService.GetByUsernameAsync(context.UserName);
-            if (byName is null || byName.PasswordHash is null)
-            {
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "unknown_user_or_no_password");
-                return;
-            }
-
-            if (!BCrypt.Net.BCrypt.Verify(context.Password, byName.PasswordHash))
-            {
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "password_mismatch");
-                return;
-            }
-
-            await playerService.TagPlatformAsync(byName.Id, platform, platformId);
-            await TryAwardLoginXpAsync(byName.Id);
-            context.Result = await CreateSuccessAsync(byName, "password");
-            return;
-        }
-
-        var effectiveDeviceId = !string.IsNullOrWhiteSpace(deviceId)
-            ? deviceId
-            : $"legacy-{(context.UserName ?? "anonymous").ToLowerInvariant()}";
-
-        if (await settings.AreSignupsDisabledAsync())
-        {
-            var existing = await playerService.GetByDeviceAsync(effectiveDeviceId);
-            if (existing is null)
-            {
-                logger.LogInformation(
-                    "[auth] IdentityServer password grant device fallback refused - signups disabled (device={Device})",
-                    effectiveDeviceId);
-                context.Result = new GrantValidationResult(
-                    TokenRequestErrors.InvalidGrant,
-                    "signups_disabled");
-                return;
-            }
-        }
-
-        var player = await playerService.GetOrCreateByDeviceAsync(
-            deviceId: effectiveDeviceId,
-            platform: platform,
-            platformId: platformId,
-            displayName: context.UserName);
-        await TryAwardLoginXpAsync(player.Id);
-        context.Result = await CreateSuccessAsync(player, "device_password");
-    }
-
-    private async Task<GrantValidationResult> CreateSuccessAsync(PlayerEntity player, string authMethod) =>
-        new(
-            subject: player.Id.ToString(),
-            authenticationMethod: authMethod,
-            claims: await RecRoomIdentityClaims.CreateAsync(db, player.Id, player.Username));
-
-    private async Task TryAwardLoginXpAsync(long playerId)
-    {
-        var lastSeen = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => p.LastSeenAt)
-            .FirstOrDefaultAsync();
-        if (lastSeen.Date < DateTime.UtcNow.Date)
-            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
-    }
-
-    private static string? First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v));
-}
-
-public sealed class CachedLoginGrantValidator(
-    PlayerService playerService,
-    LevelService level,
-    OrphanAccountTracker orphans,
-    DorkNetDbContext db,
-    ILogger<CachedLoginGrantValidator> logger) : IExtensionGrantValidator
-{
-    public string GrantType => RecRoomIdentityServerConfig.CachedLoginGrantType;
-
-    public async Task ValidateAsync(ExtensionGrantValidationContext context)
-    {
-        var raw = context.Request.Raw;
-        if (!long.TryParse(raw.Get("account_id"), out var pickedId))
-        {
-            context.Result = new GrantValidationResult(
-                TokenRequestErrors.InvalidGrant,
-                "missing account_id");
-            return;
-        }
-
-        var picked = await playerService.GetByIdAsync(pickedId);
-        if (picked is null)
-        {
-            context.Result = new GrantValidationResult(
-                TokenRequestErrors.InvalidGrant,
-                "unknown account_id");
-            return;
-        }
-
-        var deviceId = First(raw.Get("deviceId"), raw.Get("device_id"));
-        var platformId = First(raw.Get("platformId"), raw.Get("platform_id"));
-        var platform = int.TryParse(raw.Get("platform"), out var p) ? p : 0;
-
-        var pendingId = orphans.PeekPending(deviceId, platformId);
-        if (pendingId is long orphanId && orphanId != pickedId)
-        {
-            await playerService.DeleteOrphanAsync(orphanId);
-            logger.LogInformation(
-                "[orphan-cleanup] cached_login picked {PickedId}; deleted just-created {OrphanId}",
-                pickedId,
-                orphanId);
-        }
-        orphans.Clear(deviceId, platformId);
-
-        await TryAwardLoginXpAsync(picked.Id);
-        await playerService.TagPlatformAsync(picked.Id, platform, platformId);
-        context.Result = new GrantValidationResult(
-            subject: picked.Id.ToString(),
-            authenticationMethod: GrantType,
-            claims: await RecRoomIdentityClaims.CreateAsync(db, picked.Id, picked.Username));
-    }
-
-    private async Task TryAwardLoginXpAsync(long playerId)
-    {
-        var lastSeen = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => p.LastSeenAt)
-            .FirstOrDefaultAsync();
-        if (lastSeen.Date < DateTime.UtcNow.Date)
-            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
-    }
-
-    private static string? First(params string?[] values) =>
-        values.FirstOrDefault(v => !string.IsNullOrWhiteSpace(v));
-}
-
-public sealed class RecRoomProfileService(PlayerService playerService, DorkNetDbContext db) : IProfileService
-{
-    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
-    {
-        if (!TryGetSubjectId(context.Subject, out var playerId))
-            return;
-
-        var player = await playerService.GetByIdAsync(playerId);
-        if (player is null)
-            return;
-
-        context.IssuedClaims.AddRange(
-            await RecRoomIdentityClaims.CreateAsync(db, player.Id, player.Username));
-    }
-
-    public async Task IsActiveAsync(IsActiveContext context)
-    {
-        context.IsActive =
-            TryGetSubjectId(context.Subject, out var playerId)
-            && await playerService.GetByIdAsync(playerId) is not null;
-    }
-
-    private static bool TryGetSubjectId(ClaimsPrincipal subject, out long playerId)
-    {
-        var value = subject.FindFirstValue(JwtRegisteredClaimNames.Sub)
-            ?? subject.FindFirstValue(ClaimTypes.NameIdentifier);
-        return long.TryParse(value, out playerId);
-    }
-}
-
-public static class RecRoomIdentityClaims
-{
-    public static readonly List<string> UserClaimTypes =
-    [
-        JwtRegisteredClaimNames.Sub,
-        ClaimTypes.NameIdentifier,
-        "name",
-        "role",
-        ClaimTypes.Role,
-        "roles",
-        "accountId",
-        "account_id",
-        "accountid",
-    ];
-
-    public static async Task<List<Claim>> CreateAsync(DorkNetDbContext db, long playerId, string? username = null)
-    {
-        var playerInfo = await db.Players
-            .Where(p => p.Id == playerId)
-            .Select(p => new { p.Username, IsDev = p.IsDeveloper || p.IsAdmin })
-            .FirstOrDefaultAsync();
-        var name = username ?? playerInfo?.Username ?? playerId.ToString();
-        var isDev = playerInfo?.IsDev ?? false;
-
-        var claims = new List<Claim>
-        {
-            new(ClaimTypes.NameIdentifier, playerId.ToString()),
-            new(JwtRegisteredClaimNames.Sub, playerId.ToString()),
-            new("name", name),
-            new("accountId", playerId.ToString()),
-            new("account_id", playerId.ToString()),
-            new("accountid", playerId.ToString()),
-            new(ClaimTypes.Role, "gameClient"),
-            new("role", "gameClient"),
-            new("roles", "gameClient"),
-        };
-
-        if (isDev)
-        {
-            claims.Add(new Claim(ClaimTypes.Role, "developer"));
-            claims.Add(new Claim("role", "developer"));
-            claims.Add(new Claim("roles", "developer"));
-        }
-
-        return claims;
-    }
-}

DorkNet.Server/Controllers/API/Activities/ActivitiesController.cs

@@ -1,16 +1,32 @@
 using Microsoft.AspNetCore.Mvc;
+using DorkNet.Server.Services;
 
 namespace DorkNet.Server.Controllers.API.Activities;
 
 /// <summary>
 /// api.{rec.net,localhost}/api/activities/* — per-activity content
-/// (charades words, party-game prompts, etc.). The 2020 watch
+/// (charades words, party-game prompts, etc.).
-/// fetches these as a static list at room-join time; we ship an
+///
-/// empty list so the activity's bundled defaults kick in.
+/// The March 2023 watch fetches a 3D Charades deck at card-box spawn from
+/// <c>api/activities/charades/v1/words/{source}</c>, where <c>{source}</c>
+/// is one of three baked <c>CardBox.cardSource</c> slots — <c>Charades</c>,
+/// <c>CharadesAprilFoolsDay</c>, or <c>Icebreakers</c> (verified in the
+/// 2023.03.21 il2cpp dump). We resolve the admin-bound word list for the
+/// requested slot via <see cref="CharadesWordListService"/> and return the
+/// wire array of <c>{ EN_US, Difficulty }</c>. The older December route
+/// (no <c>{source}</c>) maps to the default Charades slot.
 /// </summary>
 [ApiController]
-public class ActivitiesController : ControllerBase
+public class ActivitiesController(CharadesWordListService charades) : ControllerBase
 {
+    [HttpGet("api/activities/charades/v1/words/{source}")]
+    public async Task<IActionResult> CharadesWords(string source)
+        => Ok(await charades.ResolveWireWordsAsync(source));
+
+    /// <summary>December 2020 shape — no source segment. Serves the default
+    /// Charades slot so the older client still gets a populated deck.</summary>
     [HttpGet("api/activities/charades/v1/words")]
-    public IActionResult CharadesWords() => Ok(Array.Empty<object>());
+    public async Task<IActionResult> CharadesWordsDefault()
+        => Ok(await charades.ResolveWireWordsAsync(
+            nameof(CharadesWordListService.CharadesSlot.Charades)));
 }

DorkNet.Server/Controllers/API/Sanitize/SanitizeController.cs

@@ -10,10 +10,29 @@ namespace DorkNet.Server.Controllers.API.Sanitize;
 /// invention name / chat message to be submitted. Delegates to
 /// <see cref="ProfanityFilter"/> for the actual scrubbing. Response
 /// shape: <c>{Text (purified), IsClean (bool)}</c>.
+///
+/// When the admin has flipped
+/// <see cref="Data.Entities.ServerSettingsEntity.ProfanityFilterDisabled"/>,
+/// every route short-circuits to "clean" — input is returned unmodified
+/// and purity checks always pass — so nothing gets censored.
 /// </summary>
 [ApiController]
-public class SanitizeController(ILogger<SanitizeController> logger) : ControllerBase
+public class SanitizeController(
+    ILogger<SanitizeController> logger,
+    ServerSettingsService settings) : ControllerBase
 {
+    /// <summary>Purify unless the filter is admin-disabled, in which case
+    /// the input is returned untouched.</summary>
+    private async Task<string> PurifyAsync(string input)
+        => await settings.IsProfanityFilterDisabledAsync()
+            ? input
+            : ProfanityFilter.Purify(input);
+
+    /// <summary>Clean-check unless the filter is admin-disabled, in which
+    /// case everything is treated as clean.</summary>
+    private async Task<bool> IsCleanAsync(string input)
+        => await settings.IsProfanityFilterDisabledAsync() || ProfanityFilter.IsClean(input);
+
     [HttpPost("api/sanitize/v1")]
     [HttpPost("api/sanitize/v1/text")]
     public async Task<IActionResult> Sanitize()
@@ -73,7 +92,7 @@ public class SanitizeController(ILogger<SanitizeController> logger) : Controller
         // ASP.NET Core's StringOutputFormatter doesn't serialize as
         // text/plain (raw string sans quotes), which the watch then sees
         // as an empty cleanVersion after LitJson decode.
-        var purified = ProfanityFilter.Purify(text);
+        var purified = await PurifyAsync(text);
         var json = System.Text.Json.JsonSerializer.Serialize(purified);
         logger.LogInformation("[sanitize] input=\"{Input}\" purified=\"{Purified}\" json={Json}", text, purified, json);
         return Content(json, "application/json");
@@ -95,7 +114,7 @@ public class SanitizeController(ILogger<SanitizeController> logger) : Controller
     /// <c>{Text}</c> with profanity replaced. Wire shape matches
     /// <c>StringSanitization.PurifyString</c>.</summary>
     [HttpPost("api/sanitize/v1/purifyString")]
-    public IActionResult PurifyString(
+    public async Task<IActionResult> PurifyString(
         [FromBody] SanitizeBody? body,
         [FromForm(Name = "Text")] string? textForm,
         [FromForm(Name = "Input")] string? inputForm,
@@ -104,28 +123,28 @@ public class SanitizeController(ILogger<SanitizeController> logger) : Controller
     {
         var input = body?.Text ?? body?.Input ?? body?.Value
             ?? textForm ?? inputForm ?? valueForm ?? textQuery ?? string.Empty;
-        return Ok(new { Text = ProfanityFilter.Purify(input) });
+        return Ok(new { Text = await PurifyAsync(input) });
     }
 
     /// <summary>POST <c>api/sanitize/v1/requestIsStringPure</c> —
     /// returns a bare JSON bool. Watch's <c>ExpectPrimitiveResponse</c>
     /// rejects object bodies here.</summary>
     [HttpPost("api/sanitize/v1/requestIsStringPure")]
-    public IActionResult IsStringPure(
+    public async Task<IActionResult> IsStringPure(
         [FromBody] SanitizeBody? body,
         [FromForm(Name = "Text")] string? textForm,
         [FromQuery(Name = "text")] string? textQuery)
     {
         var input = body?.Text ?? body?.Input ?? body?.Value
             ?? textForm ?? textQuery ?? string.Empty;
-        return Ok(ProfanityFilter.IsClean(input));
+        return Ok(await IsCleanAsync(input));
     }
 
     /// <summary>POST <c>api/sanitize/v1/isPure</c> — 2023 route used
     /// by CV2 maker pen text such as port names. It imports an object
     /// field named <c>IsPure</c>.</summary>
     [HttpPost("api/sanitize/v1/isPure")]
-    public IActionResult IsPureV1(
+    public async Task<IActionResult> IsPureV1(
         [FromBody] SanitizeBody? body,
         [FromForm(Name = "Text")] string? textForm,
         [FromForm(Name = "Input")] string? inputForm,
@@ -134,7 +153,7 @@ public class SanitizeController(ILogger<SanitizeController> logger) : Controller
     {
         var input = body?.Text ?? body?.Input ?? body?.Value
             ?? textForm ?? inputForm ?? valueForm ?? textQuery ?? string.Empty;
-        var isPure = ProfanityFilter.IsClean(input);
+        var isPure = await IsCleanAsync(input);
         logger.LogInformation(
             "[sanitize] isPure context={Context} intent={Intent} ruleset={Ruleset} valueLength={ValueLength} isPure={IsPure}",
             body?.Context ?? string.Empty,
@@ -151,13 +170,13 @@ public class SanitizeController(ILogger<SanitizeController> logger) : Controller
     /// used by room/settings forms. Its importer reads an <c>IsPure</c>
     /// object field, unlike the newer bare-bool route above.</summary>
     [HttpPost("api/sanitize/isPure")]
-    public IActionResult IsPure(
+    public async Task<IActionResult> IsPure(
         [FromBody] SanitizeBody? body,
         [FromForm(Name = "Text")] string? textForm,
         [FromQuery(Name = "text")] string? textQuery)
     {
         var input = body?.Text ?? body?.Input ?? body?.Value
             ?? textForm ?? textQuery ?? string.Empty;
-        return Ok(new { IsPure = ProfanityFilter.IsClean(input) });
+        return Ok(new { IsPure = await IsCleanAsync(input) });
     }
 }

DorkNet.Server/Controllers/Admin/AdminController.cs

@@ -1,7 +1,6 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.IdentityModel.Tokens;
 using DorkNet.Models.Notification;
 using DorkNet.Server.Auth;
 using DorkNet.Server.Data;
@@ -37,10 +36,10 @@ public class AdminController(
     PlayerPresenceService playerPresence,
     PlayerLogService playerLog,
     ServerSettingsService serverSettings,
+    CharadesWordListService charades,
     SignupCodeService signupCodes,
     IObjectStorage storage,
     DomainConfig domain,
-    IdentityServerSigningKeyProvider signingKeys,
     ILogger<AdminController> adminLogger) : ControllerBase
 {
     private long CurrentAdminId => this.RequireCurrentPlayerId();
@@ -1481,53 +1480,6 @@ public class AdminController(
 
     // ── Server settings (runtime toggles) ────────────────────────────────
 
-    [HttpGet("identityserver")]
-    public ActionResult GetIdentityServerSettings()
-    {
-        var issuer = domain.AuthIssuer.TrimEnd('/');
-        var client = RecRoomIdentityServerConfig.Clients[0];
-        var certPath = signingKeys.CertificatePath;
-        var fullCertPath = Path.GetFullPath(certPath);
-        var certificateExists = signingKeys.LoadedFromBase64 || System.IO.File.Exists(fullCertPath);
-
-        return Ok(new
-        {
-            Issuer = issuer,
-            DiscoveryUrl = $"{issuer}/.well-known/openid-configuration",
-            TokenEndpoint = $"{issuer}/connect/token",
-            UserInfoEndpoint = $"{issuer}/connect/userinfo",
-            Client = new
-            {
-                client.ClientId,
-                client.ClientName,
-                AllowedGrantTypes = client.AllowedGrantTypes.ToArray(),
-                AllowedScopes = client.AllowedScopes.ToArray(),
-                client.AllowOfflineAccess,
-                client.AccessTokenLifetime,
-                client.AbsoluteRefreshTokenLifetime,
-                client.SlidingRefreshTokenLifetime,
-                RefreshTokenUsage = client.RefreshTokenUsage.ToString(),
-                RefreshTokenExpiration = client.RefreshTokenExpiration.ToString(),
-            },
-            Signing = new
-            {
-                signingKeys.CertificateSource,
-                signingKeys.LoadedFromBase64,
-                CertificatePath = fullCertPath,
-                CertificateExists = certificateExists,
-                signingKeys.Certificate.Thumbprint,
-                NotBeforeUtc = signingKeys.Certificate.NotBefore.ToUniversalTime(),
-                NotAfterUtc = signingKeys.Certificate.NotAfter.ToUniversalTime(),
-                Algorithm = SecurityAlgorithms.RsaSha256,
-            },
-            PersistedGrants = new
-            {
-                Store = "in-memory",
-                Warning = "Refresh tokens are process-local until an operational store is configured.",
-            },
-        });
-    }
-
     /// <summary>GET <c>api/admin/v1/settings</c> — current server-wide
     /// toggle state. Single row, single round trip.</summary>
     [HttpGet("settings")]
@@ -1539,12 +1491,121 @@ public class AdminController(
             row.SignupsDisabled,
             row.GlobalFriendsEnabled,
             row.WeeklyChallengesCompletedRequired,
+            row.ProfanityFilterDisabled,
             row.UpdatedAt,
         });
     }
 
     public sealed record SignupsToggleRequest(bool Disabled);
     public sealed record GlobalFriendsToggleRequest(bool Enabled);
+    public sealed record ProfanityFilterToggleRequest(bool Disabled);
+
+    /// <summary>POST <c>api/admin/v1/settings/profanity</c> — flip the
+    /// server-side profanity filter. While disabled, every
+    /// <c>api/sanitize/*</c> route returns input unchanged and treats all
+    /// text as clean, so room/invention names and chat are never censored.
+    /// Takes effect immediately (checked per request).</summary>
+    [HttpPost("settings/profanity")]
+    public async Task<ActionResult> SetProfanityFilterDisabled([FromBody] ProfanityFilterToggleRequest body)
+    {
+        var row = await serverSettings.SetProfanityFilterDisabledAsync(body.Disabled);
+        await LogAsync(body.Disabled ? "profanity_filter_disabled" : "profanity_filter_enabled", "system", 0, "");
+        await db.SaveChangesAsync();
+        return Ok(new
+        {
+            row.SignupsDisabled,
+            row.GlobalFriendsEnabled,
+            row.WeeklyChallengesCompletedRequired,
+            row.ProfanityFilterDisabled,
+            row.UpdatedAt,
+        });
+    }
+
+    // ── 3D Charades word lists ───────────────────────────────────────────
+
+    public sealed record CharadesWordDto(string Text, int Difficulty);
+    public sealed record CharadesWordListWriteDto(string? Name, List<CharadesWordDto>? Words);
+    public sealed record CharadesImportDto(string? Text, int DefaultDifficulty, bool Replace);
+    public sealed record CharadesBindingsDto(long Charades, long CharadesAprilFoolsDay, long Icebreakers);
+
+    private static List<CharadesWordListService.CharadesWord>? MapWords(List<CharadesWordDto>? words)
+        => words?.Select(w => new CharadesWordListService.CharadesWord(w.Text, w.Difficulty)).ToList();
+
+    /// <summary>GET <c>api/admin/v1/charades/wordlists</c> — the whole word
+    /// list library plus the live slot→list bindings, so the SPA can render
+    /// the editor and the three slot pickers in one round trip.</summary>
+    [HttpGet("charades/wordlists")]
+    public async Task<ActionResult> ListCharadesWordLists()
+    {
+        var lists = await charades.GetAllAsync();
+        var bindings = await charades.GetBindingsAsync();
+        return Ok(new { lists, bindings });
+    }
+
+    /// <summary>POST <c>api/admin/v1/charades/wordlists</c> — create a new
+    /// word list (optionally pre-populated).</summary>
+    [HttpPost("charades/wordlists")]
+    public async Task<ActionResult> CreateCharadesWordList([FromBody] CharadesWordListWriteDto body)
+    {
+        var dto = await charades.CreateAsync(body.Name ?? string.Empty, MapWords(body.Words));
+        await LogAsync("create_charades_list", "global", dto.Id, dto.Name);
+        return Ok(dto);
+    }
+
+    /// <summary>PUT <c>api/admin/v1/charades/wordlists/{id}</c> — rename
+    /// and/or replace the words of a list. Null fields are left as-is.</summary>
+    [HttpPut("charades/wordlists/{id:long}")]
+    public async Task<ActionResult> UpdateCharadesWordList(long id, [FromBody] CharadesWordListWriteDto body)
+    {
+        var dto = await charades.UpdateAsync(id, body.Name, MapWords(body.Words));
+        if (dto is null) return NotFound();
+        await LogAsync("update_charades_list", "global", id, dto.Name);
+        return Ok(dto);
+    }
+
+    /// <summary>DELETE <c>api/admin/v1/charades/wordlists/{id}</c> — remove a
+    /// list. Any slot pointing at it is unbound (falls back to its built-in).</summary>
+    [HttpDelete("charades/wordlists/{id:long}")]
+    public async Task<ActionResult> DeleteCharadesWordList(long id)
+    {
+        var ok = await charades.DeleteAsync(id);
+        if (!ok) return NotFound();
+        await LogAsync("delete_charades_list", "global", id, "");
+        return Ok(new { deleted = id });
+    }
+
+    /// <summary>POST <c>api/admin/v1/charades/wordlists/{id}/import</c> —
+    /// bulk-add cards from pasted text (one phrase per line, optional
+    /// <c>| difficulty</c> suffix). <c>Replace=true</c> overwrites the
+    /// list; otherwise the cards are appended.</summary>
+    [HttpPost("charades/wordlists/{id:long}/import")]
+    public async Task<ActionResult> ImportCharadesWordList(long id, [FromBody] CharadesImportDto body)
+    {
+        var dto = await charades.ImportAsync(id, body.Text ?? string.Empty, body.DefaultDifficulty, body.Replace);
+        if (dto is null) return NotFound();
+        await LogAsync("import_charades_list", "global", id, dto.Name);
+        return Ok(dto);
+    }
+
+    /// <summary>PUT <c>api/admin/v1/charades/bindings</c> — set which list is
+    /// live for each of the client's three card-source slots. A list id of
+    /// 0 unbinds that slot (falls back to its built-in). This is the
+    /// "switch between lists" control.</summary>
+    [HttpPut("charades/bindings")]
+    public async Task<ActionResult> SetCharadesBindings([FromBody] CharadesBindingsDto body)
+    {
+        foreach (var listId in new[] { body.Charades, body.CharadesAprilFoolsDay, body.Icebreakers })
+        {
+            if (listId != 0 && !await db.CharadesWordLists.AnyAsync(l => l.Id == listId))
+                return BadRequest(new { error = "unknown_list", id = listId });
+        }
+
+        var bindings = await serverSettings.SetCharadesSlotBindingsAsync(
+            new CharadesSlotBindings(body.Charades, body.CharadesAprilFoolsDay, body.Icebreakers));
+        await LogAsync("set_charades_bindings", "system", 0,
+            $"{bindings.Charades}/{bindings.CharadesAprilFoolsDay}/{bindings.Icebreakers}");
+        return Ok(bindings);
+    }
 
     /// <summary>POST <c>api/admin/v1/settings/global-friends</c> — flip the
     /// "everyone is friends" toggle. No relationship rows are written; the

DorkNet.Server/Controllers/Auth/AuthController.cs

@@ -1,4 +1,6 @@
+using System.Security.Cryptography;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
 using DorkNet.Models.Auth;
 using DorkNet.Server.Data.Entities;
 using DorkNet.Server.Services;
@@ -6,18 +8,258 @@ using DorkNet.Server.Services;
 namespace DorkNet.Server.Controllers.Auth;
 
 /// <summary>
-/// auth.rec.net game-specific auth helpers. OAuth/OIDC endpoints are owned by IdentityServer.
+/// auth.rec.net — OAuth-style token endpoint used by 2019+ builds alongside PlatformLogin.
 /// </summary>
 [ApiController]
 public class AuthController(
     PlayerService playerService,
-    AuthService authService) : ControllerBase
+    AuthService authService,
+    LevelService level,
+    OrphanAccountTracker orphans,
+    ServerSettingsService settings,
+    DorkNet.Server.Data.DorkNetDbContext db,
+    DomainConfig domain,
+    ILogger<AuthController> logger) : ControllerBase
 {
+    /// <summary>Award the per-day first-login XP if the calling
+    /// player hasn't been seen yet today (UTC).</summary>
+    private async Task TryAwardLoginXpAsync(long playerId)
+    {
+        var lastSeen = await db.Players
+            .Where(p => p.Id == playerId)
+            .Select(p => p.LastSeenAt)
+            .FirstOrDefaultAsync();
+        if (lastSeen.Date < DateTime.UtcNow.Date)
+            await level.AwardXpAsync(playerId, LevelService.FirstLoginXp, "first_login_today");
+    }
+
+    private static Dictionary<string, object> BuildTokenResponse(string accessToken, string refreshToken)
+    {
+        var signingKey = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+
+        return new()
+        {
+            ["access_token"] = accessToken,
+            ["Access_token"] = accessToken,
+            ["accessToken"] = accessToken,
+            ["AccessToken"] = accessToken,
+            ["token"] = accessToken,
+            ["Token"] = accessToken,
+            ["token_type"] = "Bearer",
+            ["tokenType"] = "Bearer",
+            ["TokenType"] = "Bearer",
+            ["expires_in"] = 43200,
+            ["expiresIn"] = 43200,
+            ["ExpiresIn"] = 43200,
+            ["refresh_token"] = refreshToken,
+            ["Refresh_token"] = refreshToken,
+            ["refreshToken"] = refreshToken,
+            ["RefreshToken"] = refreshToken,
+            ["key"] = signingKey,
+            ["Key"] = signingKey,
+            ["scope"] = "openid profile",
+        };
+    }
+
+    private IActionResult TokenOk(string accessToken, string refreshToken)
+    {
+        var cookie = new CookieOptions
+        {
+            HttpOnly = true,
+            Secure = string.Equals(domain.Scheme, "https", StringComparison.OrdinalIgnoreCase),
+            SameSite = SameSiteMode.None,
+            Expires = DateTimeOffset.UtcNow.AddHours(12),
+            IsEssential = true,
+        };
+        if (domain.Apex.Contains('.'))
+            cookie.Domain = "." + domain.Apex;
+        Response.Cookies.Append(AuthService.AccessCookieName, accessToken, cookie);
+        return Ok(BuildTokenResponse(accessToken, refreshToken));
+    }
+
+    // OAuth token endpoint. The 2020 client uses three grant types here:
+    // - grant_type=cached_login → user clicked a remembered account on the
+    //   account-selection screen. Body includes `account_id` (and platform
+    //   creds). MUST issue a token for THAT specific account; otherwise the
+    //   client receives a JWT for a different account and prompts the user
+    //   to create a new one (because the JWT identity doesn't match what
+    //   they picked).
+    // - grant_type=refresh_token → re-issue access token from the existing
+    //   refresh JWT.
+    // - grant_type=password → first-time sign-in, resolve via deviceId
+    //   (preferred) or fall back to a stable synthetic id derived from
+    //   username so legacy callers don't share accounts.
+    [HttpPost("/connect/token")]
+    [Consumes("application/x-www-form-urlencoded")]
+    public async Task<IActionResult> Token(
+        [FromForm] string? grant_type,
+        [FromForm] string? username,
+        [FromForm] string? password,
+        [FromForm] string? refresh_token,
+        [FromForm] string? deviceId,
+        [FromForm(Name = "device_id")] string? device_id_snake,
+        [FromForm] int platform = 0,
+        [FromForm] string? platformId = null,
+        [FromForm(Name = "platform_id")] string? platform_id_snake = null,
+        [FromForm] long? account_id = null)
+    {
+        // The client mixes camelCase and snake_case parameter naming
+        // depending on grant type — accept both and merge.
+        var effDeviceId = !string.IsNullOrWhiteSpace(deviceId) ? deviceId : device_id_snake;
+        var effPlatformId = !string.IsNullOrWhiteSpace(platformId) ? platformId : platform_id_snake;
+
+        if (string.Equals(grant_type, "cached_login", StringComparison.OrdinalIgnoreCase))
+        {
+            if (account_id is not long pickedId)
+                return BadRequest(new { error = "invalid_request", error_description = "missing account_id" });
+            var picked = await playerService.GetByIdAsync(pickedId);
+            if (picked is null)
+                return Unauthorized(new { error = "invalid_grant", error_description = "unknown account_id" });
+
+            // Orphan cleanup: if the watch just created a brand-new
+            // account on account/create as part of its boot probe, but
+            // the user actually picked a different cached account here,
+            // the just-created row is unused. Delete it so the DB
+            // doesn't accumulate one orphan per game launch. When the
+            // user is genuinely creating a new account, the picked id
+            // matches the just-created id and we leave it.
+            var pendingId = orphans.PeekPending(effDeviceId, effPlatformId);
+            if (pendingId is long orphanId && orphanId != pickedId)
+            {
+                await playerService.DeleteOrphanAsync(orphanId);
+                logger.LogInformation(
+                    "[orphan-cleanup] cached_login picked {PickedId}; deleted just-created {OrphanId}",
+                    pickedId, orphanId);
+            }
+            orphans.Clear(effDeviceId, effPlatformId);
+
+            await TryAwardLoginXpAsync(picked.Id);
+            await playerService.TagPlatformAsync(picked.Id, platform, effPlatformId);
+            var (acc1, refr1) = authService.GenerateTokenPair(picked.Id);
+            return TokenOk(acc1, refr1);
+        }
+
+        if (string.Equals(grant_type, "refresh_token", StringComparison.OrdinalIgnoreCase))
+        {
+            if (string.IsNullOrWhiteSpace(refresh_token))
+                return BadRequest(new { error = "invalid_request" });
+            var resolved = authService.ValidateToken(refresh_token);
+            if (resolved is not long refreshedId)
+                return Unauthorized(new { error = "invalid_grant" });
+            var existing = await playerService.GetByIdAsync(refreshedId);
+            if (existing is null)
+                return Unauthorized(new { error = "invalid_grant" });
+            var (acc, refr) = authService.GenerateTokenPair(existing.Id);
+            return TokenOk(acc, refr);
+        }
+
+        // password grant: two paths.
+        //   • Username + password supplied: real password verify against
+        //     PlayerEntity.PasswordHash. Wrong password → 401.
+        //   • No password: legacy device-id synth path for the 2020
+        //     client's first-launch flow where the player hasn't set a
+        //     password yet (HasPassword returns false in the watch UI
+        //     and prompts them to create one). Resolves the existing
+        //     account (or creates a fresh one) by deviceId.
+        if (!string.IsNullOrEmpty(password) && !string.IsNullOrEmpty(username))
+        {
+            var byName = await playerService.GetByUsernameAsync(username);
+            if (byName is null || byName.PasswordHash is null)
+                return Unauthorized(new
+                {
+                    error = "invalid_grant",
+                    error_description = "unknown_user_or_no_password",
+                });
+            if (!BCrypt.Net.BCrypt.Verify(password, byName.PasswordHash))
+                return Unauthorized(new
+                {
+                    error = "invalid_grant",
+                    error_description = "password_mismatch",
+                });
+            // Tag the platform so the next boot's cached-login lookup
+            // finds this account — without this the watch's "remembered
+            // accounts" prompt would stay empty after a manual sign-in.
+            await playerService.TagPlatformAsync(byName.Id, platform, effPlatformId);
+            await TryAwardLoginXpAsync(byName.Id);
+            var pair = authService.GenerateTokenPair(byName.Id);
+            return TokenOk(pair.AccessToken, pair.RefreshToken);
+        }
+
+        // Device-id fallback path. Prefer the real deviceId; fall back
+        // to a stable legacy synthesis from username so older callers
+        // don't accidentally share an account.
+        var effectiveDeviceId = !string.IsNullOrWhiteSpace(effDeviceId)
+            ? effDeviceId
+            : $"legacy-{(username ?? "anonymous").ToLowerInvariant()}";
+
+        // Honour the admin "signups disabled" toggle. If the device
+        // hasn't logged in before, GetOrCreateByDeviceAsync would mint
+        // a fresh account here — same outcome as hitting
+        // /account/create directly, which the toggle blocks. Refuse
+        // BEFORE creation so the flag isn't bypassable.
+        if (await settings.AreSignupsDisabledAsync())
+        {
+            var existing = await playerService.GetByDeviceAsync(effectiveDeviceId);
+            if (existing is null)
+            {
+                logger.LogInformation(
+                    "[auth] /connect/token device fallback refused — signups disabled (device={Device})",
+                    effectiveDeviceId);
+                return Unauthorized(new
+                {
+                    error = "signups_disabled",
+                    error_description = "Account creation is currently disabled by the server admin.",
+                });
+            }
+        }
+
+        var player = await playerService.GetOrCreateByDeviceAsync(
+            deviceId: effectiveDeviceId,
+            platform: platform,
+            platformId: effPlatformId,
+            displayName: username);
+        await TryAwardLoginXpAsync(player.Id);
+        var (access, refresh) = authService.GenerateTokenPair(player.Id);
+
+        return TokenOk(access, refresh);
+    }
+
+    [HttpGet("/connect/userinfo")]
+    public async Task<IActionResult> UserInfo()
+    {
+        var auth = Request.Headers.Authorization.ToString();
+        if (!auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            return Unauthorized();
+        var token = auth["Bearer ".Length..].Trim();
+        var id = authService.ValidateToken(token);
+        if (id is not long playerId) return Unauthorized();
+        var player = await playerService.GetByIdAsync(playerId);
+        if (player is null) return Unauthorized();
+        return Ok(new { sub = player.Id.ToString(), name = player.Username });
+    }
+
+    // Discovery document — issuer + endpoints derived from
+    // DomainConfig so a single DORKNET_DOMAIN env var keeps the
+    // OpenID document pointed at the live deployment.
+    [HttpGet("/.well-known/openid-configuration")]
+    public IActionResult OpenIdConfig()
+    {
+        var base_ = $"https://{domain.Sub("auth")}";
+        return Ok(new
+        {
+            issuer = base_,
+            token_endpoint = $"{base_}/connect/token",
+            userinfo_endpoint = $"{base_}/connect/userinfo",
+        });
+    }
+
     // 2020.12 added an EAC challenge step in the login flow. The client GETs
     // a challenge string and passes it to EACManager.GenerateChallengeResponse,
     // which calls System.Convert.FromBase64CharPtr on the string. So the
-    // returned challenge MUST be valid base64 — sending arbitrary text throws
+    // returned challenge MUST be valid base64 — sending arbitrary text like
-    // FormatException client-side and kicks the login.
+    // "dorknet-eac-disabled" throws FormatException client-side and kicks
+    // the login. 24 chars of base64 'A's decodes to 18 zero bytes; matches
+    // the rough size of a real EAC handshake nonce.
     [HttpGet("/eac/challenge")]
     [HttpPost("/eac/challenge")]
     public IActionResult EacChallenge()
@@ -26,6 +268,11 @@ public class AuthController(
     // Cached-logins lookup — boot-sequence call from ScreenAccountSelectionManager.
     // URL: GET auth.rec.net/cachedlogin/forplatformid/{platform}/{platformId}
     // Returns List<Login.CachedLogin>. Empty array = no remembered accounts.
+    //
+    // Real lookup: any account whose last platformlogin matched
+    // (platform, platformId) shows up here, sorted most-recent-first. On a
+    // single-Steam-emu setup that's one row; on a multi-account dev box
+    // it's the full list the user has cycled through.
     [HttpGet("/cachedlogin/forplatformid/{platform:int}/{platformId}")]
     public async Task<IActionResult> CachedLoginsForPlatform(int platform, string platformId)
     {
@@ -35,8 +282,10 @@ public class AuthController(
 
     /// <summary>POST <c>cachedlogin/forplatformids</c> — bulk variant
     /// the watch uses when hydrating multiple platform-id mappings
-    /// at once. Body is form-urlencoded <c>platform=&amp;platformIds=a,b,c</c>
+    /// at once (e.g. populating a friend list from Steam ids). Body
-    /// or JSON with the same shape.</summary>
+    /// is form-urlencoded <c>platform=&amp;platformIds=a,b,c</c> or
+    /// JSON with the same shape. Returns the flattened
+    /// <c>List&lt;CachedLogin&gt;</c> across every matched id.</summary>
     [HttpPost("/cachedlogin/forplatformids")]
     [HttpGet("/cachedlogin/forplatformids")]
     public async Task<IActionResult> CachedLoginsForPlatformIds()
@@ -54,7 +303,6 @@ public class AuthController(
             }
         }
         catch { /* not form */ }
-
         if (string.IsNullOrWhiteSpace(rawIds))
         {
             int.TryParse(Request.Query["platform"], out platform);
@@ -80,8 +328,10 @@ public class AuthController(
     [HttpGet("/cachedlogin/current")]
     public async Task<IActionResult> CurrentCachedLogin()
     {
-        var token = GetBearerToken();
+        var auth = Request.Headers.Authorization.ToString();
-        if (token is null) return Unauthorized();
+        if (!auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            return Unauthorized();
+        var token = auth["Bearer ".Length..].Trim();
         var id = authService.ValidateToken(token);
         if (id is not long playerId) return Unauthorized();
         var player = await playerService.GetByIdAsync(playerId);
@@ -94,8 +344,10 @@ public class AuthController(
         [FromForm] int platform = 0,
         [FromForm] string? platformId = null)
     {
-        var token = GetBearerToken();
+        var auth = Request.Headers.Authorization.ToString();
-        if (token is null) return Unauthorized();
+        if (!auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+            return Unauthorized();
+        var token = auth["Bearer ".Length..].Trim();
         var id = authService.ValidateToken(token);
         if (id is not long playerId) return Unauthorized();
         await playerService.TagPlatformAsync(playerId, platform, platformId);
@@ -105,22 +357,37 @@ public class AuthController(
             : Ok(ToCachedLogin(player, platform, platformId ?? string.Empty));
     }
 
-    private string? GetBearerToken()
+    [HttpPost("/connect/deviceauthorization")]
+    [HttpGet("/connect/deviceauthorization")]
+    public async Task<IActionResult> DeviceAuthorization()
     {
-        var auth = Request.Headers.Authorization.ToString();
+        var deviceCode = Guid.NewGuid().ToString("N");
-        if (auth.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+        var userCode = deviceCode[..8].ToUpperInvariant();
-            return auth["Bearer ".Length..].Trim();
+        db.PlayerSettings.Add(new PlayerSettingEntity
-        return Request.Cookies.TryGetValue(AuthService.AccessCookieName, out var cookieToken)
+        {
-            ? cookieToken
+            PlayerId = RelationshipQueries.SystemAccountId,
-            : null;
+            Key = $"deviceauthorization:{deviceCode}",
+            Value = $"{userCode}|{DateTime.UtcNow.AddMinutes(15):O}",
+        });
+        await db.SaveChangesAsync();
+        return Ok(new
+        {
+            device_code = deviceCode,
+            user_code = userCode,
+            verification_uri = $"https://{domain.Sub("auth")}/device",
+            verification_uri_complete = $"https://{domain.Sub("auth")}/device?user_code={userCode}",
+            expires_in = 900,
+            interval = 5,
+        });
     }
 
-    private static CachedLogin ToCachedLogin(PlayerEntity p, int platform, string? platformId) => new()
+    private static CachedLogin ToCachedLogin(PlayerEntity p, int platform, string platformId) => new()
     {
         Platform = platform,
-        PlatformId = platformId ?? string.Empty,
+        PlatformId = platformId,
         AccountId = (int)p.Id,
         LastLoginTime = p.LastSeenAt,
         RequirePassword = false,
     };
+
 }

DorkNet.Server/Controllers/Match/GoToController.cs

@@ -410,14 +410,32 @@ public class GoToController(
     };
 
     [HttpPost("/goto/event/{eventId:long}")]
+    // 2023 rename goto/event → matchmake/event (RecNet.Matchmaking HHDMGIMLBKF).
+    [HttpPost("/matchmake/event/{eventId:long}")]
     public async Task<ActionResult<MatchmakingResponseDto>> GoToEvent(long eventId)
     {
-        var resp = await BuildResponseAsync("DormRoom");
+        // Matchmake the caller into the event's host room. Falls back to
+        // the dorm if the event is unknown or has no room set.
+        var roomId = await db.PlayerEvents.AsNoTracking()
+            .Where(e => e.Id == eventId)
+            .Select(e => (long?)e.RoomId)
+            .FirstOrDefaultAsync();
+        string? roomName = null;
+        if (roomId is long rid && rid > 0)
+            roomName = await db.Rooms.AsNoTracking()
+                .Where(r => r.Id == rid)
+                .Select(r => r.Name)
+                .FirstOrDefaultAsync();
+
+        var resp = await BuildResponseAsync(
+            string.IsNullOrWhiteSpace(roomName) ? "DormRoom" : roomName);
         await RecordResponseAsync(resp);
         return Ok(resp);
     }
 
     [HttpPost("/goto/club/{clubId:long}")]
+    // 2023 rename goto/club → matchmake/club (RecNet.Matchmaking KPAIGCCHIBN).
+    [HttpPost("/matchmake/club/{clubId:long}")]
     public async Task<ActionResult<MatchmakingResponseDto>> GoToClub(long clubId)
     {
         var club = await db.Clubs.AsNoTracking().FirstOrDefaultAsync(c => c.Id == clubId);
@@ -430,7 +448,20 @@ public class GoToController(
             });
         }
 
-        var resp = await BuildResponseAsync("RecCenter");
+        // Land in the club's clubhouse room when it has one set; otherwise
+        // fall back to the Rec Center. Either way the response carries the
+        // ClubId so the watch's club UI knows which club it matchmade for.
+        string roomName = "RecCenter";
+        if (club.ClubhouseRoomId is long clubhouseId && clubhouseId > 0)
+        {
+            var name = await db.Rooms.AsNoTracking()
+                .Where(r => r.Id == clubhouseId)
+                .Select(r => r.Name)
+                .FirstOrDefaultAsync();
+            if (!string.IsNullOrWhiteSpace(name)) roomName = name;
+        }
+
+        var resp = await BuildResponseAsync(roomName);
         resp.RoomInstance!.ClubId = club.Id;
         await RecordResponseAsync(resp);
         return Ok(resp);
@@ -438,7 +469,12 @@ public class GoToController(
 
     [HttpPost("/goto/code")]
     [HttpPost("/goto/code/{code}")]
-    public async Task<ActionResult<MatchmakingResponseDto>> GoToCode(string? code = null)
+    // 2023 sends the room code as the second segment behind the room id
+    // (RecNet.Matchmaking CPINEGCODMD → "matchmake/code/{roomId}/{code}").
+    // The code alone resolves the private instance, so the roomId is just
+    // routing context we don't need — resolve by code either way.
+    [HttpPost("/matchmake/code/{roomId:long}/{code}")]
+    public async Task<ActionResult<MatchmakingResponseDto>> GoToCode(string? code = null, long roomId = 0)
     {
         code ??= Request.HasFormContentType
             ? (await Request.ReadFormAsync())["code"].FirstOrDefault()
@@ -505,6 +541,11 @@ public class GoToController(
     /// dorm if the instance was forgotten (server restart, owner
     /// already left and nobody re-created it).</summary>
     [HttpPost("/goto/instance/{roomInstanceId:long}")]
+    // The 2023 client renamed the whole matchmaking surface from goto/* to
+    // matchmake/* (verified 2023.03.21 il2cpp dump — RecNet.Matchmaking
+    // ANOAAIHGHMG builds "matchmake/instance/{0}"). Same handler, both
+    // mounts, so December and 2023 clients each hit the path they build.
+    [HttpPost("/matchmake/instance/{roomInstanceId:long}")]
     public async Task<ActionResult<MatchmakingResponseDto>> GoToInstance(long roomInstanceId)
     {
         var resp = await BuildPrivateInstanceJoinResponseAsync(roomInstanceId);
@@ -512,7 +553,51 @@ public class GoToController(
         return Ok(resp);
     }
 
+    /// <summary>POST <c>matchmake/chatinvite/{accountId}/{roomInstanceId}</c>
+    /// — the 2023 "pull into my match" path. When a party owner invites
+    /// someone over chat (PlayerParty.AcceptChatPartyInvite →
+    /// RecNet.Matchmaking chatinvite, verified in the 2023.03.21 il2cpp
+    /// dump), the invitee's watch posts here to matchmake into the owner's
+    /// instance. The two path params are the inviter's account id and the
+    /// room instance id in an order the client doesn't document; a private
+    /// instance id is always ≥ 2^24 while account ids are small sequential,
+    /// so we take the param that resolves to a registered instance (falling
+    /// back to the larger value). Unlike the message-based
+    /// <c>POST /invite</c> flow, a chat party invite writes no invitee row,
+    /// so we add the caller to the allow-list here before resolving the
+    /// join — the owner explicitly pulled them in.</summary>
+    [HttpPost("/matchmake/chatinvite/{p0:long}/{p1:long}")]
+    public async Task<ActionResult<MatchmakingResponseDto>> MatchmakeChatInvite(long p0, long p1)
+    {
+        var roomInstanceId = await ResolveChatInviteInstanceAsync(p0, p1);
+
+        if (this.CurrentPlayerId() is long callerId && roomInstanceId > 0)
+            await privateInstances.InviteAsync(roomInstanceId, callerId);
+
+        var resp = await BuildPrivateInstanceJoinResponseAsync(roomInstanceId);
+        await RecordResponseAsync(resp);
+        logger.LogInformation(
+            "[matchmake-chatinvite] caller={Caller} p0={P0} p1={P1} → instance={Instance} error={Error}",
+            this.CurrentPlayerId(), p0, p1, roomInstanceId, resp.ErrorCode);
+        return Ok(resp);
+    }
+
+    /// <summary>Pick the room-instance param out of a chatinvite's two path
+    /// segments. Prefers whichever resolves to a registered private
+    /// instance; if neither does (e.g. a public-room party pull whose id is
+    /// synthetic), falls back to the larger value since instance ids dwarf
+    /// account ids.</summary>
+    private async Task<long> ResolveChatInviteInstanceAsync(long p0, long p1)
+    {
+        if (await privateInstances.GetAsync(p0) is not null) return p0;
+        if (await privateInstances.GetAsync(p1) is not null) return p1;
+        return Math.Max(p0, p1);
+    }
+
     [HttpPost("/goto/invite/{inviteId:long}")]
+    // 2023 rename of goto/invite → matchmake/invite (RecNet.Matchmaking
+    // OIEDPBLNMOP). {inviteId} is the invite message id, same as December.
+    [HttpPost("/matchmake/invite/{inviteId:long}")]
     public async Task<ActionResult<MatchmakingResponseDto>> GoToInvite(long inviteId)
     {
         var callerId = this.CurrentPlayerId();
@@ -758,6 +843,9 @@ public class GoToController(
     /// or on the invite list per <see cref="PrivateInstanceService.CanJoin"/>;
     /// otherwise we refuse with errorCode=9 (RoomNotJoinable).</summary>
     [HttpPost("/goto/player/{playerId:long}")]
+    // 2023 rename goto/player → matchmake/player (RecNet.Matchmaking
+    // FJAFOJHHKPO). Follow a friend into their current room/instance.
+    [HttpPost("/matchmake/player/{playerId:long}")]
     public async Task<ActionResult<MatchmakingResponseDto>> GoToPlayer(long playerId)
     {
         var theirRoom = presence.GetRoom(playerId);

DorkNet.Server/Data/DorkNetDbContext.cs

@@ -60,6 +60,7 @@ public class DorkNetDbContext(DbContextOptions<DorkNetDbContext> options) : DbCo
     public DbSet<GameSessionEntity> GameSessions => Set<GameSessionEntity>();
     public DbSet<CommunityBoardEntity> CommunityBoardRows => Set<CommunityBoardEntity>();
     public DbSet<LoadingScreenTipEntity> LoadingScreenTips => Set<LoadingScreenTipEntity>();
+    public DbSet<CharadesWordListEntity> CharadesWordLists => Set<CharadesWordListEntity>();
     public DbSet<ServerSettingsEntity> ServerSettings => Set<ServerSettingsEntity>();
     public DbSet<RoomKeyEntity> RoomKeys => Set<RoomKeyEntity>();
     public DbSet<RoomKeyPurchaseEntity> RoomKeyPurchases => Set<RoomKeyPurchaseEntity>();

DorkNet.Server/Data/Entities/CharadesWordListEntity.cs

@@ -0,0 +1,46 @@
+namespace DorkNet.Server.Data.Entities;
+
+/// <summary>
+/// One admin-authored 3D Charades word list. The March 2023 client
+/// pulls a deck at card-box spawn time from
+/// <c>api/activities/charades/v1/words/{source}</c>, where
+/// <c>{source}</c> is one of three baked <c>CardBox.cardSource</c>
+/// slots — <c>Charades</c>, <c>CharadesAprilFoolsDay</c>, or
+/// <c>Icebreakers</c> (verified in the 2023.03.21 il2cpp dump:
+/// <c>GEFMIBEPMKJ.EODJJDILECA</c>). The game itself only ever requests
+/// those three ids.
+///
+/// To let admins keep an unlimited library and freely switch which list
+/// each slot serves, every list is a row here (name + words), and the
+/// live slot→list binding lives in
+/// <see cref="ServerSettingsEntity.CharadesSlotBindingsJson"/>. This is
+/// the same admin-editable-collection shape as
+/// <see cref="LoadingScreenTipEntity"/>: a plain entity CRUD'd from the
+/// SPA, created on existing DBs via the idempotent bootstrap (it
+/// post-dates the consolidated Initial migration).
+/// </summary>
+public class CharadesWordListEntity
+{
+    public long Id { get; set; }
+
+    /// <summary>Admin-facing display name, e.g. "Default", "Movie night",
+    /// "April Fools". Not sent to the client.</summary>
+    public string Name { get; set; } = string.Empty;
+
+    /// <summary>Serialized <c>List&lt;CharadesWord&gt;</c> — each entry is
+    /// <c>{ Text, Difficulty }</c>. <c>Text</c> becomes the wire
+    /// <c>EN_US</c> field; <c>Difficulty</c> is the client
+    /// <c>CNMMMNJJDMM</c> enum (0 easy, 1 hard, 10 very hard, 20
+    /// icebreaker). Stored as JSON so a list can grow to hundreds of
+    /// cards without a child table.</summary>
+    public string WordsJson { get; set; } = "[]";
+
+    /// <summary>True for the lists seeded on first boot (Default /
+    /// April Fools / Icebreakers). Purely informational — admins may
+    /// still rename, edit, or delete them; it only gates the one-time
+    /// seed so we don't duplicate them every startup.</summary>
+    public bool IsBuiltIn { get; set; }
+
+    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
+    public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
+}

DorkNet.Server/Data/Entities/ServerSettingsEntity.cs

@@ -64,5 +64,23 @@ public class ServerSettingsEntity
     /// migration each time.</summary>
     public string DiscoveredGameConfigsJson { get; set; } = string.Empty;
 
+    /// <summary>When true, the server-side profanity filter behind
+    /// <c>api/sanitize/*</c> is bypassed — every string is treated as
+    /// clean and returned unmodified. Built for private friend servers
+    /// that don't want room/invention names or chat censored. Off by
+    /// default (filter active). See <see cref="Services.ProfanityFilter"/>
+    /// and <c>SanitizeController</c>.</summary>
+    public bool ProfanityFilterDisabled { get; set; }
+
+    /// <summary>Which charades word list (row id in
+    /// <see cref="CharadesWordListEntity"/>) is live for each of the
+    /// client's three baked card-source slots. JSON object keyed by the
+    /// client enum name — <c>{"Charades":id,"CharadesAprilFoolsDay":id,
+    /// "Icebreakers":id}</c>. Empty/0 or a dangling id falls back to the
+    /// list the seeder created for that slot. Lets admins keep an
+    /// unlimited library and switch which list a slot serves without a
+    /// redeploy.</summary>
+    public string CharadesSlotBindingsJson { get; set; } = string.Empty;
+
     public DateTime UpdatedAt { get; set; } = DateTime.UtcNow;
 }

DorkNet.Server/DorkNet.Server.csproj

@@ -1,23 +1,20 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.4" />
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.15" />
-    <PackageReference Include="Open.IdentityServer" Version="1.0.0" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.0.4">
-    <PackageReference Include="MessagePack" Version="3.1.7" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.9">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="9.0.4" />
-    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlite3" Version="3.0.3" />
+    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="9.0.4" />
-    <PackageReference Include="Npgsql.EntityFrameworkCore.PostgreSQL" Version="10.0.2" />
     <!-- RenderedCompactJsonFormatter for stdout JSON logs in production
          (Coolify-friendly). The host pipeline reads stdout line-by-line,
          and structured JSON lets a future Loki/Datadog ingest parse fields
@@ -28,8 +25,8 @@
          scale: SignalR group fanout, OrphanAccountTracker (sticky-session
          account-creation flow), and PlayerPresenceService heartbeats all
          need shared state across replicas. -->
-    <PackageReference Include="StackExchange.Redis" Version="2.13.17" />
+    <PackageReference Include="StackExchange.Redis" Version="2.8.16" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.StackExchangeRedis" Version="9.0.4" />
     <!-- S3-compatible object storage. Production target: Garage in
          Coolify (one-click). Dev fallback: local MinIO for parity
          testing. The SDK speaks plain S3, so swapping endpoints
@@ -41,7 +38,7 @@
          cost+salt in the output string so we only need one column. -->
     <PackageReference Include="BCrypt.Net-Next" Version="4.0.3" />
     <PackageReference Include="Serilog.AspNetCore" Version="9.0.0" />
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.3" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="7.3.1" />
     <!-- Server-side crop/resize for img.* CDN transforms (?cropSquare=1&width=N
          on profile thumbnails). The 2020 client treats this as part of the
          image CDN contract — it uploads a full-frame capture and expects the

DorkNet.Server/Services/AuthService.cs

@@ -3,15 +3,13 @@ using Microsoft.IdentityModel.Tokens;
 using System.IdentityModel.Tokens.Jwt;
 using System.Security.Claims;
 using System.Text;
-using DorkNet.Server.Auth;
 using DorkNet.Server.Data;
 
 namespace DorkNet.Server.Services;
 
-public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfig domain, IdentityServerSigningKeyProvider signingKeyProvider)
+public class AuthService(IConfiguration config, DorkNetDbContext db)
 {
     public const string AccessCookieName = "dorknet_access_token";
-    public const string LegacyIssuer = "https://api.rec.net/";
 
     // Resolution order MUST match Program.cs's JwtBearer validator setup —
     // env var first, config key second — otherwise tokens are signed with
@@ -42,17 +40,47 @@ public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfi
     private string CreateJwt(long playerId, TimeSpan lifetime, string tokenType)
     {
         var handler = new JwtSecurityTokenHandler();
-        var claims = RecRoomIdentityClaims.CreateAsync(db, playerId)
+        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));
-            .GetAwaiter()
+
-            .GetResult();
+        // Look up dev/admin flags so the JWT carries a "developer" role
-        claims.Add(new Claim("token_type", tokenType));
+        // claim for accounts that should see the in-game debug button.
+        // The watch's Login.SetAccessToken parses the access_token's
+        // <c>role</c> claim — either a single string or a list — and
+        // calls <c>HasRole("developer", token)</c>; that result drives
+        // <c>Accounts.SetLocalAccountIsDev</c> and ultimately
+        // <c>SessionManager.IsDeveloper</c>, which the watch UI checks
+        // when deciding whether to show the dev console toggle.
+        var isDev = db.Players
+            .Where(p => p.Id == playerId)
+            .Select(p => (bool?)(p.IsDeveloper || p.IsAdmin))
+            .FirstOrDefault() ?? false;
+
+        var claims = new List<Claim>
+        {
+            new(ClaimTypes.NameIdentifier, playerId.ToString()),
+            new(JwtRegisteredClaimNames.Sub, playerId.ToString()),
+            new("accountId", playerId.ToString()),
+            new("account_id", playerId.ToString()),
+            new("accountid", playerId.ToString()),
+            new(ClaimTypes.Role, "gameClient"),
+            new("roles", "gameClient"),
+            new("token_type", tokenType),
+        };
+        // Multiple Role claims become a JSON array on the wire — the
+        // watch's HasRole helper handles both string and List<string>
+        // forms.
+        if (isDev)
+        {
+            claims.Add(new Claim(ClaimTypes.Role, "developer"));
+            claims.Add(new Claim("roles", "developer"));
+        }
 
         var descriptor = new SecurityTokenDescriptor
         {
             Subject = new ClaimsIdentity(claims),
             Expires = DateTime.UtcNow.Add(lifetime),
-            Issuer = domain.AuthIssuer,
+            Issuer = "https://api.rec.net/",
-            SigningCredentials = new SigningCredentials(signingKeyProvider.SigningKey, SecurityAlgorithms.RsaSha256),
+            SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256),
         };
 
         return handler.WriteToken(handler.CreateJwtSecurityToken(descriptor));
@@ -63,22 +91,19 @@ public class AuthService(IConfiguration config, DorkNetDbContext db, DomainConfi
         try
         {
             var handler = new JwtSecurityTokenHandler();
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));
+
             var principal = handler.ValidateToken(token, new TokenValidationParameters
             {
                 ValidateIssuerSigningKey = true,
-                IssuerSigningKeys = signingKeyProvider.ValidationKeys,
+                IssuerSigningKey = key,
                 ValidateIssuer = true,
-                ValidIssuers = new[] { domain.AuthIssuer, LegacyIssuer },
+                ValidIssuer = "https://api.rec.net/",
                 ValidateAudience = false,
                 ClockSkew = TimeSpan.Zero,
             }, out _);
 
-            var idClaim = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value
+            var idClaim = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
-                ?? principal.FindFirst(JwtRegisteredClaimNames.Sub)?.Value
-                ?? principal.FindFirst("sub")?.Value
-                ?? principal.FindFirst("accountId")?.Value
-                ?? principal.FindFirst("account_id")?.Value
-                ?? principal.FindFirst("accountid")?.Value;
             return idClaim is not null ? long.Parse(idClaim) : null;
         }
         catch

DorkNet.Server/Services/CharadesWordListService.cs

@@ -0,0 +1,442 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using DorkNet.Server.Data;
+using DorkNet.Server.Data.Entities;
+using Microsoft.EntityFrameworkCore;
+
+namespace DorkNet.Server.Services;
+
+/// <summary>
+/// Admin-managed library of 3D Charades word lists plus the live
+/// slot→list bindings the March 2023 client reads.
+///
+/// <para>Wire contract (verified in the 2023.03.21 il2cpp dump —
+/// <c>CardBox</c> / <c>GEFMIBEPMKJ</c>): the client GETs
+/// <c>api/activities/charades/v1/words/{source}</c> at card-box spawn,
+/// where <c>{source}</c> is one of three baked <c>cardSource</c> enum
+/// slots (<see cref="CharadesSlot"/>). The response is a JSON array of
+/// <c>{ "EN_US": string, "Difficulty": int }</c> where Difficulty is the
+/// client <c>CNMMMNJJDMM</c> enum (<see cref="DifficultyEasy"/> etc.).</para>
+///
+/// <para>Storage: each list is a <see cref="CharadesWordListEntity"/> row
+/// (unlimited library); the live slot bindings live in
+/// <see cref="ServerSettingsEntity.CharadesSlotBindingsJson"/> via
+/// <see cref="ServerSettingsService"/>. Switching a slot just repoints its
+/// binding — no redeploy, effective on the next card-box refresh.</para>
+/// </summary>
+public class CharadesWordListService(DorkNetDbContext db, ServerSettingsService settings)
+{
+    /// <summary>The three baked <c>CardBox.cardSource</c> values the client
+    /// can request. Integer values match the client
+    /// <c>GEFMIBEPMKJ.EODJJDILECA</c> enum.</summary>
+    public enum CharadesSlot
+    {
+        Charades = 0,
+        CharadesAprilFoolsDay = 1,
+        Icebreakers = 2,
+    }
+
+    // Client CNMMMNJJDMM difficulty enum values.
+    public const int DifficultyEasy = 0;
+    public const int DifficultyHard = 1;
+    public const int DifficultyVeryHard = 10;
+    public const int DifficultyIcebreaker = 20;
+
+    private static readonly JsonSerializerOptions JsonOptions = new()
+    {
+        PropertyNameCaseInsensitive = true,
+    };
+
+    /// <summary>One card as stored/edited in the admin UI.</summary>
+    public sealed record CharadesWord(string Text, int Difficulty);
+
+    /// <summary>A word list as returned to the admin SPA.</summary>
+    public sealed record CharadesWordListDto(
+        long Id,
+        string Name,
+        IReadOnlyList<CharadesWord> Words,
+        bool IsBuiltIn,
+        DateTime UpdatedAt);
+
+    /// <summary>Wire entry. Property names are pinned to the exact casing
+    /// the client's LitJson importer reads (<c>EN_US</c>, <c>Difficulty</c>);
+    /// LitJson key lookup is case-sensitive.</summary>
+    public sealed record CharadesWordWire(
+        [property: JsonPropertyName("EN_US")] string EN_US,
+        [property: JsonPropertyName("Difficulty")] int Difficulty);
+
+    // ---- library CRUD ----------------------------------------------------
+
+    public async Task<IReadOnlyList<CharadesWordListDto>> GetAllAsync()
+    {
+        var rows = await db.CharadesWordLists.AsNoTracking()
+            .OrderByDescending(l => l.IsBuiltIn)
+            .ThenBy(l => l.Id)
+            .ToListAsync();
+        return rows.Select(ToDto).ToList();
+    }
+
+    public async Task<CharadesWordListDto?> GetAsync(long id)
+    {
+        var row = await db.CharadesWordLists.AsNoTracking()
+            .FirstOrDefaultAsync(l => l.Id == id);
+        return row is null ? null : ToDto(row);
+    }
+
+    public async Task<CharadesWordListDto> CreateAsync(
+        string name, IReadOnlyList<CharadesWord>? words = null, bool isBuiltIn = false)
+    {
+        var row = new CharadesWordListEntity
+        {
+            Name = CleanName(name),
+            WordsJson = SerializeWords(NormalizeWords(words ?? [])),
+            IsBuiltIn = isBuiltIn,
+            CreatedAt = DateTime.UtcNow,
+            UpdatedAt = DateTime.UtcNow,
+        };
+        db.CharadesWordLists.Add(row);
+        await db.SaveChangesAsync();
+        return ToDto(row);
+    }
+
+    /// <summary>Rename and/or replace the words of a list. Null args are
+    /// left untouched.</summary>
+    public async Task<CharadesWordListDto?> UpdateAsync(
+        long id, string? name, IReadOnlyList<CharadesWord>? words)
+    {
+        var row = await db.CharadesWordLists.FirstOrDefaultAsync(l => l.Id == id);
+        if (row is null) return null;
+        if (name is not null) row.Name = CleanName(name);
+        if (words is not null) row.WordsJson = SerializeWords(NormalizeWords(words));
+        row.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return ToDto(row);
+    }
+
+    public async Task<bool> DeleteAsync(long id)
+    {
+        var row = await db.CharadesWordLists.FirstOrDefaultAsync(l => l.Id == id);
+        if (row is null) return false;
+        db.CharadesWordLists.Remove(row);
+        await db.SaveChangesAsync();
+
+        // If any slot was pointing at the list we just deleted, drop the
+        // dangling binding so resolution falls back cleanly.
+        var bindings = await settings.GetCharadesSlotBindingsAsync();
+        if (bindings.Charades == id || bindings.CharadesAprilFoolsDay == id || bindings.Icebreakers == id)
+        {
+            await settings.SetCharadesSlotBindingsAsync(new CharadesSlotBindings(
+                bindings.Charades == id ? 0 : bindings.Charades,
+                bindings.CharadesAprilFoolsDay == id ? 0 : bindings.CharadesAprilFoolsDay,
+                bindings.Icebreakers == id ? 0 : bindings.Icebreakers));
+        }
+        return true;
+    }
+
+    /// <summary>Append (or replace) cards parsed from pasted text.
+    /// One phrase per line; an optional <c>| difficulty</c> suffix per line
+    /// (easy/hard/veryhard/icebreaker or a raw int) overrides
+    /// <paramref name="defaultDifficulty"/>.</summary>
+    public async Task<CharadesWordListDto?> ImportAsync(
+        long id, string pasteText, int defaultDifficulty, bool replace)
+    {
+        var row = await db.CharadesWordLists.FirstOrDefaultAsync(l => l.Id == id);
+        if (row is null) return null;
+
+        var incoming = ParsePaste(pasteText, defaultDifficulty);
+        var combined = replace
+            ? incoming
+            : DeserializeWords(row.WordsJson).Concat(incoming).ToList();
+
+        row.WordsJson = SerializeWords(NormalizeWords(combined));
+        row.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return ToDto(row);
+    }
+
+    // ---- slot bindings ---------------------------------------------------
+
+    public Task<CharadesSlotBindings> GetBindingsAsync() => settings.GetCharadesSlotBindingsAsync();
+
+    public async Task<CharadesSlotBindings> SetBindingAsync(CharadesSlot slot, long listId)
+    {
+        // A listId of 0 clears the binding (falls back to the built-in for
+        // that slot). A non-zero id must reference an existing list.
+        if (listId != 0 && !await db.CharadesWordLists.AnyAsync(l => l.Id == listId))
+            throw new ArgumentException($"No charades word list with id {listId}.");
+
+        var current = await settings.GetCharadesSlotBindingsAsync();
+        var next = slot switch
+        {
+            CharadesSlot.Charades => current with { Charades = listId },
+            CharadesSlot.CharadesAprilFoolsDay => current with { CharadesAprilFoolsDay = listId },
+            CharadesSlot.Icebreakers => current with { Icebreakers = listId },
+            _ => current,
+        };
+        return await settings.SetCharadesSlotBindingsAsync(next);
+    }
+
+    // ---- client resolution ----------------------------------------------
+
+    /// <summary>Resolve the wire deck for a client-requested source. The
+    /// route param may be the enum name (<c>Charades</c>) or its int
+    /// (<c>0</c>); unknown values fall back to the Charades slot. Returns
+    /// the bound list's cards, or that slot's built-in seed list if the
+    /// binding is empty/dangling, or an empty array as a last resort.</summary>
+    public async Task<IReadOnlyList<CharadesWordWire>> ResolveWireWordsAsync(string source)
+    {
+        var slot = ParseSlot(source);
+        var bindings = await settings.GetCharadesSlotBindingsAsync();
+        var boundId = slot switch
+        {
+            CharadesSlot.CharadesAprilFoolsDay => bindings.CharadesAprilFoolsDay,
+            CharadesSlot.Icebreakers => bindings.Icebreakers,
+            _ => bindings.Charades,
+        };
+
+        CharadesWordListEntity? row = null;
+        if (boundId != 0)
+            row = await db.CharadesWordLists.AsNoTracking().FirstOrDefaultAsync(l => l.Id == boundId);
+
+        // Fallback: the built-in list whose name matches the slot's default.
+        row ??= await db.CharadesWordLists.AsNoTracking()
+            .Where(l => l.IsBuiltIn && l.Name == DefaultListName(slot))
+            .FirstOrDefaultAsync();
+
+        var words = row is null ? [] : DeserializeWords(row.WordsJson);
+        return words.Select(w => new CharadesWordWire(w.Text, w.Difficulty)).ToList();
+    }
+
+    // ---- seeding ---------------------------------------------------------
+
+    /// <summary>Seed the three built-in lists (Default / April Fools /
+    /// Icebreakers) and point each slot at them. Idempotent: no-ops once any
+    /// list exists, so admin edits are never clobbered on restart.</summary>
+    public async Task SeedAsync()
+    {
+        if (await db.CharadesWordLists.AnyAsync()) return;
+
+        var defaultList = await CreateAsync(
+            DefaultListName(CharadesSlot.Charades),
+            DefaultCharadesWords, isBuiltIn: true);
+        var aprilList = await CreateAsync(
+            DefaultListName(CharadesSlot.CharadesAprilFoolsDay),
+            AprilFoolsWords, isBuiltIn: true);
+        var iceList = await CreateAsync(
+            DefaultListName(CharadesSlot.Icebreakers),
+            IcebreakerWords, isBuiltIn: true);
+
+        await settings.SetCharadesSlotBindingsAsync(new CharadesSlotBindings(
+            defaultList.Id, aprilList.Id, iceList.Id));
+    }
+
+    // ---- helpers ---------------------------------------------------------
+
+    public static IReadOnlyList<CharadesWord> ParsePaste(string text, int defaultDifficulty)
+    {
+        if (string.IsNullOrWhiteSpace(text)) return [];
+        var result = new List<CharadesWord>();
+        foreach (var raw in text.Split('\n'))
+        {
+            var line = raw.Trim().TrimEnd('\r').Trim();
+            if (line.Length == 0) continue;
+
+            var difficulty = defaultDifficulty;
+            var pipe = line.LastIndexOf('|');
+            if (pipe > 0 && pipe < line.Length - 1)
+            {
+                var maybe = line[(pipe + 1)..].Trim();
+                if (TryParseDifficulty(maybe, out var d))
+                {
+                    difficulty = d;
+                    line = line[..pipe].Trim();
+                }
+            }
+            if (line.Length == 0) continue;
+            result.Add(new CharadesWord(line, difficulty));
+        }
+        return result;
+    }
+
+    private static bool TryParseDifficulty(string s, out int difficulty)
+    {
+        switch (s.Replace(" ", string.Empty).ToLowerInvariant())
+        {
+            case "easy": difficulty = DifficultyEasy; return true;
+            case "hard": difficulty = DifficultyHard; return true;
+            case "veryhard": case "vhard": case "stupidhard": difficulty = DifficultyVeryHard; return true;
+            case "icebreaker": case "icebreakers": difficulty = DifficultyIcebreaker; return true;
+        }
+        if (int.TryParse(s, out var n) &&
+            n is DifficultyEasy or DifficultyHard or DifficultyVeryHard or DifficultyIcebreaker)
+        {
+            difficulty = n;
+            return true;
+        }
+        difficulty = DifficultyEasy;
+        return false;
+    }
+
+    private static CharadesSlot ParseSlot(string source)
+    {
+        if (string.IsNullOrWhiteSpace(source)) return CharadesSlot.Charades;
+        var s = source.Trim();
+        if (int.TryParse(s, out var n) && Enum.IsDefined(typeof(CharadesSlot), n))
+            return (CharadesSlot)n;
+        if (Enum.TryParse<CharadesSlot>(s, ignoreCase: true, out var slot))
+            return slot;
+        return CharadesSlot.Charades;
+    }
+
+    private static string DefaultListName(CharadesSlot slot) => slot switch
+    {
+        CharadesSlot.CharadesAprilFoolsDay => "April Fools (impossible)",
+        CharadesSlot.Icebreakers => "Icebreakers",
+        _ => "Default",
+    };
+
+    private static CharadesWordListDto ToDto(CharadesWordListEntity row) => new(
+        row.Id, row.Name, DeserializeWords(row.WordsJson), row.IsBuiltIn, row.UpdatedAt);
+
+    private static string CleanName(string name)
+    {
+        var trimmed = (name ?? string.Empty).Trim();
+        if (trimmed.Length == 0) trimmed = "Untitled list";
+        return trimmed.Length > 128 ? trimmed[..128] : trimmed;
+    }
+
+    /// <summary>Trim, drop blanks, clamp difficulty to a known value, and
+    /// de-duplicate case-insensitively (keeping first occurrence).</summary>
+    private static IReadOnlyList<CharadesWord> NormalizeWords(IReadOnlyList<CharadesWord> words)
+    {
+        var seen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var result = new List<CharadesWord>();
+        foreach (var w in words)
+        {
+            var text = (w.Text ?? string.Empty).Trim();
+            if (text.Length == 0) continue;
+            if (text.Length > 256) text = text[..256];
+            if (!seen.Add(text)) continue;
+            var difficulty = w.Difficulty is DifficultyEasy or DifficultyHard
+                or DifficultyVeryHard or DifficultyIcebreaker
+                ? w.Difficulty
+                : DifficultyEasy;
+            result.Add(new CharadesWord(text, difficulty));
+        }
+        return result;
+    }
+
+    private static string SerializeWords(IReadOnlyList<CharadesWord> words) =>
+        JsonSerializer.Serialize(words, JsonOptions);
+
+    private static IReadOnlyList<CharadesWord> DeserializeWords(string json)
+    {
+        if (string.IsNullOrWhiteSpace(json)) return [];
+        try
+        {
+            return JsonSerializer.Deserialize<List<CharadesWord>>(json, JsonOptions) ?? [];
+        }
+        catch
+        {
+            return [];
+        }
+    }
+
+    // ---- seed content ----------------------------------------------------
+
+    private static CharadesWord E(string t) => new(t, DifficultyEasy);
+    private static CharadesWord H(string t) => new(t, DifficultyHard);
+    private static CharadesWord V(string t) => new(t, DifficultyVeryHard);
+    private static CharadesWord I(string t) => new(t, DifficultyIcebreaker);
+
+    /// <summary>A broad, family-friendly default deck spread across the
+    /// three charades difficulties (easy / hard / very hard).</summary>
+    private static readonly IReadOnlyList<CharadesWord> DefaultCharadesWords =
+    [
+        // Easy — single actable words
+        E("Dog"), E("Cat"), E("Elephant"), E("Monkey"), E("Snake"), E("Rabbit"),
+        E("Penguin"), E("Shark"), E("Spider"), E("Kangaroo"), E("Frog"), E("Horse"),
+        E("Running"), E("Swimming"), E("Dancing"), E("Sleeping"), E("Eating"), E("Jumping"),
+        E("Crying"), E("Laughing"), E("Sneezing"), E("Fishing"), E("Cooking"), E("Painting"),
+        E("Guitar"), E("Piano"), E("Drums"), E("Basketball"), E("Soccer"), E("Tennis"),
+        E("Skateboard"), E("Bicycle"), E("Airplane"), E("Rocket"), E("Boat"), E("Train"),
+        E("Umbrella"), E("Telephone"), E("Camera"), E("Toothbrush"), E("Scissors"), E("Hammer"),
+        E("Pizza"), E("Ice cream"), E("Banana"), E("Popcorn"), E("Birthday cake"), E("Hamburger"),
+        E("Robot"), E("Ghost"), E("Zombie"), E("Superhero"), E("Pirate"), E("Wizard"),
+        // Hard — phrases, titles, actions
+        H("Riding a roller coaster"), H("Brushing your teeth"), H("Tying your shoes"),
+        H("Blowing out candles"), H("Milking a cow"), H("Climbing a ladder"),
+        H("Walking a tightrope"), H("Playing video games"), H("Taking a selfie"),
+        H("Surfing a wave"), H("Building a sandcastle"), H("Chopping wood"),
+        H("Conducting an orchestra"), H("Directing traffic"), H("Juggling"),
+        H("The Statue of Liberty"), H("A washing machine"), H("A vending machine"),
+        H("A traffic light"), H("A grandfather clock"), H("A roller coaster"),
+        H("Peter Pan"), H("Sherlock Holmes"), H("Frankenstein"), H("Cinderella"),
+        H("Harry Potter"), H("Spider-Man"), H("The Loch Ness Monster"),
+        H("Doing laundry"), H("Mowing the lawn"), H("Flying a kite"),
+        H("Scuba diving"), H("Rock climbing"), H("Bowling a strike"),
+        // Very hard — abstract-but-still-actable, longer titles
+        V("Photosynthesis"), V("The theory of relativity"), V("A midlife crisis"),
+        V("Rush hour traffic"), V("Herding cats"), V("A house of cards"),
+        V("The circle of life"), V("Breaking the fourth wall"), V("A wild goose chase"),
+        V("Death and taxes"), V("The domino effect"), V("Time flies when you're having fun"),
+        V("A blessing in disguise"), V("Barking up the wrong tree"),
+        V("The elephant in the room"), V("Raining cats and dogs"),
+        V("A penny for your thoughts"), V("Bite the bullet"),
+        V("The tip of the iceberg"), V("Once in a blue moon"),
+    ];
+
+    /// <summary>April Fools deck — concepts that are (nearly) impossible to
+    /// act out. All flagged very hard.</summary>
+    private static readonly IReadOnlyList<CharadesWord> AprilFoolsWords =
+    [
+        V("The concept of Tuesday"), V("Existential dread"), V("The smell of rain"),
+        V("Object-oriented programming"), V("The year 1997"), V("Nostalgia"),
+        V("The color infrared"), V("A prime number"), V("Dramatic irony"),
+        V("The stock market"), V("Deja vu"), V("The taste of the number seven"),
+        V("Quantum entanglement"), V("The feeling of Sunday night"),
+        V("Sarcasm"), V("The concept of infinity"), V("Static electricity"),
+        V("The sound of one hand clapping"), V("Impostor syndrome"),
+        V("The general theory of relativity"), V("A tax audit"),
+        V("The plot of Inception"), V("Schadenfreude"), V("The Dewey Decimal System"),
+        V("Awkward silence"), V("The gluten in bread"), V("Inflation"),
+        V("The concept of a concept"), V("Wi-Fi"), V("The color of Wednesday"),
+        V("A recursive function"), V("The heat death of the universe"),
+        V("Peripheral vision"), V("The smell of a new car"),
+        V("Cryptocurrency"), V("The uncanny valley"), V("A palindrome"),
+        V("The passage of time"), V("Cognitive dissonance"),
+        V("The concept of nothing at all"),
+    ];
+
+    /// <summary>Icebreaker prompts for the Icebreakers card source. All
+    /// flagged with the icebreaker difficulty so they group correctly.</summary>
+    private static readonly IReadOnlyList<CharadesWord> IcebreakerWords =
+    [
+        I("Your dream vacation"), I("A hidden talent you have"),
+        I("Your favorite childhood snack"), I("The best gift you ever got"),
+        I("A superpower you'd want"), I("Your go-to karaoke song"),
+        I("The last show you binged"), I("Your comfort food"),
+        I("A place you'd love to visit"), I("Your favorite season"),
+        I("The best concert you've been to"), I("Your dream job as a kid"),
+        I("A weird food combo you love"), I("Your favorite board game"),
+        I("The best advice you've received"), I("A skill you'd love to learn"),
+        I("Your favorite holiday"), I("The first thing you'd buy if you won the lottery"),
+        I("Your most-used emoji"), I("A movie you can quote by heart"),
+        I("Your favorite way to relax"), I("The pet you have or wish you had"),
+        I("A hobby you picked up recently"), I("Your favorite ice cream flavor"),
+        I("The best trip you've ever taken"), I("A song stuck in your head"),
+        I("Your favorite thing about Rec Room"), I("The coolest place you've been"),
+        I("A talent show act you'd perform"), I("Your dream superpower team-up"),
+    ];
+}
+
+/// <summary>Which word list (row id) is live for each of the client's
+/// three baked charades card-source slots. A 0 means "unbound" — the
+/// resolver falls back to that slot's built-in seed list.</summary>
+public sealed record CharadesSlotBindings(
+    long Charades,
+    long CharadesAprilFoolsDay,
+    long Icebreakers)
+{
+    public static CharadesSlotBindings Empty => new(0, 0, 0);
+}

DorkNet.Server/Services/DomainConfig.cs

@@ -28,8 +28,6 @@ public sealed class DomainConfig
         return UsesHyphenSubdomains ? $"{prefix}-{Apex}" : $"{prefix}.{Apex}";
     }
 
-    public string AuthIssuer => Url("auth");
-
     public string Url(string prefix, string path = "")
     {
         var host = string.IsNullOrEmpty(prefix) ? Apex : Sub(prefix);

DorkNet.Server/Services/ServerSettingsService.cs

@@ -151,6 +151,52 @@ public class ServerSettingsService(DorkNetDbContext db)
         return ToWeeklySettings(existing);
     }
 
+    /// <summary>Whether the server-side profanity filter behind
+    /// <c>api/sanitize/*</c> is bypassed. Off by default (filter active).</summary>
+    public async Task<bool> IsProfanityFilterDisabledAsync()
+    {
+        var row = await db.ServerSettings.AsNoTracking()
+            .FirstOrDefaultAsync(s => s.Id == RowId);
+        return row?.ProfanityFilterDisabled ?? false;
+    }
+
+    public async Task<ServerSettingsEntity> SetProfanityFilterDisabledAsync(bool disabled)
+    {
+        var existing = await GetTrackedRowAsync();
+        existing.ProfanityFilterDisabled = disabled;
+        existing.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return existing;
+    }
+
+    /// <summary>Live charades slot→list bindings. Empty/unparseable JSON
+    /// resolves to <see cref="CharadesSlotBindings.Empty"/> (every slot
+    /// falls back to its built-in seed list).</summary>
+    public async Task<CharadesSlotBindings> GetCharadesSlotBindingsAsync()
+    {
+        var row = await GetAsync();
+        if (string.IsNullOrWhiteSpace(row.CharadesSlotBindingsJson))
+            return CharadesSlotBindings.Empty;
+        try
+        {
+            return JsonSerializer.Deserialize<CharadesSlotBindings>(
+                row.CharadesSlotBindingsJson, JsonOptions) ?? CharadesSlotBindings.Empty;
+        }
+        catch
+        {
+            return CharadesSlotBindings.Empty;
+        }
+    }
+
+    public async Task<CharadesSlotBindings> SetCharadesSlotBindingsAsync(CharadesSlotBindings bindings)
+    {
+        var existing = await GetTrackedRowAsync();
+        existing.CharadesSlotBindingsJson = JsonSerializer.Serialize(bindings, JsonOptions);
+        existing.UpdatedAt = DateTime.UtcNow;
+        await db.SaveChangesAsync();
+        return bindings;
+    }
+
     private async Task<ServerSettingsEntity> GetTrackedRowAsync()
     {
         var existing = await db.ServerSettings.FirstOrDefaultAsync(s => s.Id == RowId);

DorkNet.Server/Startup/DatabaseBootstrap.cs

@@ -103,6 +103,7 @@ public static class DatabaseBootstrap
         // IF NOT EXISTS no-ops when EnsureCreated already built them).
         await EnsureSignupCodeTablesAsync(db);
         await EnsureServerSettingsColumnsAsync(db);
+        await EnsureCharadesWordListTableAsync(db);
         await EnsureInventorySchemaAsync(db);
         await EnsureLeaderboardSchemaAsync(db);
         await EnsureRoomColumnsAsync(db);
@@ -168,6 +169,13 @@ public static class DatabaseBootstrap
         var storeService = scope.ServiceProvider.GetRequiredService<StoreService>();
         await storeService.SeedAsync();
 
+        // Seed the three built-in 3D Charades word lists (Default / April
+        // Fools / Icebreakers) and bind each client card-source slot to
+        // them. Idempotent — no-ops once any list exists so admin edits
+        // survive restarts.
+        var charadesService = scope.ServiceProvider.GetRequiredService<CharadesWordListService>();
+        await charadesService.SeedAsync();
+
         // Tell the /healthz probe migrations are done. Coolify's rolling
         // deploy holds traffic at the LB until this flips and /healthz
         // returns 200.
@@ -438,6 +446,10 @@ public static class DatabaseBootstrap
                 @"ALTER TABLE ""ServerSettings"" ADD COLUMN IF NOT EXISTS ""DiscoveredGameConfigsJson"" text NOT NULL DEFAULT '';");
             await db.Database.ExecuteSqlRawAsync(
                 @"ALTER TABLE ""ServerSettings"" ADD COLUMN IF NOT EXISTS ""GlobalFriendsEnabled"" boolean NOT NULL DEFAULT false;");
+            await db.Database.ExecuteSqlRawAsync(
+                @"ALTER TABLE ""ServerSettings"" ADD COLUMN IF NOT EXISTS ""ProfanityFilterDisabled"" boolean NOT NULL DEFAULT false;");
+            await db.Database.ExecuteSqlRawAsync(
+                @"ALTER TABLE ""ServerSettings"" ADD COLUMN IF NOT EXISTS ""CharadesSlotBindingsJson"" text NOT NULL DEFAULT '';");
             return;
         }
 
@@ -488,6 +500,30 @@ public static class DatabaseBootstrap
             // ignore the duplicate-column error; any other schema problem
             // will surface when EF reads ServerSettings.
         }
+
+        try
+        {
+            await db.Database.ExecuteSqlRawAsync(
+                @"ALTER TABLE ""ServerSettings"" ADD COLUMN ""ProfanityFilterDisabled"" INTEGER NOT NULL DEFAULT 0;");
+        }
+        catch
+        {
+            // SQLite has no ADD COLUMN IF NOT EXISTS. If it already exists,
+            // ignore the duplicate-column error; any other schema problem
+            // will surface when EF reads ServerSettings.
+        }
+
+        try
+        {
+            await db.Database.ExecuteSqlRawAsync(
+                @"ALTER TABLE ""ServerSettings"" ADD COLUMN ""CharadesSlotBindingsJson"" TEXT NOT NULL DEFAULT '';");
+        }
+        catch
+        {
+            // SQLite has no ADD COLUMN IF NOT EXISTS. If it already exists,
+            // ignore the duplicate-column error; any other schema problem
+            // will surface when EF reads ServerSettings.
+        }
     }
 
     private static async Task EnsureInventorySchemaAsync(DorkNetDbContext db)
@@ -625,6 +661,41 @@ public static class DatabaseBootstrap
             @"CREATE INDEX IF NOT EXISTS ""IX_LeaderboardStats_RoomId_StatChannel_Value"" ON ""LeaderboardStats"" (""RoomId"", ""StatChannel"", ""Value"");");
     }
 
+    /// <summary>Idempotently create the CharadesWordLists table on both
+    /// providers. Post-dates the consolidated Initial migration (same
+    /// rationale as <see cref="EnsureSignupCodeTablesAsync"/>): Postgres
+    /// is EnsureCreated-only and the SQLite Initial migration doesn't
+    /// include it, so we create it here with CREATE TABLE IF NOT EXISTS
+    /// (a no-op on a fresh DB where EnsureCreated/convention already
+    /// built it).</summary>
+    private static async Task EnsureCharadesWordListTableAsync(DorkNetDbContext db)
+    {
+        var provider = db.Database.ProviderName ?? string.Empty;
+        var pg = provider.Contains("Npgsql", StringComparison.OrdinalIgnoreCase);
+        var sql = pg
+            ? """
+              CREATE TABLE IF NOT EXISTS "CharadesWordLists" (
+                  "Id" bigint GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+                  "Name" text NOT NULL DEFAULT '',
+                  "WordsJson" text NOT NULL DEFAULT '[]',
+                  "IsBuiltIn" boolean NOT NULL DEFAULT false,
+                  "CreatedAt" timestamp with time zone NOT NULL DEFAULT now(),
+                  "UpdatedAt" timestamp with time zone NOT NULL DEFAULT now()
+              );
+              """
+            : """
+              CREATE TABLE IF NOT EXISTS "CharadesWordLists" (
+                  "Id" INTEGER NOT NULL CONSTRAINT "PK_CharadesWordLists" PRIMARY KEY AUTOINCREMENT,
+                  "Name" TEXT NOT NULL DEFAULT '',
+                  "WordsJson" TEXT NOT NULL DEFAULT '[]',
+                  "IsBuiltIn" INTEGER NOT NULL DEFAULT 0,
+                  "CreatedAt" TEXT NOT NULL,
+                  "UpdatedAt" TEXT NOT NULL
+              );
+              """;
+        await db.Database.ExecuteSqlRawAsync(sql);
+    }
+
     private static async Task EnsureMarch2023TablesAsync(DorkNetDbContext db)
     {
         var provider = db.Database.ProviderName ?? string.Empty;

DorkNet.Server/Startup/MiddlewarePipelineExtensions.cs

@@ -87,9 +87,6 @@ public static class MiddlewarePipelineExtensions
         // calls (login, photon custom auth) are gated too.
         app.UseMiddleware<VersionDetectionMiddleware>();
 
-        app.UseMiddleware<IdentityServerGameTokenRequestMiddleware>();
-        app.UseIdentityServer();
-
         app.UseAuthentication();
         app.UseAuthorization();
         // Sits between auth and the controllers — by this point ctx.User has

DorkNet.Server/Startup/ServiceCollectionExtensions.cs

@@ -2,7 +2,6 @@ using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.IdentityModel.Tokens;
-using DorkNet.Server.Auth;
 using DorkNet.Server.Compat;
 using DorkNet.Server.Data;
 using DorkNet.Server.Services;
@@ -25,11 +24,11 @@ public static class ServiceCollectionExtensions
     {
         ConfigureLogging(builder);
         AddDatabase(builder);
-        var domain = AddDomain(builder);
+        AddDomain(builder);
         AddCoreServices(builder.Services);
         AddVersionCompatibility(builder);
         var redisConn = AddRedis(builder);
-        AddAuthentication(builder, domain);
+        AddAuthentication(builder);
         AddKestrelAndSignalR(builder, redisConn);
     }
 
@@ -109,7 +108,7 @@ public static class ServiceCollectionExtensions
     // Replaces per-controller [Host(...)] filters that hard-coded
     // rec.net/localhost pairs — the singleton DomainConfig is injected
     // anywhere code needs to build outbound URLs.
-    private static DomainConfig AddDomain(WebApplicationBuilder builder)
+    private static void AddDomain(WebApplicationBuilder builder)
     {
         var apex =
             builder.Configuration["Domain:Apex"]
@@ -148,7 +147,6 @@ public static class ServiceCollectionExtensions
             opt.IncludeFailureMessage = true;
         });
         Console.WriteLine($"[domain] apex={apex}, style={domain.HostStyle}, allowedHosts=[{string.Join(", ", allowedHosts)}]");
-        return domain;
     }
 
     private static readonly string[] KnownServiceSubdomains =
@@ -219,6 +217,7 @@ public static class ServiceCollectionExtensions
         services.AddScoped<PrivateInstanceService>();
         services.AddScoped<CommunityBoardService>();
         services.AddScoped<ServerSettingsService>();
+        services.AddScoped<CharadesWordListService>();
         // Singletons — these own connectionless state (Redis-backed or
         // process-local) and don't need a per-request scope.
         services.AddSingleton<NotificationService>();
@@ -321,11 +320,15 @@ public static class ServiceCollectionExtensions
     // Never commit a real secret to appsettings.json. DORKNET_JWT_SECRET is the
     // canonical env var name; RECNET_JWT_SECRET kept for backward compat with
     // older Coolify configs.
-    private static void AddAuthentication(WebApplicationBuilder builder, DomainConfig domain)
+    private static void AddAuthentication(WebApplicationBuilder builder)
     {
-        var signingKeyProvider = new IdentityServerSigningKeyProvider(builder.Configuration);
+        var jwtSecret = Environment.GetEnvironmentVariable("DORKNET_JWT_SECRET")
-        builder.Services.AddSingleton(signingKeyProvider);
+            ?? Environment.GetEnvironmentVariable("RECNET_JWT_SECRET")
-        builder.Services.AddRecRoomIdentityServer(builder.Configuration, domain, signingKeyProvider);
+            ?? builder.Configuration["Jwt:Secret"]
+            ?? throw new InvalidOperationException(
+                "JWT secret not configured. Set the DORKNET_JWT_SECRET env var or " +
+                "add `Jwt:Secret` to appsettings.Local.json (the install-plugin.ps1 " +
+                "script generates one automatically on same-machine setup).");
 
         builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
             .AddJwtBearer(opt =>
@@ -333,9 +336,9 @@ public static class ServiceCollectionExtensions
                 opt.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuerSigningKey = true,
-                    IssuerSigningKeys = signingKeyProvider.ValidationKeys,
+                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSecret)),
                     ValidateIssuer = true,
-                    ValidIssuers = new[] { domain.AuthIssuer, AuthService.LegacyIssuer },
+                    ValidIssuer = "https://api.rec.net/",
                     ValidateAudience = false,
                     ClockSkew = TimeSpan.Zero,
                 };

DorkNet.Server/admin-ui/src/pages/Charades.tsx

@@ -0,0 +1,429 @@
+import { useEffect, useMemo, useState } from 'react';
+import { api, get } from '../lib/api';
+import { PageHeader } from '../components/PageHeader';
+import { useToast } from '../components/Toast';
+import { Plus, Trash, RefreshCw } from '../components/Icons';
+
+// Difficulty values mirror the client CNMMMNJJDMM enum (verified in the
+// 2023.03.21 il2cpp dump). The Charades slot uses easy/hard/very-hard; the
+// Icebreakers slot uses its own value so cards group correctly in-game.
+const DIFFICULTIES = [
+  { value: 0, label: 'Easy' },
+  { value: 1, label: 'Hard' },
+  { value: 10, label: 'Very hard' },
+  { value: 20, label: 'Icebreaker' },
+] as const;
+
+// The three baked client card-source slots. Each is fed by whichever
+// library list its binding points at.
+const SLOTS = [
+  {
+    key: 'charades' as const,
+    title: 'Charades',
+    blurb: 'The main 3D Charades deck players draw from.',
+  },
+  {
+    key: 'charadesAprilFoolsDay' as const,
+    title: 'April Fools',
+    blurb: 'The seasonal "impossible to explain" deck.',
+  },
+  {
+    key: 'icebreakers' as const,
+    title: 'Icebreakers',
+    blurb: 'Prompt-style cards for the Icebreakers card box.',
+  },
+];
+
+interface CharadesWord {
+  text: string;
+  difficulty: number;
+}
+
+interface WordList {
+  id: number;
+  name: string;
+  words: CharadesWord[];
+  isBuiltIn: boolean;
+  updatedAt: string;
+}
+
+interface SlotBindings {
+  charades: number;
+  charadesAprilFoolsDay: number;
+  icebreakers: number;
+}
+
+interface WordListsResponse {
+  lists: WordList[];
+  bindings: SlotBindings;
+}
+
+export function Charades({ embedded }: { embedded?: boolean } = {}) {
+  const [lists, setLists] = useState<WordList[] | null>(null);
+  const [bindings, setBindings] = useState<SlotBindings | null>(null);
+  const [err, setErr] = useState<string | null>(null);
+  const [busy, setBusy] = useState(false);
+  const toast = useToast();
+
+  const load = async () => {
+    try {
+      const data = await get<WordListsResponse>('/charades/wordlists');
+      setLists(data.lists);
+      setBindings(data.bindings);
+      setErr(null);
+    } catch (e) {
+      setErr((e as Error).message);
+    }
+  };
+
+  useEffect(() => { void load(); }, []);
+
+  const updateLocal = (idx: number, next: WordList) => {
+    setLists(cur => {
+      if (!cur) return cur;
+      const copy = cur.slice();
+      copy[idx] = next;
+      return copy;
+    });
+  };
+
+  const addNew = async () => {
+    setBusy(true);
+    try {
+      const created = await api<WordList>('/charades/wordlists', {
+        method: 'POST',
+        body: { Name: 'New list', Words: [] },
+      });
+      setLists([...(lists ?? []), created]);
+      toast.push('List created.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const saveList = async (idx: number) => {
+    if (!lists) return;
+    const l = lists[idx];
+    try {
+      const saved = await api<WordList>(`/charades/wordlists/${l.id}`, {
+        method: 'PUT',
+        body: { Name: l.name, Words: l.words },
+      });
+      updateLocal(idx, saved);
+      toast.push('Saved.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    }
+  };
+
+  const removeList = async (idx: number) => {
+    if (!lists) return;
+    const l = lists[idx];
+    const boundSlot = bindings && (
+      bindings.charades === l.id ||
+      bindings.charadesAprilFoolsDay === l.id ||
+      bindings.icebreakers === l.id);
+    const warn = boundSlot
+      ? ` It's currently live on a slot — that slot will fall back to its built-in list.`
+      : '';
+    if (!confirm(`Delete list "${l.name || '(untitled)'}"?${warn}`)) return;
+    try {
+      await api(`/charades/wordlists/${l.id}`, { method: 'DELETE' });
+      setLists(lists.filter((_, i) => i !== idx));
+      // Reflect any binding fallback locally.
+      setBindings(cur => cur ? {
+        charades: cur.charades === l.id ? 0 : cur.charades,
+        charadesAprilFoolsDay: cur.charadesAprilFoolsDay === l.id ? 0 : cur.charadesAprilFoolsDay,
+        icebreakers: cur.icebreakers === l.id ? 0 : cur.icebreakers,
+      } : cur);
+      toast.push('Deleted.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    }
+  };
+
+  const importInto = async (idx: number, text: string, defaultDifficulty: number, replace: boolean) => {
+    if (!lists) return;
+    const l = lists[idx];
+    try {
+      const saved = await api<WordList>(`/charades/wordlists/${l.id}/import`, {
+        method: 'POST',
+        body: { Text: text, DefaultDifficulty: defaultDifficulty, Replace: replace },
+      });
+      updateLocal(idx, saved);
+      toast.push(replace ? 'List replaced from paste.' : 'Cards imported.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    }
+  };
+
+  const saveBindings = async () => {
+    if (!bindings) return;
+    setBusy(true);
+    try {
+      const saved = await api<SlotBindings>('/charades/bindings', {
+        method: 'PUT',
+        body: {
+          Charades: bindings.charades,
+          CharadesAprilFoolsDay: bindings.charadesAprilFoolsDay,
+          Icebreakers: bindings.icebreakers,
+        },
+      });
+      setBindings(saved);
+      toast.push('Live slots updated — effective on next card-box refresh.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    } finally {
+      setBusy(false);
+    }
+  };
+
+  const headerActions = (
+    <div className="flex gap-2">
+      <button onClick={load} className="btn-secondary text-xs" disabled={busy}>
+        <RefreshCw className={busy ? 'animate-spin' : ''} /> Refresh
+      </button>
+      <button onClick={addNew} className="btn-primary text-xs" disabled={busy}>
+        <Plus /> New list
+      </button>
+    </div>
+  );
+
+  return (
+    <div>
+      {embedded ? (
+        <div className="flex justify-end mb-3">{headerActions}</div>
+      ) : (
+        <PageHeader
+          title="3D Charades words"
+          blurb="Keep an unlimited library of word lists and pick which one is live for each in-game card box. The March 2023 client fetches the bound list at card-box spawn."
+          actions={headerActions}
+        />
+      )}
+
+      {err && (
+        <div className="card border-danger/30 bg-danger/5 px-4 py-3 text-sm text-danger mb-4">{err}</div>
+      )}
+
+      {lists === null && !err && (
+        <div className="card !p-6 text-center text-xs text-ink-400">Loading…</div>
+      )}
+
+      {lists && bindings && (
+        <div className="card !p-5 mb-5">
+          <div className="flex items-start justify-between gap-4">
+            <div className="min-w-0">
+              <h2 className="text-sm font-semibold text-ink-50">Live card slots</h2>
+              <p className="mt-1 text-xs text-ink-400">
+                The client only ever requests these three card sources. Point each at any list in
+                your library to switch decks — no redeploy. Changes apply the next time a card box
+                spawns (room rejoin).
+              </p>
+            </div>
+            <button onClick={saveBindings} disabled={busy} className="btn-primary text-xs shrink-0">
+              {busy ? 'Saving…' : 'Save slots'}
+            </button>
+          </div>
+          <div className="mt-4 grid gap-3 md:grid-cols-3">
+            {SLOTS.map(slot => (
+              <label key={slot.key} className="block rounded-lg border border-ink-800 bg-ink-950/30 p-3">
+                <span className="text-sm font-semibold text-ink-100">{slot.title}</span>
+                <span className="mt-0.5 block text-[11px] text-ink-500">{slot.blurb}</span>
+                <select
+                  className="input mt-2 text-xs"
+                  value={bindings[slot.key]}
+                  onChange={e => setBindings({ ...bindings, [slot.key]: parseInt(e.target.value) || 0 })}
+                >
+                  <option value={0}>— built-in fallback —</option>
+                  {lists.map(l => (
+                    <option key={l.id} value={l.id}>
+                      {l.name} ({l.words.length})
+                    </option>
+                  ))}
+                </select>
+              </label>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {lists && lists.length === 0 && (
+        <div className="card !p-6 text-center text-xs text-ink-400">
+          No lists yet — add one with the button above.
+        </div>
+      )}
+
+      {lists && (
+        <div className="space-y-3">
+          {lists.map((l, i) => (
+            <ListEditor
+              key={l.id}
+              list={l}
+              liveSlots={liveSlotsFor(l.id, bindings)}
+              onChange={next => updateLocal(i, next)}
+              onSave={() => saveList(i)}
+              onRemove={() => removeList(i)}
+              onImport={(text, diff, replace) => importInto(i, text, diff, replace)}
+            />
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
+
+function liveSlotsFor(id: number, bindings: SlotBindings | null): string[] {
+  if (!bindings) return [];
+  const out: string[] = [];
+  if (bindings.charades === id) out.push('Charades');
+  if (bindings.charadesAprilFoolsDay === id) out.push('April Fools');
+  if (bindings.icebreakers === id) out.push('Icebreakers');
+  return out;
+}
+
+function ListEditor({
+  list,
+  liveSlots,
+  onChange,
+  onSave,
+  onRemove,
+  onImport,
+}: {
+  list: WordList;
+  liveSlots: string[];
+  onChange: (next: WordList) => void;
+  onSave: () => void;
+  onRemove: () => void;
+  onImport: (text: string, defaultDifficulty: number, replace: boolean) => void;
+}) {
+  const [open, setOpen] = useState(false);
+  const [pasteText, setPasteText] = useState('');
+  const [pasteDifficulty, setPasteDifficulty] = useState(0);
+  const [pasteReplace, setPasteReplace] = useState(false);
+
+  const counts = useMemo(() => {
+    const by = new Map<number, number>();
+    for (const w of list.words) by.set(w.difficulty, (by.get(w.difficulty) ?? 0) + 1);
+    return by;
+  }, [list.words]);
+
+  const setWord = (idx: number, patch: Partial<CharadesWord>) => {
+    const words = list.words.slice();
+    words[idx] = { ...words[idx], ...patch };
+    onChange({ ...list, words });
+  };
+  const removeWord = (idx: number) => {
+    onChange({ ...list, words: list.words.filter((_, i) => i !== idx) });
+  };
+  const addWord = () => {
+    onChange({ ...list, words: [...list.words, { text: '', difficulty: 0 }] });
+  };
+
+  const runImport = () => {
+    if (!pasteText.trim()) return;
+    onImport(pasteText, pasteDifficulty, pasteReplace);
+    setPasteText('');
+  };
+
+  return (
+    <div className="card !p-4">
+      <div className="flex items-center gap-3">
+        <input
+          value={list.name}
+          onChange={e => onChange({ ...list, name: e.target.value })}
+          className="input text-sm font-semibold flex-1 min-w-0"
+          maxLength={128}
+        />
+        {list.isBuiltIn && <span className="badge-admin shrink-0">built-in</span>}
+        {liveSlots.map(s => <span key={s} className="badge-online shrink-0">live: {s}</span>)}
+        <span className="text-[11px] text-ink-500 shrink-0">{list.words.length} cards</span>
+        <button onClick={() => setOpen(o => !o)} className="btn-secondary text-xs shrink-0">
+          {open ? 'Collapse' : 'Edit'}
+        </button>
+      </div>
+
+      <div className="mt-2 flex flex-wrap gap-1.5 text-[11px] text-ink-400">
+        {DIFFICULTIES.map(d => counts.get(d.value)
+          ? <span key={d.value} className="badge-neutral">{d.label}: {counts.get(d.value)}</span>
+          : null)}
+      </div>
+
+      {open && (
+        <div className="mt-4 space-y-4">
+          <div className="space-y-2">
+            {list.words.map((w, i) => (
+              <div key={i} className="flex items-center gap-2">
+                <input
+                  value={w.text}
+                  onChange={e => setWord(i, { text: e.target.value })}
+                  placeholder="Card phrase"
+                  className="input text-xs flex-1"
+                  maxLength={256}
+                />
+                <select
+                  value={w.difficulty}
+                  onChange={e => setWord(i, { difficulty: parseInt(e.target.value) })}
+                  className="input text-xs w-32 shrink-0"
+                >
+                  {DIFFICULTIES.map(d => <option key={d.value} value={d.value}>{d.label}</option>)}
+                </select>
+                <button onClick={() => removeWord(i)} className="btn-ghost text-xs text-danger shrink-0" title="Remove card">
+                  <Trash />
+                </button>
+              </div>
+            ))}
+            <button onClick={addWord} className="btn-secondary text-xs"><Plus /> Add card</button>
+          </div>
+
+          <div className="rounded-lg border border-ink-800 bg-ink-950/30 p-3">
+            <h4 className="text-xs font-semibold text-ink-200">Import from paste</h4>
+            <p className="mt-0.5 text-[11px] text-ink-500">
+              One phrase per line. Add <span className="font-mono">| easy</span>,{' '}
+              <span className="font-mono">| hard</span>, <span className="font-mono">| veryhard</span> or{' '}
+              <span className="font-mono">| icebreaker</span> after a line to set its difficulty.
+            </p>
+            <textarea
+              value={pasteText}
+              onChange={e => setPasteText(e.target.value)}
+              placeholder={'Dancing\nRiding a bike | hard\nThe concept of time | veryhard'}
+              className="input text-xs w-full mt-2 font-mono"
+              rows={5}
+            />
+            <div className="mt-2 flex flex-wrap items-center gap-3">
+              <label className="flex items-center gap-1.5 text-xs text-ink-300">
+                Default difficulty
+                <select
+                  value={pasteDifficulty}
+                  onChange={e => setPasteDifficulty(parseInt(e.target.value))}
+                  className="input text-xs w-28"
+                >
+                  {DIFFICULTIES.map(d => <option key={d.value} value={d.value}>{d.label}</option>)}
+                </select>
+              </label>
+              <label className="flex items-center gap-1.5 text-xs text-ink-300 cursor-pointer">
+                <input type="checkbox" checked={pasteReplace} onChange={e => setPasteReplace(e.target.checked)} />
+                Replace existing cards
+              </label>
+              <div className="flex-1" />
+              <button onClick={runImport} disabled={!pasteText.trim()} className="btn-primary text-xs">
+                {pasteReplace ? 'Replace from paste' : 'Import cards'}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      <div className="mt-4 flex items-center gap-3">
+        <span className="text-[11px] text-ink-600 flex-1">
+          Last saved {new Date(list.updatedAt).toLocaleString()}
+        </span>
+        <button onClick={onSave} className="btn-primary text-xs">Save</button>
+        <button onClick={onRemove} className="btn-ghost text-xs text-danger" title="Delete list">
+          <Trash />
+        </button>
+      </div>
+    </div>
+  );
+}

DorkNet.Server/admin-ui/src/pages/Content.tsx

@@ -1,26 +1,31 @@
 import { CommunityBoard } from './CommunityBoard';
 import { LoadingTips } from './LoadingTips';
+import { Charades } from './Charades';
 import { PageHeader } from '../components/PageHeader';
 import { Tabs, useTabParam } from '../components/Tabs';
 
-// The two player-facing content surfaces the watch pulls on dorm load —
+// The player-facing content surfaces the watch pulls at runtime — the
-// the community board and the loading-screen tips — share one page.
+// community board and loading-screen tips shown on dorm load, plus the 3D
-// Old /community and /loading-tips routes redirect here.
+// Charades word lists fetched at card-box spawn — share one page. Old
+// /community and /loading-tips routes redirect here.
 export function Content() {
-  const [tab, setTab] = useTabParam<'community' | 'tips'>('community', ['community', 'tips']);
+  const [tab, setTab] = useTabParam<'community' | 'tips' | 'charades'>(
+    'community', ['community', 'tips', 'charades']);
   return (
     <div>
-      <PageHeader title="Content" blurb="Player-facing content shown on dorm load: the community board and loading-screen tips." />
+      <PageHeader title="Content" blurb="Player-facing content: the community board, loading-screen tips, and 3D Charades word lists." />
       <Tabs
         tabs={[
           { key: 'community', label: 'Community board' },
           { key: 'tips', label: 'Loading tips' },
+          { key: 'charades', label: 'Charades words' },
         ]}
         active={tab}
         onChange={setTab}
       />
       {tab === 'community' && <CommunityBoard embedded />}
       {tab === 'tips' && <LoadingTips embedded />}
+      {tab === 'charades' && <Charades embedded />}
     </div>
   );
 }

DorkNet.Server/admin-ui/src/pages/IdentityServer.tsx

@@ -1,209 +0,0 @@
-import { useEffect, useState } from 'react';
-import { get } from '../lib/api';
-import { RefreshCw } from '../components/Icons';
-
-interface IdentityServerSettings {
-  issuer: string;
-  discoveryUrl: string;
-  tokenEndpoint: string;
-  userInfoEndpoint: string;
-  client: {
-    clientId: string;
-    clientName: string;
-    allowedGrantTypes: string[];
-    allowedScopes: string[];
-    allowOfflineAccess: boolean;
-    accessTokenLifetime: number;
-    absoluteRefreshTokenLifetime: number;
-    slidingRefreshTokenLifetime: number;
-    refreshTokenUsage: string;
-    refreshTokenExpiration: string;
-  };
-  signing: {
-    certificateSource: string;
-    loadedFromBase64: boolean;
-    certificatePath: string;
-    certificateExists: boolean;
-    thumbprint: string;
-    notBeforeUtc: string;
-    notAfterUtc: string;
-    algorithm: string;
-  };
-  persistedGrants: {
-    store: string;
-    warning: string;
-  };
-}
-
-export function IdentityServer() {
-  const [settings, setSettings] = useState<IdentityServerSettings | null>(null);
-  const [err, setErr] = useState<string | null>(null);
-  const [busy, setBusy] = useState(false);
-
-  const load = async () => {
-    setBusy(true);
-    try {
-      const data = await get<IdentityServerSettings>('/identityserver');
-      setSettings(data);
-      setErr(null);
-    } catch (e) {
-      setErr((e as Error).message);
-    } finally {
-      setBusy(false);
-    }
-  };
-
-  useEffect(() => { void load(); }, []);
-
-  return (
-    <div>
-      <div className="mb-3 flex justify-end">
-        <button onClick={load} className="btn-secondary text-xs" disabled={busy}>
-          <RefreshCw className={busy ? 'animate-spin' : ''} />
-          Refresh
-        </button>
-      </div>
-
-      {err && (
-        <div className="card border-danger/30 bg-danger/5 px-4 py-3 text-sm text-danger mb-4">{err}</div>
-      )}
-
-      {!settings && !err && (
-        <div className="card !p-6 text-center text-xs text-ink-400">Loading...</div>
-      )}
-
-      {settings && (
-        <div className="grid gap-5 xl:grid-cols-[minmax(0,1fr)_360px]">
-          <div className="space-y-5">
-            <div className="card !p-5">
-              <div className="flex flex-wrap items-start justify-between gap-4">
-                <div>
-                  <h2 className="text-sm font-semibold text-ink-50">IdentityServer</h2>
-                  <p className="mt-1 break-all font-mono text-xs text-ink-300">{settings.issuer}</p>
-                </div>
-                <div className="flex flex-wrap gap-2 text-xs">
-                  <StatusBadge ok={settings.signing.certificateExists} on="Signing key" off="Missing key" />
-                </div>
-              </div>
-
-              <div className="mt-5 grid gap-3 md:grid-cols-3">
-                <Endpoint label="Discovery" value={settings.discoveryUrl} />
-                <Endpoint label="Token" value={settings.tokenEndpoint} />
-                <Endpoint label="UserInfo" value={settings.userInfoEndpoint} />
-              </div>
-            </div>
-
-            <div className="card !p-5">
-              <div className="mb-4 flex flex-wrap items-center justify-between gap-3">
-                <div>
-                  <h2 className="text-sm font-semibold text-ink-50">Client</h2>
-                  <p className="mt-1 font-mono text-xs text-ink-400">{settings.client.clientId}</p>
-                </div>
-                <span className={settings.client.allowOfflineAccess ? 'badge-online' : 'badge-neutral'}>
-                  Offline access {settings.client.allowOfflineAccess ? 'on' : 'off'}
-                </span>
-              </div>
-
-              <div className="grid gap-4 lg:grid-cols-2">
-                <ChipList title="Grant types" values={settings.client.allowedGrantTypes} />
-                <ChipList title="Scopes" values={settings.client.allowedScopes} />
-              </div>
-
-              <div className="mt-5 grid gap-3 sm:grid-cols-3">
-                <Metric label="Access token" value={duration(settings.client.accessTokenLifetime)} />
-                <Metric label="Refresh token" value={duration(settings.client.absoluteRefreshTokenLifetime)} />
-                <Metric label="Refresh mode" value={`${settings.client.refreshTokenUsage} / ${settings.client.refreshTokenExpiration}`} />
-              </div>
-            </div>
-
-          </div>
-
-          <div className="space-y-5">
-            <div className="card !p-5">
-              <h2 className="text-sm font-semibold text-ink-50">Signing certificate</h2>
-              <div className="mt-4 space-y-3">
-                <Detail label="Source" value={settings.signing.certificateSource} mono />
-                {!settings.signing.loadedFromBase64 && (
-                  <Detail label="Path" value={settings.signing.certificatePath} mono />
-                )}
-                <Detail label="Thumbprint" value={settings.signing.thumbprint} mono />
-                <Detail label="Algorithm" value={settings.signing.algorithm} mono />
-                <Detail label="Valid from" value={formatDate(settings.signing.notBeforeUtc)} />
-                <Detail label="Valid until" value={formatDate(settings.signing.notAfterUtc)} />
-              </div>
-            </div>
-
-            <div className="card !p-5">
-              <h2 className="text-sm font-semibold text-ink-50">Operational store</h2>
-              <div className="mt-3 flex items-center justify-between gap-3">
-                <span className="text-xs text-ink-400">Persisted grants</span>
-                <span className="badge-junior">{settings.persistedGrants.store}</span>
-              </div>
-              <p className="mt-4 text-xs leading-5 text-ink-400">{settings.persistedGrants.warning}</p>
-            </div>
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
-
-function Endpoint({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/40 p-3">
-      <div className="label">{label}</div>
-      <div className="mt-2 break-all font-mono text-xs text-ink-100">{value}</div>
-    </div>
-  );
-}
-
-function ChipList({ title, values }: { title: string; values: string[] }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/30 p-4">
-      <h3 className="text-xs font-semibold uppercase text-ink-400">{title}</h3>
-      <div className="mt-3 flex flex-wrap gap-2">
-        {values.map((value) => (
-          <span key={value} className="badge-neutral font-mono normal-case tracking-normal">{value}</span>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-function Metric({ label, value }: { label: string; value: string }) {
-  return (
-    <div className="rounded-lg border border-ink-800 bg-ink-950/30 p-3">
-      <div className="text-[11px] uppercase text-ink-500">{label}</div>
-      <div className="mt-1 text-sm font-semibold text-ink-50">{value}</div>
-    </div>
-  );
-}
-
-function Detail({ label, value, mono }: { label: string; value: string; mono?: boolean }) {
-  return (
-    <div>
-      <div className="label">{label}</div>
-      <div className={(mono ? 'font-mono ' : '') + 'mt-1 break-all text-xs text-ink-100'}>{value}</div>
-    </div>
-  );
-}
-
-function StatusBadge({ ok, on, off }: { ok: boolean; on: string; off: string }) {
-  return <span className={ok ? 'badge-online' : 'badge-junior'}>{ok ? on : off}</span>;
-}
-
-function formatDate(value: string): string {
-  const date = new Date(value);
-  return Number.isNaN(date.getTime()) ? value : date.toLocaleString();
-}
-
-function duration(seconds: number): string {
-  if (!Number.isFinite(seconds) || seconds <= 0) return '0s';
-  const days = Math.floor(seconds / 86400);
-  const hours = Math.floor((seconds % 86400) / 3600);
-  const minutes = Math.floor((seconds % 3600) / 60);
-  if (days > 0) return `${days}d ${hours}h`;
-  if (hours > 0) return `${hours}h ${minutes}m`;
-  if (minutes > 0) return `${minutes}m`;
-  return `${seconds}s`;
-}

DorkNet.Server/admin-ui/src/pages/Settings.tsx

@@ -8,6 +8,7 @@ interface ServerSettings {
   signupsDisabled: boolean;
   globalFriendsEnabled: boolean;
   weeklyChallengesCompletedRequired: boolean;
+  profanityFilterDisabled: boolean;
   updatedAt: string;
 }
 
@@ -215,6 +216,30 @@ export function Settings({ embedded }: { embedded?: boolean } = {}) {
     }
   };
 
+  const toggleProfanity = async () => {
+    if (!settings) return;
+    const next = !settings.profanityFilterDisabled;
+    const verb = next ? 'turn OFF the profanity filter' : 'turn the profanity filter back on';
+    if (!confirm(
+      next
+        ? 'Turn off the profanity filter? Room names, invention names and chat will no longer be censored by the server. Toggle back on any time.'
+        : `Really ${verb}? Text will be filtered again server-side.`,
+    )) return;
+    setBusy(true);
+    try {
+      const updated = await api<ServerSettings>('/settings/profanity', {
+        method: 'POST',
+        body: { Disabled: next },
+      });
+      setSettings(updated);
+      toast.push(next ? 'Profanity filter disabled.' : 'Profanity filter enabled.', 'success');
+    } catch (e) {
+      toast.push((e as Error).message, 'error');
+    } finally {
+      setBusy(false);
+    }
+  };
+
   const updateWeeklyChallenge = (index: number, patch: Partial<WeeklyChallenge>) => {
     setWeekly((current) => {
       if (!current) return current;
@@ -485,6 +510,37 @@ export function Settings({ embedded }: { embedded?: boolean } = {}) {
         </div>
       )}
 
+      {settings && (
+        <div className="card !p-5 max-w-2xl mt-5">
+          <div className="flex items-start justify-between gap-4">
+            <div className="min-w-0 flex-1">
+              <h2 className="text-sm font-semibold text-ink-50">Profanity filter</h2>
+              <p className="mt-1 text-xs text-ink-400">
+                The server-side filter behind <span className="font-mono">api/sanitize/*</span> that
+                the watch calls before letting a player submit a room name, invention name, or chat
+                message. Turn it off to stop censoring text entirely — every check returns "clean"
+                and input is passed through unchanged. Takes effect immediately.
+              </p>
+              <p className="mt-2 text-[11px] text-ink-500">
+                Last changed {new Date(settings.updatedAt).toLocaleString()}.
+              </p>
+            </div>
+            <button
+              onClick={toggleProfanity}
+              disabled={busy}
+              className={(settings.profanityFilterDisabled ? 'btn-primary' : 'btn-danger') + ' text-xs shrink-0'}
+            >
+              {busy ? 'Working…' : settings.profanityFilterDisabled ? 'Enable filter' : 'Disable filter'}
+            </button>
+          </div>
+          <div className="mt-4 text-xs">
+            {settings.profanityFilterDisabled
+              ? <span className="badge-banned">Filter off — nothing censored</span>
+              : <span className="badge-online">Filter active</span>}
+          </div>
+        </div>
+      )}
+
       {gameConfigs && (
         <DiscoveredGameConfigsPanel
           settings={gameConfigs}

DorkNet.Server/admin-ui/src/pages/SettingsHome.tsx

@@ -1,5 +1,4 @@
 import { Settings } from './Settings';
-import { IdentityServer } from './IdentityServer';
 import { SignupCodes } from './SignupCodes';
 import { PageHeader } from '../components/PageHeader';
 import { Tabs, useTabParam } from '../components/Tabs';
@@ -8,21 +7,19 @@ import { Tabs, useTabParam } from '../components/Tabs';
 // invite codes (an access-control setting in its own right). Old
 // /signup-codes route redirects here with ?tab=signup.
 export function SettingsHome() {
-  const [tab, setTab] = useTabParam<'server' | 'identity' | 'signup'>('server', ['server', 'identity', 'signup']);
+  const [tab, setTab] = useTabParam<'server' | 'signup'>('server', ['server', 'signup']);
   return (
     <div>
-      <PageHeader title="Settings" blurb="Runtime server toggles, authentication, and single-use signup invite codes." />
+      <PageHeader title="Settings" blurb="Runtime server toggles and single-use signup invite codes." />
       <Tabs
         tabs={[
           { key: 'server', label: 'Server' },
-          { key: 'identity', label: 'IdentityServer' },
           { key: 'signup', label: 'Signup codes' },
         ]}
         active={tab}
         onChange={setTab}
       />
       {tab === 'server' && <Settings embedded />}
-      {tab === 'identity' && <IdentityServer />}
       {tab === 'signup' && <SignupCodes embedded />}
     </div>
   );

DorkNet.ServiceDefaults/DorkNet.ServiceDefaults.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Commerce/DorkNet.Services.Commerce.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Content/DorkNet.Services.Content.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Identity/DorkNet.Services.Identity.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Moderation/DorkNet.Services.Moderation.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Notify/DorkNet.Services.Notify.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Platform/DorkNet.Services.Platform.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Rooms/DorkNet.Services.Rooms.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Social/DorkNet.Services.Social.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

DorkNet.Services.Web/DorkNet.Services.Web.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk.Web">
 
   <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

README.md

@@ -72,17 +72,13 @@ cd DorkNet
 | `S3:SecretKey` | `S3__SecretKey` | production | S3 secret key |
 | `S3:Region` | `S3__Region` | no | defaults to `garage`; use `auto` for R2 |
 
-`/connect/token` issues access and refresh tokens with the configured
-auth host as the issuer. Set `DORKNET_DOMAIN` for production so OpenID
-discovery and JWT validation agree on `https://auth.<domain>`.
-
 **4. Boot a local standalone server:**
 
 ```pwsh
 dotnet run --project DorkNet.Server
 ```
 
-First boot creates `bin/Debug/net10.0/data/dorknet.db`, runs every
+First boot creates `bin/Debug/net9.0/data/dorknet.db`, runs every
 `LegacyUpgrades` pass, seeds canonical rooms / store catalog / club
 categories / playlists, and starts listening. You should see
 `Application started.` in the log; `curl http://localhost:8080/healthz`

docs/admin.md

@@ -57,8 +57,8 @@ that outer check.
 | Overview | `/` | Live ops dashboard, online players, active sessions, quick kick/ban/broadcast actions |
 | Moderation | `/players` | Player directory, bans, reports, per-player ban/grant/gift/password/avatar/account actions |
 | Activity | `/activity` | Admin audit log and per-player request logs |
-| Content | `/rooms`, `/rooms/:id`, `/import-room`, `/content` | Room list/detail, room import, instances, leaderboards, community board, loading tips |
+| Content | `/rooms`, `/rooms/:id`, `/import-room`, `/content` | Room list/detail, room import, instances, leaderboards, community board, loading tips, 3D Charades word lists |
-| Operations | `/broadcast`, `/settings` | Server broadcast, server toggles, signup codes, weekly challenges, Play menu tags, Rec Center doors, game config values |
+| Operations | `/broadcast`, `/settings` | Server broadcast, server toggles (signups, everyone-is-friends, profanity filter), signup codes, weekly challenges, Play menu tags, Rec Center doors, game config values |
 
 Several older admin URLs are kept as redirects:
 
@@ -76,6 +76,39 @@ Several older admin URLs are kept as redirects:
 
 `/import-room-legacy` still exists for the legacy room importer.
 
+## 3D Charades word lists (`/content?tab=charades`)
+
+The March 2023 client fetches a charades deck at card-box spawn from
+`GET api/activities/charades/v1/words/{source}`, where `{source}` is one
+of three baked `CardBox.cardSource` slots — `Charades`,
+`CharadesAprilFoolsDay`, and `Icebreakers` (verified in the 2023.03.21
+il2cpp dump). The response is a JSON array of
+`{ "EN_US": "<phrase>", "Difficulty": <int> }` (`Difficulty` is the client
+`CNMMMNJJDMM` enum: 0 easy, 1 hard, 10 very hard, 20 icebreaker).
+
+The admin tab exposes:
+
+- A **library** of unlimited named word lists (`CharadesWordListEntity`
+  rows), each with a per-card difficulty. Paste-import accepts one phrase
+  per line with an optional `| easy|hard|veryhard|icebreaker` suffix.
+- **Live card slots** — three dropdowns binding each client slot to any
+  library list. Switching a slot just repoints its binding
+  (`ServerSettingsEntity.CharadesSlotBindingsJson`); it takes effect on the
+  next card-box refresh (room rejoin). An unbound slot falls back to the
+  built-in list seeded for it.
+
+Three built-in lists (Default / April Fools / Icebreakers) are seeded on
+first boot and bound to their slots. Seeding is idempotent — admin edits
+survive restarts.
+
+## Profanity filter toggle (`/settings`)
+
+`ServerSettingsEntity.ProfanityFilterDisabled` gates the server-side
+`api/sanitize/*` filter. When on, every sanitize route returns input
+unchanged and treats all text as clean, so room/invention names and chat
+are never censored. Off by default; checked per request so it takes effect
+immediately.
+
 ## Build And Deploy
 
 The service Dockerfile builds the admin SPA for service images that need

docs/architecture.md

@@ -38,7 +38,7 @@ DorkNet.sln
 | `DorkNet.Contracts` | Service names, route ownership, service-map options, health responses, probe responses | .NET 9 |
 | `DorkNet.ServiceDefaults` | Common service health checks, JSON defaults, HTTP clients, service identity, route guard | .NET 9 |
 | `DorkNet.Gateway` | Edge reverse proxy; routes host/path slices to services and exposes service health probes | .NET 9 |
-| `DorkNet.Services.Identity` | Accounts, auth, platform login, OpenID discovery, JWT issuance route slice | .NET 9 |
+| `DorkNet.Services.Identity` | Accounts, auth, platform login, JWT issuance route slice | .NET 9 |
 | `DorkNet.Services.Rooms` | Rooms, room keys, matchmaking, discovery route slice | .NET 9 |
 | `DorkNet.Services.Notify` | SignalR edge, messages/chat, notification fan-out route slice | .NET 9 |
 | `DorkNet.Services.Content` | CDN paths, image/photo APIs, uploads, S3-backed blobs | .NET 9 |
@@ -113,10 +113,6 @@ Compose network and forwards Cloudflare Tunnel traffic to
 configured with `DORKNET_S3_*` environment variables; the compose files
 do not run MinIO or Garage.
 
-The identity slice is the token issuer in the service split. Discovery at
-`/.well-known/openid-configuration` advertises the configured auth host,
-and access/refresh tokens minted by `/connect/token` use that same issuer.
-
 `Dockerfile.service` is the reusable service image. It accepts
 `PROJECT_PATH` and `APP_DLL` build args, rebuilds the admin/site Vite
 SPAs for service images that need static assets, publishes the selected

docs/deploy.md

@@ -42,11 +42,6 @@ shared `DorkNet.Server` controller/service stack behind route ownership
 guards, so response contracts stay identical while the architecture is
 split.
 
-Auth tokens are issued by the identity service using the configured
-auth host (`https://auth.<apex>` or the equivalent configured host style)
-as the JWT/OpenID issuer. `DORKNET_JWT_SECRET` still supplies the signing
-key for every service that validates bearer tokens.
-
 ---
 
 ## Dokploy Microservices

tools/DorkNet.ApiRouteCoverage/DorkNet.ApiRouteCoverage.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

tools/DorkNet.ApiRouteCoverage/Program.cs

@@ -51,8 +51,8 @@ static Assembly LoadServerAssembly(string[] args)
     var repositoryRoot = FindRepositoryRoot();
     var candidates = new[]
     {
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net10.0", "DorkNet.Server.dll"),
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net9.0", "DorkNet.Server.dll"),
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net10.0", "DorkNet.Server.dll")
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net9.0", "DorkNet.Server.dll")
     };
 
     var existingCandidates = candidates.Where(File.Exists).ToArray();

tools/DorkNet.EndpointContract/DorkNet.EndpointContract.csproj

@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <OutputType>Exe</OutputType>
-    <TargetFramework>net10.0</TargetFramework>
+    <TargetFramework>net9.0</TargetFramework>
     <Nullable>enable</Nullable>
     <ImplicitUsings>enable</ImplicitUsings>
   </PropertyGroup>

tools/DorkNet.EndpointContract/Program.cs

@@ -333,8 +333,8 @@ static Assembly LoadServerAssembly(string? configuredPath)
     var repositoryRoot = FindRepositoryRoot();
     var candidates = new[]
     {
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net10.0", "DorkNet.Server.dll"),
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Debug", "net9.0", "DorkNet.Server.dll"),
-        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net10.0", "DorkNet.Server.dll")
+        Path.Combine(repositoryRoot, "DorkNet.Server", "bin", "Release", "net9.0", "DorkNet.Server.dll")
     };
     var existingCandidates = candidates.Where(File.Exists).ToArray();
     if (existingCandidates.Length == 0)