diff --git a/documentation/TODO__Agents.md b/documentation/TODO__Agents.md index b958216f..23a6151e 100644 --- a/documentation/TODO__Agents.md +++ b/documentation/TODO__Agents.md @@ -75,6 +75,7 @@ lead record look like in the DB? - **Input Field Audit:** Several input fields are missing `name`/`id` attributes or `data-testid`. Known examples: badge override fields in `ae_comp__badge_obj_view.svelte`; template name input in `ae_comp__badge_template_form.svelte`. Matters for: accessibility, autofill, label associations, and test targeting. (For tests, use `getByLabel()` rather than `input[value*=...]` which only checks the HTML attribute, not the Svelte-bound DOM property.) ## ✅ Completed (2026-03) +- [x] **[Launcher]** Hosted file download button `require_auth` prop — added `require_auth?: boolean` (default `true`) to `ae_comp__hosted_files_download_button.svelte`; all existing consumers unchanged. Launcher `launcher_file_cont.svelte` passes `require_auth={false}` so unauthenticated kiosk users can open/download files without being blocked. (2026-03-16) - [x] **[Security]** `PUBLIC_AE_API_SECRET_KEY` audit complete. Key is `PUBLIC_*` by design (always in client bundle). Highest-risk anonymous path uses limited-permission `PUBLIC_AE_BOOTSTRAP_KEY`. Full server-side migration not justified given JWT + account_id auth layers. Current state acceptable. (2026-03-11) - [x] **[UX]** Session Expired banner — `ae_auth_error` store wired to API helpers; root layout sets `flag_expired` on 401/403; non-blocking dismissible banner rendered. (2026-03-12) - [x] **[UX]** Access Denied UI standardized — `element_access_denied.svelte` created; `/core` layout, `/events/settings`, and `/events/badges/review` updated to use it. (2026-03-12) diff --git a/package.json b/package.json index 0f0ec499..2c78d92c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "osit-aether-app-svelte", - "version": "3.00.03", + "version": "3.00.04", "description": "One Sky IT's Aether App created with Svelte, SvelteKit, Tailwind CSS, Lucide, Font Awesome, and Skeleton UI. -Scott Idem", "homepage": "https://oneskyit.com/", "private": true, diff --git a/src/routes/idaa/(idaa)/recovery_meetings/ae_idaa_comp__event_obj_id_edit.svelte b/src/routes/idaa/(idaa)/recovery_meetings/ae_idaa_comp__event_obj_id_edit.svelte index 69e2ebc7..9422ae8f 100644 --- a/src/routes/idaa/(idaa)/recovery_meetings/ae_idaa_comp__event_obj_id_edit.svelte +++ b/src/routes/idaa/(idaa)/recovery_meetings/ae_idaa_comp__event_obj_id_edit.svelte @@ -748,16 +748,16 @@ Copy and paste link: ${ SECTION 1 — Meeting Information Fields: name, description, type ============================================================ --> -
-

+
+

Meeting Information

-
-
- ${ {:else if $idaa_sess.recovery_meetings.attend_platform === 'Jitsi'} -
- -
-

+
+

Schedule

-
${ The "Add More Details?" button promotes the auto-generated text to a custom editable value by stripping the *gen* prefix. --> {#if $ae_loc.administrator_access || ($lq__event_obj && ($idaa_slct.event_obj?.show_recurring_text || ($lq__event_obj?.recurring_text && !$lq__event_obj?.recurring_text.includes('*gen*'))))} -
-
+
-

+
+

Contacts

@@ -1509,9 +1506,9 @@ Copy and paste link:
${ {#if $ae_loc.trusted_access} -
-

Meeting Owner

+

Meeting Owner

{#if $lq__event_obj?.external_person_full_name} @@ -1547,9 +1544,9 @@ Copy and paste link: ${ locked readonly for members. This is intentional: the primary contact for a meeting is nearly always the owner. Members unlock via confirm if they truly need different contact details. --> -
+
-
-
-
+
{#if show_contact_2}
-
-
@@ -1743,14 +1740,14 @@ Copy and paste link:
${ Fields: status, hide, priority, sort, group, enable, notes ============================================================ --> {#if $ae_loc.trusted_access} -
+