ArmoryA World of Warcraft armory for Flarum 2. Members sign in with Battle.net, and the extension pulls their characters straight from the Blizzard API — gear with hover tooltips, stats, talents, Mythic+/raid progress, professions, PvP ratings, reputations and collections — on a tabbed, theme-aware character page that looks at home in light or dark mode. Free and open source (MIT). The companion Convoro build shares the same data engine. FeaturesBattle.net OAuth — one click to connect; characters sync automatically. Full character page at /armory with tabs: Gear — every slot with a big 3D character render and Wowhead-style item tooltips (item level, stats, sockets, set bonuses, sell price). Stats — primary + secondary stats, defenses and resources. Talents — active spec, talents, and the in-game loadout import string. PvE — Mythic+ rating and best weekly runs, plus raid progress. Professions — primary and secondary, with tier skill. PvP — honor level and rated 2v2 / 3v3 / RBG ratings. Reputations and Achievements / Collections (points, mounts, pets). Roster sidebar to switch between your characters; pick a main, hide alts. Role-Play tie-in — if ernestdefoe/roleplay is installed, an Add to Role-Play button imports a WoW character as a playable Role-Play character: a combat sheet (HP + might/agility/wits/heart scaled from item level and primary stats) plus a deck of signature class ability cards whose damage dice scale with item level. Re-run after a gear upgrade to rescale. Theme-aware — colors follow your forum's light/dark scheme. Caching — character data is cached so the page stays fast and stays well under Blizzard's rate limits. SetupInstall: php flarum migrate php flarum cache:clear ```Create a Battle.net API client at develop.battle.net/access/clients. Set the Redirect URL to https://YOUR-FORUM/auth/battlenet/callback. In Admin → Armory, paste the Client ID and Client Secret, and choose your default region (Americas / Europe / Korea / Taiwan). Members open Armory from the navigation and click Connect Battle.net. How it worksPublic character data (gear, stats, raids, …) is fetched with an app-level client-credentials token, so refreshes never require the member to sign in again. The member's wow.profile token is used only once — to discover which characters belong to them. LicenseMIT © ernestdefoe

bespoke 2.0.36 What's Changed Compact the boxed-stream ReplyPlaceholder + drop hover underline on widget rows Drop underline on bento nav tiles + wrap Extension Manager repo chips Admin: repo chips 3-wide with ellipsized labels Center the reply placeholder row on the button midline Reply placeholder: larger 40px avatar, tighter symmetric padding Reply placeholder: bump avatar to 48px Reply placeholder: bump avatar to 56px Reply placeholder: drop top margin so it centers inside its own card Full Changelog: https://github.com/ernestdefoe/bespoke/compare/2.0.35...2.0.36 View release on GitHub

social-groups v2.4.9 Fixed Hotfix for two v2.4.8 issues — update straight past v2.4.8 if you haven't already: The notification dropdown rendered empty when a Social Groups notification was present. Flarum 2 requires notification components to implement excerpt(); ours didn't, which crashed the list render. All three notification types display correctly now, and they also appear in Settings → Notifications with per-user toggles. Raw translation keys showed in group pages (tab labels, member-list messages, the RSS link) — a locale-file nesting mistake in v2.4.8. All strings render again. Update php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.9)

social-groups v2.4.8 Fixed Group notifications never actually delivered — now they do. Flarum 2's alert driver only handles notification blueprints that implement AlertableInterface; ours didn't, so the new-post and new-reply notifications silently reached no one. All notification types now deliver. Rejoin after leaving an approval-gated group works properly. Leaving a group now clears your join-request history, and a stale approved/denied request no longer swallows a new one — previously the UI said "pending review" while no request (and no notification) ever reached the group's managers. Thanks to the user who reported this. New Join-request alerts — the group's creator and moderators get a notification (with a per-user toggle in notification settings) whenever someone asks to join an approval-gated group. Mute members — group creators and moderators can mute a member from the member list: they stay in the group and can read everything, but can't post or reply until unmuted. The composer is replaced with a clear notice for muted members (nothing errors on submit), and a Muted badge shows managers who's restricted. Primary group on posts — forums running fof/badges now show the author's primary social-group image chip in post headers, linking to the group. Private groups stay hidden from non-members; the data rides on the existing user payload, so there are no extra requests. Groups on profiles — a new Groups item in the profile sidebar lists every group a member created or joined (/u/{username}/groups). Group discovery — directory cards now tease each group's two most recently active discussions, so visitors see real conversations without opening every group. Update php flarum migrate php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.8)

calendar v2.2.0 New Hide the Calendar nav link — a new admin setting removes the Calendar entry from the sidebar navigation for forums that prefer a lean nav. The calendar stays reachable from the Upcoming Events widget and the /calendar URL. fof/forum-widgets-core support — if you run the FoF widget manager, Upcoming Events now registers as a managed widget: place and reorder it from the widget manager like any other widget (it renders flat, with its own header — no double chrome). The extension detects the widget core at runtime; forums without it keep the exact same behavior as before, and nothing new is required. Update php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/calendar/releases/tag/v2.2.0)

social-groups v2.4.7 Fixed Regular members and group creators got a 403 ("You do not have permission to perform this action") when starting a new discussion in a group — only site administrators could create them. Replies to existing threads were unaffected. Root cause: the discussion Create endpoint carried a ->can('create') gate, but at create time there is no model for Flarum's gate to hand to the extension's policy — the check ran against nothing, skipped the policy entirely, and fell back to core's admins-only default. The endpoint now relies on the extension's real authorization (the member / owner / moderator check that runs during creation and always has), which is the same pattern the reply endpoint uses. No admin configuration is needed — group members and creators have always been intended to have this permission by default; the gate ordering just made the check unreachable. Verified both ways: a plain member of a group can create a discussion (201), a non-member still cannot (403). Update php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.7)

social-groups v2.4.6 Fixed Follow-up to v2.4.5 for forums on the default Flarum theme: Profile Group Badge tiles were unreadable — the tiles have an opaque light background but inherited the user-card hero's white text color. Tile labels now always use the theme's text color. The selected tile went see-through, letting the hero color bleed through it. It now stays opaque under its blue highlight tint. "GROUPS", the help text, and the empty/saving states rendered in muted gray directly on the colored hero. They now inherit the hero's contrast color, so they're legible over any profile color, light or dark. Update php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.6)

social-groups v2.4.5 Fixed User-card Controls menu unreadable on the default Flarum theme. The extension globally aliased core's --text-color CSS variable to --body-color, a variable that only exists in certain themes. On stock Flarum this made every core color: var(--text-color) invalid, so the profile-page Controls dropdown inherited the hero's white text — white on a white menu. The alias is removed; the menu (and anything else that reads --text-color) renders correctly on every theme. Thanks to the user who reported this with screenshots. Guests on login-restricted forums no longer see public group names/descriptions they can't actually open: the groups listing now honors the same viewForum gate as the rest of the extension. Friendlier permission errors in the group feed. A denied feed load now shows a lock panel (with a Log In button for guests) instead of a raw "You do not have permission" toast. Two stray hardcoded English strings (user-card "Groups" label, feed search empty-state) now go through the translator. Update php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.5)

bespoke 2.0.35 What's Changed New: default cover image for grid cards The Discussions panel (grid mode) gains a Default cover image field: cards whose first post has no image show it instead, so every card keeps the same silhouette. Leave it empty for plain cards. Covers are live-managed: a real post image replaces the fallback the moment it's available, editing the URL swaps existing default covers, and clearing the field removes them — post-image covers are never touched. Fixes Covers fill the whole cover area. Core gives the card's inner content box its own padding (for the list controls the grid hides), which left a visible frame around cover images. Grid mode zeroes it; all covers now bleed flush to the card edges. Tags widget shows every listed tag. Tags flagged "hidden" were wrongly excluded — in Flarum that flag keeps a tag's discussions off All Discussions, not the tag itself out of listings (core's tags page shows them). The widget now matches core. The "How many" setting also accepts 0 = show all. Full Changelog: https://github.com/ernestdefoe/bespoke/compare/2.0.34...2.0.35 View release on GitHub

bespoke 2.0.34 What's Changed Discussion list View counts — discussions now track views (guests included, one per browser session) and grid cards show an eye + compact count next to replies. New companion table + visibility-checked endpoint; the index eager-loads counts so big lists stay one query. Card action menu — grid cards get a kebab in the top-right corner (glass chip, fades in on hover) exposing the full standard discussion controls: follow, rename, edit tags, sticky, lock, delete, plus whatever other extensions add. Renders outside the card so rounded corners can't clip it; no controls → no button. Live typing badges — with flarum/realtime installed, list rows and cards pulse a "typing…" badge (top-left) driven by the same per-discussion channels and 6-second expiry as core's post-stream indicator. Capped at 30 visible rows, permission-gated, no-op without realtime. The card footer reply count is now translatable. Widgets Tags widget typing dots — tag rows/chips pulse three brand-colored dots when someone is typing in an on-screen discussion carrying that tag. Real tags-list widget (chips or list style, counts, top-level filter), guest visitor count on Online Now, and a widget/panel registration API for companion extensions (queue-based — load order never matters), with third-party widget i18n. Theme & editor Midnight preset (the Shattered Pact look) with hand-picked high-contrast golds. Bento nav tiles; fixed widgets vanishing on publish; nav item filter; extension settings round-trip fix; ReplyPlaceholder contained inside carded post streams. Full Changelog: https://github.com/ernestdefoe/bespoke/compare/2.0.33...2.0.34 View release on GitHub

social-groups v2.4.4 Improvement Fully translatable. Every user-facing string now goes through the translator — 48 new locale keys covering the share modal, reaction labels, upload/save errors, and every backend error message (invites, polls, media, join requests, member roles, sharing). Translation packs can now localize the extension completely; nothing is hardcoded English anymore. No behavior changes. Update: php flarum cache:clear``` **Full Changelog**: https://github.com/ernestdefoe/social-groups/compare/v2.4.3...v2.4.4 [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.4)

onair-plus v0.1.4 Past streams now render on the /onair Live page below the live grid (one streaming hub) instead of a separate sidebar nav link. The VOD browser is a reusable component; /onair-vods still works for deep links. View release on GitHub

onair-plus v0.1.3 What's Changed Public VOD directory Past streams is now a public directory — a "Past streams" link appears in the index sidebar for everyone (guests included). It was previously only reachable from the logged-in avatar menu, which made recordings look private to their owner. Filter by streamer — click a name in the list to see just that member's recordings. Recording deletion New DELETE /api/onair/recordings/{id} for the recording owner, admins, and onair.manage holders; the VOD page shows a trash button where allowed. New admin setting Recordings directory (onair-plus.recordings_root): when set to the local path the RTMP server records into, deleting a VOD also removes its files (path-confined). Leave empty if recordings live on another host — deletion then only removes the listing. Pairs with OnAir v0.1.4, which adds stream deletion on the stream page. Full Changelog: https://github.com/ernestdefoe/onair-plus/compare/v0.1.2...v0.1.3 View release on GitHub

onair-plus v0.1.3 What's Changed Public VOD directory Past streams is now a public directory — a "Past streams" link appears in the index sidebar for everyone (guests included). It was previously only reachable from the logged-in avatar menu, which made recordings look private to their owner. Filter by streamer — click a name in the list to see just that member's recordings. Recording deletion New DELETE /api/onair/recordings/{id} for the recording owner, admins, and onair.manage holders; the VOD page shows a trash button where allowed. New admin setting Recordings directory (onair-plus.recordings_root): when set to the local path the RTMP server records into, deleting a VOD also removes its files (path-confined). Leave empty if recordings live on another host — deletion then only removes the listing. Pairs with OnAir v0.1.4, which adds stream deletion on the stream page. Full Changelog: https://github.com/ernestdefoe/onair-plus/compare/v0.1.2...v0.1.3 View release on GitHub

onair v0.1.4 What's Changed New: delete streams The stream page now has a Delete stream button for the stream's owner and holders of the Manage / end others' streams permission — works on live and ended streams and removes the stream permanently. Previously there was no way to remove a stream from the UI. The End/Delete buttons are driven by a new backend-computed canEdit capability, so moderators with onair.manage now see them too (they always had the backend permission). Rolled up from v0.1.2–v0.1.3 Live Streams widget for Bespoke with inline stream previews, grid layout in wide zones. Pairs with OnAir+ v0.1.3, which makes the past-streams page a public VOD directory with per-streamer filtering and recording deletion. Full Changelog: https://github.com/ernestdefoe/onair/compare/v0.1.1...v0.1.4 View release on GitHub

social-groups v2.4.3 Bug fix Fixed the 403 when replying to or editing group posts — for everyone, not just non-members. The social-group-posts resource declared discussionId, content, linkPreview and parentPostId as read-only fields while the create/update hooks consumed them from the request body. Flarum 2 rejects any request whose body contains a declared-but-unwritable field (403 — Field [discussionId] is not writable), so every reply and post edit failed regardless of membership or permissions. The fields are now writable with no-op setters, keeping the lifecycle hooks as the single writers so the membership gate, reply flattening and link-preview sanitization still apply. Reported by flavour1 — thank you for the persistence, this was the real cause behind the earlier reports. Fixed the v2.4.2 composer gate. The thread read canReply as a method on a plain object (a TypeError) and the client-side projection never included the attribute. Members now correctly get the composer; non-members get the "Join this group to reply" hint; admins and global moderators can also comment from the feed without joining. Update: php flarum cache:clear``` **Full Changelog**: https://github.com/ernestdefoe/social-groups/compare/v2.4.2...v2.4.3 [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.3)

calendar 2.1.0 What's Changed New: attendee roster on events Event details now list Who's going and Also interested with avatar chips. When the armory extension is installed, each attendee's best character (main first, then highest item level) is shown in official class color with spec and item level — perfect for raid signups. Roster is delivered via the show/RSVP endpoints; the list endpoint stays lean. Maintenance CalendarPage split into MonthGrid / TimeGrid / EventListView components (audit follow-up). Full Changelog: https://github.com/ernestdefoe/calendar/compare/2.0.6...2.1.0 View release on GitHub

Logged. Consolidating everything reported by @flavour1 and Ernest across this thread into one tracked issue list for Social Groups (against Social Groups v2.3.67 / Flarum 2.0.0-rc.3): Permissions / access Guest access leak — non-logged-in visitors could open and read group discussions even with view restricted to members; the API correctly returned 401 not_authenticated but the client still rendered the content. Reported fixed in v2.3.67 — restriction now enforced. Remaining polish: opening a /groups/… URL as a guest now shows "Failed to load group." plus a "The requested resource was not found." error modal — this is expected behavior, so the modal should be suppressed rather than surfaced as an error. Cannot reply to group posts — POST social-group-posts returns 403 / "You do not have permission to do that." with permissions set to Create Social Groups: Members, Edit & delete any: Admins. No reply-level permission is exposed in Admin → Permissions, and normal discussion replies work fine — points to a missing/incorrect policy check on the post-create endpoint. Cannot edit posts as admin — only deletion of the whole discussion is available; per-post edit is missing. Composer / editor No formatting controls — the group composer footer shows no TextEditor controls; only third-party buttons (fof/upload, fof/polls) appear. SGFeed composer not dynamic — the input area doesn't grow with content, so once pasted content fills the space it can no longer be edited. Embeds not rendered on submit — image links / URLs only render after a full page reload, not immediately on post. Media Uploads missing from SGMedia — images uploaded via fof/upload don't appear in the SGMedia tab. SGMedia lightbox author link opens an auto-generated discussion named "gallery"; inside it, editing and replying both fail with "Failed to save edit." / "You do not have permission to do that." (reactions do work). I've captured all of the above so nothing is lost. @flavour1 — thanks for the thorough repro steps and browser-console details; that's exactly what makes these fixable. Ernest has noted he'll work through these; I'll leave the roadmap/timeline and any fix confirmations to @ernestdefoe.

social-groups v2.4.2 Bug fix Fixed a 403 when replying in a group you can see but haven't joined. The thread UI showed a reply composer to any logged-in user, but the backend only accepts replies from active group members (and admins/global moderators). A logged-in non-member viewing a public group therefore got a composer that returned 403 (social-group-posts) on submit. The discussion API now exposes a canReply capability that mirrors the backend write gate exactly, and the composer + per-post reply buttons are gated on it. Non-members see a "Join this group to reply" hint instead of a failing composer. Reported by flavour1. Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.4.1...v2.4.2 View release on GitHub

social-groups v2.4.1 Bug fixes Guests can now view members of public groups. GET /api/social-group-members was returning 401 for guests on public groups because the resource scope called assertRegistered() before the visibility check. Registration is no longer required to list a public group's members; private groups still return 403 for non-members. Group avatar color disc now only paints behind the initial-letter fallback, never behind an uploaded icon image (previously the disc could bleed through transparent-PNG logos). Full Changelog: https://github.com/ernestdefoe/social-groups/compare/v2.4.0...v2.4.1 View release on GitHub

digest-mail 2.1.3 Fixed The digest-frequency selector now reliably appears in Settings → Notifications. On some Flarum 2 builds the settings chunk is double-bundled, so extending only the module registry never reached the mounted page. The extension now hooks both the registry (string-form extend) and the settings route's lazy resolver, with dedupe — validated end-to-end in a browser (render, save, persist across reload). PHP 8.x deprecation: optional-before-required constructor parameter in DigestContent. Hardened (Floxum audit) DigestSendLog uses an explicit $fillable whitelist instead of $guarded = []. Awards digest fetch bounded to the newest 50 non-draft awards. All 36 third-party-table query call sites annotated; the ConnectionInterface exception is scoped and documented (own digest_* tables remain Eloquent-only). Long methods split for testability: processFrequency (stamp/log/prune/window helpers), getPicks (events + leaderboard builders), getLeaderboard (CASE builder + rank reconstruction), getResofireGamepedia (getTopGenres). resolve() usage in the ApiResource fields callback documented as an intentional lazy exception. View release on GitHub

social-groups v2.4.0 Fixes 5 issues reported on the support forum (d/8, by flavour1) and adds a markdown formatting toolbar. Fixed Embeds/formatting now render immediately after posting in the feed (previously the new card showed only the bare title until a page reload). Admins can edit posts again — the Edit action is now exposed in the feed and thread for admins, matching the edit policy. Images shared in the feed now appear in the Media tab (only the hidden gallery archive was scanned before; inline emoji are excluded). The Media lightbox no longer links gallery uploads to the hidden container discussion where edit/reply returned 403 — the "View post" jump is shown only for real feed posts. Replies by admins/global moderators in any group without joining first (carried over from the prior 403 fix). Added Markdown formatting toolbar (bold, italic, strikethrough, link, quote, list, inline code) on the feed and thread composers and the post editors. Update: php flarum cache:clear``` [View release on GitHub](https://github.com/ernestdefoe/social-groups/releases/tag/v2.4.0)

social-groups v2.3.69 Fixes the 403 'You do not have permission to do that' when an admin or global moderator (who isn't a member of the group) tries to reply to a group post — the post-create hook now grants the same admin/moderator bypass the React/Delete/Pin policies already have. View release on GitHub

google-fonts 0.2.3 Audit hardening: family save dedupes redundant POSTs, and a new gc command (weekly) cleans up orphaned uploaded font files. View release on GitHub

espn-cfb-ticker v2.0.7 Audit hardening: full TypeScript conversion (tsc clean) + an AbortController timeout on the ESPN fetch. View release on GitHub