nate/homeschool
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix parent doc viewer: sign comment permissions server-side
Build and Push Docker Image / build-and-push (push) Successful in 35s
Details

Browse Source 
Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
nmemmertandClaude Sonnet 4.6 committed 2026-10-19 16:38:34 -04:00
1 parent 3e53efd752
commit 91fe38c00d
3 files changed
+6 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

public/admin.html
+1 -1
View File
@@ -793,6 +793,6 @@
</div> </div>
</div> </div>
<script src="admin.js?v=4"></script> <script src="admin.js?v=5"></script>
</body> </body>
</html> </html>
public/admin.js
+1 -6
View File
@@ -3341,16 +3341,11 @@ async function openAdminDocViewer(id, key, filename, title) {
adminDocsEditorInstance = null; adminDocsEditorInstance = null;
} }
const { onlyofficeUrl, config } = await api(`/api/docs/bykey/${key}/editor-config`).catch(() => null) || {}; const { onlyofficeUrl, config } = await api(`/api/admin/docs/bykey/${key}/editor-config`).catch(() => null) || {};
if (!onlyofficeUrl || !config) { if (!onlyofficeUrl || !config) {
frame.innerHTML = `<div class="docs-error">Could not load document config.</div>`; frame.innerHTML = `<div class="docs-error">Could not load document config.</div>`;
return; return;
} }
// Parent can comment but not edit the student's text
config.editorConfig = config.editorConfig || {};
config.editorConfig.mode = 'edit';
config.document = config.document || {};
config.document.permissions = { edit: false, comment: true, download: true, print: true };
function initEditor() { function initEditor() {
adminDocsEditorInstance = new window.DocsAPI.DocEditor('admin-doc-frame', config); adminDocsEditorInstance = new window.DocsAPI.DocEditor('admin-doc-frame', config);
server.js
+4 -4
View File
@@ -2546,13 +2546,13 @@ app.get('/api/docs/config', (req, res) => {
res.json({ onlyofficeUrl: ONLYOFFICE_URL, serverUrl: SERVER_URL }); res.json({ onlyofficeUrl: ONLYOFFICE_URL, serverUrl: SERVER_URL });
}); });
// Returns a fully-signed OnlyOffice editor config — lookup by doc key (for admin) // Returns a fully-signed OnlyOffice editor config — parent comment-only view (PIN required)
app.get('/api/docs/bykey/:key/editor-config', (req, res) => { app.get('/api/admin/docs/bykey/:key/editor-config', requirePin, (req, res) => {
const doc = db.prepare(`SELECT d.*, s.name AS student_name FROM documents d JOIN students s ON s.id = d.student_id WHERE d.doc_key = ?`).get(req.params.key); const doc = db.prepare(`SELECT d.*, s.name AS student_name FROM documents d JOIN students s ON s.id = d.student_id WHERE d.doc_key = ?`).get(req.params.key);
if (!doc) return res.status(404).json({ error: 'Not found' }); if (!doc) return res.status(404).json({ error: 'Not found' });
const config = { const config = {
document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, download: true, print: true } }, document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, comment: true, download: true, print: true } },
editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'view', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } }, editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'edit', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
type: 'desktop', height: '100%', width: '100%', type: 'desktop', height: '100%', width: '100%',
}; };
const token = jwtSign(config); const token = jwtSign(config);