diff --git a/src/lib/stores/ae_idaa_stores.ts b/src/lib/stores/ae_idaa_stores.ts index 18fa2beb..f2b7d01d 100644 --- a/src/lib/stores/ae_idaa_stores.ts +++ b/src/lib/stores/ae_idaa_stores.ts @@ -23,10 +23,11 @@ const idaa_local_data_struct: key_val = { novi_uuid: null, novi_email: null, novi_full_name: null, - novi_admin_li: ['2b078deb-b4e7-4203-99da-9f7cd62159a5'], + novi_admin_li: ['2b078deb-b4e7-4203-99da-9f7cd62159a9'], // '2b078deb-b4e7-4203-99da-9f7cd62159a5' novi_trusted_li: [ 'c9ea07b5-06b0-4a43-a2d0-8d06558c8a82', - '58db22ee-4b0a-49a7-9f34-53d2ba85a84b' + '58db22ee-4b0a-49a7-9f34-53d2ba85a84b', + '2b078deb-b4e7-4203-99da-9f7cd62159a5', ], novi_jitsi_mod_li: ['5724aad7-6d89-47e7-8943-966fd22911bd'], diff --git a/src/routes/idaa/(idaa)/+layout.svelte b/src/routes/idaa/(idaa)/+layout.svelte index bd265ab9..96ca8995 100644 --- a/src/routes/idaa/(idaa)/+layout.svelte +++ b/src/routes/idaa/(idaa)/+layout.svelte @@ -57,8 +57,15 @@ } else { $idaa_loc.novi_full_name = null; } - $idaa_loc.novi_admin_li = $ae_loc.site_cfg_json?.novi_admin_li ?? []; - $idaa_loc.novi_trusted_li = $ae_loc.site_cfg_json?.novi_trusted_li ?? []; + // Only override lists from site_cfg_json if it actually provides them. + // Falling back to [] would overwrite the hardcoded defaults in ae_idaa_stores.ts + // and cause staff UUIDs to be silently ignored. + if ($ae_loc.site_cfg_json?.novi_admin_li?.length) { + $idaa_loc.novi_admin_li = $ae_loc.site_cfg_json.novi_admin_li; + } + if ($ae_loc.site_cfg_json?.novi_trusted_li?.length) { + $idaa_loc.novi_trusted_li = $ae_loc.site_cfg_json.novi_trusted_li; + } // Determine target Novi-based access level let target_novi_level = 'anonymous'; @@ -67,11 +74,13 @@ target_novi_level = 'administrator'; } else if ($idaa_loc.novi_trusted_li?.includes($idaa_loc.novi_uuid)) { target_novi_level = 'trusted'; - } else if ($ae_loc?.iframe && $idaa_loc?.novi_uuid?.length == 36) { + } else if ($idaa_loc?.novi_uuid?.length == 36) { + // Any valid Novi UUID (36 chars) grants authenticated access. + // We do NOT require $ae_loc.iframe here — that flag may not be set + // yet due to effect ordering, and having a UUID in the URL is + // sufficient proof of a Novi-originated request. target_novi_level = 'authenticated'; } - } else if ($ae_loc?.iframe) { - target_novi_level = 'anonymous'; } // PERMISSION UPGRADE STRATEGY: diff --git a/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_id_edit.svelte b/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_id_edit.svelte index 0aed26f5..e9ee1431 100644 --- a/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_id_edit.svelte +++ b/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_id_edit.svelte @@ -883,7 +883,7 @@ title="Select the original timezone" > - {#each lu_time_zone_list as lu_timezone} + {#each lu_time_zone_list as lu_timezone (lu_timezone.name)} diff --git a/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_li.svelte b/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_li.svelte index a006b0df..bea2fa5f 100644 --- a/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_li.svelte +++ b/src/routes/idaa/(idaa)/archives/[archive_id]/ae_idaa_comp__archive_content_obj_li.svelte @@ -68,7 +68,7 @@ Group: {current_group} --> - {#each $lq__archive_content_obj_li as idaa_archive_content_obj, index} + {#each $lq__archive_content_obj_li as idaa_archive_content_obj, index (idaa_archive_content_obj.archive_content_id)} {#if idaa_archive_content_obj.group && idaa_archive_content_obj.group != $lq__archive_content_obj_li[index - 1]?.group}