diff --git a/documentation/TODO__Agents.md b/documentation/TODO__Agents.md index 83195f97..2333787b 100644 --- a/documentation/TODO__Agents.md +++ b/documentation/TODO__Agents.md @@ -5,7 +5,7 @@ > **Status:** Stable — ongoing development. > **Scope:** Active/open work only. Completed detail lives in archive files. -## 🔴 LCI October — Pres Mgmt Restoration (in progress 2026-06-12) +## ✅ LCI October — Pres Mgmt Restoration (complete 2026-06-16) These features regressed over the last 6 months and must be working before the LCI conference. Reference commit for original working implementation: `bb993a102`. @@ -52,18 +52,16 @@ wrong to users. session page) reads `presenter_id`/`presentation_id` from the URL and grants presenter-level auth via `auth__kv.presenter`/`auth__kv.presentation`, not just session read access. -- [ ] **[Pres Mgmt] Presenter agreement not enforced before file upload** (verified still open, - 2026-06-16) `presenter_is_authed` in `presenter/[presenter_id]/+page.svelte` — the gate used - everywhere the upload UI is shown (`Comp_event_files_upload`, `Element_manage_event_file_li_wrap`) - — only checks sign-in state (`auth__kv.presenter`/`auth__kv.session`/person match). It has no - dependency on `.agree` at all. `require__presenter_agree` (`pres_mgmt_loc.current`) is read in - exactly one place (`presenter_page_menu.svelte`) to decide whether to *show* the Agreed/Not - Agreed button — it never blocks anything. A presenter who signs in but has not agreed can still - see and use the upload section when this setting is on. Confirmed `ae_comp__event_files_upload.svelte` - has no internal agreement check either — there is no enforcement anywhere in the chain. - Fix: gate the upload sections (and ideally `allow_basic`/`allow_moderator` on the file list too) - on `!pres_mgmt_loc.current.require__presenter_agree || $lq__auth__event_presenter_obj?.agree` - in addition to `presenter_is_authed`. +- [x] **[Pres Mgmt] Presenter agreement not enforced before file upload** (fixed 2026-06-16) + `presenter_is_authed` only checked sign-in state, never `.agree`, so a presenter could upload + without agreeing whenever `require__presenter_agree` was on. Added a new derived + `presenter_agree_ok` (`trusted_access || !require__presenter_agree || auth__event_presenter_obj.agree`) + and `presenter_can_upload` (`presenter_is_authed && presenter_agree_ok`) in + `presenter/[presenter_id]/+page.svelte`, and swapped it in everywhere the upload UI/file-list + permissions are gated (both the default view and the `manage_files` alt view — the latter's + `public_access` identity bypass is preserved but still requires `presenter_agree_ok`). Also + added an inline warning message in place of the upload section when signed in but pending + agreement, instead of it just silently disappearing. ### Session POC Sign-In diff --git a/src/routes/events/[event_id]/(pres_mgmt)/presenter/[presenter_id]/+page.svelte b/src/routes/events/[event_id]/(pres_mgmt)/presenter/[presenter_id]/+page.svelte index b1fb2434..3224dccd 100644 --- a/src/routes/events/[event_id]/(pres_mgmt)/presenter/[presenter_id]/+page.svelte +++ b/src/routes/events/[event_id]/(pres_mgmt)/presenter/[presenter_id]/+page.svelte @@ -149,6 +149,22 @@ let presenter_is_authed = $derived( ) ); +// True when the admin's "Require Presenter Agreement" setting (if on) is satisfied — +// either the requirement is off, the presenter has agreed, or staff is managing this +// on their behalf. Trusted staff always bypass it, same as the "agreed" message above. +// WHY this exists separately from presenter_is_authed: a presenter can be signed in +// (authed) without having agreed yet — being signed in must not be enough to upload +// when an agreement is required. See TODO__Agents.md "Presenter agreement not enforced +// before file upload". +let presenter_agree_ok = $derived( + $ae_loc.trusted_access || + !pres_mgmt_loc.current.require__presenter_agree || + !!$lq__auth__event_presenter_obj?.agree +); + +// The actual gate for showing/using the upload UI — signed in AND (if required) agreed. +let presenter_can_upload = $derived(presenter_is_authed && presenter_agree_ok); + // if (browser && $lq__event_presenter_obj) { // console.log('Pres Mgmt [page]: +presenter.svelte'); // $events_slct.event_presenter_obj = $lq__event_presenter_obj; @@ -379,7 +395,7 @@ let presenter_is_authed = $derived( - {#if presenter_is_authed} + {#if presenter_can_upload} {/snippet} + {:else if presenter_is_authed} +

+ + File upload is locked until you agree to the presenter terms — see the + Agreed/Not Agreed action in the Options menu above. +

{/if}
{:else if pres_mgmt_loc.current.show_content__presenter_view == 'manage_files' && $ae_loc.authenticated_access} @@ -428,7 +450,7 @@ let presenter_is_authed = $derived( - {#if presenter_is_authed || $ae_loc.public_access} + {#if presenter_can_upload || ($ae_loc.public_access && presenter_agree_ok)} {/snippet} + {:else if presenter_is_authed} +

+ + File upload is locked until you agree to the presenter terms — see the + Agreed/Not Agreed action in the Options menu above. +

{/if}