hoai2026: levelbuilder update

[breville]

[written by Claude]

Newer Sprite Lab in Lab2 flags ship before their editing UI: show_world_tab, guide_steps, visible_tabs, images_advanced and friends appear nowhere on the level edit page — today they can only be set by editing .level files on a dev checkout. This adds an escape hatch: a collapsed "Additional properties (JSON)" section at the bottom of the level edit page, for saved Sprite Lab levels with Lab2 enabled.

Entirely client-side

The PR is one JS module (plus its test and an import line) — not a single server change. Everything the feature needs already exists:

• Values come from the level's level_properties endpoint, the same one the lab itself reads.
• Saves go through the levelbuilder-authorized update_properties endpoint, which App Lab's starter-code editor has used for years, and which logs who changed what.
• The code rides the levelbuilder bundle the edit page already loads (which already contains the CodeMirror setup it uses), injected after the level form. On any other page, or a level that isn't Sprite Lab in Lab2 (checked against the form's exact level type — Dancelab and Poetry subclass GamelabJr and are deliberately excluded — and the saved Lab2 checkbox), it does nothing.

An explicit allowlist, not a general property editor

The editable set is a constant — ten flags today. The dump enumerates exactly those keys, set or not (null = unset), so it reads like a form of the available knobs, and the box refuses any other key with "…isn't in this level's editable list." Every other property keeps its own editor — form fields, the blocks editors, the encrypted values — by construction, and the list doubles as the working list of flags still waiting for real UI: remove an entry when its editor lands, and the section retires with the last one.

• The values box is the levelbuilder CodeMirror with a JSON lint gutter. Keys merge by whole top-level key — a value replaces its property outright, so a nested tweak is copy the value from the dump, edit, save it back. A key set to null — or to any empty or false value — is removed: properties store no blanks, so flags are true or absent. The help text says all of this.
• A successful save refetches the dump from the server, so it always shows what was actually stored (a removed value shows as null) — it is the documented copy-source for nested edits, so it must never show submitted-but-unstored values. The "Saved." status annotates itself when the box holds edits newer than what was saved, and when the level is unpublished — an unpublished level's save reaches the database but not its .level file, so it warns to publish before the value can survive a seed. The section sits outside the level form on purpose: it saves through its own endpoint, and sharing the form's submit or dirty-check machinery would discard unsaved edits elsewhere on the page.

Screenshot

Testing

• A unit test pins the seam that must not drift: the snake-to-camel name mapping for every editable key (values are read by the camelized names level_properties serves and saved by the stored snake_case names). Because a save refetches rather than mirroring, the client never needs its own copy of the server's blank-stripping rule.
• Driven end to end in the browser the way a person uses it: expand the section by clicking its heading, type {"show_world_tab": true} into CodeMirror, click Save — and the level itself gains the World tab on next load; typing null and saving removes it again. The dump shows all ten keys (null for unset, real values for set ones), a non-allowlisted key (start_html) is refused with a plain message, and on this unpublished scratch level the save status carried the publish-to-persist warning. On a classic (non-Lab2) Sprite Lab level the section does not render. Lint and yarn run typecheck pass.

History note

This branch was rewritten before review: earlier exploratory commits built the same feature server-side (a haml partial, a model allowlist, and update_properties endpoint hardening). The endpoint hardening — refusing encrypted properties and their plaintext twins, 400s with reasons for malformed bodies and values the save hooks reject — is parked as a candidate separate PR, since it protects the endpoint's other callers and is orthogonal to this UI.