Matt 35f46c3e34 fix(security): require jury membership for liveVoting.vote
Prevents non-jury authenticated users from casting votes that get
counted in the jury aggregate. Admins are still allowed; everyone else
must be a JuryGroupMember of the round's jury group. Also explicitly
sets isAudienceVote=false on the upsert so audience votes can't be
laundered into jury votes via this path. Audience voting continues to
flow through the existing castAudienceVote publicProcedure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 03:12:54 +02:00
2026-04-28 18:55:12 +02:00
2026-04-28 18:55:12 +02:00
Description
No description provided
25 MiB
Languages
TypeScript 99.5%
JavaScript 0.2%
Shell 0.2%
CSS 0.1%