nate/homeschool
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix parent doc viewer: sign comment permissions server-side
Build and Push Docker Image / build-and-push (push) Successful in 35s
Details

Browse Source 
Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
nmemmertandClaude Sonnet 4.6 committed 2026-10-19 16:38:34 -04:00
1 parent 3e53efd752
commit 91fe38c00d
3 files changed
+6 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server.js
+4 -4
View File
@@ -2546,13 +2546,13 @@ app.get('/api/docs/config', (req, res) => {
res.json({ onlyofficeUrl: ONLYOFFICE_URL, serverUrl: SERVER_URL });
});
// Returns a fully-signed OnlyOffice editor config — lookup by doc key (for admin)
app.get('/api/docs/bykey/:key/editor-config', (req, res) => {
// Returns a fully-signed OnlyOffice editor config — parent comment-only view (PIN required)
app.get('/api/admin/docs/bykey/:key/editor-config', requirePin, (req, res) => {
const doc = db.prepare(`SELECT d.*, s.name AS student_name FROM documents d JOIN students s ON s.id = d.student_id WHERE d.doc_key = ?`).get(req.params.key);
if (!doc) return res.status(404).json({ error: 'Not found' });
const config = {
document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, download: true, print: true } },
editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'view', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, comment: true, download: true, print: true } },
editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'edit', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
type: 'desktop', height: '100%', width: '100%',
};
const token = jwtSign(config);