marty/rm-circle-team-router
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Only the position's owner sees the placement switch

Browse Source 
Marty asked where to find the setting, which surfaced the problem: /my/<id>
is a public page and the switch was rendering on it for every visitor. The
POST is wallet-gated so nobody could actually change someone else's
placement, but offering a stranger a control over another member's team is
wrong on its face.

It now stays hidden until /api/public/msg-me confirms the viewer has proved
with their wallet that the position is theirs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
martbost
2026-09-18 15:49:44 -05:00
parent da223c288b
commit 838e5bb2d0
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/my.js
+8 -1
View File
@@ -826,7 +826,7 @@
<div style="display:flex;gap:8px;flex-wrap:wrap;align-items:center"><button id="copyDirect" class="btn btn-secondary btn-sm">Copy Direct link</button><span class="micro" style="word-break:break-all;color:var(--muted)">${esc(directUrl)}</span></div>
<p class="micro" style="margin:8px 0 0">${dd?'Either way you keep the entry reward on anyone you personally bring.':'<strong style="color:var(--text)">Team link</strong> helps your team qualify. <strong style="color:var(--text)">Direct link</strong> places every join under you (own spillover). Either way you keep the entry reward on anyone you personally bring.'}</p>
</div>
<div style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
<div id="plBox" hidden style="margin-top:16px;padding-top:14px;border-top:1px solid var(--line)">
<div style="font-weight:800;font-size:14px;margin-bottom:4px">\u2699\ufe0f How your link places people</div>
<p class="micro" style="margin:0 0 10px">This is your choice, and you can change it any time. It only affects where NEW joins are registered \u2014 nobody already placed ever moves.</p>
<div style="display:flex;gap:8px;flex-wrap:wrap">
@@ -850,6 +850,13 @@
const bt=document.getElementById('plTeam'), bd=document.getElementById('plDirect');
if(bt)bt.addEventListener('click',()=>setMode('team'));
if(bd)bd.addEventListener('click',()=>setMode('direct'));
// This is a control, not information: only show it to someone who has proved with their
// wallet that this position is theirs. /my/<id> is a public page, so a visitor must never
// be offered a switch that changes somebody else's placement.
fetch('/api/public/msg-me').then(r=>r.ok?r.json():null).then(me=>{
const box=document.getElementById('plBox');
if(box&&me&&String(me.id)===String(d.id))box.hidden=false;
}).catch(()=>{});
}
const qr=document.getElementById('dQr');if(qr)qr.innerHTML=qrSvg(dashUrl);
const qb=document.getElementById('dQrBtn');