fix(map): group collocated user markers

2026-08-01 21:24:49 -04:00
parent ebc7c7df17
commit aa0b757814
10 changed files with 176 additions and 31 deletions
@@ -19,6 +19,7 @@ Player account management, administrator navigation, dashboard metrics and chart
 - Made event JSON keyboard-focusable so horizontally overflowing content can be reviewed without a pointer.
 - Added an accessible title, description, date labels, per-point labels, and textual values to the daily-active-user chart.
 - Added labelled, keyboard-linked world-map markers plus a complete semantic table equivalent for approximate user locations.
+- Collocated users share a visible count badge; hover and focus tooltips announce every nickname, while interactive grouped markers expose per-user popup links.
 - Added keyboard-operable tabs for the server-rendered overview and opt-in interactive OpenStreetMap view.
 - Added explicit new-tab context to the external Discord invite link.
 - Kept destructive account and group actions behind native keyboard-operable `details` confirmation disclosures.
@@ -28,6 +28,7 @@ Next.js portal and APIs, Discord bot, PostgreSQL persistence, Keycloak admin aut
 - Group and membership mutations re-check the Keycloak administrator role server-side; destructive group deletion and its audit event commit atomically.
 - Event filters accept only event types already present in the ledger, and event detail routes remain role-protected.
 - The administrator-only map defaults to bundled Natural Earth boundaries. OpenStreetMap tile requests begin only after an explicit operator opt-in; marker coordinates are not transmitted as data, but the requested tiles disclose the viewed geographic extent along with the administrator's IP and portal origin.
+- Grouped-map popup labels and links are created with DOM `textContent` and server-rendered React escaping rather than interpolated HTML.
 - ORM-parameterized queries are used throughout.
 - CSP, clickjacking, MIME-sniffing, referrer, and browser-permission headers are configured.
 - Forwarded IP headers are ignored unless `TRUST_PROXY=true` is explicitly configured.