Cap total LGA count at 774 on registration, with a seed-secret test bypass - #25
Merged
Conversation
Analytics, Press Releases, Live Streams, Audit Reports, Procurement,
and Users were built with dark-theme classes (text-white, text-green-
200/*, bg-white/5, border-white/10) assuming a dark page background,
but the admin content area is actually light (bg-slate-50) — headings,
subtitles, stat labels, search placeholders, and pagination text were
all rendering nearly invisible (white/pale-green on white). Converted
all six to the light theme already used correctly elsewhere in the
admin panel (LGA Approvals, Wards, Payments, Allocations).
The Users list row had the same non-stacking layout bug fixed earlier
on LGA Approvals — avatar, name, badges, and Suspend/Ban buttons were
forced into one non-wrapping row, so on mobile names and emails
truncated to a single character ("K…", "ke…") and buttons crowded the
text. Now stacks properly on narrow screens.
Also found the root cause of a stray corrupted byte discovered while
editing press-releases: the previous session's arrow-mojibake fix
(sed replacing "â†" with "←") left a dangling C1 control byte (U+0090)
immediately after the arrow in 5 files, invisible in normal viewing
but preventing exact-string edits on those lines. Fixed at the byte
level and confirmed zero remaining control-character corruption
across the whole app/ tree.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UPJE5cNDtQ4j7yeg9Xjtxw
…ypass Nigeria has exactly 774 LGAs, but POST /api/lga/register had no limit on how many rows could be created — the admin dashboard could accumulate unlimited fake LGAs. Blocks the "fresh create" branch (no matching seeded row) once the total hits 774; the "claim a seeded LGA" branch is untouched so real chairmen can always register against the official 774 seeded via /api/admin/seed. Test/seed scripts bypass the cap with the existing SEED_SECRET via an x-seed-secret header. Updates the Playwright suite's registration helpers to send the bypass header (the local test DB already exceeds 774 from prior test runs), and adds regression coverage for both the cap and the seeded-claim exemption.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /api/lga/registerhad no limit on how many rows could be created — the admin dashboard could accumulate unlimited fake LGAs beyond the real 774./api/admin/seed— is untouched, so real chairman registrations are never blocked once the official 774 are seeded.SEED_SECRET(already used to gate/api/admin/seed) as anx-seed-secretheader.SEED_SECRETproperly in.env.example(it previously existed there undocumented and duplicated).Test plan
npx tsc --noEmit— cleannpx eslinton all changed files — no new warnings/errorsx-seed-secretheader still allows creation past the cap; a wrong/missing header stays blocked; claiming an already-seeded LGA (no chairman yet) succeeds even when the total is well over 774npx playwright test --project=api— 454 passed (452 existing + 2 new)Generated by Claude Code