This website requires JavaScript.
b5dabd9948
Merge pull request 'Security: signed staff tokens, fail-closed checksum, upload & submit hardening' (#2 ) from security/staff-auth-hardening into main
joelbrock
2026-10-30 11:24:28 -07:00
335cdd0c23
Refresh Next.js-generated agent rules block in AGENTS.md
Joel Brock
2026-10-30 11:20:30 -07:00
526422abed
Give /api/preview-link its own Bearer secret; constant-time token checks
Joel Brock
2026-10-30 11:20:30 -07:00
df471e0e88
Verify client-supplied file ids on submit
Joel Brock
2026-10-30 11:19:07 -07:00
0a19b57a86
Harden the extension upload endpoint (CSRF, record ACL, mime allowlist)
Joel Brock
2026-10-30 11:18:10 -07:00
c9b610590e
Fail closed in verifyChecksum; drop the Contact.get fallback
Joel Brock
2026-10-30 11:17:52 -07:00
818c979479
Replace raw staff key in URLs with signed, org-bound tokens
Joel Brock
2026-10-30 11:17:28 -07:00
e943158c49
Merge pull request 'Security: upgrade Next.js to 16.4.3 and pin Node 24' (#1 ) from security/next-16.4.3-node-24 into main
joelbrock
2026-10-30 11:06:40 -07:00
fe9bfed0d6
Upgrade Next.js to 16.4.3 and pin Node 24
Joel Brock
2026-10-30 11:04:08 -07:00
00a159ca69
Hide stage progress bars on form (header and floating bar)
Joel Brock
2026-06-25 12:24:12 -07:00
c3b63946cc
Add form-only instruction note below survey subtitle
Joel Brock
2026-06-25 10:33:34 -07:00
098bbd7cde
Remove contact identity fields from Stage 0 and widen Current stage
Joel Brock
2026-06-22 10:48:02 -07:00
a0ebef6bc5
copy edit, form subheader
Joel Brock
2026-06-22 10:28:10 -07:00
e4085aa0f3
Lightbox: pin and size to visible viewport when framed
Joel Brock
2026-06-19 08:03:40 -07:00
b4f733ee65
PROD update info help text on the form with latest from CiviCRM prd
Joel Brock
2026-06-19 08:01:01 -07:00
5124010b8a
Lightbox: fix proxy 404, cap modal size, allow multi-Civi embed
Joel Brock
2026-06-16 16:15:28 -07:00
0019996b15
Staff file proxy: restore IDOR check via column ownership
Joel Brock
2026-06-15 16:03:48 -07:00
e74462da0b
Lightbox: fix proxy 404 and PDF iframe block
Joel Brock
2026-06-15 16:00:30 -07:00
49d0d24950
Staff file proxy: allowlist inline mimes, force download otherwise
Joel Brock
2026-06-15 11:59:12 -07:00
6850ff9dee
Staff report: inline lightbox for image/PDF attachments
Joel Brock
2026-06-15 11:56:45 -07:00
5203dabeac
Submit confirm: trim copy and use 'survey' wording
Joel Brock
2026-06-11 14:41:18 -07:00
13d7f6e93b
Timeline: draw stage-period ranges from activities, milestones on top
Joel Brock
2026-06-11 14:14:36 -07:00
d3b88d92c2
Timeline: place dots by co-op stage at the event date
Joel Brock
2026-06-11 13:56:27 -07:00
ade938eaaa
Survey copy: clarify subtitle and rename submit-another button
Joel Brock
2026-06-11 13:47:35 -07:00
8dfbbea0ba
Report: drop Stage 0 lane, flip 5→1 axis, fix Actual label clipping
Joel Brock
2026-06-11 13:39:42 -07:00
2dc8ec4e6d
Civi extension: bump version to 0.3.0
Joel Brock
2026-06-10 12:35:41 -07:00
325615576a
Upload: route through Civi extension multipart endpoint
Joel Brock
2026-06-10 12:28:43 -07:00
e42e3b70ef
Upload: APIv3 Attachment.create with base64 content (not multipart)
Joel Brock
2026-06-10 12:16:32 -07:00
f74fd07ba5
Upload: switch to APIv3 Attachment.create multipart (decode bytes properly)
Joel Brock
2026-06-10 11:57:52 -07:00
e22c9226d8
Staff report: query Attachment.get per file id (no IN clause)
Joel Brock
2026-06-10 11:34:54 -07:00
6c3e8dd6a0
Staff report: APIv3 return is a string, not an array
Joel Brock
2026-06-10 11:25:06 -07:00
8ace5f41fe
Staff report: signed file URLs via APIv3 Attachment.get
Joel Brock
2026-06-10 11:05:00 -07:00
41467bd4cf
File redirect: per-entity permission check before minting fcs
Joel Brock
2026-06-10 10:49:28 -07:00
b65bc6d0e0
File redirect route: mint fcs JWT in extension, link from staff report
Joel Brock
2026-06-10 10:47:34 -07:00
50e719e1a9
Staff report: fold Y1 Monthly Sales Target row into the M matrix
Joel Brock
2026-06-10 09:29:42 -07:00
63e73e7fe6
Staff report: pass Civi-signed file URLs through to clicks
Joel Brock
2026-06-10 09:29:42 -07:00
229ef51537
Staff report: monthly Y1 matrix, value emphasis, submitter header
Joel Brock
2026-06-10 09:03:19 -07:00
bd859ce906
Form: required submitter info section above the stage pathway
Joel Brock
2026-06-10 09:03:19 -07:00
2e1244aa47
Staff report: hide section anchor nav when framed in Civi
Joel Brock
2026-06-09 17:22:27 -07:00
38f4738eca
Staff report: fix infinite iframe-grow loop when framed in Civi
Joel Brock
2026-06-09 17:14:54 -07:00
57bd5be4ab
Civi extension: register templates/ dir via hook_civicrm_config
Joel Brock
2026-06-09 17:14:54 -07:00
1364917ada
Form: confirm dialog before submitting check-in
Joel Brock
2026-06-09 13:44:33 -07:00
4d194176b1
Civi extension: register xml/Menu via hook_civicrm_xmlMenu
Joel Brock
2026-06-09 13:32:24 -07:00
a9c4a074d3
Form: drop sole required field; broaden currency field visibility
Joel Brock
2026-06-09 12:09:07 -07:00
9341f67231
Add PRODUCTION_CUTOVER.md and link from DEPLOYMENT.md
Joel Brock
2026-06-09 12:09:00 -07:00
4ca3c194d7
Staff report: CSP frame-ancestors + frame-mode + WebForm-mw Civi extension
Joel Brock
2026-06-05 17:42:35 -07:00
b548b6425b
Staff report: compact rows, anchor nav, Civi file links, Y1 matrix
Joel Brock
2026-06-05 17:28:17 -07:00
586cf14e75
Amplify: wire STAFF_REPORT_KEY into build env + .env.production
Joel Brock
2026-06-05 17:08:17 -07:00
d7a1396640
Staff file proxy: harden against SVG XSS and SSRF
Joel Brock
2026-06-05 17:02:42 -07:00
64076a145b
Staff report: drop dead .url file join (client uses proxy URL)
Joel Brock
2026-06-05 16:42:36 -07:00
e76ed39091
Docs: document STAFF_REPORT_KEY env var
Joel Brock
2026-06-05 16:38:38 -07:00
36821f42a8
Staff report: app/staff/report page with auth gate
Joel Brock
2026-06-05 16:37:15 -07:00
f889212296
Staff report: StaffReportView client component
Joel Brock
2026-06-05 16:35:15 -07:00
d83077ba09
Staff report: file proxy with stub PNG and Civi attachment streaming
Joel Brock
2026-06-05 16:31:12 -07:00
b05d7c77e3
Staff report: live Civi branch (schema discovery + activity walk)
Joel Brock
2026-06-05 16:27:23 -07:00
5a349a4f1c
Staff report: API route with stub payload and key validation
Joel Brock
2026-06-05 16:15:30 -07:00
7cd5cd6cdf
Staff report: add shared-secret key validator
Joel Brock
2026-06-05 16:09:57 -07:00
92bd784d7a
Staff report: relax CustomFieldRow JSDoc for dotted property names
Joel Brock
2026-06-05 16:09:20 -07:00
d31faf2def
Staff report: add CustomField → StaffFieldDescriptor mapper with tests
Joel Brock
2026-06-05 14:45:20 -07:00
d737950a3d
Report: extract Loading/Empty/Error states to components/report/
Joel Brock
2026-06-05 14:43:19 -07:00
5cc60467a9
Report: extract MembershipChart to components/report/
Joel Brock
2026-06-05 14:21:36 -07:00
cc2a17e7a0
Report: extract DateTimeline to components/report/
Joel Brock
2026-06-05 14:11:25 -07:00
5f5c1d6a61
Report: trim unused FieldHistory re-exports from ReportView
Joel Brock
2026-06-05 13:23:28 -07:00
89e0c7a7ea
Report: extract FieldHistory primitives to components/report/
Joel Brock
2026-06-05 13:22:24 -07:00
e2f7b1e1ab
Staff report: drop unused StaffFileMeta type (YAGNI)
Joel Brock
2026-06-05 13:10:28 -07:00
ff0deed5fb
Staff report: add StaffReportPayload and supporting types
Joel Brock
2026-06-05 13:04:27 -07:00
b474cb8004
Copy: route contact prompts to Chris @ FCI; warmer form subtitle
Joel Brock
2026-06-05 11:37:43 -07:00
9702eaa077
Footer: replace privacy blurb with copyright line; tidy thank-you and contact copy
Joel Brock
2026-06-05 11:18:32 -07:00
2400931a04
File upload pipeline: wire end-to-end via APIv4 File.create
Joel Brock
2026-06-05 07:48:57 -07:00
8159b87074
File upload pipeline: spike + endpoint skeleton (Phase 1, in progress)
Joel Brock
2026-06-05 07:11:18 -07:00
8ecf64c79b
Stage 0: org-contact custom fields (Food_Co_op_Organizing)
Joel Brock
2026-06-04 17:37:36 -07:00
b120075ca2
Rebrand: Co-op Check-in -> Co-op Survey in user-facing copy
Joel Brock
2026-06-04 17:12:03 -07:00
9bc4bbb732
Field groups: tighter style + apply to report
Joel Brock
2026-05-21 16:51:00 -07:00
8766de5ed0
Copy: "member(s)" → "member-owner(s)" in user-facing strings
Joel Brock
2026-05-21 14:08:06 -07:00
5e7774795b
Style anchors with underline + leaf color for visibility
Joel Brock
2026-05-21 13:46:51 -07:00
42b25289f8
Repair two multi-line fields the sync script left without commas
Joel Brock
2026-05-21 13:21:54 -07:00
d2d733a1d6
sync-help: ensure trailing comma before inserting new help line
Joel Brock
2026-05-21 13:21:54 -07:00
d4a6709149
Stage 1/3: add date+upload field groups; drop Stage 2 group labels
Joel Brock
2026-05-21 12:51:01 -07:00
de53fde1f7
Submit bar: animated stage-progress pills mirroring the header
Joel Brock
2026-05-21 12:41:14 -07:00
7e5b1e1197
Sticky submit bar: show org name + currently viewed stage
Joel Brock
2026-05-21 12:30:54 -07:00
2ca2d378a4
Add sync-help-from-civi script + field-group rendering
Joel Brock
2026-05-21 12:27:22 -07:00
9460e8320f
WIP: form copy and field visibility adjustments
Joel Brock
2026-05-21 12:11:23 -07:00
709d9bfd8b
WIP: form copy and field visibility adjustments
Joel Brock
2026-05-21 11:17:06 -07:00
0545dc3bc4
Pin Turbopack root to app dir to stop dev recompile loop
Joel Brock
2026-05-21 11:15:24 -07:00
f0530ed337
FCI theming refresh, contact identity fields, Amplify secrets fix
Joel Brock
2026-05-20 16:46:44 -07:00
8caa851bcc
Comment out three Stage 0 fields (Peer Group, Internal Startup Assessment x2)
Joel Brock
2026-05-20 16:04:21 -07:00
fbf668800b
Amplify: write env vars + secrets to .env.production at build time
Joel Brock
2026-05-20 16:03:33 -07:00
97222afe58
AMPLIFY_DEPLOY: document Gen 2 Environment variables vs Secrets split
Joel Brock
2026-05-19 17:28:24 -07:00
e90d007513
Amplify: install devDependencies during build (Tailwind/PostCSS need them)
Joel Brock
2026-05-19 17:13:13 -07:00
6e7df382c9
AWS Amplify Hosting deploy prep
Joel Brock
2026-05-19 16:48:38 -07:00
d88f1229ae
Report: stair-step actual line, drop sparklines, move chart into Stage 0
Joel Brock
2026-05-19 16:45:53 -07:00
ae4e47025c
Report: dedicated Membership chart (goal vs actual over time)
Joel Brock
2026-05-19 16:37:01 -07:00
00e10a992f
Timeline: hover/focus tooltips, stage 0 lane, adaptive date axis
Joel Brock
2026-05-19 16:32:50 -07:00
814b560363
Report: sparkline charts on numeric history + stage-grouped date timeline
Joel Brock
2026-05-19 16:16:57 -07:00
9209d6dc02
Prefill file fields with their file_name joined from CiviCRM
Joel Brock
2026-05-19 15:51:35 -07:00
a8ed6073a9
File fields: surface a prior-attachment indicator from RHF prefill
Joel Brock
2026-05-19 15:48:10 -07:00
dbd607b829
Prune scaffold cruft: unused Next.js template SVGs and axios dep
Joel Brock
2026-05-13 13:36:21 -07:00
899dad2323
README: refresh for current architecture, drop stale Framework Stage / mock-field notes
Joel Brock
2026-05-13 13:19:11 -07:00
ba88eb0165
Add /report — read-only activity history view
Joel Brock
2026-05-13 12:33:26 -07:00
04e69ca04c
Header: show Civi stage label prominently; restore current_stage readonly in Stage 0
Joel Brock
2026-05-13 12:09:24 -07:00
joelbrock
Joel Brock