nate/homeschool
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix parent doc viewer: sign comment permissions server-side
Build and Push Docker Image / build-and-push (push) Successful in 35s
Details

Browse Source 
Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
nmemmertandClaude Sonnet 4.6 committed 2026-10-19 16:38:34 -04:00
1 parent 3e53efd752
commit 91fe38c00d
3 files changed
+6 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

public/admin.js
+1 -6
View File
@@ -3341,16 +3341,11 @@ async function openAdminDocViewer(id, key, filename, title) {
adminDocsEditorInstance = null;
}
const { onlyofficeUrl, config } = await api(`/api/docs/bykey/${key}/editor-config`).catch(() => null) || {};
const { onlyofficeUrl, config } = await api(`/api/admin/docs/bykey/${key}/editor-config`).catch(() => null) || {};
if (!onlyofficeUrl || !config) {
frame.innerHTML = `<div class="docs-error">Could not load document config.</div>`;
return;
}
// Parent can comment but not edit the student's text
config.editorConfig = config.editorConfig || {};
config.editorConfig.mode = 'edit';
config.document = config.document || {};
config.document.permissions = { edit: false, comment: true, download: true, print: true };
function initEditor() {
adminDocsEditorInstance = new window.DocsAPI.DocEditor('admin-doc-frame', config);