feat(frontend): support join button - #279
Merged
Merged
Conversation
Both `Join` and `SubmitAnswers` now name their upsert's conflict target, `(question_id, user_id)`, matched by the unique index `db/schema/answer.go` already declared — so registration answers save, and `/register/[id]` no longer has to tell people they cannot.
A visitor reading a public hackathon had nothing to do at the end of it. Signed out, there was no sign-up at all. Signed in, they were redirected to the member view, whose guard refuses a non-participant — so the one person who came to take part was answered with "You are not a confirmed member of this hackathon". The foot of the page now carries the way in: Register for a signed-in visitor, sending them to `/register/[id]`, which asks the hackathon's questions or joins outright when it asks none; sign in via Keycloak for a signed-out one, returning to this page. A finished hackathon gets no CTA — the hero's badge is already the reason. The redirect to the member view is narrowed to actual participants, waitlisted ones included.
`hooks.server.ts` and the (app) layout answer a protected route with `/?returnTo=<path>`, and nothing read it: the header's Log in named the current pathname as its callback, which on that bounce page is `/`, so every deep link into the app ended at the dashboard instead of where it asked for. The header now reads it through `safeReturnTo`, which accepts only a same-site absolute path — `//host` and `/\host` are a foreign origin wearing a path's clothes, and the parameter is public and attacker-controllable. It also stops dropping the query string, which on a filtered list or a form step is half the destination.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As someone who finds a hackathon I want to join, I can now join it from the page that describes it.
Before, that page was a dead end. Signed out, there was no sign-up button at all. Signed in, the page redirected me into the members-only view, which refuses anyone who hasn't joined — so I got an error page telling me I'm not a confirmed member. The only working way in was a private invitation link.
Now the bottom of the page carries the way in: