Workspace / Dashboard
API CHECKING
ASC
Overview / Home

Command Dashboard

A central workspace for ExperienceSettings and the Arcsen ecosystem.

CLOUDFLARE • STAGE 5.5
WELCOME TO ARCSCRIPTCENTER

Your control center.
One unified workspace.

Plan announcements, prepare moderation records, and connect your Roblox clients when your API is ready.

Active Users
—
Opt-in sessions · heartbeat-based, AFK stays online
Active Bans
—
Pending · Awaiting moderation API
Active Warnings
—
Active server warnings
API Status
Checking…
Contacting Cloudflare Worker

Activity monitoring

7-day opt-in daily unique trend · Asia/Bangkok

CONNECTING
Today — · This year —
Connecting to analytics…

Only users who opted into analytics are counted. Values are unverified.

GET /api/v1/analytics/activityAggregate only · 7 days

Quick actions

Access your workspace tools

Stage 5.0: Cloudflare Pages + Worker + D1. Keep Cloudflare Access enabled for this Pages dashboard; public Worker health does not authorize administration. No admin credentials are embedded in this site.
Analytics / Opt-in Presence

Active Users

Anonymous active count plus optional, self-reported Roblox profiles visible only after Admin unlock.

CONNECTING
Active opt-in sessions
—
Contacting Cloudflare API…
Last count check
Never
Smart Sync: ตรวจทุก 5s เมื่อมีเซสชัน / ทุก 15s เมื่อไม่มี · อัปเดตเฉพาะจำนวนที่เปลี่ยน

Active User List

Only profiles explicitly shared by users · admin-only · identities are not verified by Roblox

LOCKED

Unlock to view consented profiles.

Profiles are client-reported and can be spoofed. Verify a Roblox account before saving a ban draft. No automatic bans occur here.

Anonymous session counting

Privacy-first, consent-based statistics

AGGREGATE ONLY
What gets stored: an anonymized temporary session ID and timestamps for Active Users. When Analytics is separately enabled, the Worker stores an HMAC of the client-reported UserId (not the raw ID) to deduplicate days/years. Names are shown in the admin-only leaderboard only when expressly opted in. No IPs, place IDs or chat contents are stored in these tables.
Accuracy: counts only clients that chose to share presence; counts can be spoofed by untrusted clients. The identity list is not authenticated by Roblox. Confirm the ID before drafting a restriction.

Waiting for the anonymous presence API.

Unique users

Opt-in, estimated unique accounts. Bangkok calendar dates; the same account is counted once per period.

ANALYTICS
Daily unique users
—
Today · Asia/Bangkok
Yearly unique users
—
This year · Asia/Bangkok

Analytics collection starts after the migration and upgraded client opt-in.

Most active users — Leaderboard

Ranked by accumulated connected time, not character movement. Only expressly opted-in names appear; admin-only.

LOCKED

Unlock Active User List using your Admin Key to view the opt-in leaderboard.

All identifiers are client-reported, NOT verified by Roblox. Never use rankings alone to enforce restrictions. Concurrent sessions are credited at most once per account per server time interval.

Communication / Global

Global Warnings

Publish messages that ExperienceSettings clients can display.

CLOUD CONNECTED
Server warnings are public service notices; only Admins with a Worker secret may publish or end them. Handle ID uses built-in local Leave/Rejoin actions. loadstring() drafts are local developer-only exports; the API never sends executable Lua source code.

Compose warning

Create a new service notice from the Admin dashboard.

PUBLISH
Up to 900 characters. Turn on RichText, select a phrase in Message, then use the formatting toolbar. Only selected text changes.
Works like a word processor: select text first, then apply a style. Raw HTML/Luau are never accepted as formatting.
Only Live: existing clients at publish time. Live and After: existing and newly started clients until the selected expiry. Each warning appears once per client session.
ExitUI closes the popup. Handle ID offers Leave and Rejoin, performed only after a user taps that clearly labeled button. loadstring() is a local developer draft: copy and test it yourself; it cannot be published to other clients.

Client preview

Example of what a client popup could look like

LIVE PREVIEW
Service announcement
ArcScriptCenter · System Message

This is a preview notification from ArcScriptCenter.

Understood

Cloud warning records

0 PUBLISHED

Locked. Public warnings are still visible without a key.

Loading warnings…
Moderation / GitHub Sync

Banned Check Center

Manage access restrictions for ExperienceSettings only. Changes commit to the GitHub loadstring branch.

LOCKED
This does not ban Roblox accounts. The target Setup file must contain the managed-ban markers from Setup v1.248. GitHub is public: do not put private information in reasons.

Administrator unlock

Enter ARCSCRIPT_ADMIN_KEY (not GITHUB_TOKEN). Key is held in memory only until this page reloads or you lock.

WORKER AUTH

Locked. No GitHub data loaded.

GitHub target: White-rbx/HealthBar-Remake · loadstring · ExperienceSettings-SetUp.lua

Add / edit restriction

User ID is used for matching; username is a display note only, not independently verified.

ICT · UTC+7
Blank expiry = Permanent
Server-side GitHub sync is limited to a managed block. A client-side access check can be bypassed and is not secure enforcement of a Cloud service.

GitHub-managed list

Only entries created by ArcScriptCenter. Legacy bans stay untouched.

0 ENTRIES
Unlock to read GitHub-managed restrictions.
Operations / Audit Trail

Audit Logs

Server-side history of GitHub Ban Management operations. Records begin after Stage 5.4 deployment.

LOCKED
Admin-only D1 audit history. Actor is identified as verified Admin Key, not a specific person. No IP addresses, admin secrets, GitHub tokens, or ban reasons are stored.

Unlock Audit History

Enter the Worker Admin Key, or reuse the active Ban Management session.

PRIVATE

Locked. No audit data loaded.

Recent GitHub Sync events

Newest first · up to 100 per page · up to 2,000 retained records

0 LOADED
Unlock to read server-side audit history.
Infrastructure / Stage 5.0

API & Security

Cloud health, warnings, presence and authenticated administration. Chat features have been retired.

CLOUD HEALTH

Cloudflare API Connection

Direct HTTPS status check; no admin token or secrets in browser code.

CHECKING
Worker URLarcscriptcenter-api-staging.kogpasan14.workers.dev
API Service—
API Version—
Worker StatusChecking…
D1 DatabaseChecking…
Last successful checkNever
Connection details—
Open Health Endpoint

Connecting to Cloudflare...

Ban Check Tester

Staging only · Test public POST endpoint with a Roblox UserId. No administrator secret is required.

STAGING TEST
Not tested
Response will appear here.

A 503 response can mean GitHub ban markers or snapshot verification are unavailable. A 403 Origin response means the request did not originate from this allowed Staging Dashboard. A submitted UserId is not proof of identity.

Signed Policy Tester

Staging only · Request a signed UI policy, verify the signature, then confirm a modified policy is rejected.

STAGING TEST
Not tested
Results will appear here.

Expected: a fresh policy has valid: true, while a policy modified without re-signing has valid: false and reason: signature_mismatch. Policies expire after 60 seconds. This is UI integrity only; it does not verify Roblox identity or grant authorization. No signing keys or admin credentials are sent by this tester.

Presence Heartbeat Tester

Staging only · Test a temporary anonymous session from Heartbeat through Leave. No Roblox UserId or admin secret is needed.

STAGING TEST

One click checks the count before, creates an anonymous heartbeat, checks the count again, sends Leave, and confirms the count returns. Expected with no other active clients: 0 → 1 → 0.

Not tested 
Test results will appear here.

Counts include any other consenting clients, so results compare changes from the initial count rather than requiring exactly 0 → 1 → 0. Incomplete sessions expire after 150 seconds. This test does not enable analytics, share profile data, or verify Roblox identities.

Analytics API Tester

Staging only · Read-only validation of Summary, 7-day Activity and the public opt-in Leaderboard. No administrator secret is required.

STAGING TEST
Not tested 
Test results will appear here.

These public GET routes read opt-in, self-reported and unverified statistics. A zero count and an empty leaderboard are valid results on a fresh Staging database. The public leaderboard must not return raw actor hashes or session IDs.

Analytics Write + Consent Tester

Staging only · Check that opting in records an anonymous aggregate, opting out clears live analytics immediately, and Leave cleans up the test session.

STAGING TEST

One test creates a random synthetic numeric test identifier; it is NOT a real Roblox account and is never shown on a public leaderboard. No personal account, profile, admin key, or secret is required in the browser.

Not tested 
Results will appear here.

Expected: anonymous heartbeat does not change Analytics; opt-in adds 1 to daily/yearly unique counts; immediate opt-out is accepted (not throttled); final Leave removes the presence session. Concurrent opt-in clients can change global counts. HTTP 503 mentioning ASC_ANALYTICS_HASH_KEY means the private Worker secret is missing (minimum 32 characters). Never paste its value into chat or this page.

Online Routes

Health, warnings, presence and admin endpoints are available.

READ ONLY
GET
/api/v1/healthCheck Worker and D1 connectivity
Chat features have been retired. Worker access to admin functions still requires a separate secret.

Access & privacy checklist

Security responsibilities before enabling real moderation

ADMIN ONLY
1
Pages Access

Only approved admin email accounts should enter the Production and Preview dashboards.

2
Worker authorization

Cloudflare Access on Pages does not automatically protect a separate workers.dev API. Validate permissions on every admin route.

3
Noindex

Pages sends X-Robots-Tag. Search exclusion is best effort, not access protection.

4
Roblox compliance

Keep administrative actions authenticated and audit important changes.