Merge pull request #50 from Krish-2118/development

registration flow and supabase fix

Author: Krish-2118

docs/pass-experience.md

@@ -4,7 +4,7 @@ The live flow is Google login → participant details → payment QR → screens
 
 ## Reviewer preview and the single off switch
 
-`REGISTRATION_PREVIEW_ENABLED` in `src/config/launch.ts` is currently **true**. Set it to **false** and redeploy to remove all preview entry points, mock users, local uploads and simulated approval. There is no UI toggle. This is independent of `REGISTRATIONS_OPEN`, which controls whether live registration is open.
+`REGISTRATION_PREVIEW_ENABLED` in `src/config/launch.ts` is currently **false**: every preview entry point, mock user, local upload and simulated approval is off. Set it to **true** and redeploy only to bring the reviewer preview back for a review build. There is no UI toggle. This is independent of `REGISTRATIONS_OPEN`, which controls whether live registration is open.
 
 - `/?preview=register` starts all steps, with a blank college field.
 - Preview participants select a local screenshot and enter a 12-digit test UTR. No payment, registration, upload or acknowledgement is sent to the server.

src/app/api/pass/experience/route.ts

@@ -1,7 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getAuthenticatedUser } from '@/lib/auth-server';
 import { getSupabaseAsUser } from '@/lib/supabase';
-import { createRateLimiter } from '@/lib/security';
+import { createRateLimiter, readJsonObject } from '@/lib/security';
 import { entryRateLimited, entryRpcFailure } from '@/lib/entry-route';
 
 const limiter = createRateLimiter({ limit: 40, windowMs: 60_000 });
@@ -11,8 +11,10 @@ export async function POST(req: NextRequest) {
   if (!auth) return NextResponse.json({ error: 'Sign in required.' }, { status: 401 });
   const limited = entryRateLimited(limiter, auth.user.id);
   if (limited) return limited;
-  const body = await req.json().catch(() => null);
-  if (!body || !['claim', 'acknowledge'].includes(body.action) ||
+  const parsed = await readJsonObject(req);
+  if (!parsed.ok) return NextResponse.json({ error: parsed.error }, { status: parsed.status });
+  const body = parsed.value;
+  if (typeof body.action !== 'string' || !['claim', 'acknowledge'].includes(body.action) ||
     typeof body.claim !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(body.claim)) {
     return NextResponse.json({ error: 'Invalid experience request.' }, { status: 400 });
   }

src/config/launch.ts

@@ -16,10 +16,10 @@
 export const REGISTRATIONS_OPEN = true;
 export const MERCH_STORE_OPEN = true;
 
-/** Review-only registration preview. Set false and redeploy to disable ALL mock users,
+/** Review-only registration preview. Keep false in production: false disables ALL mock users,
  * preview links, simulated uploads and simulated approval. Real API authorization is
  * always enforced; preview data is kept in memory and never submitted to the backend. */
-export const REGISTRATION_PREVIEW_ENABLED = true;
+export const REGISTRATION_PREVIEW_ENABLED = false;
 
 /** Where the REGISTER buttons point while registrations are closed. */
 export const REGISTRATIONS_SOON_PATH = '/register';

supabase/schema.sql

@@ -1410,7 +1410,7 @@ REVOKE EXECUTE ON FUNCTION public.new_referral_code() FROM PUBLIC, anon, authent
 REVOKE EXECUTE ON FUNCTION public.assign_referral_code() FROM PUBLIC, anon, authenticated, service_role;
 
 
--- Durable one-time approval presentation
+-- 15. PASS EXPERIENCE (durable one-time approval presentation)
 -- Apply once before deploying the pass reveal. Also included in schema.sql for new installs.
 -- No payment or registration fields are written by these functions.
 CREATE TABLE IF NOT EXISTS public.pass_experiences (