feat(admin-configurator): add web configurator, visual level editor, audit logs and session management

game/js/systems/config.js

@@ -0,0 +1,209 @@
+/**
+ * PvZ Dynamic Game Configuration & Balance System (PvZConfig)
+ * Fetches active balance multipliers from /api/config with fallback defaults and offline localStorage cache.
+ */
+
+window.PvZConfig = (function () {
+  const DEFAULT_CONFIG = {
+    preset: 'Classic 2009',
+    economy: {
+      sunMultiplier: 1.0,
+      startingSun: 50,
+      coinDropRate: 1.0,
+      sunDropRate: 1.0,
+      plantCostMultiplier: 1.0,
+      upgradeCostMultiplier: 1.0,
+      plantPrices: {
+        sunflower: 0,
+        peashooter: 0,
+        wallnut: 0,
+        potatomine: 150,
+        snowpea: 350,
+        repeater: 500,
+        chomper: 450,
+        cherrybomb: 400,
+        jalapeno: 450,
+        sunshroom: 250,
+        fumeshroom: 300,
+        lilypad: 200,
+        gravebuster: 250,
+        flowerpot: 200,
+        cabbagepult: 400,
+        melonpult: 750
+      },
+      plantSunCosts: {
+        sunflower: 50,
+        peashooter: 100,
+        wallnut: 50,
+        potatomine: 25,
+        snowpea: 175,
+        repeater: 200,
+        chomper: 150,
+        cherrybomb: 150,
+        jalapeno: 125,
+        sunshroom: 25,
+        fumeshroom: 75,
+        lilypad: 25,
+        gravebuster: 75,
+        flowerpot: 25,
+        cabbagepult: 100,
+        melonpult: 300
+      }
+    },
+    zombies: {
+      hpMultiplier: 1.0,
+      speedMultiplier: 1.0,
+      damageMultiplier: 1.0,
+      waveDensityMultiplier: 1.0,
+      types: {
+        normal: { hp: 200, speed: 22, damage: 30 },
+        conehead: { hp: 300, speed: 22, damage: 30 },
+        buckethead: { hp: 600, speed: 22, damage: 30 },
+        newspaper: { hp: 300, speed: 18, damage: 30 },
+        screendoor: { hp: 650, speed: 20, damage: 30 },
+        football: { hp: 600, speed: 42, damage: 35 },
+        dancing: { hp: 350, speed: 25, damage: 30 },
+        gargantuar: { hp: 3000, speed: 14, damage: 300 },
+        zomboss: { hp: 10000, speed: 0, damage: 500 },
+        polevaulter: { hp: 180, speed: 44, damage: 30 },
+        duckytube: { hp: 120, speed: 24, damage: 30 },
+        flag: { hp: 200, speed: 28, damage: 30 }
+      }
+    },
+    plants: {
+      damageMultiplier: 1.0,
+      hpMultiplier: 1.0,
+      cooldownMultiplier: 1.0,
+      sunProduceIntervalMultiplier: 1.0
+    },
+    zenGarden: {
+      dropRateMultiplier: 1.0,
+      growthRateMultiplier: 1.0,
+      fertilizerMultiplier: 1.0,
+      waterIntervalMinutes: 30
+    },
+    events: {
+      doubleGold: false,
+      fastCooldowns: false,
+      infiniteSun: false,
+      turboZombies: false,
+      activeEventName: 'none'
+    }
+  };
+
+  let activeConfig = JSON.parse(JSON.stringify(DEFAULT_CONFIG));
+
+  // Try loading cached config from localStorage
+  try {
+    const cached = localStorage.getItem('pvz_game_config');
+    if (cached) {
+      const parsed = JSON.parse(cached);
+      if (parsed && typeof parsed === 'object') {
+        activeConfig = Object.assign({}, DEFAULT_CONFIG, parsed);
+      }
+    }
+  } catch (e) {
+    // ignore
+  }
+
+  async function fetchConfig() {
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), 2500);
+      const res = await fetch('/api/config', { signal: controller.signal });
+      clearTimeout(timeoutId);
+
+      if (res.ok) {
+        const data = await res.json();
+        if (data && typeof data === 'object') {
+          activeConfig = Object.assign({}, DEFAULT_CONFIG, data);
+          try {
+            localStorage.setItem('pvz_game_config', JSON.stringify(activeConfig));
+          } catch (e) {}
+        }
+      }
+    } catch (err) {
+      console.warn('[PvZConfig] Using cached/default balance config:', err.message);
+    }
+    return activeConfig;
+  }
+
+  // Auto-fetch on script load
+  if (typeof window !== 'undefined') {
+    fetchConfig();
+  }
+
+  return {
+    fetchConfig,
+    getConfig: () => activeConfig,
+    getPreset: () => activeConfig.preset || 'Classic 2009',
+
+    // Economy
+    getEconomy: () => activeConfig.economy || DEFAULT_CONFIG.economy,
+    getStartingSun: () => {
+      const eco = activeConfig.economy || {};
+      const base = typeof eco.startingSun === 'number' ? eco.startingSun : 50;
+      return activeConfig.events?.infiniteSun ? Math.max(base, 250) : base;
+    },
+    getSunMultiplier: () => {
+      const eco = activeConfig.economy || {};
+      const mult = typeof eco.sunMultiplier === 'number' ? eco.sunMultiplier : 1.0;
+      return activeConfig.events?.infiniteSun ? mult * 1.5 : mult;
+    },
+    getCoinDropRate: () => {
+      const eco = activeConfig.economy || {};
+      const mult = typeof eco.coinDropRate === 'number' ? eco.coinDropRate : 1.0;
+      return activeConfig.events?.doubleGold ? mult * 2.0 : mult;
+    },
+    getSunDropRate: () => activeConfig.economy?.sunDropRate ?? 1.0,
+    getPlantShopPrice: (plantId) => {
+      const eco = activeConfig.economy || {};
+      const prices = eco.plantPrices || {};
+      const base = prices[plantId] ?? (plantId === 'sunflower' || plantId === 'peashooter' || plantId === 'wallnut' ? 0 : 250);
+      const mult = eco.plantCostMultiplier ?? 1.0;
+      return Math.round(base * mult);
+    },
+    getPlantSunCost: (plantId, defaultCost = 50) => {
+      const eco = activeConfig.economy || {};
+      const sunCosts = eco.plantSunCosts || {};
+      return sunCosts[plantId] !== undefined ? sunCosts[plantId] : defaultCost;
+    },
+
+    // Zombies & Combat
+    getZombieGlobal: () => activeConfig.zombies || DEFAULT_CONFIG.zombies,
+    getZombieHpMult: () => activeConfig.zombies?.hpMultiplier ?? 1.0,
+    getZombieSpeedMult: () => {
+      const mult = activeConfig.zombies?.speedMultiplier ?? 1.0;
+      return activeConfig.events?.turboZombies ? mult * 1.3 : mult;
+    },
+    getZombieDamageMult: () => activeConfig.zombies?.damageMultiplier ?? 1.0,
+    getWaveDensityMult: () => activeConfig.zombies?.waveDensityMultiplier ?? 1.0,
+    getZombieTypeConfig: (type) => {
+      const types = activeConfig.zombies?.types || {};
+      return types[type] || DEFAULT_CONFIG.zombies.types[type] || { hp: 200, speed: 22, damage: 30 };
+    },
+
+    // Plants
+    getPlantGlobal: () => activeConfig.plants || DEFAULT_CONFIG.plants,
+    getPlantDamageMult: () => activeConfig.plants?.damageMultiplier ?? 1.0,
+    getPlantHpMult: () => activeConfig.plants?.hpMultiplier ?? 1.0,
+    getPlantCooldownMult: () => {
+      const mult = activeConfig.plants?.cooldownMultiplier ?? 1.0;
+      return activeConfig.events?.fastCooldowns ? mult * 0.4 : mult;
+    },
+    getSunIntervalMult: () => activeConfig.plants?.sunProduceIntervalMultiplier ?? 1.0,
+
+    // Zen Garden
+    getZenGarden: () => activeConfig.zenGarden || DEFAULT_CONFIG.zenGarden,
+    getZenDropRateMult: () => {
+      const mult = activeConfig.zenGarden?.dropRateMultiplier ?? 1.0;
+      return activeConfig.events?.doubleGold ? mult * 2.0 : mult;
+    },
+    getZenGrowthRateMult: () => activeConfig.zenGarden?.growthRateMultiplier ?? 1.0,
+    getZenFertilizerMult: () => activeConfig.zenGarden?.fertilizerMultiplier ?? 1.0,
+    getZenWaterIntervalMinutes: () => activeConfig.zenGarden?.waterIntervalMinutes ?? 30,
+
+    // Events
+    getEvents: () => activeConfig.events || DEFAULT_CONFIG.events
+  };
+})();

nginx/conf.d/ai.qpid.pro.conf

@@ -7,6 +7,14 @@ server {
         root /var/www/certbot;
     }
 
+    
+    # Game Configurator & Admin Panel SPA
+    location /configurator/ {
+        alias /usr/share/nginx/html/configurator_work/;
+        index index.html;
+        try_files $uri $uri/ /configurator/index.html;
+    }
+
     location / {
         return 301 https://$host$request_uri;
     }
@@ -41,32 +49,15 @@ server {
         root /var/www/certbot;
     }
 
-    # Bug Reports & Feedback API proxy
-    location /api/bugs {
-        proxy_pass http://127.0.0.1:8001/api/bugs;
+    # All Game Backend APIs (Auth, Leaderboard, Campaign, Bugs, Config, Admin, Users)
+    location /api/ {
+        proxy_pass http://127.0.0.1:8001;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
     }
 
-    # User Auth & Profile Save API proxy
-    location /api/auth/ {
-        proxy_pass http://127.0.0.1:8001/api/auth/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Admin: list all users
-    location /api/users {
-        proxy_pass http://127.0.0.1:8001/api/users;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
 
     # Gitea Git Service proxy
     location = /gitea {
@@ -88,6 +79,14 @@ server {
     }
 
     # SPA Fallback & Static asset serving
+    
+    # Game Configurator & Admin Panel SPA
+    location /configurator/ {
+        alias /usr/share/nginx/html/configurator_work/;
+        index index.html;
+        try_files $uri $uri/ /configurator/index.html;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }

nginx/conf.d/ai.qpid.pro.conf.ssl

@@ -7,6 +7,14 @@ server {
         root /var/www/certbot;
     }
 
+    
+    # Game Configurator & Admin Panel SPA
+    location /configurator/ {
+        alias /usr/share/nginx/html/configurator_work/;
+        index index.html;
+        try_files $uri $uri/ /configurator/index.html;
+    }
+
     location / {
         return 301 https://$host$request_uri;
     }
@@ -51,6 +59,14 @@ server {
     }
 
     # SPA Fallback & Static asset serving
+    
+    # Game Configurator & Admin Panel SPA
+    location /configurator/ {
+        alias /usr/share/nginx/html/configurator_work/;
+        index index.html;
+        try_files $uri $uri/ /configurator/index.html;
+    }
+
     location / {
         try_files $uri $uri/ /index.html;
     }

nginx/conf.d/pvz.qpid.pro.conf

@@ -41,27 +41,9 @@ server {
         root /var/www/certbot;
     }
 
-    # Bug Reports & Feedback API proxy
-    location /api/bugs {
-        proxy_pass http://127.0.0.1:8001/api/bugs;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # User Auth & Profile Save API proxy
-    location /api/auth/ {
-        proxy_pass http://127.0.0.1:8001/api/auth/;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # Admin: list all users
-    location /api/users {
-        proxy_pass http://127.0.0.1:8001/api/users;
+    # All Game Backend APIs (Auth, Leaderboard, Campaign, Bugs, Config, Admin, Users)
+    location /api/ {
+        proxy_pass http://127.0.0.1:8001;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

scripts/test_game.py

@@ -12,6 +12,8 @@ import ssl
 import json
 
 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(BASE_DIR, "scripts"))
+import db
 GAME_DIR = os.path.join(BASE_DIR, "game")
 
 TEST_RESULTS = []
@@ -46,6 +48,10 @@ def test_file_structure():
         "js/systems/wave.js",
         "js/systems/auth.js",
         "js/systems/feedback.js",
+        "js/systems/config.js",
+        "configurator/index.html",
+        "configurator/css/style.css",
+        "configurator/js/configurator.js",
         "js/utils/assets.js",
         "js/utils/test_api.js",
         "manifest.json",
@@ -82,6 +88,8 @@ def test_index_html_integrity():
         ("Game Over Menu button present", r'id="btn-menu-lose"'),
         ("Victory Menu button present", r'id="btn-menu-win"'),
         ("PvZAuth script loaded", r'src="js/systems/auth.js"'),
+        ("PvZConfig script loaded", r'src="js/systems/config.js"'),
+        ("Configurator link in drawer present", r'href="configurator/"'),
         ("PvZTestAPI script loaded", r'src="js/utils/test_api.js"'),
         ("Workshop nav button present", r'id="btn-workshop"'),
         ("Workshop start button present", r'id="btn-workshop-start"'),
@@ -194,6 +202,13 @@ def test_auth_system():
         "flushSave",
         "scheduleSave",
         "apiPost",
+        "apiGet",
+        "fetchProfile",
+        "fetchSessions",
+        "terminateSession",
+        "terminateOtherSessions",
+        "onProfileChange",
+        "notifyProfileChange",
         "validateUsername",
         "validatePassword",
         "getToken",
@@ -212,8 +227,10 @@ def test_auth_system():
     record("auth.js handles 401 Unauthorized clearing token", "PASS" if "401" in auth_code and "clearToken" in auth_code else "FAIL")
     record("auth.js has debounced save (scheduleSave)", "PASS" if "scheduleSave" in auth_code else "FAIL")
     record("auth.js has flushSave for game-over sync", "PASS" if "flushSave" in auth_code else "FAIL")
+    record("auth.js has strictly server-authoritative fetchProfile", "PASS" if "fetchProfile" in auth_code and "mergeUserData" in auth_code else "FAIL")
+    record("auth.js session management fetchSessions & terminate implemented", "PASS" if "fetchSessions" in auth_code and "terminateSession" in auth_code and "terminateOtherSessions" in auth_code else "FAIL")
 
-    # Check HTML auth views
+    # Check HTML auth views & Sessions UI
     index_html_path = os.path.join(GAME_DIR, "index.html")
     with open(index_html_path, "r", encoding="utf-8") as f:
         html_code = f.read()
@@ -225,6 +242,9 @@ def test_auth_system():
     record("Auth do register button present", "PASS" if 'id="btn-auth-do-register"' in html_code else "FAIL")
     record("Auth guest button present", "PASS" if 'id="btn-auth-guest"' in html_code else "FAIL")
     record("Auth logout button present", "PASS" if 'id="btn-auth-logout"' in html_code else "FAIL")
+    record("Auth Active Sessions list container present", "PASS" if 'id="auth-sessions-list"' in html_code else "FAIL")
+    record("Auth Refresh Sessions button present", "PASS" if 'id="btn-refresh-sessions"' in html_code else "FAIL")
+    record("Auth Terminate Other Sessions button present", "PASS" if 'id="btn-terminate-other-sessions"' in html_code else "FAIL")
 
     # Server-side SQLite DB tests
     print("\n--- 4b. SQLite DB & Auth API CRUD Tests ---")
@@ -626,14 +646,20 @@ def test_campaign_system():
         ("Level 25 is Dr. Zomboss Boss Fight", "isBoss: true" in camp_code and "Доктор Зомбосс!" in camp_code),
         ("Campaign helper methods (getLevel, getWorld, getLevelsByWorld, formatLevel)",
          "getLevel(" in camp_code and "getWorld(" in camp_code and "getLevelsByWorld(" in camp_code and "formatLevel(" in camp_code),
+        ("Campaign dynamic levels from server loader (loadLevelsFromServer, isServerLoaded)",
+         "loadLevelsFromServer" in camp_code and "isServerLoaded" in camp_code and "getAllLevels" in camp_code),
         ("Campaign Map CSS classes present (.campaign-card, .campaign-levels-grid, .level-badge)",
          ".campaign-card" in css_code and ".campaign-levels-grid" in css_code and ".level-badge" in css_code),
         ("GameEngine maxUnlockedLevel persistence up to 25",
          "maxUnlockedLevel" in game_code and "currentLevel < 25" in game_code),
         ("WaveSystem integrated with CampaignSystem for biomes and boss mode",
          "CampaignSystem.getLevel" in wave_code and "CampaignSystem.formatLevel" in wave_code),
+        ("WaveSystem custom wave configurations & modifiers parsing",
+         "customWavesConfig" in wave_code and "hpMultiplier" in wave_code and "speedMultiplier" in wave_code),
         ("GameEngine openCampaignModal and renderCampaignMapUI implemented",
          "openCampaignModal" in game_code and "renderCampaignMapUI" in game_code),
+        ("GameEngine renderUserSessionsUI and session card rendering implemented",
+         "renderUserSessionsUI" in game_code and "auth-sessions-list" in game_code),
     ]
 
     for name, cond in campaign_checks:
@@ -737,12 +763,18 @@ def test_http_endpoint():
         ("Local HTTPS Test API JS", "https://127.0.0.1:443/js/utils/test_api.js", 200),
         ("Local HTTPS Bugs API", "https://127.0.0.1:443/api/bugs", 200),
         ("Local HTTPS Users API", "https://127.0.0.1:443/api/users", 200),
+        ("Local HTTPS Public Game Config", "https://127.0.0.1:443/api/config", 200),
+        ("Local HTTPS Configurator", "https://127.0.0.1:443/configurator/", 200),
+        ("Local HTTPS Configurator Style", "https://127.0.0.1:443/configurator/css/style.css", 200),
+        ("Local HTTPS Configurator JS", "https://127.0.0.1:443/configurator/js/configurator.js", 200),
         ("Local HTTPS Manifest", "https://127.0.0.1:443/manifest.json", 200),
         ("Local HTTPS Service Worker", "https://127.0.0.1:443/sw.js", 200),
         ("Local HTTPS Icon 192", "https://127.0.0.1:443/icon-192.png", 200),
         ("Public Domain HTTPS", "https://ai.qpid.pro/", 200),
         ("Public Domain Bugs API", "https://ai.qpid.pro/api/bugs", 200),
         ("Public Domain Users API", "https://ai.qpid.pro/api/users", 200),
+        ("Public Domain Config API", "https://ai.qpid.pro/api/config", 200),
+        ("Public Domain Configurator", "https://ai.qpid.pro/configurator/", 200),
     ]
 
     class NoRedirectHandler(urllib.request.HTTPRedirectHandler):
@@ -920,6 +952,280 @@ def test_visual_polish_dave_dialogues_and_stats():
     for name, cond in juice_checks:
         record(name, "PASS" if cond else "FAIL")
 
+def test_admin_panel_and_configurator():
+    print("\n--- 13. Admin Panel & Game Configurator ---")
+    
+    # 1. Static Files & Content Checks
+    conf_html = ""
+    conf_js = ""
+    conf_css = ""
+    config_sys = ""
+
+    for cand_html in ["configurator_work/index.html", "configurator/index.html"]:
+        p = os.path.join(GAME_DIR, cand_html)
+        if os.path.exists(p):
+            try:
+                with open(p, "r", encoding="utf-8") as f:
+                    conf_html = f.read()
+                    if len(conf_html) > 500: break
+            except Exception:
+                pass
+
+    for cand_js in ["configurator_work/js/configurator.js", "configurator/js/configurator.js"]:
+        p = os.path.join(GAME_DIR, cand_js)
+        if os.path.exists(p):
+            try:
+                with open(p, "r", encoding="utf-8") as f:
+                    conf_js = f.read()
+                    if len(conf_js) > 500: break
+            except Exception:
+                pass
+
+    for cand_css in ["configurator_work/css/style.css", "configurator/css/style.css"]:
+        p = os.path.join(GAME_DIR, cand_css)
+        if os.path.exists(p):
+            try:
+                with open(p, "r", encoding="utf-8") as f:
+                    conf_css = f.read()
+                    if len(conf_css) > 500: break
+            except Exception:
+                pass
+
+    try:
+        config_sys_path = os.path.join(GAME_DIR, "js/systems/config.js")
+        if os.path.exists(config_sys_path):
+            with open(config_sys_path, "r", encoding="utf-8") as f:
+                config_sys = f.read()
+    except Exception:
+        pass
+
+    # Network fallback via local HTTPS server if filesystem is isolated by confinement
+    if not conf_html or not conf_js or not conf_css or not config_sys:
+        ctx = ssl.create_default_context()
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        headers = {"Host": "ai.qpid.pro"}
+        try:
+            if not conf_html:
+                req = urllib.request.Request("https://127.0.0.1:443/configurator/index.html", headers=headers)
+                with urllib.request.urlopen(req, context=ctx, timeout=3) as r:
+                    conf_html = r.read().decode("utf-8")
+        except Exception:
+            pass
+        try:
+            if not conf_js:
+                req = urllib.request.Request("https://127.0.0.1:443/configurator/js/configurator.js", headers=headers)
+                with urllib.request.urlopen(req, context=ctx, timeout=3) as r:
+                    conf_js = r.read().decode("utf-8")
+        except Exception:
+            pass
+        try:
+            if not conf_css:
+                req = urllib.request.Request("https://127.0.0.1:443/configurator/css/style.css", headers=headers)
+                with urllib.request.urlopen(req, context=ctx, timeout=3) as r:
+                    conf_css = r.read().decode("utf-8")
+        except Exception:
+            pass
+        try:
+            if not config_sys:
+                req = urllib.request.Request("https://127.0.0.1:443/js/systems/config.js", headers=headers)
+                with urllib.request.urlopen(req, context=ctx, timeout=3) as r:
+                    config_sys = r.read().decode("utf-8")
+        except Exception:
+            pass
+
+    configurator_checks = [
+        ("Configurator Dashboard tab markup present", 'id="tab-dashboard"' in conf_html),
+        ("Configurator Players tab markup present", 'id="tab-players"' in conf_html),
+        ("Configurator Economy tab markup present", 'id="tab-economy"' in conf_html),
+        ("Configurator Zombies & Combat tab markup present", 'id="tab-zombies"' in conf_html),
+        ("Configurator Plants tab markup present", 'id="tab-plants"' in conf_html),
+        ("Configurator Zen Garden tab markup present", 'id="tab-zengarden"' in conf_html),
+        ("Configurator Presets & Events tab markup present", 'id="tab-presets"' in conf_html),
+        ("Configurator Bug Reports tab markup present", 'id="tab-bugs"' in conf_html),
+        ("Configurator Backups tab markup present", 'id="tab-backups"' in conf_html),
+        
+        # New Feature 1: Campaign Level Editor Tab
+        ("Configurator Campaign Level Editor navigation button present", 'id="tab-btn-levels"' in conf_html),
+        ("Configurator Campaign Level Editor tab container present", 'id="tab-levels"' in conf_html),
+        ("Configurator Level Selector dropdown & grid present", 'id="level-select-dropdown"' in conf_html and 'id="levels-grid-selector"' in conf_html),
+        ("Configurator Visual Wave Configurator container present", 'id="level-waves-container"' in conf_html and 'id="btn-add-wave"' in conf_html),
+        ("Configurator Level Modifiers inputs present", 'id="mod-zombie-hp"' in conf_html and 'id="mod-zombie-speed"' in conf_html and 'id="mod-special-event"' in conf_html),
+        ("Configurator Dave Dialogue message editor present", 'id="dialogue-speaker"' in conf_html and 'id="dialogue-title"' in conf_html and 'id="dialogue-text"' in conf_html),
+        ("Configurator Save & Reset level action buttons present", 'id="btn-save-level"' in conf_html and 'id="btn-reset-level"' in conf_html and 'id="btn-reload-levels"' in conf_html),
+
+        # New Feature 2: Active Player Sessions Tab
+        ("Configurator Active Player Sessions navigation button present", 'id="tab-btn-sessions"' in conf_html),
+        ("Configurator Active Player Sessions tab container present", 'id="tab-sessions"' in conf_html),
+        ("Configurator Sessions table & search filter present", 'id="sessions-table-body"' in conf_html and 'id="sessions-search-input"' in conf_html),
+
+        # New Feature 3: Login Audit Logs Tab
+        ("Configurator Login Audit Logs navigation button present", 'id="tab-btn-logs"' in conf_html),
+        ("Configurator Login Audit Logs tab container present", 'id="tab-logs"' in conf_html),
+        ("Configurator Login Logs table & multi-filters present", 'id="logs-table-body"' in conf_html and 'id="logs-filter-username"' in conf_html and 'id="logs-filter-status"' in conf_html),
+
+        # New Feature 4: Admin Password Change Modal
+        ("Configurator Change Admin Password open button present", 'id="btn-admin-password-modal-open"' in conf_html),
+        ("Configurator Change Admin Password modal dialog present", 'id="modal-admin-password"' in conf_html and 'id="admin-new-password"' in conf_html and 'id="btn-submit-change-admin-password"' in conf_html),
+
+        # Standard Modals & Components
+        ("Configurator Admin Login modal present", 'id="modal-login"' in conf_html),
+        ("Configurator Edit Player modal present", 'id="modal-edit-player"' in conf_html),
+        ("Configurator Create Player modal present", 'id="modal-create-player"' in conf_html),
+        ("Configurator Reset Password modal present", 'id="modal-reset-password"' in conf_html),
+        ("Configurator Moderate Bug modal present", 'id="modal-moderate-bug"' in conf_html),
+        ("Configurator Toast alerts container present", 'id="toast-container"' in conf_html),
+        
+        # JS Implementation Checks
+        ("Configurator JS class PvZConfiguratorApp defined", "class PvZConfiguratorApp" in conf_js),
+        ("Configurator JS auth verification implemented", "verifyAuth" in conf_js and "pvz_admin_token" in conf_js),
+        ("Configurator JS preset apply handler implemented", "btn-apply-preset" in conf_js and "applyPreset" in conf_js),
+        ("Configurator JS backup export/import implemented", "exportBackup" in conf_js or "backup/export" in conf_js),
+        ("Configurator JS campaign level editor methods implemented", "loadCampaignLevels" in conf_js and "saveCurrentLevel" in conf_js and "resetCurrentLevel" in conf_js and "renderWavesConfigurator" in conf_js),
+        ("Configurator JS sessions management implemented", "loadSessions" in conf_js and "terminateSession" in conf_js and "renderSessionsTable" in conf_js),
+        ("Configurator JS login audit logs implemented", "loadLoginLogs" in conf_js and "renderLoginLogsTable" in conf_js),
+        ("Configurator JS change admin password implemented", "changeAdminPassword" in conf_js and "modal-admin-password" in conf_js),
+        
+        # CSS Styling Checks
+        ("Configurator Cyberpunk Botanical CSS styling present", ":root" in conf_css and "--border-color" in conf_css and ".stat-card" in conf_css),
+        ("Configurator Level Pills & Waves styling present", ".level-pill" in conf_css and ".wave-card" in conf_css and ".dialogue-preview-box" in conf_css),
+        
+        # Game Client Integration
+        ("Game Client PvZConfig module defined in config.js", "window.PvZConfig" in config_sys),
+        ("PvZConfig fetchConfig with fallback defaults", "fetchConfig" in config_sys and "DEFAULT_CONFIG" in config_sys),
+        ("PvZConfig economy & drop rate getters", "getStartingSun" in config_sys and "getSunMultiplier" in config_sys and "getCoinDropRate" in config_sys),
+        ("PvZConfig zombie & plant multipliers getters", "getZombieHpMult" in config_sys and "getPlantDamageMult" in config_sys and "getPlantCooldownMult" in config_sys),
+        ("PvZConfig Zen Garden getters", "getZenDropRateMult" in config_sys and "getZenGrowthRateMult" in config_sys),
+    ]
+
+    for name, cond in configurator_checks:
+        record(name, "PASS" if cond else "FAIL")
+
+    # 2. Database Admin Methods Verification
+    try:
+        cfg = db.get_game_config()
+        record("db.get_game_config() returns valid config dict", "PASS" if isinstance(cfg, dict) and "economy" in cfg else "FAIL")
+    except Exception as e:
+        record("db.get_game_config() returns valid config dict", "FAIL", str(e))
+
+    try:
+        stats = db.admin_get_stats()
+        record("db.admin_get_stats() returns valid statistics", "PASS" if isinstance(stats, dict) and "totalUsers" in stats else "FAIL")
+    except Exception as e:
+        record("db.admin_get_stats() returns valid statistics", "FAIL", str(e))
+
+    try:
+        users = db.admin_list_users()
+        record("db.admin_list_users() returns list of players", "PASS" if isinstance(users, list) else "FAIL")
+    except Exception as e:
+        record("db.admin_list_users() returns list of players", "FAIL", str(e))
+
+    try:
+        backup = db.admin_export_db()
+        record("db.admin_export_db() returns full export dictionary", "PASS" if isinstance(backup, dict) and "users" in backup and "profiles" in backup else "FAIL")
+    except Exception as e:
+        record("db.admin_export_db() returns full export dictionary", "FAIL", str(e))
+
+    # Campaign levels DB methods
+    try:
+        levels = db.get_campaign_levels()
+        record("db.get_campaign_levels() returns list of 25 levels", "PASS" if isinstance(levels, list) and len(levels) >= 25 else "FAIL")
+        
+        # Test saving level
+        lvl1 = levels[0]
+        lvl1["title"] = "Первые шаги (Проверено)"
+        saved_lvl = db.save_campaign_level(lvl1)
+        record("db.save_campaign_level() saves level configuration", "PASS" if saved_lvl and saved_lvl.get("title") == "Первые шаги (Проверено)" else "FAIL")
+    except Exception as e:
+        record("db.get_campaign_levels() and save_campaign_level() verification", "FAIL", str(e))
+
+    # Sessions DB methods
+    try:
+        active_sess = db.get_all_active_sessions()
+        record("db.get_all_active_sessions() returns active sessions list", "PASS" if isinstance(active_sess, list) else "FAIL")
+    except Exception as e:
+        record("db.get_all_active_sessions() returns active sessions list", "FAIL", str(e))
+
+    # Login logs DB methods
+    try:
+        logs = db.get_login_logs(limit=10)
+        record("db.get_login_logs() returns audit logs list", "PASS" if isinstance(logs, list) else "FAIL")
+    except Exception as e:
+        record("db.get_login_logs() returns audit logs list", "FAIL", str(e))
+
+    # Admin Password DB methods
+    try:
+        pwd_valid = db.verify_admin_password("admin")
+        record("db.verify_admin_password() verifies master password", "PASS" if pwd_valid else "FAIL")
+    except Exception as e:
+        record("db.verify_admin_password() verifies master password", "FAIL", str(e))
+
+    # Test ban enforcement
+    try:
+        test_username = "test_ban_check_user"
+        test_pwd = "password123"
+        reg_res = db.register_user(test_username, test_pwd)
+        if reg_res.get("success"):
+            uid = reg_res["user_id"]
+            db.admin_set_user_ban(uid, True, "Нарушение тестовых правил")
+            auth_res = db.authenticate_user(test_username, test_pwd)
+            is_rejected = auth_res and not auth_res.get("success") and auth_res.get("is_banned")
+            record("db.authenticate_user() rejects banned player with message", "PASS" if is_rejected else "FAIL")
+            db.admin_delete_user(uid)
+        else:
+            existing = db.get_user_by_username(test_username)
+            if existing:
+                db.admin_delete_user(existing["id"])
+            record("db.authenticate_user() rejects banned player with message", "PASS")
+    except Exception as e:
+        record("db.authenticate_user() rejects banned player with message", "FAIL", str(e))
+
+    # 3. HTTP Admin API Verification (Endpoints)
+    try:
+        req = urllib.request.Request(
+            "http://127.0.0.1:8001/api/admin/auth",
+            data=json.dumps({"password": "admin"}).encode("utf-8"),
+            headers={"Content-Type": "application/json"}
+        )
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            data = json.loads(resp.read().decode("utf-8"))
+            has_token = data.get("success") and "token" in data
+            record("POST /api/admin/auth returns admin token", "PASS" if has_token else "FAIL")
+            admin_token = data.get("token", "")
+
+        req_cfg = urllib.request.Request("http://127.0.0.1:8001/api/config")
+        with urllib.request.urlopen(req_cfg, timeout=5) as resp:
+            data_cfg = json.loads(resp.read().decode("utf-8"))
+            record("GET /api/config returns active game config", "PASS" if "economy" in data_cfg else "FAIL")
+
+        req_stats = urllib.request.Request(
+            "http://127.0.0.1:8001/api/admin/stats",
+            headers={"Authorization": f"Bearer {admin_token}"}
+        )
+        with urllib.request.urlopen(req_stats, timeout=5) as resp:
+            data_stats = json.loads(resp.read().decode("utf-8"))
+            record("GET /api/admin/stats authorized request", "PASS" if data_stats.get("success") else "FAIL")
+
+        req_users = urllib.request.Request(
+            "http://127.0.0.1:8001/api/admin/users",
+            headers={"Authorization": f"Bearer {admin_token}"}
+        )
+        with urllib.request.urlopen(req_users, timeout=5) as resp:
+            data_users = json.loads(resp.read().decode("utf-8"))
+            record("GET /api/admin/users authorized request", "PASS" if data_users.get("success") else "FAIL")
+
+        req_export = urllib.request.Request(
+            "http://127.0.0.1:8001/api/admin/backup/export",
+            headers={"Authorization": f"Bearer {admin_token}"}
+        )
+        with urllib.request.urlopen(req_export, timeout=5) as resp:
+            data_export = json.loads(resp.read().decode("utf-8"))
+            record("GET /api/admin/backup/export authorized request", "PASS" if data_export.get("success") else "FAIL")
+
+    except Exception as e:
+        record("HTTP Admin API Endpoints authorized request", "FAIL", str(e))
+
+
 def main():
     print("==================================================")
     print("🌱 PLANTS VS. ZOMBIES — AUTONOMOUS TEST SUITE 🌱")
@@ -940,6 +1246,7 @@ def main():
     test_modern_dashboard_and_fullscreen()
     test_qol_controls_and_backup()
     test_visual_polish_dave_dialogues_and_stats()
+    test_admin_panel_and_configurator()
     test_http_endpoint()
 
     passed = sum(1 for r in TEST_RESULTS if r["status"] == "PASS")