feat(seed): a private hackathon an invitation can actually get you into - #253
Merged
Conversation
The invite RPCs landed with no fixture exercising them. H3 is the only private hackathon and it is over with `register` off, so Join refuses before it ever looks at a token — every attempt to test an invitation came back PermissionDenied for a reason that had nothing to do with the invitation. H5 is private, upcoming and taking sign-ups, so a link is the only way in and following one gets you somewhere. It carries three invites, one in each state the API can produce: live, revoked, expired. The last two are there because neither can reasonably be made by hand — an organizer cannot backdate an expiry, and revoking is a one-way door — so without them those refusals could only be seen once, by breaking the fixture. alice owns it rather than admin. A global admin passes casbin's g2(r.sub, "admin") escape hatch, so testing the organizer surfaces as admin proves nothing about the hackathon:write gate all four invite RPCs sit behind. dana joins on the live link and stays waitlisted, so every seed run exercises Join's invite gate for real. bob and charles are left out so either stays available to redeem a link by hand — that needs an account that can sign in to Keycloak, which dana cannot. The tokens print as ready URLs: a token is unguessable by design, and until the organizer's invitations page exists there is no way to get one without a detour through ListInvites or Postgres. No phases, tracks, projects or pages. This fixture is the door, not the room. It does have a markdown description, because that is the whole of what PreviewInvite shows an invitee. Adding a fifth hackathon makes any database holding the previous four look like a run that died partway, which is fatal by design — so this needs `just clean::state && just start && just db::seed`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As someone testing invitation links, I can now actually follow one.
Before this, I couldn't. The platform had four seeded hackathons and exactly one was private — the Internal Product Sprint, which is deliberately finished with registration switched off. So every time I tried an invitation, the backend said "permission denied" — and it was telling the truth, just about something else entirely: the event was over. There was no way to tell a broken invitation from a closed hackathon, and no way to see what a revoked or expired link does without permanently spoiling the one link there was.
Now there's a fifth hackathon, Partner Data Sprint 2026 — private, starting in twelve days, taking sign-ups. It comes with three invitation links: one that works, one that's been revoked, and one that expired yesterday. The seed prints all three as ready-to-click URLs when it runs, so testing an invitation is a copy-paste instead of a database expedition.
Details: