Let the attendance account scan without making it an admin - #26
Open
Krishna-Das20 wants to merge 2 commits into
Open
Let the attendance account scan without making it an admin#26Krishna-Das20 wants to merge 2 commits into
Krishna-Das20 wants to merge 2 commits into
Conversation
Restricting markAttendance to ADMIN closed a real hole — a participant can mint their own QR through /api/form/attendanceCode and post it back to mark themselves present — but it also locked out attendance@fedkiit.com, which is a plain USER and exists only to run a scanner at the door. Since that shipped, nobody has been able to scan. Promoting the account to ADMIN would fix it and also hand a shared login the ability to edit and delete events and export payment proofs, so instead the check becomes a permission of its own. FORM_ATTENDANCE_MARK holds the six senior-executive roles the Express author wrote and then commented out in routes/api/forms/formRoutes.js, and FORM_ATTENDANCE_ALLOWED_EMAILS names addresses that qualify regardless of role, the way FORM_ANALYTICS_ALLOWED_EMAILS already did. The account stays a USER, so it gains the scanner page and markAttendance and nothing else: addForm, editForm and deleteForm still ask isAdmin. Verified across eight role and address combinations. export-attendance stays ADMIN-only. It includes payment proof screenshots, which is a wider disclosure than scanning and a separate decision.
|
@Krishna-Das20 is attempting to deploy a commit to the fedkiitgmailcom's projects Team on Vercel. A member of the Team first needs to authorize it. |
Takes the new work from satyampandey-1105:my-changes — the /Insights page, the social-posts CRUD API, the management panel and the SocialPost model — without merging the branch itself. It was cut from Beta (fed-tech#12) and is 86 commits behind, so a real merge conflicted in next.config.ts and tried to restore src/layouts/Navbar/Navbar.tsx, a file since deleted. Taking the paths instead avoids reconciling two histories at all. Replaces the x-admin-secret header with the session check every other admin route uses. The header was a stopgap for a contributor without an admin account, but it authenticated nobody in particular: one shared password, no record of who changed a post, and the browser had to hold the secret to send it — kept in sessionStorage and a cookie that was neither httpOnly nor Secure, readable by any script on the page for a day. The session cookie is httpOnly and already identifies the person. /profile/social is gated server-side like /profile/attendance, so a signed-in participant who types the path does not get a screen of controls that all fail. The unfiltered GET is now ADMIN-only. It returns posts an admin has deliberately hidden, so leaving it open meant unpublishing a post still left it readable to anyone who dropped the query string. ?visible=true stays public; the /Insights page does not use the route either way, since SocialFeed reads Prisma directly. Insights is reachable from the navbar, which said "Insights" but pointed at /Blog. /Blog and /Social now redirect there, as do the lowercase forms, so existing links keep working. Verified against a running server: anonymous 401 on every mutating route, signed-in non-admin 403, admin full create/toggle/delete. The old secret header no longer grants anything. Not taken: the bcryptjs removal from serverExternalPackages, an em-dash corrupted to a replacement character, a tsconfig include pointing at a global.d.ts the branch does not contain, the seed script, and 942 lines of AI planning notes under .agents/ and .kilo/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restricting markAttendance to ADMIN closed a real hole — a participant can mint their own QR through /api/form/attendanceCode and post it back to mark themselves present — but it also locked out attendance@fedkiit.com, which is a plain USER and exists only to run a scanner at the door. Since that shipped, nobody has been able to scan.
Promoting the account to ADMIN would fix it and also hand a shared login the ability to edit and delete events and export payment proofs, so instead the check becomes a permission of its own. FORM_ATTENDANCE_MARK holds the six senior-executive roles the Express author wrote and then commented out in routes/api/forms/formRoutes.js, and FORM_ATTENDANCE_ALLOWED_EMAILS names addresses that qualify regardless of role, the way FORM_ANALYTICS_ALLOWED_EMAILS already did.
The account stays a USER, so it gains the scanner page and markAttendance and nothing else: addForm, editForm and deleteForm still ask isAdmin. Verified across eight role and address combinations.
export-attendance stays ADMIN-only. It includes payment proof screenshots, which is a wider disclosure than scanning and a separate decision.