Shaan-Shoukath · Oct 30, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
@@ -13,8 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -64,8 +64,8 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -86,8 +86,8 @@ jobs:
       matrix:
         deployment: [split, vps]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -97,7 +97,7 @@ jobs:
       # PostgreSQL/Redis containers. No deployed database or hosting keys needed.
       - run: npm run test:e2e:${{ matrix.deployment }}
       # Retry traces of failed specs (disposable data and credentials only).
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: failure()
         with:
           name: playwright-${{ matrix.deployment }}

@@ -45,8 +45,8 @@ jobs:
       S3_REGION: us-east-1
       ALLOW_INSECURE_PRODUCTION_TESTS: "1"
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm

@@ -46,7 +46,7 @@ jobs:
       release: ${{ steps.release.outputs.release }}
       prerelease: ${{ steps.release.outputs.prerelease }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.event.workflow_run.head_sha || github.sha }}
           persist-credentials: false
@@ -116,12 +116,12 @@ jobs:
         org.opencontainers.image.version=${{ needs.prepare.outputs.version }}
         org.opencontainers.image.licenses=AGPL-3.0-or-later
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ needs.prepare.outputs.sha }}
           persist-credentials: false
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -137,7 +137,7 @@ jobs:
 
       - name: Build backend
         id: backend
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         env:
           NEXT_SERVER_ACTIONS_ENCRYPTION_KEY: ${{ env.BUILD_ACTIONS_KEY }}
         with:
@@ -157,7 +157,7 @@ jobs:
 
       - name: Build frontend
         id: frontend
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         env:
           NEXT_SERVER_ACTIONS_ENCRYPTION_KEY: ${{ env.BUILD_ACTIONS_KEY }}
         with:
@@ -183,7 +183,7 @@ jobs:
           mkdir -p digests/spaceworks-events-backend digests/spaceworks-events-frontend
           touch "digests/spaceworks-events-backend/${BACKEND#sha256:}" \
             "digests/spaceworks-events-frontend/${FRONTEND#sha256:}"
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: digests-${{ matrix.runner }}
           path: digests/
@@ -196,13 +196,13 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: digests-*
           merge-multiple: true
           path: digests
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

@@ -17,7 +17,7 @@ jobs:
   check:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: dev
           fetch-depth: 0

@@ -23,28 +23,25 @@ COPY prisma ./prisma
 COPY scripts/prisma.mjs ./scripts/prisma.mjs
 CMD ["node", "scripts/prisma.mjs", "migrate", "deploy"]
 
-# Prisma CLI only, pinned to the lockfile's version, so the runner can apply
-# migrations on start (MIGRATE_ON_START=1) on platforms without a release job,
-# such as the Render free plan. Kept apart from the app's node_modules.
+# Prisma CLI only, so the runner can apply migrations on start
+# (MIGRATE_ON_START=1) on platforms without a release job, such as the Render
+# free plan. Kept apart from the app's node_modules and installed with `npm ci`
+# from its own committed lockfile, so every transitive dependency is pinned
+# too. tests/unit/docker-deps.test.ts keeps its version equal to the root
+# lockfile's.
 FROM node:22-alpine AS prisma-cli
 WORKDIR /opt/prisma-cli
-COPY --from=deps /app/node_modules/prisma/package.json /tmp/prisma-package.json
-RUN npm install --omit=dev --no-save --no-audit --no-fund \
-      "prisma@$(node -p "require('/tmp/prisma-package.json').version")" \
-    && npm cache clean --force
+COPY docker/deps/prisma-cli/package.json docker/deps/prisma-cli/package-lock.json ./
+RUN npm ci --omit=dev --no-audit --no-fund && npm cache clean --force
 
-# Clients the VPS operator tools (docker/vps/*.mjs) import, pinned to the
-# lockfile's versions. The application bundles its own copies into its build.
+# Clients the VPS operator tools (docker/vps/*.mjs) import, installed with
+# `npm ci` from their own committed lockfile (same direct versions as the root
+# lockfile, checked by tests/unit/docker-deps.test.ts). The application
+# bundles its own copies into its build.
 FROM node:22-alpine AS ops-modules
 WORKDIR /opt/ops
-COPY --from=deps /app/node_modules/ioredis/package.json /tmp/ioredis-package.json
-COPY --from=deps /app/node_modules/@aws-sdk/client-s3/package.json /tmp/s3-package.json
-COPY --from=deps /app/node_modules/nodemailer/package.json /tmp/nodemailer-package.json
-RUN npm install --omit=dev --no-save --no-audit --no-fund \
-      "ioredis@$(node -p "require('/tmp/ioredis-package.json').version")" \
-      "@aws-sdk/client-s3@$(node -p "require('/tmp/s3-package.json').version")" \
-      "nodemailer@$(node -p "require('/tmp/nodemailer-package.json').version")" \
-    && npm cache clean --force
+COPY docker/deps/ops/package.json docker/deps/ops/package-lock.json ./
+RUN npm ci --omit=dev --no-audit --no-fund && npm cache clean --force
 
 # Stage 2: Rebuild the source code
 FROM node:22-alpine AS builder

@@ -44,7 +44,7 @@ export async function loadApplicationReview(input: unknown): Promise<ActionResul
 
 export async function submitApplicationReview(input: unknown): Promise<ActionResult> {
   const gate = await reviewerGate(reviewSchema, input);
-  return gate.ok ? done(gate.ctx, await submitReview(gate.ctx, gate.data.assignmentId, { scores: gate.data.scores, notes: gate.data.notes })) : gate;
+  return gate.ok ? done(gate.ctx, await submitReview(gate.ctx, gate.data.assignmentId, { answersRevision: gate.data.answersRevision, scores: gate.data.scores, notes: gate.data.notes })) : gate;
 }
 
 export async function recuseFromApplication(input: unknown): Promise<ActionResult<{ replacedBy: boolean }>> {

@@ -69,6 +69,7 @@ export const onBehalfSchema = eventScope.extend({ applicationId: id, response: z
 
 export const reviewSchema = eventScope.extend({
   assignmentId: id,
+  answersRevision: z.number().int().min(1),
   scores: z.record(z.string().max(ADMISSION_CRITERION_MAX), z.number()),
   notes: z.string().max(ADMISSION_NOTES_MAX),
 }).strict();

@@ -42,6 +42,11 @@ export async function signUpWithPassword(
     return { ok: false, error: "New account creation is currently unavailable." };
   }
 
+  // Every attempt spends the address's creation quota before any lookup or
+  // hashing. A limited attempt creates and sends nothing but answers exactly
+  // like the others, so the limit can't tell existing addresses from new ones.
+  if (await isActionRateLimited("signup", email)) return { ok: true, data: { email } };
+
   // The super admin's account and password come from the server's recovery
   // tool. Answer like any other sign-up so the address isn't revealed.
   if (isSuperAdminEmail(email)) return { ok: true, data: { email } };
@@ -59,13 +64,6 @@ export async function signUpWithPassword(
     return { ok: true, data: { email } };
   }
 
-  // A double-submit or network retry can arrive just after the first request
-  // created the account. Check for that case before consuming the creation
-  // quota so a real account creation is never presented as a rate-limit error.
-  if (await isActionRateLimited("signup", email)) {
-    return { ok: false, error: "Too many attempts. Please try again later." };
-  }
-
   try {
     await prisma.$transaction(async (tx) => {
       const user = await tx.user.create({

@@ -3,9 +3,10 @@ import { gateCheckInForStatus } from "@/lib/checkIn";
 import { prisma } from "@/lib/db";
 import { offlineCheckInRosterSchema, syncOfflineCheckInsSchema } from "@/lib/validators";
 import type { ActionResult } from "../org";
-import { commitCheckInProjection } from "@/lib/checkInMutations";
+import { commitOfflineCheckIn } from "@/lib/checkInMutations";
 import { getCheckInDetails, getRegistrationDetails } from "@/lib/checkInDetails";
 import { deskAttendanceState } from "@/lib/attendanceCheck";
+import { recordAuditEvent } from "@/lib/audit";
 import { attendeeLabel, requireOrgMemberForEvent, revalidatePath } from "./access";
 import type { OfflineCheckInRosterRow } from "../checkin";
 
@@ -52,32 +53,36 @@ export async function downloadOfflineCheckInRoster(
     else answersByRsvp.set(answer.rsvpId, [answer]);
   }
 
-  return {
-    ok: true,
-    data: {
-      generatedAt: new Date().toISOString(),
-      rows: rsvps.map((r) => {
-        const user = r.userId ? { name: r.userName, email: r.userEmail } : null;
-        const rsvpAnswers = answersByRsvp.get(r.id) ?? [];
-        return {
-          rsvpId: r.id,
-          ticketToken: r.checkInToken,
-          displayName: attendeeLabel({ user, guestName: r.guestName, guestEmail: r.guestEmail }),
-          email: user?.email ?? r.guestEmail,
-          status: r.status,
-          checkedInAt: r.checkedInAt?.toISOString() ?? null,
-          checkInDetails: getCheckInDetails(rsvpAnswers, r.crewFood != null ? { foodPreference: r.crewFood } : null),
-          registrationDetails: getRegistrationDetails(rsvpAnswers),
-          teamName: r.teamName,
-          // The attendance reply only (docs/ATTENDANCE.md); never the note.
-          attendance: deskAttendanceState(r.attendanceAsked ? { response: r.attendanceResponse } : null),
-          isCrew: r.isCrew,
-        };
-      }),
-    },
-  };
+  const rows = rsvps.map((r): OfflineCheckInRosterRow => {
+    const user = r.userId ? { name: r.userName, email: r.userEmail } : null;
+    const rsvpAnswers = answersByRsvp.get(r.id) ?? [];
+    return {
+      rsvpId: r.id,
+      ticketToken: r.checkInToken,
+      displayName: attendeeLabel({ user, guestName: r.guestName, guestEmail: r.guestEmail }),
+      email: user?.email ?? r.guestEmail,
+      status: r.status,
+      checkedInAt: r.checkedInAt?.toISOString() ?? null,
+      checkInDetails: getCheckInDetails(rsvpAnswers, r.crewFood != null ? { foodPreference: r.crewFood } : null),
+      registrationDetails: getRegistrationDetails(rsvpAnswers),
+      teamName: r.teamName,
+      // The attendance reply only (docs/ATTENDANCE.md); never the note.
+      attendance: deskAttendanceState(r.attendanceAsked ? { response: r.attendanceResponse } : null),
+      isCrew: r.isCrew,
+    };
+  });
+  // The roster carries ticket links, contacts and answers: who took one is
+  // recorded (web and mobile alike), with the row count only in metadata.
+  await recordAuditEvent({
+    action: "CHECK_IN_ROSTER_DOWNLOADED", actorUserId: ctx.actorUserId, organisationId: ctx.event.organisationId,
+    targetType: "Event", targetId: ctx.event.id, metadata: { rows: rows.length },
+  });
+  return { ok: true, data: { generatedAt: new Date().toISOString(), rows } };
 }
 
+/** Offline check-ins older than this are refused (docs/SECURITY.md); their replay records are kept a day longer. */
+export const OFFLINE_CHECK_IN_MAX_AGE_MS = 7 * 24 * 60 * 60_000;
+
 export async function syncOfflineCheckIns(
   input: unknown,
 ): Promise<ActionResult<{ syncedIds: string[]; alreadyCheckedInIds: string[]; failed: { rsvpId: string; error: string; }[]; }>> {
@@ -92,7 +97,7 @@ export async function syncOfflineCheckIns(
 
   const rsvps = await prisma.rSVP.findMany({
     where: { eventId: ctx.event.id, id: { in: checkIns.map((checkIn) => checkIn.rsvpId) } },
-    select: { id: true, status: true, checkedInAt: true },
+    select: { id: true },
   });
   const rsvpById = new Map(rsvps.map((rsvp) => [rsvp.id, rsvp]));
   const syncedIds: string[] = [];
@@ -111,29 +116,33 @@ export async function syncOfflineCheckIns(
       failed.push({ rsvpId: checkIn.rsvpId, error: "RSVP not found for this event." });
       continue;
     }
-    const gate = gateCheckInForStatus(rsvp.status, checkIn.force);
-    if (!gate.ok) {
-      failed.push({ rsvpId: checkIn.rsvpId, error: gate.reason });
-      continue;
-    }
     const checkedInAt = new Date(checkIn.checkedInAt);
     const earliest = ctx.event.startDateTime.getTime() - 24 * 60 * 60_000;
     const latest = Math.min(Date.now() + 5 * 60_000, ctx.event.endDateTime.getTime() + 60 * 60_000);
     if (checkedInAt.getTime() < earliest || checkedInAt.getTime() > latest) {
       failed.push({ rsvpId: checkIn.rsvpId, error: "Offline check-in time is outside the event operating window." });
       continue;
     }
-    if (rsvp.checkedInAt) {
-      alreadyCheckedInIds.push(rsvp.id);
+    if (checkedInAt.getTime() < Date.now() - OFFLINE_CHECK_IN_MAX_AGE_MS) {
+      failed.push({ rsvpId: checkIn.rsvpId, error: "Offline check-ins older than 7 days are no longer accepted." });
       continue;
     }
-    const committed = await commitCheckInProjection({
+    // Claimed with its outcome in the check-in transaction: a retry returns
+    // the first outcome, whatever happened since (an undo included).
+    const commit = await commitOfflineCheckIn({
+      eventId: ctx.event.id,
+      clientMutationId: checkIn.clientMutationId,
       rsvpId: rsvp.id,
       actorUserId: ctx.actorUserId,
       source: "offline-sync",
       checkedInAt,
       force: checkIn.force,
     });
+    if (commit.kind === "mismatch") {
+      failed.push({ rsvpId: rsvp.id, error: "This offline check-in was already sent with different details." });
+      continue;
+    }
+    const committed = commit.result;
     if (committed.state === "checked-in") {
       syncedIds.push(rsvp.id);
     } else if (committed.state === "already-checked-in") {