From 696d7e9041897902b350f5fc290e378a48ea4f1e Mon Sep 17 00:00:00 2001 From: Matt Date: Tue, 9 Jun 2026 16:19:16 +0200 Subject: [PATCH] fix(final-docs): exclude dropped mentors from doc access; relative in-app reminder link Review follow-ups: mentor.getProjectFinalDocuments now filters droppedAt:null (a dropped mentor no longer sees a team's final docs); reminder linkUrl is relative so the in-app notification does client-side nav (email still absolutized). Co-Authored-By: Claude Opus 4.8 (1M context) --- src/server/routers/mentor.ts | 2 +- src/server/services/final-documents.ts | 6 +----- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/src/server/routers/mentor.ts b/src/server/routers/mentor.ts index 500110c..105b820 100644 --- a/src/server/routers/mentor.ts +++ b/src/server/routers/mentor.ts @@ -223,7 +223,7 @@ export const mentorRouter = router({ const isAdmin = ['SUPER_ADMIN', 'PROGRAM_ADMIN'].includes(ctx.user.role) if (!isAdmin) { const [mentorAssignment, teamMembership] = await Promise.all([ - ctx.prisma.mentorAssignment.findFirst({ where: { mentorId: ctx.user.id, projectId: input.projectId }, select: { id: true } }), + ctx.prisma.mentorAssignment.findFirst({ where: { mentorId: ctx.user.id, projectId: input.projectId, droppedAt: null }, select: { id: true } }), ctx.prisma.teamMember.findFirst({ where: { userId: ctx.user.id, projectId: input.projectId }, select: { id: true } }), ]) if (!mentorAssignment && !teamMembership) throw new TRPCError({ code: 'FORBIDDEN', message: 'No access to this project' }) diff --git a/src/server/services/final-documents.ts b/src/server/services/final-documents.ts index 99798bb..90a52cc 100644 --- a/src/server/services/final-documents.ts +++ b/src/server/services/final-documents.ts @@ -88,10 +88,6 @@ export async function getFinalDocumentStatusForProject( } } -function baseUrl(): string { - return (process.env.NEXTAUTH_URL ?? 'http://localhost:3000').replace(/\/$/, '') -} - /** Build the reminder notification payload for one finalist team lead. */ async function remindTeam( prisma: PrismaClient, @@ -104,7 +100,7 @@ async function remindTeam( message: args.missing.length ? `Still needed for "${args.projectTitle}": ${args.missing.join(', ')}.` : `Please upload the final documents for "${args.projectTitle}".`, - linkUrl: `${baseUrl()}/applicant/documents`, + linkUrl: `/applicant/documents`, // relative → client-side nav in-app; email renderer absolutizes metadata: { projectId: args.projectId, projectTitle: args.projectTitle,