CheckRust documentation

What CheckRust is

A web control plane for Rust server networks: staff workflows, player intelligence, reports, checks, chat, bans/mutes, alerts and audit — backed by PostgreSQL and a server-side Oxide/uMod (Carbon-ready) plugin.

• Multi-project: each owner workspace is a Project with its own servers, staff roles and data isolation.
• Plugin-first ingestion: heartbeats and batched events use a per-server token issued from the dashboard.
• Human auth: cookie session (JWT in httpOnly cookie) for the browser; plugin uses Bearer project/server tokens.

Accounts & sign-in

Users can register with email and password (two-step profile: display name + unique @username), use Google OAuth, Steam OpenID, or (development only) dev-login.

After email/password step one you are redirected to /register/complete until display name and username are set; the dashboard is blocked until then.

OAuth callbacks create or refresh the user, attach the default owner project when missing, and set the same session cookie as password login.

// Success
{ "ok": true, "data": { /* payload */ } }

// Error
{ "ok": false, "error": { "code": "SOME_CODE", "message": "Human-readable text" } }

Projects & staff

A Project groups servers, players, moderation entities and billing. The first project is created automatically; additional projects are created via the REST API.

• Roles: owner, admin, senior_moderator, moderator, support, custom — mapped to granular permissions in the panel.
• Staff invites use @username (unique nickname after registration) or the account email; the person must already have a CheckRust account.

CheckRust.cs on the game server

Upload the single-file plugin, generate a connect token in Dashboard → Plugin, then pair from the server console before the token expires.

Heartbeats keep the server row online, rotate command queue delivery, and record lightweight telemetry in the audit log.

The events endpoint accepts batches of typed payloads; supported shapes are normalized into players, chat lines, reports, etc.

cr.pair <paste-token-here>
// then watch dashboard → Plugin for heartbeat + queued commands

Dashboard map

Authenticated UI under /dashboard — each area talks to /api/dashboard/* or /api/projects/:id/* depending on feature.

• Servers: connect tokens, RCON-style command queue visibility, status.
• Players / bans / mutes / reports / checks / chat / alerts / audit / settings (billing, webhooks, risk rules) / plugin token management.
• Checker: external agent flow via /api/checker/* for assisted player checks when enabled.

Security & operations

POSTs that mutate state expect a same-site browser context (Sec-Fetch-Site / Origin alignment with APP_URL in production). Rate limits apply to auth and dashboard POST families.

• Session cookie name: bz_session — HttpOnly, SameSite=Lax, Secure in production unless SESSION_COOKIE_SECURE=false.
• Plugin calls require Authorization: Bearer <server token>; never expose tokens in screenshots or public repos.
• Use HTTPS in production; rotate plugin tokens from the dashboard if leaked.

Conventions

This page tracks the shipped routes in this repository. When in doubt, read the handler under src/app/api/**/route.ts — it is the source of truth.