v0.1.14: admin-gated URL, allowed servers, structured blacklist, event log, UI polish

Major feature pass alongside server PR #24 (allowed_servers + is_admin on
/api/auth/whoami + strict ingest gate). Backward-compatible with v0.1.13
config files on disk — legacy BlacklistedCharacters migrates to the new
structured BlacklistedEntries on Load.

Settings panel changes
- Server URL field locks (with 🔒 glyph + tooltip) for non-admin accounts.
  Plugin opportunistically calls /auth/whoami on startup and after every
  Test Connection / Save click; URL unlocks only when the server returns
  is_admin=true. Fail-CLOSED — outdated server (no field) → URL locked.
- New "✦ ALLOWED SERVERS" card showing the read-only list the site permits
  uploads from. Defaults to ["Varsoon", "Wuoshi"] until whoami returns the
  list. Inline warning when the current logging server isn't allowed.
- New "▤ EVENT LOG" card in the right column (TableLayoutPanel split).
  Captures + uploads + HTTP request/response summaries with severity
  colours, toolbar (Clear / Copy / Auto-scroll / category filters), and a
  500-entry ring buffer. Bearer token never appears in any log line.
- "Don't upload as" blacklist now a row-based editor with [Character]
  [Server (dropdown)] [✕ Remove] rows + an Add button. Server dropdown is
  pre-populated with the allowed-servers list. Doubled visible area
  (84px → 180px). Fixes the issue where same-named alts on different
  servers couldn't be selectively blacklisted.

UI polish
- Embedded Cinzel variable font (SIL OFL 1.1, ~125KB) for the EQ2
  LEXICON UPLOADER title and all card section headings. Loaded via
  PrivateFontCollection so users don't need it installed; body text
  stays Segoe UI for legibility.
- Rounded buttons (6px radius) via custom RoundedButton control with
  proper parent-bg painting in OnPaintBackground so corners blend
  cleanly into the card behind. Rounded card borders (8px) via the
  same path helper.
- Spacing breathing room: root padding 16 → 24/20/24/24; card-to-card
  gap 12 → 16; header-to-first-card gap 12 → 18.

Core
- UploadClient: ExtractJsonBool + ExtractJsonStringArray helpers (same
  fail-closed posture as the existing ExtractJsonString). TestConnection
  returns IsAdmin (default false) and AllowedServers (default null →
  caller substitutes built-in default). New RequestCompleted event
  fires after every HTTP exchange with anonymised summary (verb, URL,
  status, duration, success, 200-char response excerpt) — never the
  token, never the payload body.
- New EventLog Core type (thread-safe ring buffer, EntryAdded event,
  Snapshot, Clear). Pure, no ACT/WinForms refs.
- PluginConfig: new BlacklistedEntry (Character + Server) class.
  IsBlacklisted now takes (character, server). Server="" means
  "any server" (legacy semantics). Load() migrates legacy
  BlacklistedCharacters → BlacklistedEntries with Server="";
  idempotent.

Tests: 234 passing (up from 215). New coverage for ExtractJsonBool,
ExtractJsonStringArray, EventLog ring-buffer + thread-safety, the new
(character, server) blacklist match semantics, and the legacy
list-of-string → list-of-entry migration on Load.

Server-side contract for the new whoami fields is documented in
CLAUDE.md → "Required server-side changes". Server PR landed as
VortexUK/EQ2Lexicon#24 — the plugin reads what the server now ships.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: VortexUK

CLAUDE.md

@@ -139,6 +139,22 @@ Every upload includes an `X-Lexicon-Signature` header: HMAC-SHA256 of the reques
 
 **Rollout coordination with the server**: ship the server's signature validator in *opportunistic* mode first (validate only if header present, reject only if validation fails) so existing v0.1.7 installs keep uploading. Flip to *strict* mode (require the header) once telemetry shows ≥98% of uploads carry it — pulled from the `User-Agent` header which UploadClient sets to `EQ2LexiconACTPlugin/<assembly version>`.
 
+## Required server-side changes (pending in [VortexUK/EQ2Lexicon](https://github.com/VortexUK/EQ2Lexicon))
+
+The plugin already wires UI for two fields that the production server does not yet emit. Until the server PRs land, the plugin falls back to safe defaults (URL field stays locked; allowed-servers card shows a built-in list).
+
+### `is_admin` on `/api/auth/whoami`
+
+Add a boolean `is_admin` to the JSON response. Drives the Server URL field's editability gate in the plugin — only admins can change the endpoint. Fail-CLOSED in the plugin: if the field is missing the URL stays locked, so a non-admin can never see a writable URL field by simply pointing at an old build of the server. Same opportunistic-rollout pattern as the HMAC header in v0.1.8 — additive field, ignored by old clients, used by new ones.
+
+### `allowed_servers` on `/api/auth/whoami`
+
+Add an array of EQ2 server name strings (e.g. `["Varsoon", "Wuoshi"]`) the user is permitted to upload from. Drives the ALLOWED SERVERS card in the settings panel — read-only display so the user knows up-front which characters' parses will reach the site. The list could be a global default, per-guild, or per-user — server's choice; the plugin just renders what it's given. Sanitisation in the plugin caps each entry at 64 chars and the whole array at 32 entries to keep a hostile/buggy server from breaking the UI layout.
+
+When absent, the plugin uses a built-in default of `["Varsoon", "Wuoshi"]` (the two active English-language EQ2 TLE servers as of 2026). When the server starts returning the field, the built-in default is replaced by whatever the site says on the next whoami round-trip.
+
+Future enforcement: the server should *also* validate `logger_server` on incoming uploads against the same list and reject mismatched uploads with a 403. The plugin's display is courtesy/transparency; the real gate is the server.
+
 ## Update awareness (v0.1.8+)
 
 The plugin fetches `https://api.github.com/repos/VortexUK/EQ2LexiconACTPlugin/releases` once per ACT session, compares the assembly version to the published tags, and:

THIRD_PARTY_NOTICES.md

@@ -0,0 +1,16 @@
+# Third-party notices
+
+The EQ2 Lexicon ACT Plugin redistributes the following third-party assets.
+
+## Cinzel font
+
+The plugin embeds [Cinzel](https://github.com/google/fonts/tree/main/ofl/cinzel) (the variable font `Cinzel[wght].ttf`) by Natanael Gama, licensed under the [SIL Open Font License 1.1](https://scripts.sil.org/cms/scripts/page.php?site_id=nrsi&id=OFL).
+
+The full OFL text is bundled inside the DLL at `src/Resources/Fonts/OFL.txt` and reproduced here for convenience: <https://github.com/google/fonts/blob/main/ofl/cinzel/OFL.txt>
+
+The OFL grants permission to use, embed, and redistribute the font under the conditions in the license — most relevantly:
+
+- The font may not be sold by itself.
+- The font (or modified versions) when bundled inside a software package may be distributed at no extra charge, with the OFL included.
+
+We meet these conditions by shipping the unmodified Cinzel variable font as an embedded resource in `EQ2Lexicon.ACTPlugin.dll` along with the OFL.txt notice file.

src/Core/EQ2Lexicon.ACTPlugin.Core.csproj

@@ -18,7 +18,7 @@
       Build metadata is mirrored from the UI csproj so this assembly's
       version tracks the user-facing plugin version.
     -->
-    <Version>0.1.13</Version>
+    <Version>0.1.14</Version>
     <Company>EQ2 Lexicon</Company>
     <Product>EQ2 Lexicon Uploader (Core)</Product>
     <Description>Pure payload / config / HTTP layer shared by EQ2Lexicon.ACTPlugin.</Description>

src/Core/EventLog.cs

@@ -0,0 +1,155 @@
+using System;
+using System.Collections.Generic;
+
+namespace EQ2Lexicon.ACTPlugin
+{
+    /// <summary>
+    /// Severity tier for an event log entry. Drives the colour the
+    /// settings panel paints the row with. Kept separate from the
+    /// HTTP status / capture-result distinctions so the UI doesn't
+    /// have to translate "success" booleans into colours in five
+    /// different call sites.
+    /// </summary>
+    public enum EventSeverity
+    {
+        Info,
+        Success,
+        Warning,
+        Error,
+    }
+
+    /// <summary>
+    /// One row in the in-memory event log. UTC timestamp so the panel
+    /// can render in local time without ambiguity when ACT moves
+    /// between time zones (rare but possible — laptop user travels).
+    /// Plain DTO; no behaviour.
+    /// </summary>
+    public sealed class LogEntry
+    {
+        public DateTime At { get; set; }            // UTC
+        public EventSeverity Severity { get; set; }
+        /// <summary>"capture" | "upload" | "http" — used by the panel's filter checkboxes.</summary>
+        public string Category { get; set; } = "";
+        public string Message { get; set; } = "";
+    }
+
+    /// <summary>
+    /// Tiny thread-safe ring-buffered event log surfaced in the settings
+    /// panel. One instance per Plugin lifetime; subscribers (the
+    /// settings panel) receive each entry via <see cref="EntryAdded"/>
+    /// AND can pull the full backlog via <see cref="Snapshot"/> when
+    /// they first attach.
+    ///
+    /// Lives in Core deliberately — no ACT or WinForms refs means it's
+    /// unit-testable without spinning up a UI thread, and a future
+    /// headless CLI could reuse it. Cap is fixed at construction so a
+    /// long-running ACT session doesn't accumulate unbounded entries.
+    /// </summary>
+    public sealed class EventLog
+    {
+        private readonly int _cap;
+        private readonly LinkedList<LogEntry> _entries = new LinkedList<LogEntry>();
+        private readonly object _lock = new object();
+
+        // ID monotonically increments. The UI uses it to detect "I
+        // missed entries while the marshal was queued" (entries
+        // evicted between subscribe and first paint).
+        private long _nextId;
+
+        /// <summary>
+        /// Default cap is 500 entries — enough for a multi-hour raid
+        /// session at typical capture rates (~1 entry per encounter +
+        /// ~2 per upload). Override only in tests where eviction
+        /// timing matters.
+        /// </summary>
+        public EventLog(int capacity = 500)
+        {
+            if (capacity < 1) capacity = 1;
+            _cap = capacity;
+        }
+
+        public int Capacity => _cap;
+
+        /// <summary>
+        /// Total number of entries ever logged (including evicted).
+        /// Surfaced in the UI footer ("showing N of M (cap C)") so the
+        /// user knows when older events have rolled off.
+        /// </summary>
+        public long TotalLogged
+        {
+            get
+            {
+                lock (_lock) { return _nextId; }
+            }
+        }
+
+        /// <summary>
+        /// Raised whenever a new entry is added. May fire on any
+        /// thread — subscribers MUST marshal if they touch UI.
+        /// Handler exceptions are swallowed so a buggy subscriber
+        /// can't break the log pipeline for other listeners.
+        /// </summary>
+        public event Action<LogEntry>? EntryAdded;
+
+        public void Log(EventSeverity severity, string category, string message)
+        {
+            var entry = new LogEntry
+            {
+                At = DateTime.UtcNow,
+                Severity = severity,
+                Category = category ?? "",
+                Message = message ?? "",
+            };
+            lock (_lock)
+            {
+                _entries.AddLast(entry);
+                _nextId++;
+                while (_entries.Count > _cap)
+                {
+                    _entries.RemoveFirst();
+                }
+            }
+            var handler = EntryAdded;
+            if (handler == null) return;
+            foreach (var subscriber in handler.GetInvocationList())
+            {
+                try
+                {
+                    ((Action<LogEntry>)subscriber)(entry);
+                }
+                catch
+                {
+                    // One subscriber must not break the rest.
+                }
+            }
+        }
+
+        /// <summary>
+        /// Snapshot of the current entries, oldest first. The list is
+        /// a copy — safe to enumerate without holding the log lock.
+        /// </summary>
+        public IReadOnlyList<LogEntry> Snapshot()
+        {
+            lock (_lock)
+            {
+                var copy = new List<LogEntry>(_entries.Count);
+                copy.AddRange(_entries);
+                return copy;
+            }
+        }
+
+        /// <summary>
+        /// Empty the log. The UI's "Clear" button calls this. Does
+        /// NOT reset <see cref="TotalLogged"/> — the cumulative
+        /// counter keeps growing so we can still tell whether
+        /// anything has happened since startup.
+        /// </summary>
+        public void Clear()
+        {
+            lock (_lock)
+            {
+                _entries.Clear();
+            }
+        }
+    }
+}

src/Core/PluginConfig.cs

@@ -8,6 +8,21 @@
 
 namespace EQ2Lexicon.ACTPlugin
 {
+    /// <summary>
+    /// One row of the (Character, Server) blacklist surfaced in the
+    /// settings panel. Plain DTO; equality / serialization use the
+    /// two string properties directly. A blank Server means "match
+    /// any EQ2 server" — the legacy v0.1.13 semantics.
+    /// </summary>
+    public class BlacklistedEntry
+    {
+        [XmlAttribute("character")]
+        public string Character { get; set; } = "";
+
+        [XmlAttribute("server")]
+        public string Server { get; set; } = "";
+    }
+
     /// <summary>
     /// User-configurable settings, persisted as XML.
     ///
@@ -58,22 +73,71 @@ public class PluginConfig
         public bool UploadEnabled { get; set; } = false;
 
         /// <summary>
-        /// Character names to NEVER upload as. Encounters where ACT's
-        /// active logging character is in this list are skipped silently.
-        /// Useful for alts you don't want to attribute parses to (e.g. a
-        /// non-guild bank toon, low-level alts, etc.). Match is
-        /// case-insensitive on exact name.
+        /// LEGACY — character-name-only blacklist. v0.1.13 and earlier
+        /// stored a flat list of names which matched regardless of EQ2
+        /// server, so a player with the same character name on two
+        /// servers (e.g. an alt on Wuoshi sharing a name with a main on
+        /// Varsoon) couldn't blacklist one without blacklisting both.
+        ///
+        /// Still serialized as <c>&lt;BlacklistedCharacters&gt;</c> in
+        /// the XML so an existing v0.1.13 config file can be loaded
+        /// without data loss. On <see cref="Load"/>, any entries here
+        /// are migrated into <see cref="BlacklistedEntries"/> (with
+        /// Server="" = "any server", preserving the legacy semantics)
+        /// and this list is cleared before the next Save persists.
         /// </summary>
         [XmlArray("BlacklistedCharacters")]
         [XmlArrayItem("Character")]
         public List<string> BlacklistedCharacters { get; set; } = new List<string>();
 
-        public bool IsBlacklisted(string characterName)
+        /// <summary>
+        /// Structured blacklist replacing <see cref="BlacklistedCharacters"/>.
+        /// Each entry is a (Character, Server) pair. A blank Server
+        /// matches any server (i.e. the legacy semantics). Encounters
+        /// where ACT's active logging character matches an entry AND
+        /// the current server is allowed by that entry are skipped
+        /// silently. Match is case-insensitive on both fields.
+        /// </summary>
+        [XmlArray("BlacklistedEntries")]
+        [XmlArrayItem("Entry")]
+        public List<BlacklistedEntry> BlacklistedEntries { get; set; } = new List<BlacklistedEntry>();
+
+        /// <summary>
+        /// Returns true when <paramref name="characterName"/> on
+        /// <paramref name="serverName"/> should NOT upload. Matches:
+        /// (a) any BlacklistedEntries row whose Character equals the
+        ///     given name AND whose Server is blank (= any) or equals
+        ///     the given server name; PLUS
+        /// (b) any legacy BlacklistedCharacters entry that equals the
+        ///     given name — kept so a unit test that constructs a
+        ///     PluginConfig in memory without going through Load()
+        ///     still gets the old semantics. After Load() migrates
+        ///     them, the legacy list is empty and (b) is a no-op.
+        /// </summary>
+        public bool IsBlacklisted(string characterName, string serverName)
         {
             if (string.IsNullOrWhiteSpace(characterName)) return false;
-            return BlacklistedCharacters.Any(b =>
-                !string.IsNullOrWhiteSpace(b) &&
-                string.Equals(b.Trim(), characterName.Trim(), StringComparison.OrdinalIgnoreCase));
+            var cName = characterName.Trim();
+            var sName = (serverName ?? "").Trim();
+
+            foreach (var entry in BlacklistedEntries)
+            {
+                if (entry == null) continue;
+                if (string.IsNullOrWhiteSpace(entry.Character)) continue;
+                if (!string.Equals(entry.Character.Trim(), cName, StringComparison.OrdinalIgnoreCase)) continue;
+                // Blank server in the entry means "any server".
+                if (string.IsNullOrWhiteSpace(entry.Server)) return true;
+                if (string.Equals(entry.Server.Trim(), sName, StringComparison.OrdinalIgnoreCase)) return true;
+            }
+
+            // Legacy list — treated as "any server" matches. Empty
+            // after Load() runs the migration.
+            foreach (var legacy in BlacklistedCharacters)
+            {
+                if (string.IsNullOrWhiteSpace(legacy)) continue;
+                if (string.Equals(legacy.Trim(), cName, StringComparison.OrdinalIgnoreCase)) return true;
+            }
+            return false;
         }
 
         // -------------------------------------------------------------------
@@ -159,6 +223,7 @@ public static PluginConfig Load(string path)
                     {
                         loaded.ServerUrl = DefaultServerUrl;
                     }
+                    loaded.MigrateLegacyBlacklist();
                     return loaded;
                 }
             }
@@ -171,6 +236,39 @@ public static PluginConfig Load(string path)
             }
         }
 
+        /// <summary>
+        /// One-shot migration: copy any names from the legacy
+        /// <see cref="BlacklistedCharacters"/> list into the
+        /// structured <see cref="BlacklistedEntries"/> with Server=""
+        /// (= match any server, preserving the v0.1.13 semantics),
+        /// then clear the legacy list so the next Save persists only
+        /// the new shape. Idempotent — running twice is a no-op
+        /// because the second pass sees an empty legacy list.
+        ///
+        /// De-duplicates: a legacy name that's already represented
+        /// (same character, any-server entry) in the new list is
+        /// skipped rather than added twice.
+        /// </summary>
+        internal void MigrateLegacyBlacklist()
+        {
+            if (BlacklistedCharacters == null || BlacklistedCharacters.Count == 0) return;
+            if (BlacklistedEntries == null) BlacklistedEntries = new List<BlacklistedEntry>();
+
+            foreach (var legacy in BlacklistedCharacters)
+            {
+                if (string.IsNullOrWhiteSpace(legacy)) continue;
+                var name = legacy.Trim();
+                bool alreadyPresent = BlacklistedEntries.Any(e =>
+                    e != null
+                    && !string.IsNullOrWhiteSpace(e.Character)
+                    && string.IsNullOrWhiteSpace(e.Server)
+                    && string.Equals(e.Character.Trim(), name, StringComparison.OrdinalIgnoreCase));
+                if (alreadyPresent) continue;
+                BlacklistedEntries.Add(new BlacklistedEntry { Character = name, Server = "" });
+            }
+            BlacklistedCharacters.Clear();
+        }
+
         public void Save(string path)
         {
             var dir = Path.GetDirectoryName(path);