# MartianGames Integration — gamez/ Change Log

**Last updated:** 2026-05-09  
**Author:** Jenni / Claude (MG site session)  
**Contact:** martiangames@gmail.com

This file records all changes made to `/var/www/html/gamez/` (and its local mirror
`C:\Users\Owner\Projects\www\html\gamez\`) in the context of integrating gamez/ as
the canonical self-hosted game build source for **martiangames.com**.

---

## Changes Made (2026-05-09)

### 1. `KartWars2/.htaccess` — **CHANGED**

**Before:**
```apache
# Deny public access to game subdirectories, allow internal PHP and SSH
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$ [NC]
RewriteCond %{REMOTE_ADDR} !^64\.23\.243\.225$ [NC]
RewriteRule ^ - [F,L]
```

**After:**
```apache
Options -Indexes
```

**Why:** The blocking rule prevented browsers from loading the game's `index.html`,
`Build/` assets, and `TemplateData/` files. KartWars2 is now embedded directly on
`martiangames.com/kartwars` via an `<iframe>`. The Unity WebGL client needs to download
the Build assets from the browser — a server-IP-only restriction blocks that entirely.
`Options -Indexes` just prevents directory listing while allowing normal file serving.

**⚠️ Do not revert** this to IP-restricting rules. The martiangames.com embed depends
on browser access to these files.

---

### 2. `KartWars2/php/.htaccess` — **CHANGED**

**Before:**
```apache
# Deny public access to game subdirectories, allow internal PHP and SSH
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.1$ [NC]
RewriteCond %{REMOTE_ADDR} !^64\.23\.243\.225$ [NC]
RewriteRule ^ - [F,L]
```

**After:**
```apache
# Self-hosted embed on martiangames.com — restrict CORS to origin only.
RewriteEngine Off

<IfModule mod_headers.c>
    Header always set Access-Control-Allow-Origin "https://martiangames.com"
    Header always set Access-Control-Allow-Methods "GET, POST, OPTIONS"
    Header always set Access-Control-Allow-Headers "Content-Type, X-Requested-With"
    Header always set Access-Control-Max-Age "86400"
</IfModule>

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^OPTIONS$
RewriteRule ^ - [R=204,L]
```

**Why:** The old blocking rule prevented browsers from calling `playerLogin.php`,
`playerUpdate.php`, etc. The Unity client (running in the user's browser at
`martiangames.com`) needs to POST to these endpoints. CORS is restricted to
`https://martiangames.com` only — not `*` — so third-party sites cannot make
cross-origin requests to these endpoints.

**⚠️ Do not revert** to the blocking version.  
**⚠️ Do not widen** to `Access-Control-Allow-Origin: *` for this directory unless
KartWars2 is re-hosted on CrazyGames and needs cross-origin access from their CDN.

---

### 3. `includes/secure_db_config.php` — **BUG FIX**

**File:** `/var/www/html/gamez/includes/secure_db_config.php`  
(Same fix applied to `/var/www/html/martiangames/games/includes/secure_db_config.php`)

**Problem:** First-time visitors (IP not yet in `players_KartWars2` table) could never
log in. `handleGuestLogin` called `createPlayer()` successfully but never set
`$player->found = true`. This caused `hasError()` to return `true`, so `playerLogin.php`
echoed the JSON response instead of the Unity-expected `ip~xp` format. Unity couldn't
parse the JSON, so it showed a login error for every new player.

Returning players (IP already in DB) were unaffected because their `$player->found`
was set to `true` by `getPlayerByLogin`.

**Fix — two locations in `handleGuestLogin` and `handleRegularLogin`:**
```php
// After successful createPlayer, add these two lines:
$player->found = true;
$player->xp = 0;
```

**⚠️ Preserve** this fix. If `secure_db_config.php` is replaced or regenerated, ensure
the `found = true` lines are present in both `handleGuestLogin` and `handleRegularLogin`
after `$result === "createdAccount"`.

---

### 4. Apache Alias — **NEW (server config only)**

**File:** `/etc/apache2/sites-enabled/martiangames.com-le-ssl.conf`

```apache
# gamez/ — shared game builds (outside MG DocRoot, served via Alias)
Alias /gamez /var/www/html/gamez
<Directory /var/www/html/gamez>
    Options -Indexes +FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>
```

**Why:** `gamez/` is outside the martiangames.com DocumentRoot
(`/var/www/html/martiangames`). Without the Alias, `martiangames.com/gamez/` would 404.
The Alias makes `gamez/KartWars2/` accessible at `https://martiangames.com/gamez/KartWars2/`.

**⚠️ Preserve** this Alias. If Apache config is regenerated or the vhost file is replaced,
re-add the Alias block. The martiangames.com embed and all gamez/-hosted games depend on it.

---

## What to Preserve (summary for other devs)

| Item | Rule |
|------|------|
| `KartWars2/.htaccess` | Must stay as `Options -Indexes` (no IP-blocking rules) |
| `KartWars2/php/.htaccess` | Must allow browser access; CORS origin = `https://martiangames.com` |
| `includes/secure_db_config.php` | `found = true` + `xp = 0` after createPlayer in handleGuestLogin + handleRegularLogin |
| Apache Alias `/gamez` | Must exist in martiangames.com-le-ssl.conf and http conf |
| `cors_handler.php` (root) | Unchanged — still `*` CORS for CrazyGames-hosted game backends |
| All other game PHP dirs (Solwars, TankOff, etc.) | Unchanged — still use their own php/.htaccess rules |

---

## What Was NOT Changed

- `cors_handler.php` (root-level) — left as-is with `*` CORS. This is used by
  CrazyGames-hosted game backends that need wide-open cross-origin access from
  CrazyGames CDN IPs. Do not restrict this file.
- `Solwars/php/` — unchanged. No frontend build exists; this is the PHP backend for
  the CrazyGames-hosted Sol Wars. The CrazyGames client calls these endpoints.
- `cow-defender/` — unchanged. The `index.html` is a placeholder only; the real game
  is on CrazyGames.
- All other game directories (TankOff, TankOff2, AirWars, etc.) — unchanged.
- `gamez/.htaccess` (root) — left as-is (commented-out rules, no restrictions).

---

## Architecture Context

```
martiangames.com/kartwars
  └── PHP page: /var/www/html/martiangames/game/kart-wars.php
        └── <iframe data-src="/gamez/KartWars2/">  ← Apache Alias resolves this
              └── /var/www/html/gamez/KartWars2/index.html
                    └── Unity WebGL loads Build/KartWars-215.*
                    └── PHP calls go to /gamez/KartWars2/php/playerLogin.php
                          └── includes ../../includes/secure_db_config.php
                                └── Connects to martian_games DB (localhost)
```