V6.4.1 Release Notes

Release Date: 2026-03-26

Overview

V6.4.1 introduces a critical security feature for public deployments: Admin control over player PIN change permissions. This feature allows administrators to restrict regular users from changing their PINs, which is essential for maintaining account security in public environments.

🚀 New Features

Player PIN Change Restriction

  • Feature: Admin can control whether players can change their own PINs
  • Setting: AllowPlayerPinChange (boolean, default: true)
  • Access: Admin-only configuration in Admin settings
  • Impact: When disabled, only Admins can change PINs

Behavior Changes

  • When Enabled (default): Players see full PIN change functionality
  • When Disabled: Players see message directing them to contact admin
  • Admin Exemption: Admin users are unaffected by this restriction

🔧 Technical Implementation

Database Changes

  • Added AllowPlayerPinChange column to Settings table
  • Default value: true (maintains backward compatibility)
  • Automatic migration for existing databases

Code Changes

  • AppSettings.cs: Added AllowPlayerPinChange property
  • SettingsService.cs: Added getter/setter methods
  • Admin.razor: Added admin control toggle
  • Player.razor: Added conditional UI rendering
  • DbSeeder.cs: Updated default settings

New API Methods

public async Task<bool> GetAllowPlayerPinChangeAsync()
public async Task<bool> UpdateAllowPlayerPinChangeAsync(bool newValue)
public bool AllowPlayerPinChange { get; }

🛡️ Security Enhancements

Public Deployment Ready

  • Prevents unauthorized PIN changes in public environments
  • Maintains administrative control over user credentials
  • Reduces risk of account lockouts and security breaches

Admin Control

  • Only Admin users can change this setting
  • Setting located in Admin settings page
  • Real-time UI updates for players

User Experience

  • Clear messaging when PIN change is disabled
  • Seamless transition when setting changes
  • No impact on Admin PIN change capabilities

📱 User Interface Changes

Admin Page

  • Added checkbox: “Allow players to change their PIN”
  • Includes informational note about restriction behavior
  • Integrated into existing settings save workflow

Player Page

  • Conditional rendering based on admin setting
  • Disabled state shows helpful message
  • Maintains consistent styling

UI States

Enabled State:
├── "Change My PIN" heading
├── Current PIN input
├── New PIN input
└── Change PIN button

Disabled State:
├── "PIN Change" heading
└── "PIN change is currently disabled. Please contact an administrator..."

🔄 Backward Compatibility

Existing Deployments

  • No Breaking Changes: Default behavior preserved
  • Gradual Adoption: Can enable/disable as needed
  • No User Impact: Existing functionality maintained until changed

Migration Path

  1. Deploy V6.4.1 - no immediate changes
  2. Admin decides on PIN change policy
  3. Configure setting accordingly
  4. Users see updated interface

📋 Configuration

Admin Setup

  1. Login as Admin (PIN: 9999)
  2. Navigate to Admin page
  3. Scroll to Settings section
  4. Find “Allow players to change their PIN” checkbox
  5. Toggle as desired
  6. Click Save
  • Public Deployments: Disable (false)
  • Private/Development: Enable (true)
  • Corporate/Educational: Disable (false)

🧪 Testing

Verification Steps

  1. Admin Control Test
    • Login as Admin
    • Toggle setting
    • Verify save success
  2. Player UI Test
    • Login as Player
    • Verify UI matches setting
    • Test both enabled/disabled states
  3. PIN Change Test
    • Attempt PIN change as Player
    • Verify restriction works when disabled
    • Confirm Admin can still change PINs

Test Cases Passed

  • ✅ Setting loads correctly on Admin page
  • ✅ Setting saves and persists
  • ✅ Player UI updates in real-time
  • ✅ PIN change restriction works
  • ✅ Admin exemption works
  • ✅ Database migration works
  • ✅ Default behavior preserved

📚 Documentation

New Documentation

  • player-pin-change-restriction.md - Comprehensive feature guide
  • v6.4.1-release-notes.md - This release document

Updated Documentation

  • Admin interface documentation
  • Security best practices guide
  • Public deployment checklist

🚦 Deployment Notes

Production Deployment

  • Feature is disabled by default for existing deployments
  • No immediate user impact
  • Admin can configure as needed

New Deployments

  • Consider security requirements
  • Configure setting before user onboarding
  • Document PIN change policy for users

Database Requirements

  • No manual database updates required
  • Automatic column addition
  • Compatible with existing data

🔍 Debugging & Troubleshooting

Common Issues

  1. Setting doesn’t save: Verify Admin permissions
  2. Players still see PIN change: Refresh browser cache
  3. Admin can’t change PIN: This restriction doesn’t affect Admins

Debug Information

  • Check Settings.AllowPlayerPinChange in database
  • Verify user roles and permissions
  • Check browser console for JavaScript errors

📊 Performance Impact

Minimal Overhead

  • One additional boolean setting
  • Simple conditional rendering
  • No database query performance impact
  • Negligible memory footprint

Scalability

  • No impact on concurrent users
  • Efficient setting caching
  • Real-time UI updates

🔮 Future Considerations

Potential Enhancements

  • Role-based PIN change permissions
  • Time-based PIN change restrictions
  • PIN change approval workflow
  • Audit logging for PIN change attempts

Monitoring

  • Track PIN change frequency
  • Monitor setting changes
  • Alert on unusual patterns

🎯 Use Cases

Public Gaming Websites

  • Prevent unauthorized account changes
  • Maintain account security
  • Reduce support overhead

Educational Institutions

  • Control student account access
  • Maintain classroom management
  • Prevent account sharing

Corporate Environments

  • Ensure compliance with security policies
  • Maintain audit trails
  • Control employee access

📋 Checklist

Pre-Deployment

  • Review security requirements
  • Determine PIN change policy
  • Plan user communication

Post-Deployment

  • Configure setting as needed
  • Test player experience
  • Update user documentation

Monitoring

  • Monitor for issues
  • Track user feedback
  • Review security logs

🏆 Summary

V6.4.1 delivers a critical security feature that makes the application ready for public deployment. The Admin PIN change control provides the necessary security oversight while maintaining flexibility for different deployment scenarios.

Key Benefits

  • ✅ Public Deployment Ready
  • ✅ Admin Control Over Security
  • ✅ Backward Compatible
  • ✅ User-Friendly Interface
  • ✅ Comprehensive Documentation

This release represents the final step in preparing the application for public deployment, providing administrators with the tools needed to maintain account security in production environments.

Version: 6.4.1
Release Date: 2026-03-26
Security Level: High
Deployment Ready: ✅ Yes
Backward Compatible: ✅ Yes

?? ? Back to Project Documentation