implemented role and state based authorization

always check your quotes

.gitea/workflows/cd-deploy.yaml

@@ -48,12 +48,12 @@ jobs:
           cd /var/www/html/milsim-site-v4
           version=`git log -1 --format=%H`
           echo "Current Revision: $version"
-          echo "Updating to: ${{ github.sha }}
+          echo "Updating to: ${{ github.sha }}"
           sudo -u nginx git reset --hard
-          sudo -u nginx git pull origin main
+          sudo -u nginx git fetch --tags
           sudo -u nginx git pull origin main
           new_version=`git log -1 --format=%H`
-          echo "Sucessfully updated to: $new_version
+          echo "Successfully updated to: $new_version"
 
       - name: Update Shared Dependencies and Fix Permissions
         run: |

api/.env.example

@@ -21,6 +21,7 @@ CLIENT_URL= # This is whatever URL the client web app is served on
 CLIENT_DOMAIN= #whatever.com
 APPLICATION_VERSION= # Should match release tag
 APPLICATION_ENVIRONMENT= # dev / prod
+CONFIG_ID= # configures 
 
 # Glitchtip
 GLITCHTIP_DSN=

api/src/middleware/auth.ts

@@ -0,0 +1,49 @@
+import { NextFunction, Request, Response } from "express";
+import { MemberState } from "../services/memberService";
+import { stat } from "fs";
+
+export const requireLogin = function (req: Request, res: Response, next: NextFunction) {
+    if (req.user?.id)
+        next();
+    else
+        res.sendStatus(401)
+}
+
+export function requireMemberState(state: MemberState) {
+    return function (req: Request, res: Response, next: NextFunction) {
+        if (req.user?.state === state)
+            next();
+        else
+            res.status(403).send("You must be a member of the 17th RBN to access this resource");
+    }
+}
+
+export function requireRole(requiredRoles: string | string[]) {
+    // Normalize the input to always be an array of lowercase required roles
+    const normalizedRequiredRoles: string[] = Array.isArray(requiredRoles)
+        ? requiredRoles.map(role => role.toLowerCase())
+        : [requiredRoles.toLowerCase()];
+
+    const DEV_ROLE = 'dev';
+
+    return function (req: Request, res: Response, next: NextFunction) {
+        if (!req.user || !req.user.roles) {
+            // User is not authenticated or has no roles array
+            return res.sendStatus(401);
+        }
+
+        const userRolesLowercase = req.user.roles.map(role => role.name.toLowerCase());
+
+        // Check if the user has *any* of the required roles OR the 'dev' role
+        const hasAccess = userRolesLowercase.some(userRole =>
+            userRole === DEV_ROLE || normalizedRequiredRoles.includes(userRole)
+        );
+
+        if (hasAccess) {
+            return next();
+        } else {
+            // User is authenticated but does not have the necessary permissions
+            return res.sendStatus(403);
+        }
+    };
+}

api/src/routes/applications.ts

@@ -7,11 +7,30 @@ import { MemberState, setUserState } from '../services/memberService';
 import { getRankByName, insertMemberRank } from '../services/rankService';
 import { ApplicationFull, CommentRow } from "@app/shared/types/application"
 import { assignUserToStatus } from '../services/statusService';
-import { Request, Response } from 'express';
+import { Request, response, Response } from 'express';
 import { getUserRoles } from '../services/rolesService';
+import { requireLogin, requireRole } from '../middleware/auth';
+
+//get CoC
+router.get('/coc', async (req: Request, res: Response) => {
+  const output = await fetch(`${process.env.DOC_HOST}/api/pages/714`, {
+    headers: {
+      Authorization: `Token ${process.env.DOC_TOKEN_ID}:${process.env.DOC_TOKEN_SECRET}`,
+    }
+  })
+
+  if (output.ok) {
+    const out = await output.json();
+    res.status(200).json(out.html);
+  } else {
+    console.error("Failed to fetch LOA policy from bookstack");
+    res.sendStatus(500);
+  }
+})
+
 
 // POST /application
-router.post('/', async (req, res) => {
+router.post('/', [requireLogin], async (req, res) => {
   try {
     const App = req.body?.App || {};
     const memberID = req.user.id;
@@ -29,7 +48,7 @@ router.post('/', async (req, res) => {
 });
 
 // GET /application/all
-router.get('/all', async (req, res) => {
+router.get('/all', [requireLogin, requireRole("Recruiter")], async (req, res) => {
   try {
     const rows = await getApplicationList();
     res.status(200).json(rows);
@@ -53,7 +72,7 @@ router.get('/meList', async (req, res) => {
   }
 })
 
-router.get('/me', async (req, res) => {
+router.get('/me', [requireLogin], async (req, res) => {
 
   let userID = req.user.id;
 
@@ -78,7 +97,7 @@ router.get('/me', async (req, res) => {
 })
 
 // GET /application/:id
-router.get('/me/:id', async (req: Request, res: Response) => {
+router.get('/me/:id', [requireLogin], async (req: Request, res: Response) => {
   let appID = Number(req.params.id);
   let member = req.user.id;
   try {
@@ -105,22 +124,10 @@ router.get('/me/:id', async (req: Request, res: Response) => {
 });
 
 // GET /application/:id
-router.get('/:id', async (req: Request, res: Response) => {
+router.get('/:id', [requireLogin, requireRole("Recruiter")], async (req: Request, res: Response) => {
   let appID = Number(req.params.id);
   let asAdmin = !!req.query.admin || false;
-  let user = req.user.id;
 
-  //TODO: Replace this with bigger authorization system eventually
-  if (asAdmin) {
-    let allowed = (await getUserRoles(user)).some((role) =>
-      role.name.toLowerCase() === 'dev' ||
-      role.name.toLowerCase() === 'recruiter' ||
-      role.name.toLowerCase() === 'administrator')
-    console.log(allowed)
-    if (!allowed) {
-      return res.sendStatus(403)
-    }
-  }
   try {
     const application = await getApplicationByID(appID);
     if (application === undefined)
@@ -141,8 +148,9 @@ router.get('/:id', async (req: Request, res: Response) => {
 });
 
 // POST /application/approve/:id
-router.post('/approve/:id', async (req, res) => {
-  const appID = req.params.id;
+router.post('/approve/:id', [requireLogin, requireRole("Recruiter")], async (req: Request, res: Response) => {
+  const appID = Number(req.params.id);
+  const approved_by = req.user.id;
 
   try {
     const app = await getApplicationByID(appID);
@@ -153,14 +161,14 @@ router.post('/approve/:id', async (req, res) => {
       throw new Error("Something went wrong approving the application");
     }
 
-    console.log(app.member_id);
     //update user profile
     await setUserState(app.member_id, MemberState.Member);
 
-    let nextRank = await getRankByName('Recruit')
-    await insertMemberRank(app.member_id, nextRank.id);
-    //assign user to "pending basic"
-    await assignUserToStatus(app.member_id, 1);
+    await pool.query('CALL sp_accept_new_recruit_validation(?, ?, ?, ?)', [Number(process.env.CONFIG_ID), app.member_id, approved_by, approved_by])
+    // let nextRank = await getRankByName('Recruit')
+    // await insertMemberRank(app.member_id, nextRank.id);
+    // //assign user to "pending basic"
+    // await assignUserToStatus(app.member_id, 1);
     res.sendStatus(200);
   } catch (err) {
     console.error('Approve failed:', err);
@@ -169,7 +177,7 @@ router.post('/approve/:id', async (req, res) => {
 });
 
 // POST /application/deny/:id
-router.post('/deny/:id', async (req, res) => {
+router.post('/deny/:id', [requireLogin, requireRole("Recruiter")], async (req, res) => {
   const appID = req.params.id;
 
   try {
@@ -184,7 +192,7 @@ router.post('/deny/:id', async (req, res) => {
 });
 
 // POST /application/:id/comment
-router.post('/:id/comment', async (req: Request, res: Response) => {
+router.post('/:id/comment', [requireLogin], async (req: Request, res: Response) => {
   const appID = req.params.id;
   const data = req.body.message;
   const user = req.user;
@@ -227,7 +235,7 @@ VALUES(?, ?, ?);`
 });
 
 // POST /application/:id/comment
-router.post('/:id/adminComment', async (req: Request, res: Response) => {
+router.post('/:id/adminComment', [requireLogin, requireRole("Recruiter")], async (req: Request, res: Response) => {
   const appID = req.params.id;
   const data = req.body.message;
   const user = req.user;
@@ -282,4 +290,5 @@ router.post('/restart', async (req: Request, res: Response) => {
   }
 })
 
+
 module.exports = router;

api/src/routes/auth.ts

@@ -6,7 +6,11 @@ dotenv.config();
 const express = require('express');
 const { param } = require('./applications');
 const router = express.Router();
+import { Role } from '@app/shared/types/roles';
 import pool from '../db';
+import { requireLogin } from '../middleware/auth';
+import { getUserRoles } from '../services/rolesService';
+import { getUserState, MemberState } from '../services/memberService';
 const querystring = require('querystring');
 
 
@@ -18,16 +22,16 @@ passport.use(new OpenIDConnectStrategy({
     clientID: process.env.AUTH_CLIENT_ID,
     clientSecret: process.env.AUTH_CLIENT_SECRET,
     callbackURL: process.env.AUTH_REDIRECT_URI,
-    scope: ['openid', 'profile', 'discord']
+    scope: ['openid', 'profile']
 }, async function verify(issuer, sub, profile, jwtClaims, accessToken, refreshToken, params, cb) {
 
-    console.log('--- OIDC verify() called ---');
-    console.log('issuer:', issuer);
-    console.log('sub:', sub);
-    console.log('params:', params);
-    console.log('profile:', profile);
-    console.log('id_token claims:', JSON.stringify(jwtClaims, null, 2));
-    console.log('preferred_username:', jwtClaims?.preferred_username);
+    // console.log('--- OIDC verify() called ---');
+    // console.log('issuer:', issuer);
+    // console.log('sub:', sub);
+    // // console.log('profile:', JSON.stringify(profile, null, 2));
+    // console.log('profile:', profile);
+    // console.log('id_token claims:', JSON.stringify(jwtClaims, null, 2));
+    // console.log('preferred_username:', jwtClaims?.preferred_username);
 
     const con = await pool.getConnection();
     try {
@@ -66,12 +70,6 @@ router.get('/login', (req, res, next) => {
     next();
 }, passport.authenticate('openidconnect'));
 
-// router.get('/callback', (req, res, next) => {
-//     passport.authenticate('openidconnect', {
-//         successRedirect: req.session.redirectTo,
-//         failureRedirect: process.env.CLIENT_URL
-//     })
-// });
 
 router.get('/callback', (req, res, next) => {
     const redirectURI = req.session.redirectTo;
@@ -90,7 +88,7 @@ router.get('/callback', (req, res, next) => {
     })(req, res, next);
 });
 
-router.get('/logout', function (req, res, next) {
+router.get('/logout', [requireLogin], function (req, res, next) {
     req.logout(function (err) {
         if (err) { return next(err); }
         var params = {
@@ -110,15 +108,17 @@ passport.serializeUser(function (user, cb) {
 passport.deserializeUser(function (user, cb) {
     process.nextTick(async function () {
 
-        const memberID = user.memberId;
+        const memberID = user.memberId as number;
 
         const con = await pool.getConnection();
 
-        var userData;
+        var userData: { id: number, name: string, roles: Role[], state: MemberState };
         try {
             let userResults = await con.query(`SELECT id, name FROM members WHERE id = ?;`, [memberID])
             userData = userResults[0];
-
+            let userRoles = await getUserRoles(memberID);
+            userData.roles = userRoles;
+            userData.state = await getUserState(memberID);
         } catch (error) {
             console.error(error)
         } finally {
@@ -128,5 +128,19 @@ passport.deserializeUser(function (user, cb) {
     });
 });
 
+declare global {
+    namespace Express {
+        interface Request {
+            user: {
+                id: number;
+                name: string;
+                roles: Role[];
+                state: MemberState;
+            };
+        }
+    }
+}
+
+
 
 module.exports = router;

api/src/routes/calendar.ts

@@ -1,6 +1,7 @@
 import { Request, Response } from "express";
 import { createEvent, getEventAttendance, getEventDetails, getShortEventsInRange, setAttendanceStatus, setEventCancelled, updateEvent } from "../services/calendarService";
 import { CalendarAttendance, CalendarEvent } from "@app/shared/types/calendar";
+import { requireLogin } from "../middleware/auth";
 
 const express = require('express');
 const r = express.Router();
@@ -35,7 +36,7 @@ r.get('/upcoming', async (req, res) => {
     res.sendStatus(501);
 })
 
-r.post('/:id/cancel', async (req: Request, res: Response) => {
+r.post('/:id/cancel', [requireLogin], async (req: Request, res: Response) => {
     try {
         const eventID = Number(req.params.id);
         setEventCancelled(eventID, true);
@@ -45,7 +46,7 @@ r.post('/:id/cancel', async (req: Request, res: Response) => {
         res.status(500).send('Error setting cancel status');
     }
 })
-r.post('/:id/uncancel', async (req: Request, res: Response) => {
+r.post('/:id/uncancel', [requireLogin], async (req: Request, res: Response) => {
     try {
         const eventID = Number(req.params.id);
         setEventCancelled(eventID, false);
@@ -57,7 +58,7 @@ r.post('/:id/uncancel', async (req: Request, res: Response) => {
 })
 
 
-r.post('/:id/attendance', async (req: Request, res: Response) => {
+r.post('/:id/attendance', [requireLogin], async (req: Request, res: Response) => {
     try {
         let member = req.user.id;
         let event = Number(req.params.id);
@@ -85,7 +86,7 @@ r.get('/:id', async (req: Request, res: Response) => {
 
 
 //post a new calendar event 
-r.post('/', async (req: Request, res: Response) => {
+r.post('/', [requireLogin], async (req: Request, res: Response) => {
     try {
         const member = req.user.id;
         let event: CalendarEvent = req.body;
@@ -100,7 +101,7 @@ r.post('/', async (req: Request, res: Response) => {
     }
 })
 
-r.put('/', async (req: Request, res: Response) => {
+r.put('/', [requireLogin], async (req: Request, res: Response) => {
     try {
         let event: CalendarEvent = req.body;
         event.start = new Date(event.start);

api/src/routes/course.ts

@@ -1,10 +1,14 @@
 import { CourseAttendee, CourseEventDetails } from "@app/shared/types/course";
 import { getAllCourses, getCourseEventAttendees, getCourseEventDetails, getCourseEventRoles, getCourseEvents, insertCourseEvent } from "../services/CourseSerivce";
 import { Request, Response, Router } from "express";
+import { requireLogin } from "../middleware/auth";
 
 const courseRouter = Router();
 const eventRouter = Router();
 
+courseRouter.use(requireLogin)
+eventRouter.use(requireLogin)
+
 courseRouter.get('/', async (req, res) => {
     try {
         const courses = await getAllCourses();

api/src/routes/loa.ts

@@ -5,6 +5,9 @@ import { Request, Response } from 'express';
 import pool from '../db';
 import { closeLOA, createNewLOA, getAllLOA, getLOAbyID, getLoaTypes, getUserLOA, setLOAExtension } from '../services/loaService';
 import { LOARequest } from '@app/shared/types/loa';
+import { requireLogin, requireRole } from '../middleware/auth';
+
+router.use(requireLogin);
 
 //member posts LOA
 router.post("/", async (req: Request, res: Response) => {
@@ -23,7 +26,7 @@ router.post("/", async (req: Request, res: Response) => {
 });
 
 //admin posts LOA
-router.post("/admin", async (req: Request, res: Response) => {
+router.post("/admin", [requireRole("17th Administrator")], async (req: Request, res: Response) => {
     let LOARequest = req.body as LOARequest;
     LOARequest.created_by = req.user.id;
     LOARequest.filed_date = new Date();
@@ -63,7 +66,7 @@ router.get("/history", async (req: Request, res: Response) => {
     }
 })
 
-router.get('/all', async (req, res) => {
+router.get('/all', [requireRole("17th Administrator")], async (req, res) => {
     try {
         const result = await getAllLOA();
         res.status(200).json(result)
@@ -101,7 +104,7 @@ router.post('/cancel/:id', async (req: Request, res: Response) => {
 })
 
 //TODO: enforce admin only
-router.post('/adminCancel/:id', async (req: Request, res: Response) => {
+router.post('/adminCancel/:id', [requireRole("17th Administrator")], async (req: Request, res: Response) => {
     let closer = req.user.id;
     try {
         await closeLOA(Number(req.params.id), closer);
@@ -113,7 +116,7 @@ router.post('/adminCancel/:id', async (req: Request, res: Response) => {
 })
 
 // TODO: Enforce admin only
-router.post('/extend/:id', async (req: Request, res: Response) => {
+router.post('/extend/:id', [requireRole("17th Administrator")], async (req: Request, res: Response) => {
     const to: Date = req.body.to;
 
     if (!to) {

api/src/routes/members.js

@@ -2,18 +2,15 @@ const express = require('express');
 const router = express.Router();
 
 import pool from '../db';
+import { requireLogin, requireMemberState, requireRole } from '../middleware/auth';
 import { getUserActiveLOA } from '../services/loaService';
-import { getUserData } from '../services/memberService';
+import { getUserData, MemberState } from '../services/memberService';
 import { getUserRoles } from '../services/rolesService';
 
-router.use((req, res, next) => {
-    console.log(req.user);
-    console.log('Time:', Date.now())
-    next()
-})
+router.use(requireLogin);
 
 //get all users
-router.get('/', async (req, res) => {
+router.get('/', [requireMemberState(MemberState.Member)], async (req, res) => {
     try {
         const result = await pool.query(
             `SELECT
@@ -27,7 +24,7 @@ router.get('/', async (req, res) => {
                     AND UTC_TIMESTAMP() BETWEEN l.start_date AND l.end_date
                 ) THEN 1 ELSE 0
             END AS on_loa
-            FROM view_member_rank_status_all v;`);
+            FROM view_member_rank_unit_status_latest v;`);
         return res.status(200).json(result);
     } catch (err) {
         console.error('Error fetching users:', err);
@@ -63,7 +60,7 @@ router.get('/me', async (req, res) => {
 router.get('/:id', async (req, res) => {
     try {
         const userId = req.params.id;
-        const result = await pool.query('SELECT * FROM view_member_rank_status_all WHERE id = $1;', [userId]);
+        const result = await pool.query('SELECT * FROM view_member_rank_unit_status_latest WHERE id = $1;', [userId]);
         if (result.rows.length === 0) {
             return res.status(404).json({ error: 'User not found' });
         }

api/src/routes/ranks.js

@@ -1,10 +1,15 @@
 const express = require('express');
 const r = express.Router();
 const ur = express.Router();
-const { getAllRanks, insertMemberRank } = require('../services/rankService')
+const { getAllRanks, insertMemberRank } = require('../services/rankService');
+const { requireLogin } = require('../middleware/auth');
+
+r.use(requireLogin)
+ur.use(requireLogin)
 
 //insert a new latest rank for a user
-ur.post('/', async (req, res) => {3
+ur.post('/', async (req, res) => {
+    3
     try {
         const change = req.body?.change;
         await insertMemberRank(change.member_id, change.rank_id, change.date);

api/src/routes/roles.js

@@ -3,8 +3,12 @@ const r = express.Router();
 const ur = express.Router();
 
 import pool from '../db';
+import { requireLogin } from '../middleware/auth';
 import { assignUserGroup, createGroup } from '../services/rolesService';
 
+r.use(requireLogin)
+ur.use(requireLogin)
+
 //manually assign a member to a group
 ur.post('/', async (req, res) => {
     try {
@@ -49,7 +53,7 @@ r.get('/', async (req, res) => {
         const membersRoles = await con.query(`
             SELECT mr.role_id, v.*
             FROM members_roles mr
-            JOIN view_member_rank_status_all v ON mr.member_id = v.member_id
+            JOIN view_member_rank_unit_status_latest v ON mr.member_id = v.member_id
             `);
 
 

api/src/routes/statuses.js

@@ -3,6 +3,10 @@ const status = express.Router();
 const memberStatus = express.Router();
 
 import pool from '../db';
+import { requireLogin } from '../middleware/auth';
+
+status.use(requireLogin);
+memberStatus.use(requireLogin);
 
 //insert a new latest rank for a user
 memberStatus.post('/', async (req, res) => {

api/src/services/memberService.ts

@@ -22,13 +22,8 @@ export async function setUserState(userID: number, state: MemberState) {
     return await pool.query(sql, [state, userID]);
 }
 
-declare global {
-  namespace Express {
-    interface Request {
-      user: {
-        id: number;
-        name: string;
-      };
-    }
-  }
-}
+export async function getUserState(user: number): Promise<MemberState> {
+    let out = await pool.query(`SELECT state FROM members WHERE id = ?`, [user]);
+    console.log('hi')
+    return (out[0].state as MemberState);
+}

api/src/services/rankService.ts

@@ -21,8 +21,8 @@ export async function insertMemberRank(member_id: number, rank_id: number): Prom
 
 export async function insertMemberRank(member_id: number, rank_id: number, date?: Date): Promise<void> {
     const sql = date
-        ? `INSERT INTO members_ranks (member_id, rank_id, event_date) VALUES (?, ?, ?);`
-        : `INSERT INTO members_ranks (member_id, rank_id, event_date) VALUES (?, ?, NOW());`;
+        ? `INSERT INTO members_ranks (member_id, rank_id, start_date) VALUES (?, ?, ?);`
+        : `INSERT INTO members_ranks (member_id, rank_id, start_date) VALUES (?, ?, NOW());`;
 
     const params = date
         ? [member_id, rank_id, date]

api/src/services/statusService.ts

@@ -1,6 +1,6 @@
 import pool from "../db"
 
 export async function assignUserToStatus(userID: number, statusID: number) {
-    const sql = `INSERT INTO members_statuses (member_id, status_id, event_date) VALUES (?, ?, NOW())`
+    const sql = `INSERT INTO members_statuses (member_id, status_id, start_date) VALUES (?, ?, NOW())`
     await pool.execute(sql, [userID, statusID]);
 }

ui/src/api/application.ts

@@ -59,7 +59,9 @@ export async function postAdminChatMessage(message: any, post_id: number) {
 }
 
 export async function getAllApplications(): Promise<ApplicationFull> {
-  const res = await fetch(`${addr}/application/all`)
+  const res = await fetch(`${addr}/application/all`, {
+    credentials: 'include',
+  })
 
   if (res.ok) {
     return res.json()
@@ -89,7 +91,7 @@ export async function getMyApplication(id: number): Promise<ApplicationFull> {
 }
 
 export async function approveApplication(id: Number) {
-  const res = await fetch(`${addr}/application/approve/${id}`, { method: 'POST' })
+  const res = await fetch(`${addr}/application/approve/${id}`, { method: 'POST', credentials: 'include' })
 
   if (!res.ok) {
     console.error("Something went wrong approving the application")
@@ -97,7 +99,7 @@ export async function approveApplication(id: Number) {
 }
 
 export async function denyApplication(id: Number) {
-  const res = await fetch(`${addr}/application/deny/${id}`, { method: 'POST' })
+  const res = await fetch(`${addr}/application/deny/${id}`, { method: 'POST', credentials: 'include' })
 
   if (!res.ok) {
     console.error("Something went wrong denying the application")
@@ -113,4 +115,20 @@ export async function restartApplication() {
   if (!res.ok) {
     console.error("Something went wrong restarting your application")
   }
+}
+
+export async function getCoC(): Promise<string> {
+  const res = await fetch(`${addr}/application/coc`, {
+    method: "GET",
+    credentials: 'include',
+  });
+  if (res.ok) {
+    const out = res.json();
+    if (!out) {
+      return null;
+    }
+    return out;
+  } else {
+    return null;
+  }
 }

ui/src/api/member.ts

@@ -3,6 +3,8 @@ export type Member = {
     member_name: string;
     rank: string | null;
     rank_date: string | null;
+    unit: string | null;
+    unit_date: string | null;
     status: string | null;
     status_date: string | null;
     on_loa: boolean | null;

ui/src/api/trainingReport.ts

@@ -4,7 +4,9 @@ import { Course, CourseAttendeeRole, CourseEventDetails, CourseEventSummary } fr
 const addr = import.meta.env.VITE_APIHOST;
 
 export async function getTrainingReports(sortMode: string, search: string): Promise<CourseEventSummary[]> {
-    const res = await fetch(`${addr}/courseEvent?sort=${sortMode}&search=${search}`);
+    const res = await fetch(`${addr}/courseEvent?sort=${sortMode}&search=${search}`, {
+        credentials: 'include',
+    });
 
     if (res.ok) {
         return await res.json() as Promise<CourseEventSummary[]>;
@@ -15,7 +17,9 @@ export async function getTrainingReports(sortMode: string, search: string): Prom
 }
 
 export async function getTrainingReport(id: number): Promise<CourseEventDetails> {
-    const res = await fetch(`${addr}/courseEvent/${id}`);
+    const res = await fetch(`${addr}/courseEvent/${id}`, {
+        credentials: 'include',
+    });
 
     if (res.ok) {
         return await res.json() as Promise<CourseEventDetails>;
@@ -26,10 +30,12 @@ export async function getTrainingReport(id: number): Promise<CourseEventDetails>
 }
 
 export async function getAllTrainings(): Promise<Course[]> {
-    const res = await fetch(`${addr}/course`);
+    const res = await fetch(`${addr}/course`, {
+            credentials: 'include',
+    });
 
     if (res.ok) {
-        return await res.json() as Promise<Course[]>; 
+        return await res.json() as Promise<Course[]>;
     } else {
         console.error("Something went wrong");
         throw new Error("Failed to load training list");
@@ -37,7 +43,9 @@ export async function getAllTrainings(): Promise<Course[]> {
 }
 
 export async function getAllAttendeeRoles(): Promise<CourseAttendeeRole[]> {
-    const res = await fetch(`${addr}/course/roles`);
+    const res = await fetch(`${addr}/course/roles`, {
+        credentials: 'include',
+    });
 
     if (res.ok) {
         return await res.json() as Promise<CourseAttendeeRole[]>;

ui/src/assets/base.css

@@ -168,7 +168,7 @@
 }
 
 /* Root container */
-.ListRendererV2-container {
+.bookstack-container {
   font-family: var(--font-sans, system-ui), sans-serif;
   color: var(--foreground);
   line-height: 1.45;
@@ -178,56 +178,53 @@
 }
 
 /* Headers */
-.ListRendererV2-container h4 {
+.bookstack-container h4 {
   margin: 0.9rem 0 0.4rem 0;
   font-weight: 600;
   line-height: 1.35;
   font-size: 1.05rem;
   color: var(--foreground);
-  /* PURE WHITE */
 }
 
-.ListRendererV2-container h5 {
+.bookstack-container h5 {
   margin: 0.9rem 0 0.4rem 0;
   font-weight: 600;
   line-height: 1.35;
   font-size: 0.95rem;
   color: var(--foreground);
-  /* Still white (change to muted if desired) */
 }
 
 /* Lists */
-.ListRendererV2-container ul {
+.bookstack-container ul {
   list-style-type: disc;
   margin-left: 1.1rem;
   margin-bottom: 0.6rem;
   padding-left: 0.6rem;
   color: var(--muted-foreground);
-  /* dim text */
 }
 
 /* Nested lists */
-.ListRendererV2-container ul ul {
+.bookstack-container ul ul {
   list-style-type: circle;
   margin-left: 0.9rem;
 }
 
 /* List items */
-.ListRendererV2-container li {
+.bookstack-container li {
   margin: 0.15rem 0;
   padding-left: 0.1rem;
   color: var(--muted-foreground);
 }
 
 /* Bullet color */
-.ListRendererV2-container li::marker {
+.bookstack-container li::marker {
   color: var(--muted-foreground);
 }
 
 /* Inline elements */
-.ListRendererV2-container li p,
-.ListRendererV2-container li span,
-.ListRendererV2-container p {
+.bookstack-container li p,
+.bookstack-container li span,
+.bookstack-container p {
   display: inline;
   margin: 0;
   padding: 0;
@@ -235,6 +232,45 @@
 }
 
 /* Top-level spacing */
-.ListRendererV2-container>ul>li {
+.bookstack-container>ul>li {
   margin-top: 0.3rem;
+}
+
+/* links */
+.bookstack-container a {
+  color: var(--color-primary);
+  margin-top: 0.3rem;
+}
+
+.bookstack-container a:hover {
+  text-decoration: underline;
+}
+
+/* Scrollbar stuff */
+/* Firefox */
+.scrollbar-themed {
+  scrollbar-width: thin;
+  scrollbar-color: #555 #1f1f1f;
+  padding-right: 6px;
+}
+
+/* Chrome, Edge, Safari */
+.scrollbar-themed::-webkit-scrollbar {
+  width: 10px;
+  /* slightly wider to allow padding look */
+}
+
+.scrollbar-themed::-webkit-scrollbar-track {
+  background: #1f1f1f;
+  margin-left: 6px;
+  /* ❗ adds space between content + scrollbar */
+}
+
+.scrollbar-themed::-webkit-scrollbar-thumb {
+  background: #555;
+  border-radius: 9999px;
+}
+
+.scrollbar-themed::-webkit-scrollbar-thumb:hover {
+  background: #777;
 }

ui/src/components/application/ApplicationForm.vue

@@ -13,10 +13,18 @@ import Input from '@/components/ui/input/Input.vue';
 import Textarea from '@/components/ui/textarea/Textarea.vue';
 import { toTypedSchema } from '@vee-validate/zod';
 import { Form } from 'vee-validate';
-import { onMounted, ref } from 'vue';
+import { nextTick, onMounted, ref, watch } from 'vue';
 import * as z from 'zod';
 import DateInput from '../form/DateInput.vue';
 import { ApplicationData } from '@shared/types/application';
+import Dialog from '../ui/dialog/Dialog.vue';
+import DialogTrigger from '../ui/dialog/DialogTrigger.vue';
+import DialogContent from '../ui/dialog/DialogContent.vue';
+import DialogHeader from '../ui/dialog/DialogHeader.vue';
+import DialogTitle from '../ui/dialog/DialogTitle.vue';
+import DialogDescription from '../ui/dialog/DialogDescription.vue';
+import { getCoC } from '@/api/application';
+import { startBrowserTracingPageLoadSpan } from '@sentry/vue';
 
 const regexA = /^https?:\/\/steamcommunity\.com\/id\/[A-Za-z0-9_]+\/?$/;
 const regexB = /^https?:\/\/steamcommunity\.com\/profiles\/\d+\/?$/;
@@ -61,7 +69,7 @@ async function onSubmit(val: any) {
   emit('submit', val);
 }
 
-onMounted(() => {
+onMounted(async () => {
   if (props.data !== null) {
     const parsed = typeof props.data === "string"
       ? JSON.parse(props.data)
@@ -71,8 +79,35 @@ onMounted(() => {
   } else {
     initialValues.value = { ...fallbackInitials };
   }
+
+  // CoCbox.value.innerHTML = await getCoC()
+  CoCString.value = await getCoC();
 })
 
+const showCoC = ref(false);
+const CoCbox = ref<HTMLElement>();
+const CoCString = ref<string>();
+
+async function onDialogToggle(state: boolean) {
+  showCoC.value = state;
+}
+
+function enforceExternalLinks() {
+  if (!CoCbox.value) return;
+
+  const links = CoCbox.value.querySelectorAll("a");
+  links.forEach(a => {
+    a.setAttribute("target", "_blank");
+    a.setAttribute("rel", "noopener noreferrer");
+  });
+}
+
+watch(() => showCoC.value, async () => {
+  if (showCoC) {
+    await nextTick(); // wait for v-html to update
+    enforceExternalLinks();
+  }
+});
 
 </script>
 
@@ -273,7 +308,8 @@ onMounted(() => {
         <FormControl>
           <div class="flex items-center gap-2">
             <Checkbox :model-value="value" @update:model-value="handleChange" :disabled="readOnly" />
-            <span>By checking this box, you accept the <Button variant="link" class="p-0 h-min">Code of
+            <span>By checking this box, you accept the <Button variant="link" class="p-0 h-min"
+                @click.prevent.stop="showCoC = true">Code of
                 Conduct</Button>.</span>
           </div>
         </FormControl>
@@ -284,7 +320,19 @@ onMounted(() => {
     </FormField>
 
     <div class="pt-2" v-if="!readOnly">
-      <Button type="submit" :onClick="() => console.log('hi')" :disabled="readOnly">Submit Application</Button>
+      <Button type="submit" :disabled="readOnly">Submit Application</Button>
     </div>
+
+    <Dialog :open="showCoC" @update:open="onDialogToggle">
+      <DialogContent class="sm:max-w-fit">
+        <DialogHeader>
+          <DialogTitle>Community Code of Conduct</DialogTitle>
+          <DialogDescription class="w-full max-h-[75vh] overflow-y-auto scrollbar-themed">
+            <div v-html="CoCString" ref="CoCbox" class="bookstack-container w-full"></div>
+          </DialogDescription>
+        </DialogHeader>
+      </DialogContent>
+    </Dialog>
+
   </Form>
 </template>

ui/src/components/loa/loaForm.vue

@@ -132,7 +132,7 @@ const maxEndDate = computed(() => {
     <div class="flex flex-row-reverse gap-6 mx-auto w-full" :class="!adminMode ? 'max-w-5xl' : 'max-w-5xl'">
         <div v-if="!adminMode" class="flex-1 flex flex-col space-x-4 rounded-md border p-4">
             <p class="scroll-m-20 text-2xl font-semibold tracking-tight">LOA Policy</p>
-            <div ref="policyRef">
+            <div ref="policyRef" class="bookstack-container">
                 <!-- LOA policy gets loaded here -->
             </div>
         </div>

ui/src/pages/ManageApplications.vue

@@ -1,5 +1,5 @@
 <script setup>
-import { getAllApplications, approveApplication, denyApplication     } from '@/api/application';
+import { getAllApplications, approveApplication, denyApplication } from '@/api/application';
 import { ApplicationStatus } from '@shared/types/application'
 import {
     Table,
@@ -96,39 +96,50 @@ onMounted(async () => {
         <!-- application list -->
         <div :class="openPanel == false ? 'w-full' : 'w-2/5'" class="pr-9">
             <h1 class="scroll-m-20 text-2xl font-semibold tracking-tight">Manage Applications</h1>
-            <Table>
-                <TableHeader>
-                    <TableRow>
-                        <TableHead>User</TableHead>
-                        <TableHead>Date Submitted</TableHead>
-                        <TableHead class="text-right">Status</TableHead>
-                    </TableRow>
-                </TableHeader>
-                <TableBody class="overflow-y-auto scrollbar-themed">
-                    <TableRow v-for="app in appList" :key="app.id" class="cursor-pointer"
-                        :onClick="() => { openApplication(app.id) }">
-                        <TableCell class="font-medium">{{ app.member_name }}</TableCell>
-                        <TableCell :title="formatExact(app.submitted_at)">
-                            {{ formatAgo(app.submitted_at) }}
-                        </TableCell>
-                        <TableCell v-if="app.app_status === ApplicationStatus.Pending"
-                            class="inline-flex items-end gap-2">
-                            <Button variant="success" @click.stop="() => { handleApprove(app.id) }">
-                                <CheckIcon></CheckIcon>
-                            </Button>
-                            <Button variant="destructive" @click.stop="() => { handleDeny(app.id) }">
-                                <XIcon></XIcon>
-                            </Button>
-                        </TableCell>
-                        <TableCell class="text-right font-semibold" :class="[
-                            ,
-                            app.app_status === ApplicationStatus.Pending && 'text-yellow-500',
-                            app.app_status === ApplicationStatus.Accepted && 'text-green-500',
-                            app.app_status === ApplicationStatus.Denied && 'text-destructive'
-                        ]">{{ app.app_status }}</TableCell>
-                    </TableRow>
-                </TableBody>
-            </Table>
+            <div class="max-h-[80vh] overflow-hidden">
+                <Table class="w-full">
+                    <TableHeader>
+                        <TableRow>
+                            <TableHead>User</TableHead>
+                            <TableHead>Date Submitted</TableHead>
+                            <TableHead class="text-right">Status</TableHead>
+                        </TableRow>
+                    </TableHeader>
+                </Table>
+
+                <!-- Scrollable body container -->
+                <div class="overflow-y-auto max-h-[70vh] scrollbar-themed">
+                    <Table class="w-full">
+                        <TableBody>
+                            <TableRow v-for="app in appList" :key="app.id" class="cursor-pointer"
+                                @click="openApplication(app.id)">
+                                <TableCell class="font-medium">{{ app.member_name }}</TableCell>
+                                <TableCell :title="formatExact(app.submitted_at)">
+                                    {{ formatAgo(app.submitted_at) }}
+                                </TableCell>
+
+                                <TableCell v-if="app.app_status === ApplicationStatus.Pending"
+                                    class="inline-flex items-end gap-2">
+                                    <Button variant="success" @click.stop="handleApprove(app.id)">
+                                        <CheckIcon />
+                                    </Button>
+                                    <Button variant="destructive" @click.stop="handleDeny(app.id)">
+                                        <XIcon />
+                                    </Button>
+                                </TableCell>
+
+                                <TableCell class="text-right font-semibold" :class="[
+                                    app.app_status === ApplicationStatus.Pending && 'text-yellow-500',
+                                    app.app_status === ApplicationStatus.Accepted && 'text-green-500',
+                                    app.app_status === ApplicationStatus.Denied && 'text-destructive'
+                                ]">
+                                    {{ app.app_status }}
+                                </TableCell>
+                            </TableRow>
+                        </TableBody>
+                    </Table>
+                </div>
+            </div>
         </div>
         <div v-if="openPanel" class="pl-9 border-l w-3/5" :key="$route.params.id">
             <div class="mb-5 flex justify-between">
@@ -144,32 +155,4 @@ onMounted(async () => {
     </div>
 </template>
 
-<style scoped>
-/* Firefox */
-.scrollbar-themed {
-    scrollbar-width: thin;
-    scrollbar-color: #555 #1f1f1f;
-    padding-right: 6px;
-}
-
-/* Chrome, Edge, Safari */
-.scrollbar-themed::-webkit-scrollbar {
-    width: 10px;
-    /* slightly wider to allow padding look */
-}
-
-.scrollbar-themed::-webkit-scrollbar-track {
-    background: #1f1f1f;
-    margin-left: 6px;
-    /* ❗ adds space between content + scrollbar */
-}
-
-.scrollbar-themed::-webkit-scrollbar-thumb {
-    background: #555;
-    border-radius: 9999px;
-}
-
-.scrollbar-themed::-webkit-scrollbar-thumb:hover {
-    background: #777;
-}
-</style>
+<style scoped></style>

ui/src/pages/memberList.vue

@@ -65,6 +65,7 @@ const searchedMembers = computed(() => {
                         Member
                     </TableHead>
                     <TableHead>Rank</TableHead>
+                    <TableHead>Unit</TableHead>
                     <TableHead>Status</TableHead>
                 </TableRow>
             </TableHeader>
@@ -75,6 +76,7 @@ const searchedMembers = computed(() => {
                         {{ member.member_name }}
                     </TableCell>
                     <TableCell>{{ member.rank }}</TableCell>
+                    <TableCell>{{ member.unit }}</TableCell>
                     <TableCell>{{ member.status }}</TableCell>
                     <TableCell><Badge v-if="member.on_loa">On LOA</Badge></TableCell>
                     <TableCell @click.stop="" class="text-right">