From 91fe38c00d5dd72a9746e40f1ad4ac50fee78337 Mon Sep 17 00:00:00 2001
From: nmemmert <67961292+nmemmert@users.noreply.github.com>
Date: Mon, 19 Oct 2026 16:38:34 -0400
Subject: [PATCH] Fix parent doc viewer: sign comment permissions server-side

Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 public/admin.html | 2 +-
 public/admin.js   | 7 +------
 server.js         | 8 ++++----
 3 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/public/admin.html b/public/admin.html
index df21853..fd99945 100644
--- a/public/admin.html
+++ b/public/admin.html
@@ -793,6 +793,6 @@
     </div>
   </div>
 
-  <script src="admin.js?v=4"></script>
+  <script src="admin.js?v=5"></script>
 </body>
 </html>
diff --git a/public/admin.js b/public/admin.js
index b081918..6e3ac54 100644
--- a/public/admin.js
+++ b/public/admin.js
@@ -3341,16 +3341,11 @@ async function openAdminDocViewer(id, key, filename, title) {
     adminDocsEditorInstance = null;
   }
 
-  const { onlyofficeUrl, config } = await api(`/api/docs/bykey/${key}/editor-config`).catch(() => null) || {};
+  const { onlyofficeUrl, config } = await api(`/api/admin/docs/bykey/${key}/editor-config`).catch(() => null) || {};
   if (!onlyofficeUrl || !config) {
     frame.innerHTML = `<div class="docs-error">Could not load document config.</div>`;
     return;
   }
-  // Parent can comment but not edit the student's text
-  config.editorConfig = config.editorConfig || {};
-  config.editorConfig.mode = 'edit';
-  config.document = config.document || {};
-  config.document.permissions = { edit: false, comment: true, download: true, print: true };
 
   function initEditor() {
     adminDocsEditorInstance = new window.DocsAPI.DocEditor('admin-doc-frame', config);
diff --git a/server.js b/server.js
index 11362b6..5aeda74 100644
--- a/server.js
+++ b/server.js
@@ -2546,13 +2546,13 @@ app.get('/api/docs/config', (req, res) => {
   res.json({ onlyofficeUrl: ONLYOFFICE_URL, serverUrl: SERVER_URL });
 });
 
-// Returns a fully-signed OnlyOffice editor config — lookup by doc key (for admin)
-app.get('/api/docs/bykey/:key/editor-config', (req, res) => {
+// Returns a fully-signed OnlyOffice editor config — parent comment-only view (PIN required)
+app.get('/api/admin/docs/bykey/:key/editor-config', requirePin, (req, res) => {
   const doc = db.prepare(`SELECT d.*, s.name AS student_name FROM documents d JOIN students s ON s.id = d.student_id WHERE d.doc_key = ?`).get(req.params.key);
   if (!doc) return res.status(404).json({ error: 'Not found' });
   const config = {
-    document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, download: true, print: true } },
-    editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'view', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
+    document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, comment: true, download: true, print: true } },
+    editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'edit', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
     type: 'desktop', height: '100%', width: '100%',
   };
   const token = jwtSign(config);