Release 2.6.13

Restore Docker tag fan-out
Split web and player build artifacts
2026-08-08 21:11:34 +01:00 · 2026-08-08 20:48:36 +01:00 · 2026-08-08 20:38:44 +01:00 · 2026-08-08 16:29:38 +01:00 · 2026-08-08 15:11:11 +01:00 · 2026-08-08 14:14:52 +01:00
46 changed files with 1316 additions and 225 deletions
@@ -1,5 +1,7 @@
 *
 !package.json
+!build/
+!build/**
 !src/
 !src/**
 !scripts/
@@ -10,6 +10,16 @@ jobs:
  build-and-push:
    runs-on: ubuntu-latest

+    strategy:
+      matrix:
+        include:
+          - name: web
+            image: git.lzstealth.com/lzstealth/pulse-signage-web
+            dockerfile: ./build/Dockerfile
+          - name: player
+            image: git.lzstealth.com/lzstealth/pulse-signage-player
+            dockerfile: ./build/Dockerfile.player
+
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
@@ -28,18 +38,18 @@ jobs:
        id: meta
        uses: docker/metadata-action@v5
        with:
-          images: git.lzstealth.com/LZStealth/pulse-signage
+          images: ${{ matrix.image }}
          tags: |
            type=raw,value=latest
            type=ref,event=tag
-            type=semver,pattern=v{{major}}.{{minor}}
            type=semver,pattern=v{{major}}
+            type=semver,pattern=v{{major}}.{{minor}}

      - name: Build and push image
        uses: docker/build-push-action@v6
        with:
          context: .
-          file: ./Dockerfile
+          file: ${{ matrix.dockerfile }}
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
@@ -2,6 +2,43 @@

 All notable changes to this project will be documented in this file.

+## 2.6.13 - 2026-08-08
+
+### Fixed
+
+- The player bundle now keeps the browser-only QR export dependencies lazy-loaded, so the remote player image no longer needs `puppeteer-core` or `@sparticuz/chromium` at startup.
+- Remote player startup sync now falls back to `WEB_INTERNAL_URL` when it is configured, which avoids 404s when the bridge is not the correct sync target.
+- The player startup sync and media-write info logs were removed to keep normal remote-player operation quieter.
+
+## 2.6.12 - 2026-08-08
+
+### Fixed
+
+- The Docker build inputs now live under `build/`, with separate web and player package manifests so the player image no longer carries the web browser tooling bundle.
+- The Docker publish workflow now restores `v2` and `v2.2` style image tags alongside `latest` and the full release tag.
+- Remote player sync and upload routing now carry the exact connected player device id through the bridge, so startup media and font jobs target the correct player instance in split-device deployments.
+- Player websocket registration now learns the public base URL from the actual screen request origin, so localhost and 127.0.0.1 aliases both keep websocket commands working.
+
+## 2.6.11 - 2026-08-08
+
+### Fixed
+
+- Role edits now save selected permissions from the shared RBAC form, so changes on the role page persist when you submit the form.
+- RBAC permission sections now stay open independently in the accordion, so opening one section no longer closes the others.
+
+## 2.6.10 - 2026-08-08
+
+### Fixed
+
+- The onboarding landing page and form no longer restore a previously selected screen, so the screen picker always starts clean while still keeping the saved client name.
+
+## 2.6.9 - 2026-08-08
+
+### Fixed
+
+- The connected-clients view no longer exposes or sorts by client IP, so the table stays focused on the player identity, screen, and playback state.
+- The connected-clients dashboard row renderer now keeps the actions column aligned after removing the IP column, so row updates no longer append a duplicate actions cell.
+
 ## 2.6.8 - 2026-08-08

 ### Fixed
@@ -1,20 +0,0 @@
-FROM node:24-alpine
-
-WORKDIR /app
-
-RUN apk add --no-cache ffmpeg chromium nss freetype harfbuzz ttf-freefont
-
-COPY package*.json ./
-RUN npm install --omit=dev --no-audit --no-fund
-
-COPY src ./src
-COPY scripts ./scripts
-
-RUN mkdir -p /app/src/web/public/vendor/animate.css && cp /app/node_modules/animate.css/animate.min.css /app/src/web/public/vendor/animate.css/animate.min.css
-RUN mkdir -p /app/src/player/public/vendor/animate.css && cp /app/node_modules/animate.css/animate.min.css /app/src/player/public/vendor/animate.css/animate.min.css
-
-RUN mkdir -p /app/media
-
-EXPOSE 3000
-
-CMD ["npm", "run", "start:web"]
@@ -0,0 +1,17 @@
+FROM node:24-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache chromium nss freetype harfbuzz ttf-freefont
+
+COPY build/package.web.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:web"]
@@ -0,0 +1,17 @@
+FROM node:24-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache ffmpeg
+
+COPY build/package.player.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:player"]
@@ -0,0 +1,19 @@
+{
+  "name": "pulse-signage-player",
+  "version": "2.6.13",
+  "private": false,
+  "description": "Pulse Signage player application bundle",
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/player.js",
+    "start:player": "node -r dotenv/config src/player.js"
+  },
+  "dependencies": {
+    "dotenv": "^17.4.2",
+    "express": "^4.21.2",
+    "handlebars": "^4.7.8",
+    "hls.js": "^1.5.15",
+    "mysql2": "^3.14.3",
+    "ws": "^8.21.0"
+  }
+}
@@ -0,0 +1,22 @@
+{
+  "name": "pulse-signage-web",
+  "version": "2.6.13",
+  "private": false,
+  "description": "Pulse Signage web and bridge application bundle",
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/web.js",
+    "start:web": "node -r dotenv/config src/web.js"
+  },
+  "dependencies": {
+    "@sparticuz/chromium": "^137.0.0",
+    "dotenv": "^17.4.2",
+    "express": "^4.21.2",
+    "handlebars": "^4.7.8",
+    "multer": "^2.2.0",
+    "mysql2": "^3.14.3",
+    "puppeteer-core": "^24.16.0",
+    "sharp": "^0.35.3",
+    "ws": "^8.21.0"
+  }
+}
@@ -1,5 +1,6 @@
 # Shared application settings
-PULSE_SIGNAGE_IMAGE="git.lzstealth.com/lzstealth/pulse-signage:latest"
+PULSE_SIGNAGE_WEB_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-web:latest"
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
 PULSE_SIGNAGE_SHARED_SECRET=""

 # Database settings for the web, player, and bridge services
@@ -1,5 +1,5 @@
 # Shared application settings
-PULSE_SIGNAGE_IMAGE="git.lzstealth.com/lzstealth/pulse-signage:latest"
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
 PULSE_SIGNAGE_SHARED_SECRET=""

 # Player settings
@@ -113,7 +113,8 @@ Use this file as a starting point for the public compose stack.

 Important values:

- `PULSE_SIGNAGE_IMAGE` - image to run for all app services
+- `PULSE_SIGNAGE_WEB_IMAGE` - image to run for the web app and bridge services, typically `.../pulse-signage-web:latest`
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run for the player services, typically `.../pulse-signage-player:latest`
 - `PULSE_SIGNAGE_SHARED_SECRET` - long random secret shared by the web, player, and bridge services for authenticated requests
 - `PLAYER_IDENTIFIER` - unique local player identifier
 - `DB_*` - MySQL credentials and database name for the stack
@@ -132,7 +133,7 @@ Use this file on a remote player device.

 Important values:

- `PULSE_SIGNAGE_IMAGE` - image to run on the device
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run on the device, typically `.../pulse-signage-player:latest`
 - `PULSE_SIGNAGE_SHARED_SECRET` - must match the public stack and should be the same long random value used everywhere in the deployment
 - `PLAYER_IDENTIFIER` - unique remote player identifier
 - `PLAYER_PUBLIC_URL` - public URL for the remote player
@@ -157,7 +158,8 @@ Leave it blank only if you intentionally want to run without request signing in

 | Variable | Used By | Purpose |
 | --- | --- | --- |
-| `PULSE_SIGNAGE_IMAGE` | web, player, bridge, remote player | Docker image to run for the app services. |
+| `PULSE_SIGNAGE_WEB_IMAGE` | web, bridge | Docker image to run for the web app and bridge services. |
+| `PULSE_SIGNAGE_PLAYER_IMAGE` | player, remote player | Docker image to run for the player services. |
 | `PULSE_SIGNAGE_SHARED_SECRET` | web, player, bridge, remote player | Shared secret for authenticated requests between services. |
 | `DB_HOST` | web, player, bridge | Database host name. |
 | `DB_PORT` | web, player, bridge | Database port. |
@@ -218,7 +220,7 @@ Each compose file creates its own named network:
 - A remote player must use the same `PULSE_SIGNAGE_SHARED_SECRET` as the bridge it connects to.
 - The bridge service is the dashboard-facing command path for connected remote players.
 - The remote player should point `BRIDGE_PUBLIC_URL` at the bridge, not at the public web endpoint.
- The `PULSE_SIGNAGE_IMAGE` tag defaults to the published image, but it can be overridden for local builds or custom releases.
+- The `PULSE_SIGNAGE_WEB_IMAGE` and `PULSE_SIGNAGE_PLAYER_IMAGE` tags default to the published `pulse-signage-web` and `pulse-signage-player` repositories with `latest` and `v1.2.3` style tags, but they can be overridden for local builds or custom releases.

 ## Recommended Setup

@@ -3,22 +3,22 @@ name: pulse-signage-remote
 services:

  player:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
    restart: unless-stopped
    networks:
      - pulse_signage
    ports:
      - "8081:8081"
    environment:
+      PLAYER_IDENTIFIER: ${PLAYER_IDENTIFIER:-player-remote}
      PLAYER_PUBLIC_URL: ${PLAYER_PUBLIC_URL:-http://localhost:8081}
      BRIDGE_PUBLIC_URL: ${BRIDGE_PUBLIC_URL:-}
      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      PLAYER_AGENT_RECONNECT_DELAY_MS: ${PLAYER_AGENT_RECONNECT_DELAY_MS:-5000}
    volumes:
      - pulse-signage:/app/media
    command: ["node", "src/player.js"]

-
-
 volumes:
  pulse-signage:

@@ -2,7 +2,7 @@ name: pulse-signage

 services:
  web:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
    restart: unless-stopped
    networks:
      - pulse_signage
@@ -28,7 +28,7 @@ services:
        condition: service_healthy

  player:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
    restart: unless-stopped
    networks:
      - pulse_signage
@@ -52,7 +52,7 @@ services:
        condition: service_healthy

  player-bridge:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
    restart: unless-stopped
    networks:
      - pulse_signage
@@ -1,12 +1,12 @@
 {
  "name": "pulse-signage",
-  "version": "2.5.9",
+  "version": "2.6.13",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "pulse-signage",
-      "version": "2.5.9",
+      "version": "2.6.13",
      "dependencies": {
        "@sparticuz/chromium": "^137.0.0",
        "animate.css": "^4.1.1",
@@ -1,6 +1,6 @@
 {
  "name": "pulse-signage",
-  "version": "2.6.8",
+  "version": "2.6.13",
  "private": false,
  "description": "Pulse Signage application with MySQL and media storage",
  "repository": {
@@ -1,8 +1,6 @@
 const fs = require('fs');
 const path = require('path');
 const QRCodeStyling = require(path.join(__dirname, '..', 'web', 'public', 'vendor', 'qr-code-styling', 'qr-code-styling.js'));
-const puppeteer = require('puppeteer-core');
-const chromiumModule = require('@sparticuz/chromium');
 const QR_PNG_WIDTH = 2048;
 const QR_STYLING_SCRIPT_PATH = path.join(__dirname, '..', 'web', 'public', 'vendor', 'qr-code-styling', 'qr-code-styling.js');
 const SYSTEM_CHROMIUM_PATHS = [
@@ -13,11 +11,6 @@ const SYSTEM_CHROMIUM_PATHS = [
  '/usr/local/bin/chromium',
  '/snap/bin/chromium'
 ].filter(Boolean);
-const chromium = chromiumModule && typeof chromiumModule.executablePath === 'function'
-  ? chromiumModule
-  : chromiumModule && chromiumModule.default && typeof chromiumModule.default.executablePath === 'function'
-    ? chromiumModule.default
-    : chromiumModule;
 let qrBrowserPromise = null;

 function escapeXml(value) {
@@ -353,6 +346,13 @@ function getQrBrowser() {
  }

  qrBrowserPromise = (async function () {
+    const puppeteer = require('puppeteer-core');
+    const chromiumModule = require('@sparticuz/chromium');
+    const chromium = chromiumModule && typeof chromiumModule.executablePath === 'function'
+      ? chromiumModule
+      : chromiumModule && chromiumModule.default && typeof chromiumModule.default.executablePath === 'function'
+        ? chromiumModule.default
+        : chromiumModule;
    let executablePath = SYSTEM_CHROMIUM_PATHS.find(function (candidate) {
      return fs.existsSync(candidate);
    }) || '';
@@ -40,8 +40,7 @@ function normalizeRemoteAddress(value) {

 function formatPlayerConnectionLabel(deviceId, remoteAddress) {
  const normalizedDeviceId = String(deviceId || '').trim() || 'unknown-player';
-  const normalizedRemoteAddress = normalizeRemoteAddress(remoteAddress);
-  return normalizedRemoteAddress ? `${normalizedDeviceId} (ip ${normalizedRemoteAddress})` : normalizedDeviceId;
+  return normalizedDeviceId;
 }

 function normalizeProxyBaseUrl(value) {
@@ -93,6 +92,20 @@ function resolveSnapshotUpstreamBaseUrl(player) {
  return normalizeProxyBaseUrl(player && player.public_base_url) || null;
 }

+function resolvePlayerSocketForDeviceId(playerSockets, deviceId) {
+  const normalizedDeviceId = normalizeDeviceId(deviceId);
+  if (!normalizedDeviceId || !playerSockets || typeof playerSockets.get !== 'function') {
+    return null;
+  }
+
+  const socket = playerSockets.get(normalizedDeviceId);
+  if (!socket || socket.readyState !== WebSocket.OPEN) {
+    return null;
+  }
+
+  return socket;
+}
+
 function resolveScreenCommandTargets(slug, playerSockets, screenPlayerDeviceIds) {
  const key = String(slug || '').trim();
  if (!key || !screenPlayerDeviceIds || typeof screenPlayerDeviceIds.get !== 'function' || !playerSockets || typeof playerSockets.get !== 'function') {
@@ -359,7 +372,7 @@ async function start() {
      return;
    }

-    logBridge(`Player ${formatPlayerConnectionLabel(socket.playerDeviceId, socket.bridgeRemoteAddress)} has disconnected`);
+    logBridge(`Player ${formatPlayerConnectionLabel(socket.playerDeviceId)} has disconnected`);
  }

  function resolveMediaPath(fileName) {
@@ -370,8 +383,8 @@ async function start() {
    return relativePath;
  }

-  function sendPlayerCommand(commandPayload) {
-    const socket = getConnectedPlayerSocket();
+  function sendPlayerCommand(commandPayload, deviceId) {
+    const socket = resolvePlayerSocketForDeviceId(playerSockets, deviceId);
    if (!socket) {
      return Promise.resolve({ ok: false, status: 503, error: 'Player is not connected.' });
    }
@@ -514,15 +527,37 @@ async function start() {
        return res.status(400).json({ error: 'Filename is required' });
      }

+      const deviceId = normalizeDeviceId(req.query.deviceId || req.query.playerIdentifier || req.headers['x-pulse-player-device-id']);
+      if (!deviceId) {
+        return res.status(400).json({ error: 'Device ID is required.' });
+      }
+
+      logBridge('Forwarding media upload to player', {
+        deviceId: deviceId,
+        relativePath: relativePath,
+        contentLength: Buffer.isBuffer(req.body) ? req.body.length : 0
+      });
+
      const bodyBuffer = Buffer.isBuffer(req.body) ? req.body : Buffer.from(req.body || '');
      const response = await sendPlayerCommand({
        command: 'media-put',
        relativePath: relativePath,
        bodyBase64: bodyBuffer.toString('base64')
+      }, deviceId);
+
+      logBridge('Player media upload completed', {
+        deviceId: deviceId,
+        relativePath: relativePath,
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
      });

      res.status(response.status || (response.ok ? 200 : 502)).json(response);
    } catch (error) {
+      logBridge('Player media upload failed', {
+        relativePath: req.params && req.params.filename ? String(req.params.filename).trim() : '',
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -534,13 +569,34 @@ async function start() {
        return res.status(400).json({ error: 'Filename is required' });
      }

+      const deviceId = normalizeDeviceId(req.query.deviceId || req.query.playerIdentifier || req.headers['x-pulse-player-device-id']);
+      if (!deviceId) {
+        return res.status(400).json({ error: 'Device ID is required.' });
+      }
+
+      logBridge('Forwarding media delete to player', {
+        deviceId: deviceId,
+        relativePath: relativePath
+      });
+
      const response = await sendPlayerCommand({
        command: 'media-delete',
        relativePath: relativePath
+      }, deviceId);
+
+      logBridge('Player media delete completed', {
+        deviceId: deviceId,
+        relativePath: relativePath,
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
      });

      res.status(response.status || (response.ok ? 200 : 502)).json(response);
    } catch (error) {
+      logBridge('Player media delete failed', {
+        relativePath: req.params && req.params.filename ? String(req.params.filename).trim() : '',
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -828,7 +884,7 @@ async function start() {
      });

      playerSockets.set(deviceId, socket);
-      logBridge(`Player ${formatPlayerConnectionLabel(deviceId, socket.bridgeRemoteAddress)} has connected`);
+      logBridge(`Player ${formatPlayerConnectionLabel(deviceId)} has connected`);
      socket.send(JSON.stringify({ type: 'registered', ok: true, player: player }));
      return;
    }
@@ -875,14 +931,12 @@ async function start() {
    }

    if (!verifyRequestAuth(request)) {
-      const remoteAddress = normalizeRemoteAddress(request && request.socket && request.socket.remoteAddress);
-      logBridge(remoteAddress ? `Player (ip ${remoteAddress}) denied with wrong shared secret` : 'Player denied with wrong shared secret');
+      logBridge('Player denied with wrong shared secret');
      socket.destroy();
      return;
    }

    playersWs.handleUpgrade(request, socket, head, function (ws) {
-      ws.bridgeRemoteAddress = normalizeRemoteAddress(request && request.socket && request.socket.remoteAddress);
      playersWs.emit('connection', ws, request);
    });
  });
@@ -1057,19 +1111,32 @@ async function start() {

  app.post('/api/internal/sync/player-media', requireRequestAuth, async function (_req, res, next) {
    try {
+      logBridge('Relaying player media sync request to web');
      const webBaseUrl = resolveWebBaseUrl(_req);
      if (!webBaseUrl) {
        return res.status(502).json({ error: 'Web base URL is not configured.' });
      }

+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? Object.assign({}, _req.body)
+        : {};
+
      const response = await fetch(`${webBaseUrl}/api/internal/sync/player-media`, {
        method: 'POST',
        headers: Object.assign({
-          Accept: 'application/json'
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
        }, createRequestAuthHeaders({
          method: 'POST',
-          pathname: '/api/internal/sync/player-media'
-        }))
+          pathname: '/api/internal/sync/player-media',
+          body: requestBody
+        })),
+        body: JSON.stringify(requestBody)
+      });
+
+      logBridge('Web player media sync response received', {
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
      });

      res.status(response.status);
@@ -1079,6 +1146,53 @@ async function start() {
      }
      res.send(await response.text());
    } catch (error) {
+      logBridge('Player media sync relay failed', {
+        error: error && error.message ? error.message : String(error)
+      });
+      next(error);
+    }
+  });
+
+  app.post('/api/internal/sync/player-font', requireRequestAuth, async function (_req, res, next) {
+    try {
+      logBridge('Relaying player font sync request to web');
+      const webBaseUrl = resolveWebBaseUrl(_req);
+      if (!webBaseUrl) {
+        return res.status(502).json({ error: 'Web base URL is not configured.' });
+      }
+
+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? Object.assign({}, _req.body)
+        : {};
+
+      const response = await fetch(`${webBaseUrl}/api/internal/sync/player-font`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, createRequestAuthHeaders({
+          method: 'POST',
+          pathname: '/api/internal/sync/player-font',
+          body: requestBody
+        })),
+        body: JSON.stringify(requestBody)
+      });
+
+      logBridge('Web player font sync response received', {
+        ok: Boolean(response && response.ok),
+        status: response && response.status ? response.status : null
+      });
+
+      res.status(response.status);
+      const contentType = response.headers.get('content-type');
+      if (contentType) {
+        res.type(contentType);
+      }
+      res.send(await response.text());
+    } catch (error) {
+      logBridge('Player font sync relay failed', {
+        error: error && error.message ? error.message : String(error)
+      });
      next(error);
    }
  });
@@ -1094,7 +1208,8 @@ module.exports = {
  start: start,
  resolveWebBaseUrl: resolveWebBaseUrl,
  resolveScreenCommandTargets: resolveScreenCommandTargets,
-  resolveSnapshotUpstreamBaseUrl: resolveSnapshotUpstreamBaseUrl
+  resolveSnapshotUpstreamBaseUrl: resolveSnapshotUpstreamBaseUrl,
+  resolvePlayerSocketForDeviceId: resolvePlayerSocketForDeviceId
 };

 if (require.main === module) {
@@ -22,15 +22,21 @@ async function start() {
  const PORT = Number(process.env.PLAYER_PORT || 8081);
  const PLAYER_PUBLIC_URL = String(process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
  const BRIDGE_PUBLIC_URL = String(process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
+  const WEB_INTERNAL_URL = String(process.env.WEB_INTERNAL_URL || '').trim().replace(/\/$/, '');
  const isRemotePlayer = Boolean(BRIDGE_PUBLIC_URL);
  const PLAYER_INTERNAL_URL = String(isRemotePlayer ? BRIDGE_PUBLIC_URL : (process.env.PLAYER_INTERNAL_URL || PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '')).trim().replace(/\/$/, '');
  const PLAYER_DEVICE_ID = getConfiguredPlayerIdentifier();
+  const PLAYER_AGENT_RECONNECT_DELAY_MS = Number(process.env.PLAYER_AGENT_RECONNECT_DELAY_MS || 5000);
  const ASSET_DIR = path.join(__dirname, 'player', 'public');
  const MEDIA_DIR = path.join(__dirname, '..', 'media');
  const ONBOARDING_QUEUE_FILE = path.join(MEDIA_DIR, 'player-onboarding-queue.json');
  const DB_SYNC_INTERVAL_MS = Number(process.env.PLAYER_DB_SYNC_INTERVAL_MS || 15000);
+  const RECONNECT_SYNC_STALE_MS = 60 * 1000;
  const onboardingStore = createOnboardingStore(ONBOARDING_QUEUE_FILE);
  let thinClientSocket = null;
+  let lastDisconnectAt = 0;
+  let playerPublicBaseUrl = PLAYER_PUBLIC_URL || null;
+  let refreshThinClientRegistration = null;
  const playerRuntime = createPlayerRuntime({
    pool: pool,
    normalizeDeviceId: normalizeDeviceId,
@@ -66,6 +72,35 @@ async function start() {

  let hasLoggedPlayerStartup = false;

+  function normalizePlayerPublicBaseUrl(value) {
+    const normalized = String(value || '').trim().replace(/\/$/, '');
+    if (!normalized) {
+      return null;
+    }
+
+    try {
+      return new URL(normalized).origin.replace(/\/$/, '');
+    } catch (_error) {
+      return normalized;
+    }
+  }
+
+  function setPlayerPublicBaseUrl(value) {
+    const nextBaseUrl = normalizePlayerPublicBaseUrl(value);
+    if (!nextBaseUrl || nextBaseUrl === playerPublicBaseUrl) {
+      return;
+    }
+
+    playerPublicBaseUrl = nextBaseUrl;
+    if (typeof refreshThinClientRegistration === 'function') {
+      refreshThinClientRegistration();
+    }
+  }
+
+  function getPlayerPublicBaseUrl() {
+    return playerPublicBaseUrl;
+  }
+
  function logPlayerStartup(connectionState) {
    if (hasLoggedPlayerStartup) {
      return;
@@ -75,7 +110,7 @@ async function start() {
    console.info('[player] startup', {
      mode: isRemotePlayer ? 'bridge client' : 'local',
      connected: connectionState && typeof connectionState.connected === 'boolean' ? connectionState.connected : false,
-      publicBaseUrl: PLAYER_PUBLIC_URL || null,
+      publicBaseUrl: getPlayerPublicBaseUrl(),
      bridgeBaseUrl: PLAYER_INTERNAL_URL || null,
      bridgeWebSocketUrl: BRIDGE_PUBLIC_URL ? createThinClientWebSocketUrl() : null
    });
@@ -99,28 +134,84 @@ async function start() {
  }

  async function triggerWebMediaSync() {
-    if (!isRemotePlayer || !BRIDGE_PUBLIC_URL) {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
      return false;
    }

+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
    try {
      const authHeaders = createRequestAuthHeaders({
        method: 'POST',
-        pathname: '/api/internal/sync/player-media'
+        pathname: '/api/internal/sync/player-media',
+        body: requestBody
      });
-      const response = await fetch(`${BRIDGE_PUBLIC_URL}/api/internal/sync/player-media`, {
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-media`, {
        method: 'POST',
        headers: Object.assign({
-          Accept: 'application/json'
-        }, authHeaders)
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
      });
+
      return Boolean(response && response.ok);
    } catch (_error) {
+      console.warn('[player] Startup media sync failed');
+      return false;
+    }
+  }
+
+  async function triggerWebFontSync() {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
+      return false;
+    }
+
+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
+    try {
+      const authHeaders = createRequestAuthHeaders({
+        method: 'POST',
+        pathname: '/api/internal/sync/player-font',
+        body: requestBody
+      });
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-font`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
+      });
+
+      return Boolean(response && response.ok);
+    } catch (_error) {
+      console.warn('[player] Startup font sync failed');
      return false;
    }
  }

  let webMediaSyncCompleted = false;
+  let webFontSyncCompleted = false;
+  let webFontSyncTriggered = false;
+
+  function shouldTriggerReconnectSync() {
+    if (!lastDisconnectAt) {
+      return true;
+    }
+
+    return Date.now() - lastDisconnectAt >= RECONNECT_SYNC_STALE_MS;
+  }

  async function handleThinClientCommand(socket, rawMessage) {
    let payload = null;
@@ -161,6 +252,10 @@ async function start() {
        if (!filePath) {
          response.error = 'Invalid media path.';
        } else {
+          console.info('[player] Removing media file', {
+            relativePath: relativePath,
+            filePath: filePath
+          });
          try {
            await fs.promises.unlink(filePath);
          } catch (error) {
@@ -169,6 +264,10 @@ async function start() {
            }
          }
          response.ok = true;
+          console.info('[player] Media file removed', {
+            relativePath: relativePath,
+            filePath: filePath
+          });
        }
      } else if (['refresh', 'reload', 'redirect', 'pause', 'blackout', 'previous', 'next', 'setclientname'].indexOf(command) !== -1) {
        const screenSlug = String(payload.screenSlug || payload.slug || '').trim();
@@ -210,7 +309,7 @@ async function start() {
    common: common,
    playerRuntime: playerRuntime,
    onboardingStore: onboardingStore,
-    playerPublicBaseUrl: PLAYER_PUBLIC_URL,
+    playerPublicBaseUrl: getPlayerPublicBaseUrl(),
    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
    playerDeviceId: PLAYER_DEVICE_ID
@@ -223,10 +322,10 @@ async function start() {
    playerRuntime: playerRuntime,
    playerPlaylistService: playerPlaylistService,
    rtmpStreamService: rtmpStreamService,
-    playerPublicBaseUrl: PLAYER_PUBLIC_URL,
    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
-    playerDeviceId: PLAYER_DEVICE_ID
+    playerDeviceId: PLAYER_DEVICE_ID,
+    onPlayerPublicBaseUrl: setPlayerPublicBaseUrl
  });

  function createThinClientWebSocketUrl() {
@@ -274,6 +373,54 @@ async function start() {
      });
      thinClientSocket = socket;

+      function sendHeartbeat() {
+        if (!socket || socket.readyState !== WebSocket.OPEN) {
+          return;
+        }
+
+        socket.send(JSON.stringify({
+          type: 'heartbeat',
+          deviceId: PLAYER_DEVICE_ID,
+          publicBaseUrl: getPlayerPublicBaseUrl(),
+          internalBaseUrl: PLAYER_INTERNAL_URL
+        }));
+      }
+
+      refreshThinClientRegistration = sendHeartbeat;
+
+      function triggerMediaSyncIfNeeded() {
+        if (webMediaSyncTriggered || webMediaSyncCompleted) {
+          return;
+        }
+
+        webMediaSyncTriggered = true;
+        triggerWebMediaSync().then(function (success) {
+          webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
+          if (!success) {
+            webMediaSyncTriggered = false;
+          }
+        }).catch(function () {
+          webMediaSyncTriggered = false;
+        });
+      }
+
+      function triggerFontSyncIfNeeded() {
+        if (webFontSyncTriggered || webFontSyncCompleted) {
+          return;
+        }
+
+        webFontSyncTriggered = true;
+        triggerWebFontSync().then(function (success) {
+          webFontSyncCompleted = Boolean(success) || webFontSyncCompleted;
+          if (!success) {
+            webFontSyncTriggered = false;
+          }
+        }).catch(function () {
+          webFontSyncTriggered = false;
+          webFontSyncCompleted = false;
+        });
+      }
+
      function sendSnapshot(slug) {
        if (!socket || socket.readyState !== WebSocket.OPEN) {
          return;
@@ -298,7 +445,7 @@ async function start() {
        socket.send(JSON.stringify({
          type: 'register',
          deviceId: PLAYER_DEVICE_ID,
-          publicBaseUrl: PLAYER_PUBLIC_URL,
+          publicBaseUrl: getPlayerPublicBaseUrl(),
          internalBaseUrl: PLAYER_INTERNAL_URL
        }));

@@ -306,38 +453,35 @@ async function start() {
          sendSnapshot(slug);
        });

-        if (!webMediaSyncCompleted) {
-          triggerWebMediaSync().then(function (success) {
-            webMediaSyncTriggered = Boolean(success);
-            webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
-          }).catch(function () {
-            webMediaSyncTriggered = false;
-          });
-        }
-
        heartbeatTimer = setInterval(function () {
-          if (!socket || socket.readyState !== WebSocket.OPEN) {
-            return;
-          }
-          socket.send(JSON.stringify({
-            type: 'heartbeat',
-            deviceId: PLAYER_DEVICE_ID,
-            publicBaseUrl: PLAYER_PUBLIC_URL,
-            internalBaseUrl: PLAYER_INTERNAL_URL
-          }));
-
-          if (!webMediaSyncTriggered && !webMediaSyncCompleted) {
-            triggerWebMediaSync().then(function (success) {
-              webMediaSyncTriggered = Boolean(success);
-              webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
-            }).catch(function () {
-              webMediaSyncTriggered = false;
-            });
-          }
+          sendHeartbeat();
        }, DB_SYNC_INTERVAL_MS);
      });

      socket.on('message', function (rawMessage) {
+        let parsedMessage = null;
+        try {
+          parsedMessage = JSON.parse(String(rawMessage || '{}'));
+        } catch (_error) {
+          parsedMessage = null;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'registered') {
+          console.info('[player] Bridge registration acknowledged', {
+            playerIdentifier: PLAYER_DEVICE_ID
+          });
+          sendHeartbeat();
+          return;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'heartbeat-ack') {
+          if (shouldTriggerReconnectSync()) {
+            triggerMediaSyncIfNeeded();
+            triggerFontSyncIfNeeded();
+          }
+          return;
+        }
+
        handleThinClientCommand(socket, rawMessage).catch(function (error) {
          try {
            socket.send(JSON.stringify({
@@ -353,9 +497,14 @@ async function start() {
      });

      socket.on('close', function () {
+        lastDisconnectAt = Date.now();
+        webFontSyncTriggered = false;
+        webFontSyncCompleted = false;
+        webMediaSyncCompleted = false;
        clearTimers();
        thinClientSocket = null;
-        reconnectTimer = setTimeout(connect, 5000);
+        refreshThinClientRegistration = null;
+        reconnectTimer = setTimeout(connect, PLAYER_AGENT_RECONNECT_DELAY_MS);
      });

      socket.on('error', function () {
@@ -401,7 +550,7 @@ async function start() {
    try {
      await recordPlayerHeartbeat(pool, {
        deviceId: PLAYER_DEVICE_ID,
-        publicBaseUrl: PLAYER_PUBLIC_URL,
+        publicBaseUrl: getPlayerPublicBaseUrl(),
        internalBaseUrl: PLAYER_INTERNAL_URL
      }).catch(function (error) {
        console.error(error);
@@ -430,7 +579,7 @@ async function start() {

  if (PLAYER_DEVICE_ID && !isRemotePlayer) {
    const { upsertPlayerRegistration } = require('./player/onboarding');
-    await upsertPlayerRegistration(pool, PLAYER_DEVICE_ID, PLAYER_PUBLIC_URL, PLAYER_INTERNAL_URL).catch(function (error) {
+    await upsertPlayerRegistration(pool, PLAYER_DEVICE_ID, getPlayerPublicBaseUrl(), PLAYER_INTERNAL_URL).catch(function (error) {
      console.error(error);
    });
  }
@@ -16,15 +16,16 @@ function normalizeDeviceId(value) {
 }

 function getPublicBaseUrl(req, configuredUrl) {
-  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  if (configured) {
-    return configured;
-  }
  const forwardedProto = String(req.headers['x-forwarded-proto'] || '').trim().split(',')[0];
  const protocol = forwardedProto || (req.socket && req.socket.encrypted ? 'https' : 'http');
  const forwardedHost = String(req.headers['x-forwarded-host'] || '').trim().split(',')[0];
  const host = forwardedHost || String(req.headers.host || '').trim();
-  return `${protocol}://${host}`.replace(/\/$/, '');
+  if (host) {
+    return `${protocol}://${host}`.replace(/\/$/, '');
+  }
+
+  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  return configured || null;
 }

 function getRequestIp(req) {
@@ -56,10 +56,8 @@
    loadScreens().then(function () {
      try {
        var storedClientName = getSessionStorageItem(clientNameKey) || "";
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
        var clientNameInput = form.querySelector("input[name=\"clientName\"]");
        if (clientNameInput && storedClientName) { clientNameInput.value = storedClientName; }
-        if (screenSelect && storedScreenSlug) { screenSelect.value = storedScreenSlug; }
      } catch (_error) {}
    });
    form.addEventListener("submit", function (event) {
@@ -132,14 +132,11 @@
    }
    loadScreens().then(function () {
      try {
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
        var storedClientName = getSessionStorageItem(clientNameKey) || "";
-        if (!storedClientName && storedScreenSlug) { storedClientName = getSessionStorageItem(getClientNameStorageKey(storedScreenSlug)) || ""; }
        if (storedClientName && localForm) {
          var clientNameInput = localForm.querySelector("input[name=\"clientName\"]");
          if (clientNameInput) { clientNameInput.value = storedClientName; }
        }
-        if (storedScreenSlug && localScreenSelect) { localScreenSelect.value = storedScreenSlug; }
      } catch (_error) {}
    });
    redirectIfOnboarded(deviceId).then(function (redirected) {
@@ -4,6 +4,7 @@ const fs = require('fs');
 const express = require('express');
 const path = require('path');
 const { getSharedSecret, createPageAuthBundle, verifyPageAuthToken, verifyRequestAuth, createRequestAuthHeaders } = require('#src/request-auth');
+const { getPlayerPublicBaseUrl } = require('./onboarding');
 const { buildThumbnailPreviewData } = require('./thumbnail-preview');

 const TRANSIENT_DB_ERROR_CODES = ['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EPIPE', 'ENOTFOUND', 'PROTOCOL_CONNECTION_LOST', 'POOL_CLOSED', 'ERR_POOL_CLOSED'];
@@ -31,10 +32,10 @@ function registerPlayerRoutes(app, options) {
  const playerRuntime = options && options.playerRuntime ? options.playerRuntime : null;
  const playerPlaylistService = options && options.playerPlaylistService ? options.playerPlaylistService : null;
  const rtmpStreamService = options && options.rtmpStreamService ? options.rtmpStreamService : null;
-  const playerPublicUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
  const playerInternalUrl = String(options && options.playerInternalBaseUrl || process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
  const bridgeBaseUrl = String(options && options.bridgeBaseUrl || process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
  const playerDeviceId = String(options && options.playerDeviceId || '').trim() || null;
+  const onPlayerPublicBaseUrl = typeof options.onPlayerPublicBaseUrl === 'function' ? options.onPlayerPublicBaseUrl : null;

  if (!app || !common || !mediaDir || !assetDir || !playerRuntime || !rtmpStreamService) {
    throw new Error('registerPlayerRoutes requires app, common, mediaDir, assetDir, playerRuntime, and rtmpStreamService.');
@@ -296,6 +297,13 @@ function registerPlayerRoutes(app, options) {
  });

  app.get('/screen/:slug', function (req, res) {
+    if (onPlayerPublicBaseUrl) {
+      try {
+        onPlayerPublicBaseUrl(getPlayerPublicBaseUrl(req, null));
+      } catch (_error) {
+      }
+    }
+
    res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
    res.set('Pragma', 'no-cache');
    if (bridgeBaseUrl) {
@@ -45,6 +45,76 @@ function createPlayerRuntime(options) {
    return ip;
  }

+  function firstHeaderValue(value) {
+    return String(value || '').trim().split(',')[0].trim();
+  }
+
+  function isPrivateOrReservedIp(ip) {
+    const normalized = normalizeClientIp(ip);
+    if (!normalized) {
+      return true;
+    }
+
+    const lower = normalized.toLowerCase();
+    if (lower === 'localhost' || lower === '::1') {
+      return true;
+    }
+
+    if (/^10\./.test(lower) || /^192\.168\./.test(lower) || /^127\./.test(lower) || /^169\.254\./.test(lower)) {
+      return true;
+    }
+
+    if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(lower)) {
+      return true;
+    }
+
+    if (lower.startsWith('fc') || lower.startsWith('fd') || lower.startsWith('fe80:') || lower.startsWith('::ffff:127.')) {
+      return true;
+    }
+
+    return false;
+  }
+
+  function pickForwardedIp(candidates) {
+    const normalizedCandidates = Array.isArray(candidates)
+      ? candidates.map(function (candidate) {
+        return normalizeClientIp(candidate);
+      }).filter(Boolean)
+      : [];
+
+    const publicCandidate = normalizedCandidates.find(function (candidate) {
+      return !isPrivateOrReservedIp(candidate);
+    });
+
+    return publicCandidate || normalizedCandidates[0] || null;
+  }
+
+  function resolveRequestIp(request) {
+    const forwardedFor = String(request && request.headers && request.headers['x-forwarded-for'] || '').split(',');
+    const forwardedForIp = pickForwardedIp(forwardedFor);
+    if (forwardedForIp) {
+      return forwardedForIp;
+    }
+
+    const realIp = pickForwardedIp([firstHeaderValue(request && request.headers && request.headers['x-real-ip'])]);
+    if (realIp) {
+      return realIp;
+    }
+
+    const forwarded = firstHeaderValue(request && request.headers && request.headers.forwarded);
+    if (forwarded) {
+      const forwardedMatches = Array.from(forwarded.matchAll(/(?:^|,\s*|;\s*)for=(?:"?\[?)([^"\];,\s]+)/gi)).map(function (match) {
+        return match[1];
+      });
+      const forwardedIp = pickForwardedIp(forwardedMatches);
+      if (forwardedIp) {
+        return forwardedIp;
+      }
+    }
+
+    return normalizeClientIp(request && request.socket && request.socket.remoteAddress);
+  }
+
  function parseCookies(cookieHeader) {
    return String(cookieHeader || '').split(/;\s*/).reduce(function (cookies, pair) {
      if (!pair) {
@@ -145,7 +215,6 @@ function createPlayerRuntime(options) {
    const clientName = String(connection.clientName || '').trim();
    const clientId = String(connection.clientId || '').trim();
    const userAgent = String(connection.userAgent || '').trim();
-    const clientIp = String(connection.clientIp || '').trim();
    const viewport = connection.viewport && typeof connection.viewport === 'object'
      ? connection.viewport
      : null;
@@ -161,10 +230,6 @@ function createPlayerRuntime(options) {
      labelParts.push(`id ${clientId.slice(-6)}`);
    }

-    if (clientIp) {
-      labelParts.push(clientIp);
-    }
-
    if (viewport && Number.isFinite(Number(viewport.width)) && Number.isFinite(Number(viewport.height))) {
      labelParts.push(`${Number(viewport.width)}x${Number(viewport.height)}`);
    }
@@ -198,8 +263,6 @@ function createPlayerRuntime(options) {
        blackout: Boolean(connection.blackout),
        currentSlideId: connection.currentSlide && connection.currentSlide.id ? connection.currentSlide.id : null,
        currentSlideTitle: connection.currentSlide && connection.currentSlide.title ? connection.currentSlide.title : null,
-        clientIp: connection.clientIp || null,
-        remoteAddress: connection.remoteAddress || null,
        connectedAt: connection.connectedAt ? connection.connectedAt.toISOString() : null,
        lastSeenAt: connection.lastSeenAt ? connection.lastSeenAt.toISOString() : null
      };
@@ -431,9 +494,6 @@ function createPlayerRuntime(options) {
      return;
    }

-    const remoteAddress = request.socket && request.socket.remoteAddress ? request.socket.remoteAddress : null;
-    const forwardedFor = normalizeClientIp(String(request.headers['x-forwarded-for'] || '').split(',')[0]);
-    const normalizedRemoteAddress = normalizeClientIp(remoteAddress);
    const connectionId = crypto.randomUUID();
    const connection = {
      id: connectionId,
@@ -448,9 +508,7 @@ function createPlayerRuntime(options) {
      paused: false,
      blackout: false,
      playerPublicBaseUrl: null,
-      clientIp: forwardedFor || normalizedRemoteAddress,
-      remoteAddress: normalizedRemoteAddress,
-      label: forwardedFor || normalizedRemoteAddress || 'connected client',
+      label: 'connected client',
      connectedAt: new Date(),
      lastSeenAt: new Date()
    };
@@ -491,7 +549,6 @@ function createPlayerRuntime(options) {
      }
      connection.paused = Boolean(payload.paused);
      connection.blackout = Boolean(payload.blackout);
-      connection.clientIp = payload.clientIp ? normalizeClientIp(payload.clientIp) || connection.clientIp : connection.clientIp;
      connection.currentSlide = payload.currentSlide && typeof payload.currentSlide === 'object' ? {
        id: payload.currentSlide.id || null,
        title: payload.currentSlide.title || '',
@@ -194,18 +194,21 @@ const PERMISSION_SECTIONS = [
  }
 ];

-const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section) {
-  return (Array.isArray(section.permissions) ? section.permissions : []).flatMap(function (resource) {
-    return (Array.isArray(resource.permissions) ? resource.permissions : []).map(function (action, index) {
+const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section, sectionIndex) {
+  return (Array.isArray(section.permissions) ? section.permissions : []).flatMap(function (resource, resourceIndex) {
+    return (Array.isArray(resource.permissions) ? resource.permissions : []).map(function (action, actionIndex) {
      return {
        key: `${resource.key}.${action.key}`,
        name: resource.name,
        sectionOrder: section.order,
+        sectionIndex: sectionIndex,
        actionName: action.name,
-        permissionOrder: index + 1,
+        permissionOrder: actionIndex + 1,
+        permissionIndex: actionIndex,
        sectionName: section.sectionName,
        resourceKey: resource.key,
        resourceOrder: resource.order,
+        resourceIndex: resourceIndex,
        resourceName: resource.name,
        actionKey: action.key,
        description: action.description
@@ -52,7 +52,13 @@ function registerStartupTasks(options) {
  }

  async function initialize() {
-    await loadTaskModules(backgroundTaskDirectory, options);
+    const startupTaskFile = path.join(backgroundTaskDirectory, 'data-source-refresh.js');
+    const taskModule = require(startupTaskFile);
+    const exported = getTaskExport(taskModule);
+
+    if (typeof exported === 'function') {
+      await exported(options);
+    }
  }

  return {
@@ -9,6 +9,7 @@ function registerFontSyncTask(options) {
  backgroundTaskQueue.setTaskHandler('font-sync', async function (task) {
    const payload = task && task.payload ? task.payload : task || {};
    const uploadDir = String(payload.uploadDir || '').trim();
+    const playerIdentifier = String(payload.playerIdentifier || payload.deviceId || '').trim();
    const operations = Array.isArray(payload.operations)
      ? payload.operations
      : Array.isArray(payload.uploadPaths)
@@ -28,9 +29,9 @@ function registerFontSyncTask(options) {
        continue;
      }
      if (String(operation.type || '').trim().toLowerCase() === 'delete') {
-        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir);
+        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
      } else {
-        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir);
+        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
      }
    }
  });
@@ -1,16 +1,40 @@
 const { collectFontLibrarySyncOperations } = require('../../media/font-library');
+const { fetchPlayerRegistrations } = require('#src/data/player-registry');

 const TASK = {
  key: 'initial-font-sync',
  category: 'fonts'
 };

+function isRecentPlayerRegistration(player, staleSeconds) {
+  const lastSeenAt = player && player.last_seen_at;
+  const lastSeenAtValue = lastSeenAt instanceof Date ? lastSeenAt.getTime() : new Date(lastSeenAt).getTime();
+  const cutoffTime = Date.now() - Math.max(30, Number(staleSeconds || 60)) * 1000;
+
+  return Number.isFinite(lastSeenAtValue) && lastSeenAtValue >= cutoffTime;
+}
+
+function normalizePlayerMetadata(player) {
+  const playerIdentifier = String(player && player.identifier || '').trim();
+  const playerPublicBaseUrl = String(player && player.public_base_url || '').trim();
+  const playerInternalBaseUrl = String(player && player.internal_base_url || '').trim();
+
+  return {
+    playerIdentifier: playerIdentifier || null,
+    playerPublicBaseUrl: playerPublicBaseUrl || null,
+    playerInternalBaseUrl: playerInternalBaseUrl || null,
+    playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null,
+    playerActive: true
+  };
+}
+
 function registerInitialFontSyncTask(options) {
+  const pool = options && options.pool;
  const backgroundTaskQueue = options && options.backgroundTaskQueue;
  const mediaDir = String(options && options.mediaDir || '').trim();
  const uploadSyncService = options && options.uploadSyncService;

-  if (!backgroundTaskQueue || !mediaDir) {
+  if (!pool || !backgroundTaskQueue || !mediaDir) {
    throw new Error('registerInitialFontSyncTask requires the initial font sync dependencies.');
  }

@@ -18,20 +42,45 @@ function registerInitialFontSyncTask(options) {
    ? uploadSyncService.getPlayerTaskMetadata()
    : Promise.resolve({});

-  return Promise.resolve(metadataPromise).then(function (metadata) {
-    return backgroundTaskQueue.enqueueTask({
-      key: TASK.key,
-      title: 'Initial font sync',
-      category: TASK.category,
-      taskType: 'font-sync',
-      metadata: Object.assign({}, metadata || {}),
-      payload: {
-        mode: 'initial',
-        uploadDir: mediaDir,
-        operations: collectFontLibrarySyncOperations(mediaDir)
-      },
-      persist: true
-    });
+  return Promise.resolve(metadataPromise).then(async function () {
+    let players = [];
+    try {
+      players = await fetchPlayerRegistrations(pool);
+    } catch (error) {
+      console.warn('Unable to fetch player registrations for initial font sync:', error);
+      return null;
+    }
+
+    const livePlayers = Array.isArray(players)
+      ? players.filter(function (player) {
+        return isRecentPlayerRegistration(player, 60);
+      })
+      : [];
+
+    if (!livePlayers.length) {
+      return null;
+    }
+
+    const operations = collectFontLibrarySyncOperations(mediaDir);
+    return Promise.all(livePlayers.map(function (player) {
+      const metadata = normalizePlayerMetadata(player);
+      return backgroundTaskQueue.enqueueTask({
+        key: TASK.key,
+        title: 'Initial font sync',
+        category: TASK.category,
+        taskType: 'font-sync',
+        metadata: metadata,
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          operations: operations,
+          playerIdentifier: metadata.playerIdentifier,
+          playerPublicBaseUrl: metadata.playerPublicBaseUrl,
+          playerInternalBaseUrl: metadata.playerInternalBaseUrl
+        },
+        persist: true
+      });
+    }));
  }).catch(function (error) {
    console.warn('Unable to queue initial font sync:', error);
  });
@@ -3,12 +3,37 @@ const TASK = {
  category: 'media-sync',
 };

+const { fetchPlayerRegistrations } = require('#src/data/player-registry');
+
+function isRecentPlayerRegistration(player, staleSeconds) {
+  const lastSeenAt = player && player.last_seen_at;
+  const lastSeenAtValue = lastSeenAt instanceof Date ? lastSeenAt.getTime() : new Date(lastSeenAt).getTime();
+  const cutoffTime = Date.now() - Math.max(30, Number(staleSeconds || 60)) * 1000;
+
+  return Number.isFinite(lastSeenAtValue) && lastSeenAtValue >= cutoffTime;
+}
+
+function normalizePlayerMetadata(player) {
+  const playerIdentifier = String(player && player.identifier || '').trim();
+  const playerPublicBaseUrl = String(player && player.public_base_url || '').trim();
+  const playerInternalBaseUrl = String(player && player.internal_base_url || '').trim();
+
+  return {
+    playerIdentifier: playerIdentifier || null,
+    playerPublicBaseUrl: playerPublicBaseUrl || null,
+    playerInternalBaseUrl: playerInternalBaseUrl || null,
+    playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null,
+    playerActive: true
+  };
+}
+
 function registerInitialMediaSyncTask(options) {
+  const pool = options && options.pool;
  const backgroundTaskQueue = options && options.backgroundTaskQueue;
  const mediaDir = String(options && options.mediaDir || '').trim();
  const uploadSyncService = options && options.uploadSyncService;

-  if (!backgroundTaskQueue || !mediaDir) {
+  if (!pool || !backgroundTaskQueue || !mediaDir) {
    throw new Error('registerInitialMediaSyncTask requires the initial media sync dependencies.');
  }

@@ -16,19 +41,43 @@ function registerInitialMediaSyncTask(options) {
    ? uploadSyncService.getPlayerTaskMetadata()
    : Promise.resolve({});

-  return Promise.resolve(metadataPromise).then(function (metadata) {
-    return backgroundTaskQueue.enqueueTask({
-      key: TASK.key,
-      title: 'Initial media sync',
-      category: TASK.category,
-      taskType: 'media-sync',
-      metadata: Object.assign({}, metadata || {}),
-      payload: {
-        mode: 'initial',
-        uploadDir: mediaDir
-      },
-      persist: true
-    });
+  return Promise.resolve(metadataPromise).then(async function () {
+    let players = [];
+    try {
+      players = await fetchPlayerRegistrations(pool);
+    } catch (error) {
+      console.warn('Unable to fetch player registrations for initial media sync:', error);
+      return null;
+    }
+
+    const livePlayers = Array.isArray(players)
+      ? players.filter(function (player) {
+        return isRecentPlayerRegistration(player, 60);
+      })
+      : [];
+
+    if (!livePlayers.length) {
+      return null;
+    }
+
+    return Promise.all(livePlayers.map(function (player) {
+      const metadata = normalizePlayerMetadata(player);
+      return backgroundTaskQueue.enqueueTask({
+        key: TASK.key,
+        title: 'Initial media sync',
+        category: TASK.category,
+        taskType: 'media-sync',
+        metadata: metadata,
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          playerIdentifier: metadata.playerIdentifier,
+          playerPublicBaseUrl: metadata.playerPublicBaseUrl,
+          playerInternalBaseUrl: metadata.playerInternalBaseUrl
+        },
+        persist: true
+      });
+    }));
  }).catch(function (error) {
    console.warn('Unable to queue initial media sync:', error);
  });
@@ -36,6 +36,22 @@ function normalizeBaseUrl(value) {
  return String(value || '').trim().replace(/\/$/, '');
 }

+function appendPlayerDeviceIdToUrl(baseUrl, playerIdentifier) {
+  const targetBaseUrl = normalizeBaseUrl(baseUrl);
+  const deviceId = String(playerIdentifier || '').trim();
+  if (!targetBaseUrl || !deviceId) {
+    return targetBaseUrl;
+  }
+
+  try {
+    const url = new URL(targetBaseUrl);
+    url.searchParams.set('deviceId', deviceId);
+    return url.toString().replace(/\/$/, '');
+  } catch (_error) {
+    return targetBaseUrl;
+  }
+}
+
 function normalizePlayerRowBaseUrl(player) {
  return normalizeBaseUrl(player && player.internal_base_url);
 }
@@ -74,8 +90,8 @@ function createUploadSyncService(options) {
    throw new Error('createUploadSyncService requires the upload dependencies.');
  }

-  async function getPlayerInternalBaseUrl() {
-    const metadata = await getPlayerTaskMetadata();
+  async function getPlayerInternalBaseUrl(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl) {
+    const metadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl);
    if (!metadata || metadata.playerActive === false) {
      return null;
    }
@@ -83,11 +99,44 @@ function createUploadSyncService(options) {
    return metadata.playerInternalBaseUrl ? metadata.playerInternalBaseUrl : null;
  }

-  async function getPlayerTaskMetadata() {
-    if (playerTaskMetadata) {
+  async function getPlayerTaskMetadata(preferredPlayerIdentifier, preferredPlayerInternalBaseUrl) {
+    const normalizedPreferredPlayerIdentifier = String(preferredPlayerIdentifier || '').trim();
+    const normalizedPreferredPlayerInternalBaseUrl = String(preferredPlayerInternalBaseUrl || '').trim().replace(/\/$/, '');
+
+    if (normalizedPreferredPlayerIdentifier && pool && typeof fetchPlayerRegistrations === 'function') {
+      try {
+        const players = await fetchPlayerRegistrations(pool);
+        const registeredPlayers = Array.isArray(players) ? players : [];
+        const exactPlayer = registeredPlayers.find(function (player) {
+          return String(player && player.identifier || '').trim() === normalizedPreferredPlayerIdentifier;
+        }) || null;
+        if (exactPlayer) {
+          const resolvedInternalBaseUrl = normalizePlayerRowBaseUrl(exactPlayer) || normalizedPreferredPlayerInternalBaseUrl || null;
+          const resolvedPublicBaseUrl = normalizeBaseUrl(exactPlayer && exactPlayer.public_base_url);
+          const resolvedIdentifier = String(exactPlayer && exactPlayer.identifier || '').trim();
+          playerInternalBaseUrl = resolvedInternalBaseUrl || null;
+          playerTaskMetadata = {
+            playerIdentifier: resolvedIdentifier || normalizedPreferredPlayerIdentifier || null,
+            playerPublicBaseUrl: resolvedPublicBaseUrl || null,
+            playerInternalBaseUrl: resolvedInternalBaseUrl || null,
+            playerLabel: resolvedIdentifier || resolvedPublicBaseUrl || resolvedInternalBaseUrl || null,
+            playerActive: true
+          };
+          return playerTaskMetadata;
+        }
+      } catch (_error) {
+      }
+    }
+
+    if (playerTaskMetadata && playerTaskMetadata.playerActive !== false) {
      return playerTaskMetadata;
    }

+    if (playerTaskMetadata && playerTaskMetadata.playerActive === false) {
+      playerTaskMetadata = null;
+      playerInternalBaseUrl = null;
+    }
+
    if (playerTaskMetadataPromise) {
      return playerTaskMetadataPromise;
    }
@@ -421,7 +470,8 @@ function createUploadSyncService(options) {
    pendingPlayerUploadSyncs.set(normalizeUploadReference(operation.uploadPath), {
      type: operation.type === 'delete' ? 'delete' : 'put',
      uploadPath: normalizeUploadReference(operation.uploadPath),
-      uploadDir: operation.uploadDir || null
+      uploadDir: operation.uploadDir || null,
+      metadata: operation.metadata || null
    });

    schedulePendingPlayerUploadSyncFlush();
@@ -443,7 +493,7 @@ function createUploadSyncService(options) {
    }
  }

-  async function pushUploadFileToPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl) {
+  async function pushUploadFileToPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl, preferredPlayerIdentifier) {
    if (!uploadPath || !shouldMirrorUploads(localUploadDir)) {
      return false;
    }
@@ -453,6 +503,7 @@ function createUploadSyncService(options) {
      return false;
    }

+    const playerMetadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, targetBaseUrl);
    const relativePath = getUploadRelativePath(uploadPath);
    const sourcePath = resolveUploadFilePath(localUploadDir, uploadPath);
    if (!relativePath || !sourcePath) {
@@ -474,7 +525,8 @@ function createUploadSyncService(options) {
        pathname: `/api/media/${encodeURIComponent(relativePath)}`,
        body: fileBuffer
      });
-      const response = await fetch(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, {
+      const mediaUploadUrl = appendPlayerDeviceIdToUrl(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, playerMetadata && playerMetadata.playerIdentifier);
+      const response = await fetch(mediaUploadUrl, {
        method: 'PUT',
        headers: {
          'Content-Type': 'application/octet-stream',
@@ -497,7 +549,7 @@ function createUploadSyncService(options) {
    }
  }

-  async function removeUploadFileFromPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl) {
+  async function removeUploadFileFromPlayer(uploadPath, localUploadDir, resolvedPlayerInternalBaseUrl, preferredPlayerIdentifier) {
    if (!uploadPath || !shouldMirrorUploads(localUploadDir)) {
      return false;
    }
@@ -507,6 +559,7 @@ function createUploadSyncService(options) {
      return false;
    }

+    const playerMetadata = await getPlayerTaskMetadata(preferredPlayerIdentifier, targetBaseUrl);
    const relativePath = getUploadRelativePath(uploadPath);
    if (!relativePath) {
      return false;
@@ -516,7 +569,8 @@ function createUploadSyncService(options) {
        method: 'DELETE',
        pathname: `/api/media/${encodeURIComponent(relativePath)}`
      });
-      const response = await fetch(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, {
+      const mediaDeleteUrl = appendPlayerDeviceIdToUrl(`${targetBaseUrl}/api/media/${encodeURIComponent(relativePath)}`, playerMetadata && playerMetadata.playerIdentifier);
+      const response = await fetch(mediaDeleteUrl, {
        method: 'DELETE',
        headers: {
          Accept: 'application/json',
@@ -744,16 +798,16 @@ function createUploadSyncService(options) {
      }
      const resolvedPlayerInternalBaseUrl = playerMetadata && playerMetadata.playerInternalBaseUrl
        ? playerMetadata.playerInternalBaseUrl
-        : await getPlayerInternalBaseUrl();
+        : await getPlayerInternalBaseUrl(playerMetadata && playerMetadata.playerIdentifier, playerMetadata && playerMetadata.playerInternalBaseUrl);
      let successCount = 0;
      let failureCount = 0;
      for (let i = 0; i < pendingEntries.length; i += 1) {
        const operation = pendingEntries[i];
        let success = false;
        if (operation.type === 'delete') {
-          success = await removeUploadFileFromPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl);
+          success = await removeUploadFileFromPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl, playerMetadata && playerMetadata.playerIdentifier);
        } else {
-          success = await pushUploadFileToPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl);
+          success = await pushUploadFileToPlayer(operation.uploadPath, operation.uploadDir, resolvedPlayerInternalBaseUrl, playerMetadata && playerMetadata.playerIdentifier);
        }
        if (success) {
          successCount += 1;
@@ -795,6 +849,8 @@ function createUploadSyncService(options) {
        return;
      }

+      const playerMetadata = await getPlayerTaskMetadata(taskPayload.playerIdentifier, taskPayload.playerInternalBaseUrl);
+
      const data = await common.fetchAdminData(pool);
      const uploadRefs = new Set();
      (data.slides || []).forEach(function (slide) {
@@ -812,7 +868,8 @@ function createUploadSyncService(options) {
        queuePlayerUploadSync({
          type: 'put',
          uploadPath: uploadPath,
-          uploadDir: uploadDir
+          uploadDir: uploadDir,
+          metadata: playerMetadata
        });
      });
      fontLibraryOperations.forEach(function (operation) {
@@ -823,7 +880,8 @@ function createUploadSyncService(options) {
        queuePlayerUploadSync({
          type: String(operation.type || 'put').trim().toLowerCase() === 'delete' ? 'delete' : 'put',
          uploadPath: operation.uploadPath,
-          uploadDir: uploadDir
+          uploadDir: uploadDir,
+          metadata: playerMetadata
        });
      });
      await flushPendingPlayerUploadSyncs();
@@ -870,7 +928,7 @@ function createUploadSyncService(options) {
      safePayload.operation = Object.assign({}, safePayload.operation);
      delete safePayload.operation.pool;
    }
-    const playerMetadata = await getPlayerTaskMetadata();
+    const playerMetadata = await getPlayerTaskMetadata(safePayload.playerIdentifier, safePayload.playerInternalBaseUrl);

    const definition = {
      key: taskKey,
@@ -29,7 +29,7 @@ module.exports = function registerMiddleware(app, deps) {
  });

  app.use(function (req, res, next) {
-    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media') {
+    if (req.path === '/' || req.path === '/login' || req.path === '/logout' || req.path.indexOf('/api/internal/slide-thumbnails/') === 0 || req.path === '/api/internal/sync/player-media' || req.path === '/api/internal/sync/player-font') {
      return next();
    }

@@ -245,8 +245,6 @@
        client && client.slug,
        client && client.screen_slug,
        client && client.screen_name,
-        client && client.ipAddress,
-        client && client.clientIp,
        client && client.status,
        client && client.currentSlideTitle
      ];
@@ -264,7 +262,6 @@
      client: function (client) { return String(client && (getClientDisplayName(client) || client.client_name || client.name || client.clientId) || '').trim(); },
      screen: function (client) { return String(client && (client.screen_name || client.screen_slug) || '').trim(); },
      slide: function (client) { return String(client && client.currentSlideTitle || '').trim(); },
-      ip: function (client) { return String(client && client.clientIp || '').trim(); },
      viewport: function (client) {
        var viewport = client && client.viewport;
        if (!viewport || !viewport.width || !viewport.height) {
@@ -283,12 +280,6 @@
      ? [normalizedSortKey]
      : ['client'];

-    if (sortKeys[0] === 'client') {
-      sortKeys.push('ip');
-    } else if (sortKeys[0] === 'ip') {
-      sortKeys.push('client');
-    }
-
    return (Array.isArray(clients) ? clients.slice() : []).sort(function (leftClient, rightClient) {
      for (var index = 0; index < sortKeys.length; index += 1) {
        var sortKeyName = sortKeys[index];
@@ -539,13 +530,13 @@
    }

    if (!hasActionsColumn) {
-      if (row.cells.length > 6) {
+      if (row.cells.length > 5) {
        row.deleteCell(row.cells.length - 1);
      }
      return;
    }

-    var actionCell = row.cells.length > 6 ? row.cells[6] : null;
+    var actionCell = row.cells.length > 5 ? row.cells[5] : null;
    if (!actionCell) {
      actionCell = row.insertCell(-1);
      actionCell.setAttribute('data-label', 'Actions');
@@ -557,8 +548,6 @@

  function renderClientRow(client, hasActionsColumn) {
    var connectedAt = client.connectedAt ? '<div>' + escapeHtml(client.connectedAtLabel || formatDashboardDate(client.connectedAt) || client.connectedAt) + '</div>' + (client.lastSeenAt ? '<div class="subtle connected-updated-secondary">' + escapeHtml(client.lastSeenAtLabel || formatDashboardDate(client.lastSeenAt) || client.lastSeenAt) + '</div>' : '') : '<span class="empty">Unknown</span>';
-    var clientIpValue = normalizeDisplayIp(client.clientIp);
-    var clientIp = clientIpValue ? escapeHtml(clientIpValue) : '<span class="empty">Unknown</span>';
    var viewport = client.viewport && client.viewport.width && client.viewport.height ? escapeHtml(client.viewport.width + 'x' + client.viewport.height) : '<span class="empty">Unknown</span>';
    var clientNameValue = getClientDisplayName(client);
    var clientName = clientNameValue ? escapeHtml(clientNameValue) : '<span class="empty">Unknown</span>';
@@ -571,7 +560,6 @@
      '<td data-label="Client"><div>' + clientName + '</div></td>',
      '<td data-label="Current Screen"><div>' + screenName + '</div></td>',
      '<td data-label="Current Slide">' + currentSlide + '</td>',
-      '<td data-label="IP">' + clientIp + '</td>',
      '<td data-label="Viewport">' + viewport + '</td>',
      '<td data-label="Connected/Updated">' + connectedAt + '</td>',
      actionCell,
@@ -580,13 +568,11 @@
  }

  function updateClientRowCells(row, client, hasActionsColumn) {
-    if (!row || !row.cells || row.cells.length < 6) {
+    if (!row || !row.cells || row.cells.length < 5) {
      return;
    }

    var connectedAt = client.connectedAt ? '<div>' + escapeHtml(client.connectedAtLabel || formatDashboardDate(client.connectedAt) || client.connectedAt) + '</div>' + (client.lastSeenAt ? '<div class="subtle connected-updated-secondary">' + escapeHtml(client.lastSeenAtLabel || formatDashboardDate(client.lastSeenAt) || client.lastSeenAt) + '</div>' : '') : '<span class="empty">Unknown</span>';
-    var clientIpValue = normalizeDisplayIp(client.clientIp);
-    var clientIp = clientIpValue ? escapeHtml(clientIpValue) : '<span class="empty">Unknown</span>';
    var viewport = client.viewport && client.viewport.width && client.viewport.height ? escapeHtml(client.viewport.width + 'x' + client.viewport.height) : '<span class="empty">Unknown</span>';
    var clientNameValue = getClientDisplayName(client);
    var clientName = clientNameValue ? escapeHtml(clientNameValue) : '<span class="empty">Unknown</span>';
@@ -603,9 +589,8 @@
    setCellHtml(row.cells[0], '<div>' + clientName + '</div>');
    setCellHtml(row.cells[1], '<div>' + screenName + '</div>');
    setCellHtml(row.cells[2], currentSlide);
-    setCellHtml(row.cells[3], clientIp);
-    setCellHtml(row.cells[4], viewport);
-    setCellHtml(row.cells[5], connectedAt);
+    setCellHtml(row.cells[3], viewport);
+    setCellHtml(row.cells[4], connectedAt);

    syncClientActionCell(row, client, hasActionsColumn);
  }
@@ -19,6 +19,11 @@

 	const LIST_PAGE_SIZE = 25;

+	function toSortIndex(value) {
+		const number = Number(value);
+		return Number.isFinite(number) ? number : 999;
+	}
+
 	function slugifyRoleKey(name) {
 		const value = String(name || '').trim().toLowerCase();
 		const slug = value.replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, ROLE_KEY_MAX_LENGTH);
@@ -73,8 +78,11 @@
 				resourceKey: definition ? definition.resourceKey : String(permission.section_name || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-'),
 				resourceName: definition ? definition.resourceName : permission.section_name,
 				categoryName: definition ? definition.sectionName : permission.section_name,
+				sectionIndex: definition ? toSortIndex(definition.sectionIndex) : 999,
 				sectionOrder: definition ? definition.sectionOrder : 999,
+				resourceIndex: definition ? toSortIndex(definition.resourceIndex) : 999,
 				resourceOrder: definition ? Number(definition.resourceOrder) || 999 : 999,
+				permissionIndex: definition ? toSortIndex(definition.permissionIndex) : 999,
 				permissionOrder: definition ? Number(definition.permissionOrder) || 999 : 999,
 				actionKey: definition ? definition.actionKey : 'read',
 				actionLabel: definition ? definition.actionName : getActionLabel(permission.actionKey),
@@ -103,7 +111,9 @@
 					id: sectionKey || 'permissions',
 					title: String(permission.resourceName || permission.categoryName || 'Permissions').trim(),
 					categoryName: String(permission.categoryName || '').trim(),
+					sectionIndex: toSortIndex(permission.sectionIndex),
 					sectionOrder: Number(permission.sectionOrder) || 999,
+					resourceIndex: toSortIndex(permission.resourceIndex),
 					permissions: []
 				};
 				groupIndex.set(sectionKey, group);
@@ -114,8 +124,13 @@

 		groups.forEach(function (group) {
 			group.permissions.sort(function (left, right) {
-				const leftOrder = Number(left.permissionOrder) || 999;
-				const rightOrder = Number(right.permissionOrder) || 999;
+				const leftIndex = toSortIndex(left.permissionIndex);
+				const rightIndex = toSortIndex(right.permissionIndex);
+				if (leftIndex !== rightIndex) {
+					return leftIndex - rightIndex;
+				}
+				const leftOrder = toSortIndex(left.permissionOrder);
+				const rightOrder = toSortIndex(right.permissionOrder);
 				if (leftOrder !== rightOrder) {
 					return leftOrder - rightOrder;
 				}
@@ -124,8 +139,13 @@
 		});

 		groups.sort(function (left, right) {
-			const leftOrder = Number(left.sectionOrder) || 999;
-			const rightOrder = Number(right.sectionOrder) || 999;
+			const leftIndex = toSortIndex(left.sectionIndex);
+			const rightIndex = toSortIndex(right.sectionIndex);
+			if (leftIndex !== rightIndex) {
+				return leftIndex - rightIndex;
+			}
+			const leftOrder = toSortIndex(left.sectionOrder);
+			const rightOrder = toSortIndex(right.sectionOrder);
 			if (leftOrder !== rightOrder) {
 				return leftOrder - rightOrder;
 			}
@@ -1,6 +1,7 @@
 // Internal sync trigger routes for player-driven queue flushes.

 const { verifyRequestAuth } = require('#src/request-auth');
+const { collectFontLibrarySyncOperations } = require('#src/web/lib/media/font-library');

 function requireRequestAuth(req, res, next) {
  if (!verifyRequestAuth(req)) {
@@ -11,21 +12,77 @@ function requireRequestAuth(req, res, next) {
 }

 module.exports = function registerInternalSyncRoutes(app, deps) {
+  const backgroundTaskQueue = deps && deps.backgroundTaskQueue;
  const uploadSyncService = deps && deps.uploadSyncService;
  const mediaDir = String(deps && deps.mediaDir || '').trim();

-  if (!uploadSyncService || typeof uploadSyncService.flushPendingPlayerUploadSyncs !== 'function' || typeof uploadSyncService.runMediaSyncTask !== 'function' || !mediaDir) {
+  if (!backgroundTaskQueue || typeof backgroundTaskQueue.enqueueTask !== 'function' || !uploadSyncService || !mediaDir) {
    throw new Error('registerInternalSyncRoutes requires the sync dependencies.');
  }

  app.post('/api/internal/sync/player-media', requireRequestAuth, async function (_req, res, next) {
    try {
-      await uploadSyncService.runMediaSyncTask({
-        mode: 'initial',
-        uploadDir: mediaDir
+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? _req.body
+        : {};
+      const playerIdentifier = String(requestBody.playerIdentifier || requestBody.deviceId || '').trim();
+      const playerPublicBaseUrl = String(requestBody.playerPublicBaseUrl || '').trim();
+      const playerInternalBaseUrl = String(requestBody.playerInternalBaseUrl || '').trim();
+      const task = await backgroundTaskQueue.enqueueTask({
+        key: 'player-media-sync',
+        title: 'Player media sync',
+        category: 'media-sync',
+        taskType: 'media-sync',
+        metadata: {
+          playerIdentifier: playerIdentifier || null,
+          playerPublicBaseUrl: playerPublicBaseUrl || null,
+          playerInternalBaseUrl: playerInternalBaseUrl || null,
+          playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null
+        },
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          playerIdentifier: playerIdentifier,
+          playerPublicBaseUrl: playerPublicBaseUrl,
+          playerInternalBaseUrl: playerInternalBaseUrl
+        }
      });
-      await uploadSyncService.flushPendingPlayerUploadSyncs();
-      res.json({ ok: true });
+      res.status(202).json({ ok: true, queued: true, task: task });
+    } catch (error) {
+      next(error);
+    }
+  });
+
+  app.post('/api/internal/sync/player-font', requireRequestAuth, async function (_req, res, next) {
+    try {
+      const requestBody = _req.body && typeof _req.body === 'object' && !Array.isArray(_req.body)
+        ? _req.body
+        : {};
+      const playerIdentifier = String(requestBody.playerIdentifier || requestBody.deviceId || '').trim();
+      const playerPublicBaseUrl = String(requestBody.playerPublicBaseUrl || '').trim();
+      const playerInternalBaseUrl = String(requestBody.playerInternalBaseUrl || '').trim();
+      const operations = collectFontLibrarySyncOperations(mediaDir);
+      const task = await backgroundTaskQueue.enqueueTask({
+        key: 'player-font-sync',
+        title: 'Player font sync',
+        category: 'fonts',
+        taskType: 'font-sync',
+        metadata: {
+          playerIdentifier: playerIdentifier || null,
+          playerPublicBaseUrl: playerPublicBaseUrl || null,
+          playerInternalBaseUrl: playerInternalBaseUrl || null,
+          playerLabel: playerIdentifier || playerPublicBaseUrl || playerInternalBaseUrl || null
+        },
+        payload: {
+          mode: 'initial',
+          uploadDir: mediaDir,
+          operations: operations,
+          playerIdentifier: playerIdentifier,
+          playerPublicBaseUrl: playerPublicBaseUrl,
+          playerInternalBaseUrl: playerInternalBaseUrl
+        }
+      });
+      res.status(202).json({ ok: true, queued: true, task: task });
    } catch (error) {
      next(error);
    }
@@ -25,6 +25,7 @@ function registerRoutes(app, deps) {
  registerSignageRoutes(app, deps);
  registerSettingsAndContentRoutes(app, deps);
  registerInternalSyncRoutes(app, {
+    backgroundTaskQueue: deps.backgroundTaskQueue,
    uploadSyncService: deps.uploadSyncService,
    mediaDir: deps.mediaDir
  });
@@ -4,6 +4,11 @@ function normalizeSectionId(value) {
  return String(value || '').trim().toLowerCase().replace(/[^a-z0-9]+/g, '-');
 }

+function toSortIndex(value) {
+  const number = Number(value);
+  return Number.isFinite(number) ? number : 999;
+}
+
 function buildPermissionSections(permissionGroups) {
  const sections = [];
  const sectionIndex = new Map();
@@ -23,7 +28,8 @@ function buildPermissionSections(permissionGroups) {
      sectionIndex.set(sectionKey, {
        id: sectionKey,
        title: sectionTitle,
-        sectionOrder: Number(group && group.sectionOrder) || 999,
+        sourceIndex: toSortIndex(group && group.sectionIndex),
+        sectionOrder: toSortIndex(group && group.sectionOrder),
        groups: []
      });
      sections.push(sectionIndex.get(sectionKey));
@@ -47,8 +53,14 @@ function buildPermissionSections(permissionGroups) {
    });

    section.groups.sort(function (left, right) {
-      const leftOrder = Number(left.resourceOrder) || 999;
-      const rightOrder = Number(right.resourceOrder) || 999;
+      const leftIndex = toSortIndex(left.resourceIndex);
+      const rightIndex = toSortIndex(right.resourceIndex);
+      if (leftIndex !== rightIndex) {
+        return leftIndex - rightIndex;
+      }
+
+      const leftOrder = toSortIndex(left.resourceOrder);
+      const rightOrder = toSortIndex(right.resourceOrder);
      if (leftOrder !== rightOrder) {
        return leftOrder - rightOrder;
      }
@@ -65,8 +77,14 @@ function buildPermissionSections(permissionGroups) {
  });

  sections.sort(function (left, right) {
-    const leftOrder = Number(left.sectionOrder) || 999;
-    const rightOrder = Number(right.sectionOrder) || 999;
+    const leftIndex = toSortIndex(left.sourceIndex);
+    const rightIndex = toSortIndex(right.sourceIndex);
+    if (leftIndex !== rightIndex) {
+      return leftIndex - rightIndex;
+    }
+
+    const leftOrder = toSortIndex(left.sectionOrder);
+    const rightOrder = toSortIndex(right.sectionOrder);
    if (leftOrder !== rightOrder) {
      return leftOrder - rightOrder;
    }
@@ -134,5 +152,6 @@ function buildRbacEditViewModel(role, message, currentUser, permissionGroups, us

 module.exports = {
  buildRbacAddViewModel: buildRbacAddViewModel,
-  buildRbacEditViewModel: buildRbacEditViewModel
+  buildRbacEditViewModel: buildRbacEditViewModel,
+  buildPermissionSections: buildPermissionSections
 };
@@ -18,7 +18,6 @@ module.exports = function registerClientsRoutes(app, deps) {
      client: function (client) { return String(client && (client.client_name || client.name || client.clientId) || '').trim(); },
      screen: function (client) { return String(client && (client.screen_name || client.screen_slug) || '').trim(); },
      slide: function (client) { return String(client && client.currentSlideTitle || '').trim(); },
-      ip: function (client) { return String(client && client.clientIp || '').trim(); },
      viewport: function (client) {
        const viewport = client && client.viewport;
        if (!viewport || !viewport.width || !viewport.height) {
@@ -37,12 +36,6 @@ module.exports = function registerClientsRoutes(app, deps) {
      ? [normalizedSortKey]
      : ['client'];

-    if (sortKeys[0] === 'client') {
-      sortKeys.push('ip');
-    } else if (sortKeys[0] === 'ip') {
-      sortKeys.push('client');
-    }
-
    return (Array.isArray(clients) ? clients.slice() : []).sort(function (leftClient, rightClient) {
      for (let index = 0; index < sortKeys.length; index += 1) {
        const sortKeyName = sortKeys[index];
@@ -71,7 +64,6 @@ module.exports = function registerClientsRoutes(app, deps) {
        'deviceId',
        'slug',
        'screen_slug',
-        'ipAddress',
        'status'
      ]);
      const filteredClients = (data.clients || []).filter(matchesSearch);
@@ -6,6 +6,7 @@
 </div>

 <form id="{{formId}}" method="post" action="{{formAction}}" {{{formAttrs}}}>
+  <input type="hidden" name="permissions_present" value="1" />
  <input type="hidden" name="users_present" value="1" />

  <div class="row g-3">
@@ -94,7 +95,7 @@
                      <span class="fw-semibold">{{title}}</span>
                    </button>
                  </h2>
-                  <div id="permission-section-collapse-{{id}}" class="accordion-collapse collapse {{#if @first}}show{{/if}}" aria-labelledby="permission-section-heading-{{id}}" data-bs-parent="#role-permissions-accordion">
+                  <div id="permission-section-collapse-{{id}}" class="accordion-collapse collapse {{#if @first}}show{{/if}}" aria-labelledby="permission-section-heading-{{id}}">
                    <div class="accordion-body p-0">
                      <div class="table-responsive">
                              <table class="table table-striped align-middle mb-0 rbac-permissions-table" style="table-layout: fixed; width: 100%;">
@@ -88,7 +88,6 @@
          <th data-table-sort-key="client">Client</th>
          <th data-table-sort-key="screen">Current Screen Group</th>
          <th data-table-sort-key="slide">Current Slide</th>
-          <th data-table-sort-key="ip">IP</th>
          <th data-table-sort-key="viewport">Viewport</th>
          <th data-table-sort-key="connected">Connected/Updated</th>
          {{#if (hasPermission currentUser 'clients.allow')}}<th>Actions</th>{{/if}}
@@ -111,7 +110,6 @@
                  <span class="empty">No slide currently showing</span>
                {{/if}}
              </td>
-              <td data-label="IP">{{#if clientIp}}{{clientIp}}{{else}}<span class="empty">Unknown</span>{{/if}}</td>
              <td data-label="Viewport">
                {{#if viewport}}
                  {{viewport.width}}x{{viewport.height}}
@@ -169,7 +167,7 @@
            </tr>
          {{/each}}
        {{else}}
-          <tr data-table-search-empty-default><td colspan="{{#if (hasPermission currentUser 'clients.allow')}}7{{else}}6{{/if}}" class="empty">No connected clients yet.</td></tr>
+          <tr data-table-search-empty-default><td colspan="{{#if (hasPermission currentUser 'clients.allow')}}6{{else}}5{{/if}}" class="empty">No connected clients yet.</td></tr>
        {{/if}}
      </tbody>
    </table>
@@ -0,0 +1,62 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+require('../src/common');
+
+const { registerInitialFontSyncTask } = require('../src/web/lib/background-tasks/tasks-startup/font-sync');
+
+test('initial font sync queues a separate task for each live player', async () => {
+  const queuedTasks = [];
+  const liveLastSeenAt = new Date(Date.now() - 10_000).toISOString();
+  const staleLastSeenAt = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+
+  await registerInitialFontSyncTask({
+    pool: {
+      async query() {
+        return [[
+          {
+            identifier: 'player-one',
+            public_base_url: 'https://player-one.example',
+            internal_base_url: 'http://player-one:8081',
+            last_seen_at: liveLastSeenAt
+          },
+          {
+            identifier: 'player-two',
+            public_base_url: 'https://player-two.example',
+            internal_base_url: 'http://player-two:8081',
+            last_seen_at: liveLastSeenAt
+          },
+          {
+            identifier: 'player-stale',
+            public_base_url: 'https://player-stale.example',
+            internal_base_url: 'http://player-stale:8081',
+            last_seen_at: staleLastSeenAt
+          }
+        ]];
+      }
+    },
+    backgroundTaskQueue: {
+      async enqueueTask(definition) {
+        queuedTasks.push(definition);
+        return definition;
+      }
+    },
+    mediaDir: 'e:/Projects Git/pulse-signage/media',
+    uploadSyncService: {
+      async getPlayerTaskMetadata() {
+        return {};
+      }
+    }
+  });
+
+  assert.equal(queuedTasks.length, 2);
+  assert.deepEqual(queuedTasks.map(function (task) {
+    return task.metadata.playerIdentifier;
+  }).sort(), ['player-one', 'player-two']);
+  assert.deepEqual(queuedTasks.map(function (task) {
+    return task.payload.playerIdentifier;
+  }).sort(), ['player-one', 'player-two']);
+  assert.ok(queuedTasks.every(function (task) {
+    return task.key === 'initial-font-sync' && task.title === 'Initial font sync' && task.taskType === 'font-sync';
+  }));
+});
@@ -0,0 +1,62 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+require('../src/common');
+
+const { registerInitialMediaSyncTask } = require('../src/web/lib/background-tasks/tasks-startup/media-sync');
+
+test('initial media sync queues a separate task for each live player', async () => {
+  const queuedTasks = [];
+  const liveLastSeenAt = new Date(Date.now() - 10_000).toISOString();
+  const staleLastSeenAt = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+
+  await registerInitialMediaSyncTask({
+    pool: {
+      async query() {
+        return [[
+          {
+            identifier: 'player-one',
+            public_base_url: 'https://player-one.example',
+            internal_base_url: 'http://player-one:8081',
+            last_seen_at: liveLastSeenAt
+          },
+          {
+            identifier: 'player-two',
+            public_base_url: 'https://player-two.example',
+            internal_base_url: 'http://player-two:8081',
+            last_seen_at: liveLastSeenAt
+          },
+          {
+            identifier: 'player-stale',
+            public_base_url: 'https://player-stale.example',
+            internal_base_url: 'http://player-stale:8081',
+            last_seen_at: staleLastSeenAt
+          }
+        ]];
+      }
+    },
+    backgroundTaskQueue: {
+      async enqueueTask(definition) {
+        queuedTasks.push(definition);
+        return definition;
+      }
+    },
+    mediaDir: 'e:/Projects Git/pulse-signage/media',
+    uploadSyncService: {
+      async getPlayerTaskMetadata() {
+        return {};
+      }
+    }
+  });
+
+  assert.equal(queuedTasks.length, 2);
+  assert.deepEqual(queuedTasks.map(function (task) {
+    return task.metadata.playerIdentifier;
+  }).sort(), ['player-one', 'player-two']);
+  assert.deepEqual(queuedTasks.map(function (task) {
+    return task.payload.playerIdentifier;
+  }).sort(), ['player-one', 'player-two']);
+  assert.ok(queuedTasks.every(function (task) {
+    return task.key === 'initial-media-sync' && task.title === 'Initial media sync' && task.taskType === 'media-sync';
+  }));
+});
@@ -0,0 +1,158 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const express = require('express');
+
+require('../src/common');
+
+const { createRequestAuthHeaders } = require('../src/request-auth');
+const registerInternalSyncRoutes = require('../src/web/routes/internal/sync');
+
+test('player media sync requests are queued as background tasks', async () => {
+  const originalSecret = process.env.PULSE_SIGNAGE_SHARED_SECRET;
+  process.env.PULSE_SIGNAGE_SHARED_SECRET = 'test-shared-secret';
+
+  const queuedTasks = [];
+  const app = express();
+  app.use(express.json());
+
+  registerInternalSyncRoutes(app, {
+    backgroundTaskQueue: {
+      async enqueueTask(definition) {
+        queuedTasks.push(definition);
+        return {
+          id: 42,
+          key: definition.key,
+          taskType: definition.taskType,
+          title: definition.title,
+          category: definition.category,
+          status: 'queued',
+          createdAt: new Date().toISOString(),
+          startedAt: '',
+          finishedAt: '',
+          errorMessage: '',
+          attempts: 0,
+          metadata: definition.metadata,
+          payload: definition.payload
+        };
+      }
+    },
+    uploadSyncService: {},
+    mediaDir: 'e:/Projects Git/pulse-signage/media'
+  });
+
+  app.use(function (error, _req, res, _next) {
+    res.status(error.statusCode || 500).json({ error: String(error && error.message ? error.message : error) });
+  });
+
+  const server = app.listen(0);
+
+  try {
+    const address = server.address();
+    const body = {
+      deviceId: 'player-remote',
+      playerPublicBaseUrl: 'https://player.example.test',
+      playerInternalBaseUrl: 'http://player-bridge:8090'
+    };
+    const headers = Object.assign({
+      'content-type': 'application/json'
+    }, createRequestAuthHeaders({
+      method: 'POST',
+      pathname: '/api/internal/sync/player-media',
+      body: body
+    }));
+
+    const response = await fetch(`http://127.0.0.1:${address.port}/api/internal/sync/player-media`, {
+      method: 'POST',
+      headers: headers,
+      body: JSON.stringify(body)
+    });
+
+    assert.equal(response.status, 202);
+    assert.equal(queuedTasks.length, 1);
+    assert.equal(queuedTasks[0].key, 'player-media-sync');
+    assert.equal(queuedTasks[0].taskType, 'media-sync');
+    assert.equal(queuedTasks[0].payload.mode, 'initial');
+    assert.equal(queuedTasks[0].payload.playerIdentifier, 'player-remote');
+    assert.equal(queuedTasks[0].metadata.playerLabel, 'player-remote');
+  } finally {
+    await new Promise(function (resolve) {
+      server.close(resolve);
+    });
+    process.env.PULSE_SIGNAGE_SHARED_SECRET = originalSecret;
+  }
+});
+
+test('player font sync requests are queued as background tasks', async () => {
+  const originalSecret = process.env.PULSE_SIGNAGE_SHARED_SECRET;
+  process.env.PULSE_SIGNAGE_SHARED_SECRET = 'test-shared-secret';
+
+  const queuedTasks = [];
+  const app = express();
+  app.use(express.json());
+
+  registerInternalSyncRoutes(app, {
+    backgroundTaskQueue: {
+      async enqueueTask(definition) {
+        queuedTasks.push(definition);
+        return {
+          id: 43,
+          key: definition.key,
+          taskType: definition.taskType,
+          title: definition.title,
+          category: definition.category,
+          status: 'queued',
+          createdAt: new Date().toISOString(),
+          startedAt: '',
+          finishedAt: '',
+          errorMessage: '',
+          attempts: 0,
+          metadata: definition.metadata,
+          payload: definition.payload
+        };
+      }
+    },
+    uploadSyncService: {},
+    mediaDir: 'e:/Projects Git/pulse-signage/media'
+  });
+
+  app.use(function (error, _req, res, _next) {
+    res.status(error.statusCode || 500).json({ error: String(error && error.message ? error.message : error) });
+  });
+
+  const server = app.listen(0);
+
+  try {
+    const address = server.address();
+    const body = {
+      deviceId: 'player-remote',
+      playerPublicBaseUrl: 'https://player.example.test',
+      playerInternalBaseUrl: 'http://player-bridge:8090'
+    };
+    const headers = Object.assign({
+      'content-type': 'application/json'
+    }, createRequestAuthHeaders({
+      method: 'POST',
+      pathname: '/api/internal/sync/player-font',
+      body: body
+    }));
+
+    const response = await fetch(`http://127.0.0.1:${address.port}/api/internal/sync/player-font`, {
+      method: 'POST',
+      headers: headers,
+      body: JSON.stringify(body)
+    });
+
+    assert.equal(response.status, 202);
+    assert.equal(queuedTasks.length, 1);
+    assert.equal(queuedTasks[0].key, 'player-font-sync');
+    assert.equal(queuedTasks[0].taskType, 'font-sync');
+    assert.equal(queuedTasks[0].payload.mode, 'initial');
+    assert.equal(queuedTasks[0].payload.playerIdentifier, 'player-remote');
+    assert.equal(queuedTasks[0].metadata.playerLabel, 'player-remote');
+  } finally {
+    await new Promise(function (resolve) {
+      server.close(resolve);
+    });
+    process.env.PULSE_SIGNAGE_SHARED_SECRET = originalSecret;
+  }
+});
@@ -4,7 +4,7 @@ const assert = require('node:assert/strict');
 require('../src/common');

 const originalWebBaseUrl = process.env.WEB_INTERNAL_URL;
-const { resolveWebBaseUrl, resolveScreenCommandTargets, resolveSnapshotUpstreamBaseUrl } = require('../src/player-bridge/index');
+const { resolveWebBaseUrl, resolveScreenCommandTargets, resolveSnapshotUpstreamBaseUrl, resolvePlayerSocketForDeviceId } = require('../src/player-bridge/index');

 test.after(() => {
  if (originalWebBaseUrl === undefined) {
@@ -87,4 +87,16 @@ test('resolveSnapshotUpstreamBaseUrl falls back to the public player url for rem
    public_base_url: 'https://remote-player.example',
    internal_base_url: 'https://pulse-dev-bridge.lzstealth.com'
  }), 'https://remote-player.example');
+});
+
+test('resolvePlayerSocketForDeviceId only returns the exact connected player socket', () => {
+  const playerSocketA = { readyState: 1 };
+  const playerSocketB = { readyState: 1 };
+  const playerSockets = new Map([
+    ['player-a', playerSocketA],
+    ['player-b', playerSocketB]
+  ]);
+
+  assert.equal(resolvePlayerSocketForDeviceId(playerSockets, 'player-b'), playerSocketB);
+  assert.equal(resolvePlayerSocketForDeviceId(playerSockets, 'player-missing'), null);
 });
@@ -97,6 +97,46 @@ function createPlayerRouteOptions(overrides) {
  }, overrides);
 }

+test('screen route reports the request origin for the player public base url', async () => {
+  const { app, handlers } = createAppAndHandlers();
+  let reportedBaseUrl = null;
+
+  registerPlayerRoutes(app, {
+    app,
+    pool: { async query() { return [[{ id: 1 }]]; } },
+    common: { renderPlayerPage() { return '<html></html>'; } },
+    ...createPlayerRouteOptions({
+      playerPlaylistService: {
+        async buildScreenPlaylist() {
+          return {
+            screen: { id: 7, slug: 'test2' },
+            playlist: null,
+            slides: [],
+            rssFeeds: [],
+            apiSources: [],
+            timetableGroups: [],
+            revision: 'abc123'
+          };
+        }
+      },
+      onPlayerPublicBaseUrl(value) {
+        reportedBaseUrl = value;
+      }
+    })
+  });
+
+  const handler = handlers['/screen/:slug'];
+  const res = createResponse();
+
+  await handler({
+    params: { slug: 'test2' },
+    headers: { host: '127.0.0.1:8080' },
+    socket: { encrypted: false }
+  }, res);
+
+  assert.equal(reportedBaseUrl, 'http://127.0.0.1:8080');
+});
+
 test('screen route falls back to offline rendering when playlist build fails', async () => {
  const { app, handlers } = createAppAndHandlers();
  const renderCalls = [];
@@ -4,14 +4,17 @@ const fs = require('node:fs');

 const rbacPermissionsScript = fs.readFileSync(require.resolve('../src/web/public/js/rbac-permissions.js'), 'utf8');
 const rbacFormTemplate = fs.readFileSync(require.resolve('../src/web/views/settings/rbac/form.hbs'), 'utf8');
+const { buildPermissionSections } = require('../src/web/routes/settings/rbac/form-view-model');
 const rbacFormViewModel = fs.readFileSync(require.resolve('../src/web/routes/settings/rbac/form-view-model.js'), 'utf8');
 const rbacSource = fs.readFileSync(require.resolve('../src/rbac.js'), 'utf8');

 test('rbac form exposes bulk permission controls', () => {
+  assert.match(rbacFormTemplate, /name="permissions_present" value="1"/);
  assert.match(rbacFormTemplate, /accordion accordion-flush/);
  assert.match(rbacFormTemplate, /card card-outline card-secondary overflow-hidden/);
  assert.match(rbacFormTemplate, /accordion-item overflow-hidden" data-permission-section/);
  assert.match(rbacFormTemplate, /accordion-body p-0/);
+  assert.ok(!rbacFormTemplate.includes('data-bs-parent="#role-permissions-accordion"'));
  assert.match(rbacFormTemplate, /table-layout: fixed; width: 100%;/);
  assert.match(rbacFormTemplate, /<col style="width: 5\.5rem;" \/>/);
  assert.match(rbacFormTemplate, /class="text-center"/);
@@ -51,6 +54,45 @@ test('rbac permissions script supports bulk permission selection', () => {
  assert.ok(!rbacPermissionsScript.includes('data-permission-section-select-none'));
 });

+test('rbac accordion sections follow source order', () => {
+  const sections = buildPermissionSections([
+    {
+      categoryName: 'Settings',
+      sectionIndex: 3,
+      sectionOrder: 40,
+      resourceIndex: 1,
+      resourceOrder: 20,
+      title: 'Later resource',
+      permissions: []
+    },
+    {
+      categoryName: 'Main navigation',
+      sectionIndex: 0,
+      sectionOrder: 10,
+      resourceIndex: 1,
+      resourceOrder: 20,
+      title: 'Clients',
+      permissions: []
+    },
+    {
+      categoryName: 'Main navigation',
+      sectionIndex: 0,
+      sectionOrder: 10,
+      resourceIndex: 0,
+      resourceOrder: 10,
+      title: 'Dashboard',
+      permissions: []
+    }
+  ]);
+
+  assert.deepEqual(sections.map(function (section) {
+    return section.title;
+  }), ['Main navigation', 'Settings']);
+  assert.deepEqual(sections[0].groups.map(function (group) {
+    return group.title;
+  }), ['Dashboard', 'Clients']);
+});
+
 test('rbac duplicate route exists', () => {
  const rbacRoutes = fs.readFileSync(require.resolve('../src/web/routes/admin/rbac.js'), 'utf8');
  const duplicateHelpers = fs.readFileSync(require.resolve('../src/web/routes/settings/rbac/duplicate.js'), 'utf8');
@@ -99,7 +99,7 @@ test('fqdn player registration wins over a local configured player target for me

    assert.equal(success, true);
    assert.equal(fetchCalls.length, 1);
-    assert.equal(fetchCalls[0].url, 'https://pulse-dev-bridge.lzstealth.com/api/media/uploads%2Fsample.bin');
+    assert.equal(fetchCalls[0].url, 'https://pulse-dev-bridge.lzstealth.com/api/media/uploads%2Fsample.bin?deviceId=player-remote');
  } finally {
    global.fetch = originalFetch;
    fs.rmSync(uploadDir, { recursive: true, force: true });
@@ -0,0 +1,44 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const path = require('path');
+
+const registerMiddleware = require('../src/web/middleware');
+
+test('web middleware bypasses auth for internal player sync routes', () => {
+  const calls = [];
+  const app = {
+    middlewares: [],
+    use(...args) {
+      this.middlewares.push(args);
+    }
+  };
+
+  registerMiddleware(app, {
+    pool: {},
+    loadCurrentUser: async () => null,
+    requireAuth(req, _res, next) {
+      calls.push(req.path);
+      next();
+    },
+    MEDIA_DIR: path.join(process.cwd(), 'media'),
+    UPLOADS_DIR: path.join(process.cwd(), 'media', 'uploads-test'),
+    THUMBNAILS_DIR: path.join(process.cwd(), 'media', 'thumbnails-test'),
+    ASSET_DIR: path.join(process.cwd(), 'src', 'web', 'public')
+  });
+
+  const authGate = app.middlewares[app.middlewares.length - 1][0];
+  const nextCalls = [];
+
+  authGate({ path: '/api/internal/sync/player-media' }, {}, function () {
+    nextCalls.push('media');
+  });
+  authGate({ path: '/api/internal/sync/player-font' }, {}, function () {
+    nextCalls.push('font');
+  });
+  authGate({ path: '/dashboard' }, {}, function () {
+    nextCalls.push('dashboard');
+  });
+
+  assert.deepEqual(nextCalls, ['media', 'font', 'dashboard']);
+  assert.deepEqual(calls, ['/dashboard']);
+});
Author	SHA1	Message	Date
lzstealth	c5172af62d	Release 2.6.13	2026-08-08 21:11:34 +01:00
lzstealth	cd8e333afd	Restore Docker tag fan-out	2026-08-08 20:48:36 +01:00
lzstealth	c3b5a0053c	Split web and player build artifacts	2026-08-08 20:38:44 +01:00
lzstealth	38565a533d	Wire remote player reconnect delay	2026-08-08 16:29:38 +01:00
lzstealth	5a08ccddbb	Release v2.6.11	2026-08-08 15:11:11 +01:00
lzstealth	2c97fe81d1	Release v2.6.10	2026-08-08 14:14:52 +01:00
lzstealth	ee3b1b51bf	Release v2.6.9	2026-08-08 14:08:16 +01:00