launch code cleanup

.github/workflows/ci.yml

@@ -9,9 +9,9 @@ on:
 env:
   PUBLIC_SUPABASE_URL: ${{ vars.PUBLIC_SUPABASE_URL || 'http://dummy' }}
   PUBLIC_SUPABASE_ANON_KEY: ${{ vars.PUBLIC_SUPABASE_ANON_KEY || 'anon-key' }}
-  PUBLIC_SUPABASE_SERVICE_KEY: ${{ vars.PUBLIC_SUPABASE_SERVICE_KEY }}
-  PUBLIC_GOOGLE_SERVICE_EMAIL: ${{ vars.PUBLIC_GOOGLE_SERVICE_EMAIL }}
-  PUBLIC_GOOGLE_PRIVATE_KEY: ${{ vars.PUBLIC_GOOGLE_PRIVATE_KEY }}
+  SUPABASE_SERVICE_KEY: ${{ secrets.SUPABASE_SERVICE_KEY }}
+  GOOGLE_SERVICE_EMAIL: ${{ secrets.GOOGLE_SERVICE_EMAIL }}
+  GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
 
 jobs:
   build:

.github/workflows/deploy.yml

@@ -12,9 +12,9 @@ env:
   # SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
   PUBLIC_SUPABASE_URL: ${{ vars.PUBLIC_SUPABASE_URL || 'http://dummy' }}
   PUBLIC_SUPABASE_ANON_KEY: ${{ vars.PUBLIC_SUPABASE_ANON_KEY || 'anon-key' }}
-  PUBLIC_SUPABASE_SERVICE_KEY: ${{ vars.PUBLIC_SUPABASE_SERVICE_KEY }}
-  PUBLIC_GOOGLE_SERVICE_EMAIL: ${{ vars.PUBLIC_GOOGLE_SERVICE_EMAIL }}
-  PUBLIC_GOOGLE_PRIVATE_KEY: ${{ vars.PUBLIC_GOOGLE_PRIVATE_KEY }}
+  SUPABASE_SERVICE_KEY: ${{ secrets.SUPABASE_SERVICE_KEY }}
+  GOOGLE_SERVICE_EMAIL: ${{ secrets.GOOGLE_SERVICE_EMAIL }}
+  GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
 
   # Custom environment used for the Container registry domain, and a name for the Docker image that this workflow builds.
   REGISTRY: ghcr.io
@@ -59,9 +59,9 @@ jobs:
           CONTAINER_PORT=${{ env.CONTAINER_PORT }}
           PUBLIC_SUPABASE_URL=${{ env.PUBLIC_SUPABASE_URL }}
           PUBLIC_SUPABASE_ANON_KEY=${{ env.PUBLIC_SUPABASE_ANON_KEY }}
-          PUBLIC_SUPABASE_SERVICE_KEY=${{ env.PUBLIC_SUPABASE_SERVICE_KEY }}
-          PUBLIC_GOOGLE_SERVICE_EMAIL=${{ env.PUBLIC_GOOGLE_SERVICE_EMAIL }}
-          PUBLIC_GOOGLE_PRIVATE_KEY=${{ env.PUBLIC_GOOGLE_PRIVATE_KEY }}
+          SUPABASE_SERVICE_KEY=${{ env.SUPABASE_SERVICE_KEY }}
+          GOOGLE_SERVICE_EMAIL=${{ env.GOOGLE_SERVICE_EMAIL }}
+          GOOGLE_PRIVATE_KEY=${{ env.GOOGLE_PRIVATE_KEY }}
           EOF
 
       # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.

.gitignore

@@ -2,3 +2,8 @@
 /.svelte-kit
 node_modules
 .env
+docs/
+CLAUDE.md
+.agents/
+.claude/
+skills-lock.json

src/app.d.ts

@@ -1,4 +1,5 @@
 import type { Session, SupabaseClient, User } from '@supabase/supabase-js';
+import type { AppRole } from '$lib/server/auth';
 import type { Database } from './database.types.ts'; // import generated types
 
 declare global {
@@ -9,9 +10,11 @@ declare global {
             safeGetSession: () => Promise<{ session: Session | null; user: User | null }>;
             session: Session | null;
             user: User | null;
+            userRole: AppRole | null;
         }
         interface PageData {
             session: Session | null;
+            userRole: AppRole | null;
         }
         // interface PageState {}
         // interface Platform {}

src/hooks.server.ts

@@ -1,3 +1,4 @@
+import type { AppRole } from '$lib/server/auth';
 import { type Handle } from '@sveltejs/kit';
 import { createServerClient } from '@supabase/ssr';
 import { sequence } from '@sveltejs/kit/hooks';
@@ -48,20 +49,21 @@ const supabase: Handle = ({ event, resolve }) => {
     });
 };
 
-// const authGuard: Handle = async ({ event, resolve }) => {
-//   const { session, user } = await event.locals.safeGetSession()
-//   event.locals.session = session
-//   event.locals.user = user
-//
-//   if (!event.locals.session && event.url.pathname.startsWith('/private')) {
-//     redirect(303, '/login')
-//   }
-//
-//   if (event.locals.session && event.url.pathname === '/login') {
-//     redirect(303, '/private')
-//   }
-//
-//   return resolve(event)
-// }
+const authGuard: Handle = async ({ event, resolve }) => {
+    const { locals } = event;
+    const { session, user } = await locals.safeGetSession();
+    let userRole: AppRole | null = null;
 
-export const handle: Handle = sequence(supabase);
+    if (user) {
+        const { data: profile } = await locals.supabase.from('profiles').select('role').eq('id', user.id).single();
+        userRole = (profile?.role as AppRole) ?? 'applicant';
+    }
+
+    locals.session = session;
+    locals.user = user;
+    locals.userRole = userRole;
+
+    return resolve(event);
+};
+
+export const handle: Handle = sequence(supabase, authGuard);

src/lib/logger.ts

@@ -0,0 +1,22 @@
+import { dev } from '$app/environment';
+
+function debug(...args: unknown[]) {
+    if (dev) {
+        // eslint-disable-next-line no-console
+        console.log('[DEBUG]', ...args);
+    }
+}
+
+function warn(...args: unknown[]) {
+    if (dev) {
+        // eslint-disable-next-line no-console
+        console.warn('[WARN]', ...args);
+    }
+}
+
+function error(...args: unknown[]) {
+    // eslint-disable-next-line no-console
+    console.error(...args);
+}
+
+export const logger = { debug, warn, error };

src/lib/server/auth.ts

@@ -0,0 +1,32 @@
+import { type RequestEvent, error } from '@sveltejs/kit';
+
+export type AppRole = 'applicant' | 'admin' | 'withdrawn' | 'inactive';
+
+/**
+ * Requires authenticated user. Throws 401 if not logged in.
+ */
+export function requireAuth(event: RequestEvent) {
+    const { user, session } = event.locals;
+    if (!session || !user) {
+        throw error(401, 'Authentication required');
+    }
+    return { user, session };
+}
+
+/**
+ * Requires a specific role. Throws 401 if not authenticated, 403 if wrong role.
+ */
+export function requireRole(event: RequestEvent, role: AppRole) {
+    const { user, session } = requireAuth(event);
+    if (event.locals.userRole !== role) {
+        throw error(403, 'Insufficient permissions');
+    }
+    return { user, session };
+}
+
+/**
+ * Check if current user is admin. Does not throw.
+ */
+export function isAdmin(event: RequestEvent): boolean {
+    return event.locals.userRole === 'admin';
+}

src/lib/server/supabaseAdmin.ts

@@ -0,0 +1,9 @@
+import { PUBLIC_SUPABASE_URL } from '$env/static/public';
+import { SUPABASE_SERVICE_KEY } from '$env/static/private';
+import { createClient } from '@supabase/supabase-js';
+
+/**
+ * Service-role Supabase client. Bypasses RLS.
+ * ONLY use in server-side code for admin operations.
+ */
+export const supabaseAdmin = createClient(PUBLIC_SUPABASE_URL, SUPABASE_SERVICE_KEY);

src/routes/+layout.server.ts

@@ -1,7 +1,10 @@
-export const load = async ({ locals: { safeGetSession }, cookies }) => {
+import type { LayoutServerLoad } from './$types';
+
+export const load: LayoutServerLoad = async ({ locals: { safeGetSession, userRole }, cookies }) => {
     const { session } = await safeGetSession();
     return {
         session,
         cookies: cookies.getAll(),
+        userRole: userRole ?? null,
     };
 };

src/routes/+layout.svelte

@@ -7,12 +7,13 @@
     import { page } from '$app/state';
 
     import { invalidate } from '$app/navigation';
+    import { logger } from '$lib/logger';
     import { onMount } from 'svelte';
 
     const { data, children } = $props();
     const { session, supabase } = $derived(data);
 
-    // Sync $lib variables to data props
+    // Sync $lib variables to data props (must be synchronous so children can read in onMount)
     if (data?.uuid) uuid.set(data.uuid);
     if (data?.user?.user_metadata.full_name) username.set(data.user.user_metadata.full_name);
     if (data?.filledSigsheet) filledSigsheet.set(data.filledSigsheet);
@@ -30,14 +31,12 @@
 
     // Get applicant_names_list
     onMount(async () => {
-        console.log('Fetching applicant names.');
         const { data: app_data, error: app_error } = await supabase.from('profiles').select('full_name');
         if (app_error) {
-            console.error('Error fetching profile names: ', app_error);
+            logger.error('Error fetching profile names: ', app_error);
         } else if (app_data) {
             applicant_names_list.set(app_data.map(row => row.full_name));
         }
-        console.log(applicant_names_list);
     });
 </script>
 
@@ -65,13 +64,24 @@
 
     <div class="flex w-full flex-row bg-[#161619]">
         {#if page.url.pathname !== '/login/'}
-            {#if isNavBarOpen}
-                <div
-                    class="fixed top-0 left-0 z-50 h-screen w-64 transform transition-transform duration-700 ease-in-out"
-                >
-                    <NavBar user={data.user} bind:isNavBarOpen />
-                </div>
-            {/if}
+            <!-- Backdrop overlay -->
+            <div
+                class="fixed inset-0 z-40 bg-black/50 transition-opacity duration-300
+                    {isNavBarOpen ? 'opacity-100' : 'pointer-events-none opacity-0'}"
+                role="button"
+                tabindex="-1"
+                onclick={() => (isNavBarOpen = false)}
+                onkeydown={e => {
+                    if (e.key === 'Escape') isNavBarOpen = false;
+                }}
+            ></div>
+            <!-- Sidebar -->
+            <div
+                class="fixed top-0 left-0 z-50 h-screen w-64 transition-transform duration-300 ease-in-out
+                    {isNavBarOpen ? 'translate-x-0' : '-translate-x-full'}"
+            >
+                <NavBar user={data.user} bind:isNavBarOpen />
+            </div>
         {/if}
 
         <div class="flex w-full justify-center">

src/routes/+layout.ts

@@ -1,6 +1,7 @@
 import type { Answer, ISection, Question } from './consti-quiz/constiquiz-types.ts';
 import { PUBLIC_SUPABASE_ANON_KEY, PUBLIC_SUPABASE_URL } from '$env/static/public';
 import { createBrowserClient, createServerClient, isBrowser } from '@supabase/ssr';
+import { logger } from '$lib/logger';
 
 export async function load({ data, depends, fetch }) {
     depends('supabase:auth');
@@ -22,16 +23,11 @@ export async function load({ data, depends, fetch }) {
               },
           });
 
-    const {
-        data: { session },
-    } = await supabase.auth.getSession();
-
-    const {
-        data: { user },
-    } = await supabase.auth.getUser();
+    const { session } = data;
+    const user = session?.user ?? null;
 
     if (!user) {
-        console.error('Failed to fetch user.');
+        logger.error('Failed to fetch user.');
         return {
             session: session,
             supabase: supabase,
@@ -43,13 +39,9 @@ export async function load({ data, depends, fetch }) {
     }
 
     const uuid = user.id;
-    console.log('Fetched uuid:', uuid);
-
     const username = user.email?.split('@')[0] ?? '';
-    console.log('Fetched username:', username);
 
     // Fetch filledSigsheet
-    console.log('Fetching sigsheet from Supabase with ID:', uuid);
     let filledSigsheet: Set<number> = new Set();
     try {
         const { data: sigRows, error: sigError } = await supabase
@@ -60,13 +52,11 @@ export async function load({ data, depends, fetch }) {
         if (sigError) throw sigError;
 
         filledSigsheet = new Set(sigRows?.map(row => row.member_id) ?? []);
-        console.log(`Fetched filledSigsheet: sigsheet size ${filledSigsheet.size}`);
     } catch (sigError) {
-        console.error('Error fetching sigsheet: ', sigError);
+        logger.error('Error fetching sigsheet: ', sigError);
     }
 
     // Fetch gdrive_folder_id
-    console.log('Fetching gdrive_folder_id for Applicant:', uuid);
     let gdrive_folder_id: string = '';
     try {
         const response = await fetch('/api/get_gdrive_folder', {
@@ -79,13 +69,13 @@ export async function load({ data, depends, fetch }) {
 
         if (!response.ok) {
             const gDriveError = await response.json().catch(() => ({}));
-            console.error('Error fetching gdrive folder:', gDriveError);
+            logger.error('Error fetching gdrive folder:', gDriveError);
         } else {
             const folderData = await response.json();
             gdrive_folder_id = folderData.folder_id ?? '';
         }
     } catch (gDriveError) {
-        console.error('Unexpected error fetching gdrive folder:', gDriveError);
+        logger.error('Unexpected error fetching gdrive folder:', gDriveError);
     }
 
     // Functions for fetching constiquiz
@@ -97,8 +87,7 @@ export async function load({ data, depends, fetch }) {
 	`);
 
         if (error) {
-            // TODO: handle error
-            console.error(error);
+            logger.error(error);
             throw error;
         }
 
@@ -123,7 +112,7 @@ export async function load({ data, depends, fetch }) {
             `);
 
         if (error || !data) {
-            console.error(error);
+            logger.error(error);
             throw error;
         }
 
@@ -147,7 +136,7 @@ export async function load({ data, depends, fetch }) {
             .eq('user_id', uuid);
 
         if (error) {
-            console.error(error);
+            logger.error(error);
             throw error;
         }
 
@@ -157,5 +146,17 @@ export async function load({ data, depends, fetch }) {
     // fetch in parallel for faster results
     const [sections, questions, answers] = await Promise.all([fetchSections(), fetchQuestions(), fetchAnswers()]);
 
-    return { session, supabase, user, uuid, username, filledSigsheet, gdrive_folder_id, sections, questions, answers };
+    return {
+        session,
+        supabase,
+        user,
+        uuid,
+        username,
+        filledSigsheet,
+        gdrive_folder_id,
+        sections,
+        questions,
+        answers,
+        userRole: data.userRole,
+    };
 }