andika/membership-be
1
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
65 Commits 5 Branches 0 Tags
1c262c4804364f125bffe90a7d4c0611bb145366
Commit Graph

65 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Koncept Kit
1c262c4804 1. Database Migration (backend/alembic/versions/014_add_custom_registration_data.py)- Adds custom_registration_data JSON column to users table for storing dynamic field responses2. User Model (backend/models.py)- Added custom_registration_data = Column(JSON, default=dict, nullable=False) to User model3. New API Endpoints (backend/server.py)- GET /api/registration/schema - Public endpoint returning form schema- GET /api/admin/registration/schema - Admin view with metadata- PUT /api/admin/registration/schema - Update schema- POST /api/admin/registration/schema/validate - Validate schema structure- POST /api/admin/registration/schema/reset - Reset to default- GET /api/admin/registration/field-types - Get available field types4. Validation Functions- validate_dynamic_registration() - Validates form data against schema- split_registration_data() - Splits data between User columns and custom_registration_data- evaluate_conditional_rules() - Evaluates show/hide rules5. Permissions (backend/seed_permissions_rbac.py)- Added registration.view and registration.manage permissions 2026-02-01 19:43:28 +07:00
Koncept Kit
a053075a30 Fix permission rbac 2026-01-31 01:26:12 +07:00
Koncept Kit
6f8ec1d254 make the migration idempotetnt 2026-01-31 01:16:02 +07:00
Koncept Kit
9754f2db6e 1. Models (backend/models.py)- Added PaymentMethodType enum (card, cash, bank_transfer, check)- Added stripe_customer_id column to User model- Created new PaymentMethod model with all fields specified in the plan2. Alembic Migration (backend/alembic/versions/add_payment_methods.py)- Creates payment_methods table- Adds stripe_customer_id to users table- Creates appropriate indexes3. API Endpoints (backend/server.py)Added 12 new endpoints:Member Endpoints:- GET /api/payment-methods - List user's payment methods- POST /api/payment-methods/setup-intent - Create Stripe SetupIntent- POST /api/payment-methods - Save payment method after setup- PUT /api/payment-methods/{id}/default - Set as default- DELETE /api/payment-methods/{id} - Remove payment methodAdmin Endpoints:- GET /api/admin/users/{user_id}/payment-methods - List user's methods (masked)- POST /api/admin/users/{user_id}/payment-methods/reveal - Reveal sensitive details (requires password)- POST /api/admin/users/{user_id}/payment-methods/setup-intent - Create SetupIntent for user- POST /api/admin/users/{user_id}/payment-methods - Save method on behalf- POST /api/admin/users/{user_id}/payment-methods/manual - Record manual method (cash/check)- PUT /api/admin/users/{user_id}/payment-methods/{id}/default - Set default- DELETE /api/admin/users/{user_id}/payment-methods/{id} - Delete method4. Permissions (backend/permissions_seed.py)Added 5 new permissions:- payment_methods.view- payment_methods.view_sensitive- payment_methods.create- payment_methods.delete- payment_methods.set_default 2026-01-31 01:03:17 +07:00
Koncept Kit
03e5dd8bda - 7 new API endpoints\ 
- Public theme config endpoint for frontend initialization (with 5-min cache)/- Admin CRUD for theme settings (get, update, reset)/- Logo and favicon upload/delete via Cloudflare R2 storage
 2026-01-27 21:31:17 +07:00
Koncept Kit
ab0f098f99 - Fix Member Directory to include staff- Implement Member Tiers settings endpoints 2026-01-27 16:15:44 +07:00
Koncept Kit
ea87b3f6ee - Add Dockerfile and .dockerignore- Fix initial DB creation- Fix seed permission 2026-01-26 20:06:22 +07:00
Koncept Kit
b29bb641f5 Fixes 2026-01-24 23:56:21 +07:00
Koncept Kit
d322d1334f 1. Added member_since to GET Response- - Endpoint: GET /api/admin/users/{user_id}- Now includes: member_since: 2024-03-15T10:30:00Z (or null)2. Created NEW PUT Endpoint for Admin User Profile Updates- Endpoint: PUT /api/admin/users/{user_id}- Permission Required: users.edit (admins and superadmins have this) 2026-01-21 11:35:19 +07:00
Koncept Kit
ece1e62913 Was reading from .env only → ✅ NOW FIXED to read from database 2026-01-21 00:10:02 +07:00
Koncept Kit
d3a0cabede - Details Column - Expandable chevron button for each row- Expandable Transaction Details - Click chevron to show/hide details- Payment Information Section:- Stripe Transaction IDs Section- Copy to Clipboard - One-click copy for all transaction IDs- Update Stripe webhook event permission on Stripe Config page. 2026-01-20 23:51:38 +07:00
Koncept Kit
e938baa78e - Add Settings menu for Stripe configuration- In the Member Profile page, Superadmin can assign new Role to the member- Stripe Configuration is now stored with encryption in Database 2026-01-16 19:07:58 +07:00
Koncept Kit
39324ba6f6 Database prevent dead connection errors and make login work on the first try 2026-01-07 16:23:01 +07:00
Koncept Kit
adbfa7a3c8 - Fixed MutableHeaders bug- Disable API docs in production- CORS diagnostic endpoint- Security headers + CORS middlewareMust have ENVIRONMENT=production and CORS_ORIGINS=... in .env file 2026-01-07 14:21:47 +07:00
Koncept Kit
a74f161efa Security Hardening #1 2026-01-07 14:15:50 +07:00
Koncept Kit
d818d847bc Security Hardening 2026-01-07 14:03:38 +07:00
Koncept Kit
1390e07500 Login and Session Fixes 2026-01-07 13:37:28 +07:00
Koncept Kit
810366d00f feat: Implement Option 3 - Proper RBAC with role-based staff invitations 
**Problem:** Admin had users.create permission but couldn't use it due to workflow requiring superadmin-only /admin/roles endpoint.

**Solution:** Created scalable endpoint that adapts role selection to user's permission level.

**Changes:**
- NEW: GET /admin/roles/assignable endpoint with intelligent role filtering
  - Superadmin: Returns all roles
  - Admin: Returns admin, finance, non-elevated custom roles (excludes superadmin)
  - Prevents privilege escalation via permission comparison

- UPDATED: InviteStaffDialog now uses /admin/roles/assignable
  - Removed 403 fallback logic (no longer needed)
  - Backend handles role filtering dynamically

- UPDATED: AdminStaff 'Invite Staff' button back to permission-based
  - Changed from user.role === 'superadmin' to hasPermission('users.create')
  - Both admin and superadmin can now invite staff with role restrictions

**Security:**
- ✅ Privilege escalation blocked (admin can't create superadmin)
- ✅ Custom roles filtered by permission comparison
- ✅ Multi-layer enforcement (frontend + backend)

**Files Modified:**
- backend/server.py (+94 lines)
- frontend/src/components/InviteStaffDialog.js (-14 lines)
- frontend/src/pages/admin/AdminStaff.js (1 line changed)
- RBAC_IMPLEMENTATION_FINAL.md (new documentation)

**Testing:**
- Superadmin can assign all roles including superadmin ✓
- Admin can assign admin and finance ✓
- Admin cannot see/assign superadmin ✓
- Custom role elevation detection working ✓
 2026-01-06 14:42:25 +07:00
Koncept Kit
314380eec6 Add missing endpoints, fix batch updates, and implement RSVP status 
## New Endpoints
- **GET /admin/events/{event_id}**: Get single event details (admin)
  - Allows viewing unpublished events
  - Returns full event with RSVP count

## Enhanced Endpoints
- **PUT /admin/events/{event_id}/attendance**: Accept batch updates
  - Add BatchAttendanceUpdate model for array of updates
  - Support both single and bulk attendance marking
  - Return count of updated records

- **GET /events**: Include user RSVP status in response
  - Query current user's RSVP for each event
  - Enable calendar color coding by status

- **GET /events/{event_id}**: Include user RSVP status
  - Query current user's RSVP for event details
  - Maintain consistency with list endpoint

## Bug Fixes
- **GET /members/event-activity**: Fix timezone comparison
  - Add timezone-aware conversion for event.end_at
  - Resolve "can't compare offset-naive and offset-aware" error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
 2026-01-06 01:03:01 +07:00
Koncept Kit
2b82f4acd8 Alembic migration for synchronize Database 2026-01-05 21:13:49 +07:00
Koncept Kit
cca694766b Alembic fix for PROD 2026-01-05 17:29:41 +07:00
Koncept Kit
0171546bba Database Migration fix 2026-01-05 17:24:57 +07:00
Koncept Kit
96aca7d39b Alembic Database fix 2026-01-05 17:15:16 +07:00
Koncept Kit
82319509c3 Alembic Database fix 2026-01-05 17:06:32 +07:00
Koncept Kit
2547758864 Database fix 2026-01-05 16:56:38 +07:00
Koncept Kit
669d78beb5 Fix migration 010: add column existence check for email_verification_expires 2026-01-05 13:56:37 +07:00
Koncept Kit
df789612e8 Fix migrations 004-006: add column existence checks to prevent duplicate column errors 2026-01-05 11:50:26 +07:00
Koncept Kit
9266521bf1 Fix migration 003: add column existence checks to prevent duplicate column errors 2026-01-05 02:43:15 +07:00
Koncept Kit
c8f4040244 Fix migration 002 - skip existing columns 2026-01-05 02:30:54 +07:00
Koncept Kit
c848d4240a Add missing email_verification_expires column 2026-01-05 02:28:47 +07:00
Koncept Kit
6784148058 Fix timezone comparison error in invitation verification 2026-01-05 02:26:11 +07:00
Koncept Kit
340f838925 Add comprehensive column check and migration 009 2026-01-04 23:19:05 +07:00
Koncept Kit
d967d1934e Add missing donations table columns 2026-01-04 23:09:28 +07:00
Koncept Kit
03ae921a5f Fix migration 007 - skip existing columns 2026-01-04 23:05:32 +07:00
Koncept Kit
d5f2373143 Add missing subscription_plans columns 2026-01-04 23:01:20 +07:00
Koncept Kit
7ad5bfb1e5 Fix subscription_plans.is_active column name 2026-01-04 22:56:56 +07:00
Koncept Kit
f9bfdfa879 Superadmin nullable fix 2026-01-04 22:33:48 +07:00
Koncept Kit
53bf84ba57 Subscription and Storage data mismatch 2026-01-04 22:26:33 +07:00
Koncept Kit
25b1cb916a Subscription and Storage data mismatch 2026-01-04 22:22:37 +07:00
Koncept Kit
cd8b4dcaa6 Fix database mismatches 2026-01-04 22:16:35 +07:00
Koncept Kit
efc2002a67 Fix database mismatches 2026-01-04 22:01:26 +07:00
Koncept Kit
6ec0745966 Prod Deployment Preparation 2026-01-04 19:08:54 +07:00
Koncept Kit
85199958bc Update Gitignore 2026-01-02 15:44:34 +07:00
Koncept Kit
487481b322 Test Preparation 2025-12-26 20:03:53 +07:00
andika
fad23c6e57 Merge pull request 'Donation base URL fix' (#2) from main into dev 
Reviewed-on: #2
 2025-12-18 11:04:08 +00:00
Koncept Kit
91c7fc01e6 Donation base URL fix 2025-12-18 18:02:36 +07:00
andika
3bcc69f3a2 Merge pull request '- Profile Picture\' (#1) from main into dev 
Reviewed-on: #1
 2025-12-18 10:30:00 +00:00
Koncept Kit
db13f0e9de - Profile Picture\ 
Donation Tracking\
Validation Rejection\
Subscription Data Export\
Admin Dashboard Logo\
Admin Navbar Reorganization
 2025-12-18 17:04:00 +07:00
Koncept Kit
b7ab1a897f Permission fix 2025-12-17 01:41:29 +07:00
Koncept Kit
1050abd830 Permission fix 2025-12-17 01:38:10 +07:00