V1.7.2: the combatant on turn cannot be their own target

- In a battle under way, whoever is on turn has no Target button on their
  card, and the server refuses a target list that includes them.
- All packages at version 1.7.2.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "private": true,
   "type": "commonjs",
   "main": "src/index.js",

backend/prisma/migrations/20261007190000_area_attack_ac_penalty/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable: how much an area attack adds to each AC per extra target
+ALTER TABLE "campaigns" ADD COLUMN "areaAttackAcPenalty" INTEGER NOT NULL DEFAULT 2;

backend/prisma/schema.prisma

@@ -168,6 +168,9 @@ model Campaign {
   skipMotivationRoll Boolean  @default(false)
   // Off: players see only a health bar for monsters and NPCs, not the numbers.
   showMonsterHp      Boolean  @default(true)
+  // An attack on several targets is harder to land: each target's AC counts
+  // as this much higher for every target beyond the first. 0 turns it off.
+  areaAttackAcPenalty Int     @default(2)
   ownerId            String
   // Set while the campaign is archived: kept in full, but moved off the main
   // list and closed to new members until the DM restores it.

backend/src/routes/api.integration.test.js

@@ -1948,12 +1948,32 @@ describe('targets', () => {
     expect(await seen(dmAuth)).toEqual([]);
     expect((await target(playerAuth, first.id)).status).toBe(403);
 
+    // Whoever is on turn can't be a target, their own or as part of a group.
+    expect((await target(dmAuth, first.id)).status).toBe(400);
+    expect((await target(dmAuth, hero.id, first.id)).status).toBe(400);
+
     // The goblin's turn: the DM marks the hero, and can clear it again.
     expect((await target(dmAuth, hero.id)).body.encounter.targetParticipantIds).toEqual([hero.id]);
     expect((await target(dmAuth)).body.encounter.targetParticipantIds).toEqual([]);
   });
 });
 
+describe('area attack AC penalty', () => {
+  itIfDb('is a campaign setting the DM changes, 2 unless told otherwise', async () => {
+    const { dmAuth, playerAuth, campaign } = await setupCampaign('areapenalty');
+    const c = `/campaigns/${campaign.id}`;
+    expect(campaign.areaAttackAcPenalty).toBe(2);
+
+    expect((await request(app).patch(c).set(playerAuth).send({ areaAttackAcPenalty: 0 })).status).toBe(403);
+    expect((await request(app).patch(c).set(dmAuth).send({ areaAttackAcPenalty: 11 })).status).toBe(400);
+    expect((await request(app).patch(c).set(dmAuth).send({ areaAttackAcPenalty: -1 })).status).toBe(400);
+    expect((await request(app).patch(c).set(dmAuth).send({ areaAttackAcPenalty: 0 })).body.campaign.areaAttackAcPenalty).toBe(0);
+
+    // Players are told it too: their cards show the penalty on a marked target.
+    expect((await request(app).get(c).set(playerAuth)).body.campaign.areaAttackAcPenalty).toBe(0);
+  });
+});
+
 describe('number limits', () => {
   itIfDb('are enforced by the server, whatever a form sends', async () => {
     const { dmAuth, playerAuth, campaign } = await setupCampaign('limits');

backend/src/routes/campaigns.routes.js

@@ -25,6 +25,7 @@ function campaignSummary(campaign, role) {
     startingSpellCount: campaign.startingSpellCount,
     skipMotivationRoll: campaign.skipMotivationRoll,
     showMonsterHp: campaign.showMonsterHp,
+    areaAttackAcPenalty: campaign.areaAttackAcPenalty,
     ownerId: campaign.ownerId,
     archivedAt: campaign.archivedAt,
     role,
@@ -54,6 +55,7 @@ const createCampaignSchema = z.object({
   startingSpellCount: z.number().int().min(0).max(50).optional(),
   skipMotivationRoll: z.boolean().optional(),
   showMonsterHp: z.boolean().optional(),
+  areaAttackAcPenalty: z.number().int().min(0).max(10).optional(),
 });
 
 // POST /campaigns — create, creator becomes DM/owner

backend/src/routes/encounters.routes.js

@@ -460,23 +460,30 @@ const targetsSchema = z.object({ participantIds: z.array(z.string()).max(50) });
 // Combatants can be marked as targets, for everyone to see; the DM's screen
 // then offers to apply damage to them. One is an ordinary attack, more is an
 // area attack. The DM can mark anyone at any time. A player can while their
-// own character is on turn in a battle.
+// own character is on turn in a battle. Nobody can mark the combatant who is
+// on turn: you don't target yourself.
 router.put('/:id/targets', requireEncounterAccess, async (req, res, next) => {
   try {
     const parsed = targetsSchema.safeParse(req.body);
     if (!parsed.success) return res.status(400).json({ error: parsed.error.flatten() });
     const participantIds = [...new Set(parsed.data.participantIds)];
 
+    // Whoever is on turn, when a battle is under way.
+    const { mode, status, activeParticipantId } = req.encounter;
+    const onTurnId = mode === 'BATTLE' && status === 'ACTIVE' ? activeParticipantId : null;
+
     if (!req.isDM) {
-      const { mode, status, activeParticipantId } = req.encounter;
-      const onTurn =
-        mode === 'BATTLE' && status === 'ACTIVE' && activeParticipantId
-          ? await prisma.encounterParticipant.findFirst({
-              where: { id: activeParticipantId, encounterId: req.encounter.id, character: { userId: req.user.id } },
-              select: { id: true },
-            })
-          : null;
-      if (!onTurn) return res.status(403).json({ error: "You can only pick targets on your own character's turn" });
+      const ownTurn = onTurnId
+        ? await prisma.encounterParticipant.findFirst({
+            where: { id: onTurnId, encounterId: req.encounter.id, character: { userId: req.user.id } },
+            select: { id: true },
+          })
+        : null;
+      if (!ownTurn) return res.status(403).json({ error: "You can only pick targets on your own character's turn" });
+    }
+
+    if (onTurnId && participantIds.includes(onTurnId)) {
+      return res.status(400).json({ error: 'The combatant on turn cannot be their own target' });
     }
 
     const found = await prisma.encounterParticipant.count({ where: { id: { in: participantIds }, encounterId: req.encounter.id } });

docs/ENCOUNTERS.md

@@ -213,6 +213,9 @@ healed) right now. One target is an ordinary attack; more than one is an
 - The **DM** can mark anyone at any time, in a battle or a quest. A **player**
   can while their own character is on turn in a battle, so they can show the
   DM who they are going for.
+- The combatant **on turn** cannot be marked: nobody targets themselves, and
+  their card has no Target button until the turn passes. To heal or hurt them
+  on their own turn, use the buttons on their card.
 - A target's card is outlined in red for everyone and reads "Targeted by
   <whoever is on turn>".
 - While anyone is marked the DM gets an **attack bar** above the list, which
@@ -229,8 +232,10 @@ healed) right now. One target is an ordinary attack; more than one is an
 
 An attack on several targets is harder to land and its damage is shared.
 
-- **Harder to hit.** Every target's AC counts as **2 higher for each target
-  beyond the first**:
+- **Harder to hit.** Every target's AC counts as higher for each target
+  beyond the first, by the campaign's **area attack AC penalty**. The DM sets
+  it in the campaign settings, from 0 (no penalty) to 10; it starts at 2, which
+  gives:
 
   | Targets | Added to each AC |
   |---|---|
@@ -251,8 +256,7 @@ An attack on several targets is harder to land and its damage is shared.
 - A target with no hit points to track is left out of the sharing.
 
 The app does not roll the attack or decide whether it hits: the DM compares
-the roll with the AC shown and types the damage. The +2 is fixed in the code
-(`AREA_AC_STEP` in `frontend/src/pages/EncounterPage.tsx`).
+the roll with the AC shown and types the damage.
 
 ## 8. Conditions
 

frontend/package.json

@@ -1,7 +1,7 @@
 {
   "name": "frontend",
   "private": true,
-  "version": "1.7.0",
+  "version": "1.7.2",
   "type": "module",
   "scripts": {
     "dev": "vite",

frontend/src/api/types.ts

@@ -93,6 +93,8 @@ export interface Campaign {
   startingSpellCount: number;
   skipMotivationRoll: boolean;
   showMonsterHp: boolean; // off: players get a health bar for monsters and NPCs, no numbers
+  // Added to each target's AC for every target beyond the first in an area attack; 0 is off.
+  areaAttackAcPenalty: number;
   ownerId: string;
   archivedAt: string | null; // set while the campaign is archived
   role: 'DM' | 'PLAYER';

frontend/src/pages/CampaignHomePage.tsx

@@ -489,6 +489,7 @@ export function CampaignHomePage() {
                   startingSpellCount: Number(fd.get('startingSpellCount')),
                   skipMotivationRoll: fd.get('skipMotivationRoll') === 'on',
                   showMonsterHp: fd.get('showMonsterHp') === 'on',
+                  areaAttackAcPenalty: Number(fd.get('areaAttackAcPenalty')),
                 });
               }}
             >
@@ -514,6 +515,19 @@ export function CampaignHomePage() {
                 <input type="checkbox" name="showMonsterHp" defaultChecked={campaign.showMonsterHp} />
                 Players see the exact hit points of monsters and NPCs in encounters (untick for a health bar only)
               </label>
+              <label className="flex-row flex-wrap gap-sm mt-sm">
+                Area attack AC penalty
+                <NumberInput
+                  name="areaAttackAcPenalty"
+                  min={0}
+                  max={10}
+                  keepValue
+                  defaultValue={campaign.areaAttackAcPenalty}
+                  style={{ width: 70 }}
+                  title="An attack on several targets is harder to land: each target's AC counts as this much higher for every target beyond the first. 0 turns the penalty off."
+                />
+                <span className="combatant-sub">added to each target's AC for every target beyond the first (0 for none)</span>
+              </label>
               <button type="submit" className="btn btn-primary mt-md" disabled={updateCampaign.isPending}>
                 Save Settings
               </button>

frontend/src/pages/EncounterPage.tsx

@@ -64,9 +64,9 @@ const CONDITIONS = [
 ];
 
 // An attack on more than one target is an area attack, and harder to land:
-// every target's AC counts as this much higher for each target beyond the first.
-const AREA_AC_STEP = 2;
-const areaPenalty = (targetCount: number) => Math.max(0, targetCount - 1) * AREA_AC_STEP;
+// every target's AC counts as `step` higher for each target beyond the first.
+// The step is the campaign's "area attack AC penalty" setting.
+const areaPenalty = (targetCount: number, step: number) => Math.max(0, targetCount - 1) * step;
 
 const KIND_LABELS = { CHARACTER: 'PC', MONSTER: 'Monster', NPC: 'NPC' } as const;
 const KIND_BADGES = { CHARACTER: 'badge-player', MONSTER: 'badge-hostile', NPC: 'badge-friendly' } as const;
@@ -124,7 +124,7 @@ function CombatantCard({
   // What an area attack adds to this target's AC; 0 when they are the only one.
   acPenalty: number;
   // Marks this combatant as a target, or unmarks them. Absent for someone who
-  // may not pick targets right now.
+  // may not pick targets right now, and on the card of whoever is on turn.
   onTarget?: () => void;
   onRemove: () => void;
   onError: (err: unknown) => void;
@@ -468,12 +468,14 @@ function shares(amount: number, count: number, mode: AreaMode): number[] {
 function AttackBar({
   attacker,
   targets,
+  acStep,
   onApply,
   onRemove,
   onClear,
 }: {
   attacker: EncounterParticipant | undefined;
   targets: EncounterParticipant[];
+  acStep: number; // the campaign's area attack AC penalty
   onApply: (changes: { participantId: string; currentHp: number }[]) => void;
   onRemove: (participantId: string) => void;
   onClear: () => void;
@@ -483,13 +485,12 @@ function AttackBar({
   const [missed, setMissed] = useState<string[]>([]);
 
   const isArea = targets.length > 1;
-  const penalty = areaPenalty(targets.length);
+  const penalty = areaPenalty(targets.length, acStep);
   const tracksHp = (t: EncounterParticipant) => (t.maxHp ?? 0) > 0;
   const hit = targets.filter((t) => tracksHp(t) && !missed.includes(t.id));
   const value = Number(amount) || 0;
   const portions = shares(value, hit.length, isArea ? mode : 'EACH');
-  const selfOnly = targets.length === 1 && targets[0].id === attacker?.id;
-  const attacks = attacker && !selfOnly ? attackLines(attacker) : [];
+  const attacks = attacker ? attackLines(attacker) : [];
 
   function apply(sign: 1 | -1) {
     if (!value || hit.length === 0) return;
@@ -502,7 +503,7 @@ function AttackBar({
     <div className="card attack-bar">
       <div className="flex-between flex-wrap">
         <div className="attack-bar-title">
-          {attacker && !selfOnly && <>{attacker.displayName} → </>}🎯 {isArea ? `${targets.length} targets` : targets[0].displayName}
+          {attacker && <>{attacker.displayName} → </>}🎯 {isArea ? `${targets.length} targets` : targets[0].displayName}
         </div>
         <button className="btn btn-ghost" onClick={onClear}>
           ✕ Clear {isArea ? 'targets' : 'target'}
@@ -510,7 +511,8 @@ function AttackBar({
       </div>
       {isArea && (
         <p className="combatant-sub" style={{ margin: '0.25rem 0 0' }}>
-          Area attack: every target's AC counts as {penalty} higher (+{AREA_AC_STEP} for each target beyond the first). Untick anyone the roll missed.
+          Area attack{penalty > 0 && `: every target's AC counts as ${penalty} higher (+${acStep} for each target beyond the first)`}. Untick anyone the
+          roll missed.
         </p>
       )}
 
@@ -861,6 +863,7 @@ export function EncounterPage() {
   const targetIds = encounter.targetParticipantIds ?? [];
   const targets = targetIds.map((id) => participants.find((p) => p.id === id)).filter((p): p is EncounterParticipant => p !== undefined);
   // The DM marks targets whenever they like; a player while their own character is on turn.
+  const acStep = campaignData?.campaign.areaAttackAcPenalty ?? 0;
   const canTarget = isDM || (active?.character != null && active.character.userId === user?.id);
   const builtCharacters = characters?.filter((c) => c.buildStage === 'COMPLETE') ?? [];
   const onError = (err: unknown) => setFormError(extractErrorMessage(err));
@@ -890,10 +893,11 @@ export function EncounterPage() {
       isActive={p.id === active?.id}
       onPatch={(data) => patchParticipant.mutate({ participantId: p.id, ...data }, fail)}
       canRollInitiative={isDM || (p.character != null && p.character.userId === user?.id)}
-      targetedBy={targetIds.includes(p.id) ? (active && active.id !== p.id ? active.displayName : '') : undefined}
-      acPenalty={areaPenalty(targets.length)}
+      targetedBy={targetIds.includes(p.id) ? (active?.displayName ?? '') : undefined}
+      acPenalty={areaPenalty(targets.length, acStep)}
       onTarget={
-        canTarget
+        // Nobody targets themselves: the combatant on turn has no button.
+        canTarget && p.id !== active?.id
           ? () => setTargets.mutate(targetIds.includes(p.id) ? targetIds.filter((id) => id !== p.id) : [...targetIds, p.id], fail)
           : undefined
       }
@@ -1037,6 +1041,7 @@ export function EncounterPage() {
             <AttackBar
               attacker={active}
               targets={targets}
+              acStep={acStep}
               onApply={(changes) => Promise.all(changes.map((change) => patchParticipant.mutateAsync(change))).catch(onError)}
               onRemove={(id) => setTargets.mutate(targetIds.filter((x) => x !== id), fail)}
               onClear={() => setTargets.mutate([], fail)}

package-lock.json

@@ -1,19 +1,19 @@
 {
   "name": "dnd-campaign-manager",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "dnd-campaign-manager",
-      "version": "1.7.0",
+      "version": "1.7.2",
       "workspaces": [
         "backend",
         "frontend"
       ]
     },
     "backend": {
-      "version": "1.7.0",
+      "version": "1.7.2",
       "dependencies": {
         "@prisma/client": "^5.20.0",
         "bcrypt": "^5.1.1",
@@ -31,7 +31,7 @@
       }
     },
     "frontend": {
-      "version": "1.7.0",
+      "version": "1.7.2",
       "dependencies": {
         "@tanstack/react-query": "^5.103.2",
         "axios": "^1.20.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "dnd-campaign-manager",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "private": true,
   "description": "D&D 5e campaign manager — monorepo root",
   "workspaces": [