Skip to content
Skip to documentation content

Defense / Incoming Attacks

Incoming Attacks

Review recorded incoming waves, mark their display state and create a defense or counter-scout response.

At a glance

Product route: /workspaces/{workspace_id}/incoming-attacks.

Who can open this page: signed-in users with enabled workspace entitlement and verified membership, including the owner. Non-owners need active membership and collection; verified owners bypass the individual grant check, not entitlement or verification. Page viewing does not require a current linked-account resolver; certain write actions do. Navigation visibility never grants endpoint access.

What you see

The table shows Tag color, Target Account, Target Village/coordinates, Attacker Account, Attacker Village/coordinates, Attacker artifacts, Type with wave count, Impact Time countdown and local absolute time, Inactive Time, manager-only Def Call and Remove. Account links open game profiles when a player ID is available; village links open maps. Artifact icons link to the game artifact detail where known. Missing inactive time is a dash; missing artifacts leave an empty cell. Wave badges are 1…4; an invalid badge input displays1.

Group by offers None, Target Account, Target Village, Attacker Account, Attacker Village or Type. Group headings show row counts and collapse/expand; the grouped column is hidden. Sortable headers toggle order, initially impact ascending. Village scout buttons add attacker coordinates or defender coordinates with impact to Counter Scout Plan, marking known entries as added. The Def Call dialog pre-fills read-only target coordinates and Send Before from the wave’s impact; enter Troops Needed and optional Snipe. There is no add-observation form, push-call control, or expired/dismissed toggle on this page.

Who fills in each field

Field or data What it means Who fills it in Can it be changed here? When it updates
Attack wave Recorded attacker/defender labels and coordinates, attack/raid type, wave count, impact and optional inactive time. Artifact context is looked up from workspace artifact records. Wave identity includes both coordinate pairs, type and exact second-level impact. signed-in-member, extension-collected, backend-derived Wave data read-only here; page has no manual add form Authorized ingestion/capture, visible at load
Color and dismissed Color cycles gray/red/orange/yellow/green/blue/purple; Remove dismisses the wave for the whole workspace. signed-in-member, backend-derived Verified collection color/dismiss actions Submission; expiry cleanup on reload

Calculations

No derived values on this page.

Grouping, sorting and hiding expired/dismissed records are page state. Countdown formatting is a display of recorded impact time, not a combat or travel estimate.

Freshness and updates

The browser loads incoming rows and existing counter-scout selections on entry. It ticks impact countdowns every second; at impact it shows “Impact” and reloads. The rows endpoint removes impacts at or before backend UTC now and excludes dismissed rows, then orders remaining records by impact. This is lazy cleanup, not a scheduled background job. Color/dismiss are saved immediately; dismissal remains on repeated ingestion because matching rows do not reset that state. The recorded wave/roster/artifact context is not a live game view. Impact absolute display is browser-local HH:MM:SS without date; the countdown floors remaining seconds. Ingestion accepts a timestamp, treats a naive value as UTC and strips microseconds. A successful capture does not guarantee continuous incoming visibility. Connected extension collection runs once on a completed matching incoming-page navigation. It records impact from the integer-second game countdown and browser capture clock at whole-second precision. The extension ingestion path hydrates player/village labels from the server roster and uses Unknown when unavailable; it does not trust page labels as roster identity. Inactive Time is the recorded browser inactivity gap since the last genuine user gesture on that origin, in HH:MM floored to minutes; missing, invalid or future activity timestamps give no value. It is not the attacker’s game-account inactivity.

Actions and permissions

Who can perform each action / Who can take action: the actor labels describe data responsibility; actual grants and action-specific guards decide access. Every feature request remains workspace-scoped and entitlement/verification-gated.

Action Actor Permission
Color/dismiss attack signed-in-member Verified collection, enabled entitlement, same origin and workspace-scoped record; allowed colors only. Observation ingestion separately uses collection with no same-origin gate and no visible add form
Create defense call workspace-manager Verified manage_def_calls plus collection and current linked account, enabled entitlement, same origin, roster destination and needed ≥1; no push-call action on this screen
Add counter-scout attacker/target signed-in-member Verified collection, enabled entitlement and same origin; coordinate syntax is validated, not roster existence; target impact is copied from the observation
Group/sort/collapse signed-in-member Page viewing access; local presentation state

States and edge cases

No active rows shows the empty list. Incoming-load failure explicitly says “Incoming attacks could not be loaded”; failed counter-scout selection fetches fall back to empty selection markers. A failed scout add leaves an error on the button; failed color or dismissal keeps prior state. Dismissal affects everyone in the workspace and has no restore control here. Expired and dismissed records cannot be revealed with a filter. Simultaneous impacts remain separate when attacker/defender coordinates or attack type differ; repeat submissions of the same identity update the observation. Unknown roster coordinates may be pinned for counter-scouting but can have unknown labels and no generated attacker plan. A wave badge is an observation count, not a backend estimate of attacking troops.

Def Calls, Counter Scout Plan, Overview.

Source references

Stable page ID: defense.incoming-attacks.

Source reviewed: 2026-10-07

Reviewed handlers, visible controls and producers - `src/trapitan/api/routes/web.py` — `incoming_attacks_page`. - `src/trapitan/web/templates/incoming_attacks.html` — bounded template/script region. - `src/trapitan/api/routes/web.py` — `_shell_context`. - `src/trapitan/api/routes/web.py` — `list_incoming_attacks`. - `src/trapitan/api/routes/web.py` — `create_incoming_attack`. - `src/trapitan/api/routes/web.py` — `_incoming_attack_payload`. - `src/trapitan/api/routes/web.py` — `_purge_expired_incoming_attacks`. - `src/trapitan/api/routes/web.py` — `update_incoming_attack_color`. - `src/trapitan/api/routes/web.py` — `dismiss_incoming_attack`. - `src/trapitan/api/routes/web.py` — `add_counter_scout_target`. - `src/trapitan/api/routes/web.py` — `IncomingAttackCreate`. - `src/trapitan/web/templates/partials/def_call_modal.html` — bounded template/script region. - `src/trapitan/api/routes/extension_collection.py` — `_upsert_incoming_attacks`. - `src/trapitan/api/routes/extension_collection.py` — `submit_incoming_attacks`. - `src/trapitan/api/routes/extension_collection.py` — `ExtensionIncomingAttackSubmission`. - `src/trapitan/api/routes/extension_collection.py` — `ExtensionIncomingAttacksSubmission`. - `extension/chromium/lib/incoming-attacks.js` — bounded template/script region. - `src/trapitan/authorization/dependencies.py` — `require_workspace_permission`. - `src/trapitan/authorization/policy.py` — `authorize_workspace_action`. - `src/trapitan/authorization/policy.py` — `_authorize_from_database`. - `src/trapitan/authorization/policy.py` — `is_membership_verified`. - `src/trapitan/authorization/policy.py` — `_active_membership`. - `src/trapitan/authorization/policy.py` — `_is_workspace_entitled`. - `src/trapitan/authorization/policy.py` — `_has_active_permission`. - `src/trapitan/authorization/policy.py` — `WorkspaceAction`. - `src/trapitan/authorization/policy.py` — `GRANTABLE_ACTIONS`. - `src/trapitan/api/routes/web.py` — `create_def_call`. - `src/trapitan/api/routes/guards.py` — `is_same_origin`. - `src/trapitan/authorization/dependencies.py` — `require_current_workspace_travian_account`. - `src/trapitan/authorization/current_account.py` — `resolve_current_workspace_travian_account`. - `src/trapitan/api/routes/web.py` — `add_counter_scout_attacker`.