apps/quiz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(roster): gate joins on registered student-ID list

Browse Source 
Adds an optional roster.json (set of allowed student IDs) loaded at
startup. add_participant() raises StudentIdNotInRoster when the gate is
on and the supplied id is not present; route returns 403 with a clear
message and logs a roster_reject audit event. Names are NOT checked
against the roster: the join form asks for a current name as a soft
deterrent, but the only hard check is the id.

Includes a deploy/build_roster.py helper that turns class_register
attendance.xlsx into roster.json. Bootstrap env file now exports
QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour).

Also drops the user-facing "The cookie is per-device." line from the
join card — students don't need to know the implementation; replaced
with "Enter your registered student ID and your current full name."
This commit is contained in:
ameer
2026-05-05 22:02:03 +08:00
parent 19603abc58
commit 74c1745559
12 changed files with 289 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
static/quiz.js
View File

@@ -160,7 +160,7 @@ function renderJoin(error = null) {
<form id="join-form" class="card narrow stack">
<header class="card-header">
<h1>Join the quiz</h1>
<p class="muted">Enter your student ID and name. The cookie is per-device.</p>
<p class="muted">Enter your registered student ID and your current full name.</p>
</header>
<label class="field">
<span>Student ID</span>
@@ -175,10 +175,9 @@ function renderJoin(error = null) {
<summary>Before you join — please read</summary>
<ul>
<li><b>Use only your own student ID.</b> Using another student's ID is academic misconduct and is logged.</li>
<li>If you see <em>"This student ID is already in use"</em>, <b>do not retry</b> — every attempt is recorded. Tell the instructor and they will reset your slot.</li>
<li>Asking the instructor to reset your slot will set <b>all already-closed questions to 0</b> (status: missed). This is permanent and applies whether or not the slot was actually hijacked.</li>
<li>Do not clear your cookies during the quiz. Clearing them locks you out and recovery requires a reset (same penalty as above).</li>
<li>This portal is for in-lecture engagement; attendance is taken on paper.</li>
<li>If you see <em>"This student ID is already in use"</em>, <b>do not retry</b>. Tell the instructor and they will reset your slot.</li>
<li>Do not clear your cookies during the quiz. Clearing them locks you out and recovery requires a reset by instructor, and mark all the previous questions as missed (0 marks).</li>
<li>Also mark your attendance on paper at end of this lecture. The paper attendance will be cross-referenced with the record on this website.</li>
</ul>
</details>
<button type="submit" class="btn primary block">Join</button>