74c1745559
Adds an optional roster.json (set of allowed student IDs) loaded at startup. add_participant() raises StudentIdNotInRoster when the gate is on and the supplied id is not present; route returns 403 with a clear message and logs a roster_reject audit event. Names are NOT checked against the roster: the join form asks for a current name as a soft deterrent, but the only hard check is the id. Includes a deploy/build_roster.py helper that turns class_register attendance.xlsx into roster.json. Bootstrap env file now exports QUIZ_ROSTER_PATH; missing file disables the gate (legacy behaviour). Also drops the user-facing "The cookie is per-device." line from the join card — students don't need to know the implementation; replaced with "Enter your registered student ID and your current full name."
31 lines
676 B
Plaintext
31 lines
676 B
Plaintext
.venv/
|
|
__pycache__/
|
|
*.py[cod]
|
|
.pytest_cache/
|
|
.coverage
|
|
htmlcov/
|
|
*.egg-info/
|
|
.env
|
|
quiz.db
|
|
*.db
|
|
*.db-shm
|
|
*.db-wal
|
|
|
|
# Real quiz pools must never be committed (they contain answer keys).
|
|
# Only generic demo pools tracked under examples/.
|
|
examples/*_pool.json
|
|
!examples/pool_example.json
|
|
!examples/demo10_pool.json
|
|
# The runtime pool the server reads from disk lives at the repo root.
|
|
# Operators populate it; it stays out of version control.
|
|
/pool.json
|
|
|
|
# Class roster (real student IDs and names) lives at the repo root on
|
|
# the operator's machine and on the server; never in version control.
|
|
/roster.json
|
|
|
|
# Codex build leftovers
|
|
.codex_done
|
|
codex_last_message.md
|
|
codex_run.log
|