+
+ {cap.poolBarLabel}
+ {poolTaken} / {reserve}
-
+
-
-
+
+
{cap.poolTitle}
-
{poolNote}
-
{cap.poolExplain}
+
{poolNote}
+
{cap.poolExplain}
)}
diff --git a/src/components/events/SubmissionForm.tsx b/src/components/events/SubmissionForm.tsx
index bb47678..cb844c3 100644
--- a/src/components/events/SubmissionForm.tsx
+++ b/src/components/events/SubmissionForm.tsx
@@ -1,5 +1,7 @@
import { useState } from 'preact/hooks';
import type { TargetedSubmitEvent } from 'preact';
+import { optionLabel } from '../../lib/i18n';
+import type { Check } from '../../lib/events';
type FieldMode = 'required' | 'optional' | 'hidden';
interface Fields {
@@ -9,7 +11,6 @@ interface Fields {
image_url: FieldMode;
video_url: FieldMode;
}
-interface CheckItem { pass: boolean }
interface Existing {
title?: string;
description?: string;
@@ -20,12 +21,12 @@ interface Existing {
video_url?: string;
auto_points?: number;
not_prize_eligible?: boolean;
- checks?: Record
;
+ checks?: Record;
}
interface Result {
auto_points: number;
not_prize_eligible: boolean;
- checks: Record;
+ checks: Record;
}
// Convierte la respuesta del backend en el resumen de checks que pinta la UI.
@@ -55,7 +56,11 @@ interface Props {
discordMode: 'required' | 'optional' | 'none';
specialties: string[];
levels: string[];
- /** Etiquetas traducidas de especialidades/niveles y de los checks. */
+ /**
+ * Etiquetas traducidas de especialidades/niveles y de los checks. Solo
+ * traduce el vocabulario fijo de v2: el de especialidades y niveles lo
+ * escribe quien organiza (§3.2) y lo que no conoce pasa por `optionLabel`.
+ */
options: Record;
}
@@ -91,7 +96,11 @@ export default function SubmissionForm({
setF({ ...f, [k]: (e.currentTarget as HTMLInputElement | HTMLTextAreaElement).value });
const setPart = (k: keyof typeof p) => (e: Event) =>
setP({ ...p, [k]: (e.currentTarget as HTMLInputElement | HTMLSelectElement).value });
- const label = (v: string) => options[v] ?? v;
+ // Especialidades y niveles: vocabulario libre del evento, igual que en el
+ // alta, así que lo que no está en el diccionario sale con la inicial en
+ // mayúscula. Los checks no: ese vocabulario lo fija el backend.
+ const label = (v: string) => optionLabel(options, v);
+ const checkLabel = (v: string) => options[v] ?? v;
const fieldLabel: Record = {
title: t.fTitle, description: t.description, public_url: t.publicUrl, space_url: t.spaceUrl,
repo_url: t.repoUrl, image_url: t.imageUrl, video_url: t.videoUrl,
@@ -293,7 +302,7 @@ export default function SubmissionForm({
{t.checks}: {result.auto_points}/{autoMax}
{checks.map((k) => (
- - {result.checks[k]?.pass ? '✓' : '✗'} {label(k)}
+ - {result.checks[k]?.pass ? '✓' : '✗'} {checkLabel(k)}
))}
{result.not_prize_eligible && {t.notPrizeEligible}
}
diff --git a/src/components/events/admin/AdminNotices.astro b/src/components/events/admin/AdminNotices.astro
new file mode 100644
index 0000000..f240f04
--- /dev/null
+++ b/src/components/events/admin/AdminNotices.astro
@@ -0,0 +1,43 @@
+---
+/**
+ * Avisos del panel: confirmación tras redirección (`?ok=`), avisos del
+ * backend (§8, traducidos) y error de la última respuesta. Cada bloque solo
+ * se pinta si tiene contenido.
+ */
+import type { ApiResult } from '../../../lib/eventsAdmin';
+import { warningLabel } from '../../../lib/eventsAdminForms';
+
+interface Props {
+ ok?: string | null;
+ warnings?: string[];
+ result?: ApiResult;
+ /** Texto que precede a la lista de avisos (p. ej. "Simulación: no se ha guardado nada"). */
+ warningsTitle?: string;
+ forbidden?: boolean;
+}
+const { ok = null, warnings = [], result, warningsTitle, forbidden = false } = Astro.props;
+const errorText = result && !result.ok
+ ? [result.message ?? result.error ?? 'error', result.fields.length ? `campos: ${result.fields.join(', ')}` : '', result.detail ?? '']
+ .filter(Boolean)
+ .join(' · ')
+ : '';
+const showWarnings = warnings.length > 0 || (result?.ok && (result.warnings.length > 0 || warningsTitle));
+---
+
+{forbidden && La petición no venía de nan.builders y no se ha procesado.
}
+{ok && {ok}
}
+{errorText && (
+
+ Error {result?.status || ''}: {errorText}
+
+)}
+{showWarnings && (
+
+ {warningsTitle &&
{warningsTitle}
}
+ {(warnings.length ? warnings : result?.warnings ?? []).length > 0 && (
+
+ {(warnings.length ? warnings : result?.warnings ?? []).map((w) => {w} — {warningLabel(w)}
+ )}
+
Estado
+
+ - Estado actual
- {label(ev.status)}
+ {ev.status === 'cancelled' && ev.previous_status && - Estado previo
- {label(ev.previous_status)}
}
+ - Automatización por fechas
- {automation ? 'activa' : 'apagada'}
+
+
+ {disabled ? (
+ Evento archivado: no se puede cambiar de estado.
+ ) : targets.length === 0 ? (
+ No hay transiciones posibles desde este estado.
+ ) : (
+
+ )}
+
+ Avanzar puede saltar pasos; retroceder solo un paso. Nunca se borran datos: votos, entregas y equipos se conservan.
+ Cancelar guarda el estado actual para poder volver a él.
+
+
+ {preview && (
+
+ {previewNoChange ? (
+
El evento ya está en {label(chosen)}: no hay nada que cambiar.
+ ) : (
+
+ Previsualización de {label(ev.status)} → {label(chosen)}{previewWarnings.length ? ': consecuencias.' : ': sin avisos.'} No se ha cambiado nada todavía.
+
+ )}
+ {previewWarnings.length > 0 && !previewNoChange && (
+
{previewWarnings.map((w) => {w} — {warningLabel(w)}
+ )}
+ {!previewNoChange && previewTarget && (
+
+ )}
+
+
El sweep no ha cambiado el estado.
+ {sweep.warnings.length > 0 &&
{sweep.warnings.map((w) => {w} — {warningLabel(w)}
}
+
@@ -275,7 +316,31 @@ const hack = eventos.hackathons[0];
transition: color var(--dur-micro) var(--ease), border-color var(--dur-micro) var(--ease);
}
.agenda__link:hover { color: var(--color-link); border-bottom-color: var(--color-link); }
- .agenda__by { font-size: 13px; color: var(--color-muted); }
+ .agenda__time { display: block; font-size: 11px; color: var(--color-muted); letter-spacing: 0.04em; }
+ .agenda__by { font-size: 13px; color: var(--color-muted); display: inline-flex; gap: var(--space-3); align-items: baseline; }
+ .agenda__cal {
+ font-size: 11px; letter-spacing: 0.06em; text-transform: uppercase;
+ color: var(--color-violet-2); text-decoration: none; white-space: nowrap;
+ border-bottom: 1px solid color-mix(in srgb, var(--color-violet) 45%, transparent);
+ }
+ .agenda__cal:hover { color: var(--color-link); border-bottom-color: var(--color-link); }
+
+ /* suscripción al calendario */
+ .calsub {
+ margin-top: var(--space-8); border: 1px solid var(--color-line); padding: clamp(20px, 3vw, 36px);
+ background: var(--color-surface);
+ }
+ .calsub__title {
+ font-family: var(--font-serif); font-weight: 400; color: var(--color-text);
+ font-size: clamp(22px, 2.2vw, 30px); line-height: 1.1;
+ }
+ .calsub__body { margin-top: var(--space-3); max-width: 56ch; color: var(--color-muted); font-size: 15px; line-height: 1.6; }
+ .calsub__actions { margin-top: var(--space-5); display: flex; flex-wrap: wrap; gap: var(--space-3); }
+ .calsub__feed { margin-top: var(--space-5); display: flex; flex-wrap: wrap; gap: var(--space-2) var(--space-3); font-size: 12px; color: var(--color-muted); }
+ .calsub__feed-l { text-transform: uppercase; letter-spacing: 0.08em; }
+ .calsub__feed-u { color: var(--color-violet-2); text-decoration: none; word-break: break-all; }
+ .calsub__feed-u:hover { color: var(--color-link); }
+ .calsub__tz { margin-top: var(--space-2); font-size: 11px; color: var(--color-muted); }
.agenda__empty { margin-top: var(--space-6); color: var(--color-muted); font-family: var(--font-serif); font-size: 17px; }
@media (max-width: 620px) {
diff --git a/src/pages/api/auth/login-request.ts b/src/pages/api/auth/login-request.ts
index 472d668..bfbe43c 100644
--- a/src/pages/api/auth/login-request.ts
+++ b/src/pages/api/auth/login-request.ts
@@ -1,15 +1,9 @@
import type { APIRoute } from 'astro';
-import { env } from 'cloudflare:workers';
+import { apiBase, ssrHeaders } from '../../../lib/events';
+import { json } from '../../../lib/apiResponse';
export const prerender = false;
-function json(body: unknown, status = 200): Response {
- return new Response(JSON.stringify(body), {
- status,
- headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
- });
-}
-
// Proxy same-origin para iniciar el login por magic link de NaN desde la landing
// de eventos (/events/{slug}). El formulario de email vive ahí (no tenemos el frontend
// de cloud), pero usa el MISMO endpoint de auth que la plataforma: reenvía a
@@ -19,13 +13,9 @@ function json(body: unknown, status = 200): Response {
// Es necesario un proxy porque la CSP de la landing es `connect-src 'self'`: el
// navegador solo puede hacer fetch a este mismo origen, no a cloud-api.
export const POST: APIRoute = async ({ request }) => {
- const base = env.CLOUD_API_URL.replace(/\/$/, '');
- const target = `${base}/api/auth/login/request`;
+ const target = `${apiBase()}/api/auth/login/request`;
- const headers = new Headers({
- 'content-type': 'application/json',
- origin: 'https://nan.builders',
- });
+ const headers = new Headers({ ...ssrHeaders(), 'content-type': 'application/json' });
// El backend limita por IP usando X-Forwarded-For; sin esto, todas las
// peticiones compartirían la IP del worker. Propagamos la IP real del cliente.
const ip = request.headers.get('cf-connecting-ip');
diff --git a/src/pages/api/events/[...path].ts b/src/pages/api/events/[...path].ts
index 20d6391..23e6546 100644
--- a/src/pages/api/events/[...path].ts
+++ b/src/pages/api/events/[...path].ts
@@ -1,29 +1,25 @@
import type { APIRoute } from 'astro';
-import { backendURL, forwardHeaders, isAdminPath } from '../../../lib/events';
+import { backendURL, forwardHeaders, hasSessionCookie, isAdminPath } from '../../../lib/events';
+import { json } from '../../../lib/apiResponse';
export const prerender = false;
-function json(body: unknown, status = 200): Response {
- return new Response(JSON.stringify(body), {
- status,
- headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
- });
-}
-
/**
* Proxy same-origin `/api/events/*` → `${CLOUD_API_URL}/api/events/*` (SPEC §8.1).
*
* Existe porque la CSP de la landing es `connect-src 'self'`: las islas solo
* pueden hacer fetch a este origen. Reenvía cookie de sesión e IP real; nunca
- * la admin key, y nunca rutas con un segmento `admin`.
+ * la admin key. Las rutas con un segmento `admin` solo pasan con cookie de
+ * sesión (SPEC v3 §8): el backend decide si esa sesión es de staff y responde
+ * 401/403 si no; el panel `/events/admin` es el que las usa.
*/
const handler: APIRoute = async ({ params, request, url }) => {
const path = (params.path ?? '').toString();
- // No exponer endpoints de operación desde el navegador público. Se mantiene
- // como primera barrera aunque `backendURL` ya acote la ruta: dice
- // explícitamente qué es lo que no debe atravesar el proxy.
- if (isAdminPath(path)) {
+ // Sin sesión, los endpoints de operación no existen de cara al exterior:
+ // 404 sin tocar el backend. Se mantiene como primera barrera aunque
+ // `backendURL` ya acote la ruta.
+ if (isAdminPath(path) && !hasSessionCookie(request)) {
return json({ ok: false, error: 'not_found' }, 404);
}
@@ -50,13 +46,28 @@ const handler: APIRoute = async ({ params, request, url }) => {
return json({ ok: false, error: 'server_error' }, 500);
}
- // Reenviar cuerpo y status; normalizar a JSON. Propagar Set-Cookie si lo hubiera.
+ // Reenviar cuerpo y status; normalizar a JSON salvo el CSV de
+ // `participants/export.csv` y el feed iCalendar (`calendar.ics`, W-10).
+ // Content-Disposition se conserva para las descargas del panel
+ // (`export?download=1`). Propagar Set-Cookie.
const text = await resp.text();
- const headers = new Headers({ 'content-type': 'application/json', 'cache-control': 'no-store' });
+ const upstreamType = resp.headers.get('content-type') ?? '';
+ const passthrough = /^text\/(csv|calendar)\b/i.test(upstreamType);
+ const headers = new Headers({
+ 'content-type': passthrough ? upstreamType : 'application/json',
+ // El feed es público y lo releen los clientes de calendario: se respeta
+ // la caché corta que fija el backend. Todo lo demás, sin caché.
+ 'cache-control': (/^text\/calendar\b/i.test(upstreamType) && resp.headers.get('cache-control')) || 'no-store',
+ });
+ const disposition = resp.headers.get('content-disposition');
+ if (disposition) headers.set('content-disposition', disposition);
// getSetCookie() devuelve un array sin colapsar comas (WHATWG); preserva
// múltiples cookies (login + refresh, handoff de onboarding, etc.).
for (const cookie of resp.headers.getSetCookie()) headers.append('set-cookie', cookie);
- return new Response(text || '{}', { status: resp.status, headers });
+ // A CSV or iCalendar body is forwarded as is, even when empty: padding it
+ // with `{}` would hand the operator a download with `{}` inside. The `{}`
+ // fallback only applies to the JSON responses, so callers can always parse.
+ return new Response(passthrough ? text : text || '{}', { status: resp.status, headers });
};
export const GET = handler;
diff --git a/src/pages/events/[slug]/_index.astro b/src/pages/events/[slug]/_index.astro
index 0486f44..4fb3f8e 100644
--- a/src/pages/events/[slug]/_index.astro
+++ b/src/pages/events/[slug]/_index.astro
@@ -8,7 +8,9 @@ import RegisterForm, { type FormStrings } from '../../../components/events/Regis
import LoginForm, { type LoginStrings } from '../../../components/events/LoginForm.tsx';
import RegistrationBar from '../../../components/events/RegistrationBar.astro';
import { getLocale, t, tObj, withLang } from '../../../lib/i18n';
-import { fetchMe, fmtDate, fmtRange, hasSessionCookie, type EventInfo } from '../../../lib/events';
+import { eventSession, fmtDate, fmtRange, type EventInfo } from '../../../lib/events';
+import { eventCalendarPath, googleEventURL } from '../../../lib/eventsCalendar';
+import { safeImage, safeUrl } from '../../../lib/projects';
const locale = getLocale(Astro.url);
// El evento lo resuelve el envoltorio de ruta (resolveEventRoute) y llega por props.
@@ -18,12 +20,8 @@ interface Props {
const ev = Astro.props.event;
const slug = ev.slug;
-// Sesión: /me solo si hay cookie. Si el backend devuelve 401, la sesión caducó.
-const hasSession = hasSessionCookie(Astro.request);
-const { me, unauthorized } = hasSession
- ? await fetchMe(slug, Astro.request.headers.get('cookie') ?? '')
- : { me: null, unauthorized: false };
-const sessionOk = hasSession && !unauthorized;
+// Sesión: /me solo si hay cookie; si el backend devuelve 401, la sesión caducó.
+const { me, sessionOk } = await eventSession(Astro.request, slug);
const participant = me?.participant ?? null;
const registered = !!participant && participant.status !== 'withdrawn';
const hasSubmission = !!me?.submission;
@@ -58,25 +56,48 @@ if (ev.dates.submission_open || ev.dates.submission_close)
dates.push({ label: dl.submission, value: fmtRange(ev.dates.submission_open, ev.dates.submission_close, locale) });
if (ev.voting.enabled && (ev.dates.voting_open || ev.dates.voting_close))
dates.push({ label: dl.voting, value: fmtRange(ev.dates.voting_open, ev.dates.voting_close, locale) });
-if (ev.dates.demo_day) dates.push({ label: dl.demoDay, value: fmtDate(ev.dates.demo_day, locale) });
+if (ev.dates.demo_day)
+ dates.push({
+ label: dl.demoDay,
+ // Con hora (y fin si lo tiene): es la cita a la que hay que ir.
+ value: ev.dates.demo_day_end
+ ? `${fmtDate(ev.dates.demo_day, locale, true)} – ${fmtDate(ev.dates.demo_day_end, locale, true)}`
+ : fmtDate(ev.dates.demo_day, locale, true),
+ });
+
+// Dónde, enlace y "añadir a mi calendario" (W-10): solo si el evento tiene fecha.
+const where = tObj
>('events.where', locale);
+const calendarLink = googleEventURL(ev, Astro.site);
+const icsHref = eventCalendarPath(ev);
// Panel principal por fase (§8.2). `null` → se pinta el bloque de inscripción.
type Panel = { title: string; body: string; href?: string; cta?: string; tone?: 'muted' | 'accent' };
let panel: Panel | null = null;
const closeAt = fmtDate(ev.dates.submission_close, locale, true);
const openAt = fmtDate(ev.dates.submission_open, locale, true);
+// En v3 todas las fechas son opcionales, así que la copia que las nombra tiene
+// gemela sin fecha: si no, la frase queda coja ("entrega antes del .").
+const notOpenBody = openAt ? fill(phase.submissionNotOpen, { date: openAt }) : phase.submissionNotOpenNoDate;
+const buildingBody = closeAt ? fill(phase.building, { date: closeAt }) : phase.buildingNoDate;
+const submittedBody = closeAt ? fill(phase.submitted, { date: closeAt }) : phase.submittedNoDate;
switch (ev.phase) {
+ case 'published':
+ // Informativo anunciado (B-26): no hay inscripción; el CTA es el enlace del evento si lo tiene.
+ panel = ev.url
+ ? { title: phase.publishedTitle, body: phase.published, href: ev.url, cta: phase.publishedCta, tone: 'accent' }
+ : { title: phase.publishedTitle, body: phase.published, tone: 'accent' };
+ break;
case 'draft':
case 'registration':
if (isTeam) panel = null; // bloque de inscripción
- else panel = { title: phase.notOpenTitle, body: fill(phase.submissionNotOpen, { date: openAt }), tone: 'muted' };
+ else panel = { title: phase.notOpenTitle, body: notOpenBody, tone: 'muted' };
break;
case 'building_pending':
panel = isTeam && registered
? { title: phase.inProgressTitle, body: phase.inProgress, href: meUrl, cta: already.cta, tone: 'accent' }
: isTeam
? { title: phase.closedTitle, body: phase.closed, tone: 'muted' }
- : { title: phase.notOpenTitle, body: fill(phase.submissionNotOpen, { date: openAt }), tone: 'muted' };
+ : { title: phase.notOpenTitle, body: notOpenBody, tone: 'muted' };
break;
case 'building':
if (isTeam) {
@@ -84,9 +105,9 @@ switch (ev.phase) {
? { title: phase.inProgressTitle, body: phase.inProgress, href: meUrl, cta: already.cta, tone: 'accent' }
: { title: phase.closedTitle, body: phase.closed, tone: 'muted' };
} else if (hasSubmission) {
- panel = { title: phase.submittedTitle, body: fill(phase.submitted, { date: closeAt }), href: submissionUrl, cta: phase.submittedCta, tone: 'accent' };
+ panel = { title: phase.submittedTitle, body: submittedBody, href: submissionUrl, cta: phase.submittedCta, tone: 'accent' };
} else {
- panel = { title: phase.buildingTitle, body: fill(phase.building, { date: closeAt }), href: submissionUrl, cta: phase.buildingCta, tone: 'accent' };
+ panel = { title: phase.buildingTitle, body: buildingBody, href: submissionUrl, cta: phase.buildingCta, tone: 'accent' };
}
break;
case 'submission':
@@ -107,93 +128,137 @@ switch (ev.phase) {
break;
}
+// Cover (B-27). The backend already validates http/https, but the CSP only
+// allows https images and the browser blocks mixed content, so an http cover
+// would render as a broken icon in production. In dev the covers point at
+// localhost, hence the looser check there.
+const cover = import.meta.env.DEV ? safeUrl(ev.image_url) : safeImage(ev.image_url);
+
const pageTitle = `${ev.name} — nan.builders`;
const closedNote = fill(cap.closedNote, { cap: capacity, res: reserve });
---
-
-
-
+{/* Ficha: una columna centrada (max-w-3xl) con aire entre bloques. Las tarjetas
+ siguen la casa: esquina recta (la impone nan-system.css), hairline y tinte
+ violeta para lo que importa (fechas, premio, CTA). Botones = .btn de la casa. */}
+
+
+
-
+ {/* Decorative: the name is already the H1 right above. */}
+ {cover && (
+ 
+ )}
+
+
{ev.description && (
- {ev.description}
+ {ev.description}
)}
+
{dates.length > 0 && (
-
+
{dates.map((d) => (
-
-
- {d.label}
-
- {d.value}
+
+
- {d.label}
+ - {d.value}
))}
)}
+
+ {(ev.location || ev.url) && (
+
+ {ev.location && (
+
+
- {where.label}
+ - {ev.location}
+
+ )}
+ {ev.url && (
+
+ )}
+
+ )}
+
+ {calendarLink && (
+
+ )}
+
{ev.prize && (
-
{t('events.prize', locale)} · {ev.prize}
+
+
{t('events.prize', locale)}
+
{ev.prize}
+
)}
+
{ev.rules && (
-
{ev.rules}
+
{ev.rules}
)}
-
+
{panel ? (
-
+ ? 'border border-violet-500/40 bg-violet-500/10 p-8 md:p-10'
+ : 'border border-neutral-800 bg-neutral-900/40 p-8 md:p-10'}>
+
{panel.title}
-
{panel.body}
+
{panel.body}
{panel.href && panel.cta && (
/* En solo, entregar requiere sesión: si no la hay, enseñamos el login en vez del CTA. */
!isTeam && ev.phase === 'building' && !sessionOk ? (
-
-
{t('events.submission.loginNote', locale)}
+
+
{t('events.submission.loginNote', locale)}
) : (
-
- {panel.cta}
-
+
{panel.cta}
)
)}
) : !ev.windows.registration.open ? (
-
-
{phase.notOpenTitle}
-
{phase.notOpen}
+
+
{phase.notOpenTitle}
+
{phase.notOpen}
) : (
-
+
{hasCapacity && (
)}
{registered ? (
-
-
{already.title}
-
+
) : full ? (
-
-
{cap.closedTitle}
-
{closedNote}
+
+
{cap.closedTitle}
+
{closedNote}
) : !sessionOk ? (
) : (
)}
diff --git a/src/pages/events/[slug]/_leaderboard.astro b/src/pages/events/[slug]/_leaderboard.astro
index ee8a116..e9a7bc8 100644
--- a/src/pages/events/[slug]/_leaderboard.astro
+++ b/src/pages/events/[slug]/_leaderboard.astro
@@ -4,7 +4,7 @@ import '../../../styles/global.css';
import NanPage from '../../../layouts/NanPage.astro';
import EventHeader from '../../../components/events/EventHeader.astro';
import { getLocale, tObj } from '../../../lib/i18n';
-import { fetchMe, fetchPublic, hasSessionCookie, type LeaderboardRow, type EventInfo } from '../../../lib/events';
+import { eventSession, fetchPublic, type LeaderboardView, type EventInfo } from '../../../lib/events';
const locale = getLocale(Astro.url);
// El evento lo resuelve el envoltorio de ruta (resolveEventRoute) y llega por props.
@@ -14,16 +14,17 @@ interface Props {
const ev = Astro.props.event;
const slug = ev.slug;
-const hasSession = hasSessionCookie(Astro.request);
// Clasificación + validación de la sesión en paralelo, como en el resto de
// páginas: la cabecera solo muestra "mi zona" si la cookie sigue siendo válida.
-const [lbRes, meRes] = await Promise.all([
- fetchPublic<{ rows: LeaderboardRow[]; public: boolean }>(slug, 'leaderboard'),
- hasSession ? fetchMe(slug, Astro.request.headers.get('cookie') ?? '') : Promise.resolve({ me: null, unauthorized: false }),
+const [lbRes, { sessionOk }] = await Promise.all([
+ fetchPublic
(slug, 'leaderboard'),
+ eventSession(Astro.request, slug),
]);
const lb = lbRes ?? { rows: [], public: false };
const rows = lb.rows ?? [];
-const sessionOk = hasSession && !meRes.unauthorized;
+// La API devuelve lista, pero un event.json editado a mano (o una versión
+// vieja del backend) puede traer null: nunca reventamos la pantalla por eso.
+const checks = ev.submission.checks ?? [];
const l = tObj>('events.leaderboard', locale);
---
@@ -40,7 +41,7 @@ const l = tObj>('events.leaderboard', locale);
{ev.format === 'team' ? l.team : l.participant} |
{l.project} |
{l.votes} |
- {ev.submission.checks.length > 0 && {l.auto} | }
+ {checks.length > 0 && {l.auto} | }
{l.total} |
@@ -50,7 +51,7 @@ const l = tObj>('events.leaderboard', locale);
{r.owner.name}{r.not_prize_eligible ? ' *' : ''} |
{r.title} |
{r.votes} |
- {ev.submission.checks.length > 0 && {r.auto_points} | }
+ {checks.length > 0 && {r.auto_points} | }
{r.total} |
))}
diff --git a/src/pages/events/[slug]/_me.astro b/src/pages/events/[slug]/_me.astro
index 4b5405e..ef440ae 100644
--- a/src/pages/events/[slug]/_me.astro
+++ b/src/pages/events/[slug]/_me.astro
@@ -5,8 +5,8 @@ import NanPage from '../../../layouts/NanPage.astro';
import EventHeader from '../../../components/events/EventHeader.astro';
import ReassignForm from '../../../components/events/ReassignForm.tsx';
import LoginForm, { type LoginStrings } from '../../../components/events/LoginForm.tsx';
-import { getLocale, t, tObj, withLang } from '../../../lib/i18n';
-import { fetchMe, hasSessionCookie, type EventInfo } from '../../../lib/events';
+import { getLocale, optionLabel, t, tObj, withLang } from '../../../lib/i18n';
+import { eventSession, type EventInfo } from '../../../lib/events';
const locale = getLocale(Astro.url);
// El evento lo resuelve el envoltorio de ruta (resolveEventRoute) y llega por props.
@@ -16,17 +16,13 @@ interface Props {
const ev = Astro.props.event;
const slug = ev.slug;
-const hasSession = hasSessionCookie(Astro.request);
-const { me, unauthorized } = hasSession
- ? await fetchMe(slug, Astro.request.headers.get('cookie') ?? '')
- : { me: null, unauthorized: false };
-const sessionOk = hasSession && !unauthorized;
+const { me, sessionOk } = await eventSession(Astro.request, slug);
const participant = me?.participant ?? null;
const team = me?.team ?? null;
const submission = me?.submission ?? null;
const isTeam = ev.format === 'team';
const options = tObj>('events.options', locale);
-const label = (v?: string | null) => (v ? options[v] ?? v : '');
+const label = (v?: string | null) => optionLabel(options, v);
const m = tObj>('events.me', locale);
const login = tObj('events.login', locale);
const submissionUrl = withLang(`/events/${slug}/submission`, locale);
@@ -34,6 +30,11 @@ const title = isTeam ? m.title : m.titleSolo;
const statusLabel = participant?.status === 'withdrawn'
? m.statusWithdrawn
: participant?.is_reserve ? m.statusReserve : m.statusRegistered;
+// Candidatos a ausente: los compañeros, nunca uno mismo. El backend rechaza
+// señalarse a sí mismo (§7.6.3) con un error genérico, así que la opción no
+// llega a ofrecerse; si no queda nadie más en el equipo, no hay a quién
+// reasignar y el formulario sobra.
+const absent = (team?.members ?? []).filter((x) => x.id !== participant?.id);
---
{/* Detrás de sesión: fuera del sitemap y también fuera del índice. */}
@@ -82,11 +83,11 @@ const statusLabel = participant?.status === 'withdrawn'
{submission ? m.submissionCta : m.submissionCreateCta}
- {ev.phase === 'building' && team.members && (
+ {ev.phase === 'building' && absent.length > 0 && (
- ({ id: x.id, name: x.name, discord_user: x.discord_user ?? undefined }))}
+ ({ id: x.id, name: x.name, discord_user: x.discord_user ?? undefined }))}
ctaLabel={m.reassignCta} info={tObj('events.me.reassignInfo', locale)}
- labels={{ pending: m.reassignPending, filled: m.reassignFilled, noPool: m.reassignNoPool, already: m.reassignAlready, selectAbsent: m.reassignSelectAbsent, errorSubmit: m.reassignErrorSubmit, sending: m.reassignSending }} />
+ labels={{ pending: m.reassignPending, filled: m.reassignFilled, noPool: m.reassignNoPool, already: m.reassignAlready, selectAbsent: m.reassignSelectAbsent, errorSubmit: m.reassignErrorSubmit, sending: m.reassignSending, refresh: m.reassignRefresh }} />
)}
diff --git a/src/pages/events/[slug]/_projects.astro b/src/pages/events/[slug]/_projects.astro
index 09ef42e..1c7118c 100644
--- a/src/pages/events/[slug]/_projects.astro
+++ b/src/pages/events/[slug]/_projects.astro
@@ -5,7 +5,7 @@ import NanPage from '../../../layouts/NanPage.astro';
import EventHeader from '../../../components/events/EventHeader.astro';
import VoteButton from '../../../components/events/VoteButton.tsx';
import { getLocale, tObj, withLang } from '../../../lib/i18n';
-import { fetchMe, fetchPublic, hasSessionCookie, type PublicSubmission, type EventInfo } from '../../../lib/events';
+import { eventSession, fetchPublic, type PublicSubmission, type EventInfo } from '../../../lib/events';
const locale = getLocale(Astro.url);
// El evento lo resuelve el envoltorio de ruta (resolveEventRoute) y llega por props.
@@ -15,16 +15,14 @@ interface Props {
const ev = Astro.props.event;
const slug = ev.slug;
-const hasSession = hasSessionCookie(Astro.request);
// Entregas + voto actual del visitante en paralelo (el voto permite marcar la
// tarjeta votada y ofrecer cambiarlo; sin sesión queda null).
-const [projects, meRes] = await Promise.all([
+const [projects, { me, sessionOk }] = await Promise.all([
ev.windows.gallery.visible ? fetchPublic(slug, 'submissions') : Promise.resolve([]),
- hasSession ? fetchMe(slug, Astro.request.headers.get('cookie') ?? '') : Promise.resolve({ me: null, unauthorized: false }),
+ eventSession(Astro.request, slug),
]);
const list = projects ?? [];
-const sessionOk = hasSession && !meRes.unauthorized;
-const myVote = meRes.me?.my_vote ?? null;
+const myVote = me?.my_vote ?? null;
const canVote = ev.windows.voting.open;
const pr = tObj>('events.projects', locale);
diff --git a/src/pages/events/[slug]/_submission.astro b/src/pages/events/[slug]/_submission.astro
index ce6add3..ccd8468 100644
--- a/src/pages/events/[slug]/_submission.astro
+++ b/src/pages/events/[slug]/_submission.astro
@@ -6,7 +6,7 @@ import EventHeader from '../../../components/events/EventHeader.astro';
import SubmissionForm from '../../../components/events/SubmissionForm.tsx';
import LoginForm, { type LoginStrings } from '../../../components/events/LoginForm.tsx';
import { getLocale, tObj } from '../../../lib/i18n';
-import { fetchMe, fmtDate, hasSessionCookie, type EventInfo } from '../../../lib/events';
+import { eventSession, fmtDate, type EventInfo, type SubmissionFields } from '../../../lib/events';
const locale = getLocale(Astro.url);
// El evento lo resuelve el envoltorio de ruta (resolveEventRoute) y llega por props.
@@ -16,24 +16,34 @@ interface Props {
const ev = Astro.props.event;
const slug = ev.slug;
-const hasSession = hasSessionCookie(Astro.request);
-const { me, unauthorized } = hasSession
- ? await fetchMe(slug, Astro.request.headers.get('cookie') ?? '')
- : { me: null, unauthorized: false };
-const sessionOk = hasSession && !unauthorized;
+const { me, sessionOk } = await eventSession(Astro.request, slug);
const isTeam = ev.format === 'team';
const hasTeam = Boolean(me?.team?.id);
const hasParticipant = Boolean(me?.participant && me.participant.status !== 'withdrawn');
const existing = me?.submission ?? null;
const canEdit = ev.windows.submission.open;
-const beforeOpen = ev.phase === 'draft' || ev.phase === 'registration' || ev.phase === 'building_pending';
+const beforeOpen = ev.phase === 'draft' || ev.phase === 'published' || ev.phase === 'registration' || ev.phase === 'building_pending';
const s = tObj>('events.submission', locale);
const options = tObj>('events.options', locale);
const login = tObj('events.login', locale);
const fill = (str: string, vars: Record) =>
Object.entries(vars).reduce((acc, [k, v]) => acc.replaceAll(`{${k}}`, v), str);
-const fields = ev.submission.fields;
+// Las fechas son opcionales (v3): sin ellas la frase que las nombra queda coja,
+// así que cada aviso tiene gemelo sin fecha.
+const openAt = fmtDate(ev.dates.submission_open, locale, true);
+const closeAt = fmtDate(ev.dates.submission_close, locale, true);
+const windowNotOpen = openAt ? fill(s.notOpen, { date: openAt }) : s.notOpenNoDate;
+const windowClosed = closeAt ? fill(s.closedNote, { date: closeAt }) : s.closedNoteNoDate;
+// Las listas del evento llegan como null cuando el slice va nil en el backend
+// (ver EventInfo): nunca reventamos la pantalla por eso, y el tipo obliga.
+const specialties = ev.registration.specialties ?? [];
+const levels = ev.registration.levels ?? [];
+const checks = ev.submission.checks ?? [];
+// fields NO necesita guarda: en el backend es un struct por valor, así que
+// siempre se serializa como objeto. Un modo en cadena vacía (event.json v2)
+// cae en "visible y opcional", que es el trato correcto.
+const fields: SubmissionFields = ev.submission.fields;
const readonlyRows = existing
? [
{ label: s.fTitle, value: existing.title },
@@ -63,18 +73,16 @@ const readonlyRows = existing
) : canEdit ? (
) : (
{beforeOpen ? s.notOpenTitle : s.closedTitle}
- {beforeOpen
- ? fill(s.notOpen, { date: fmtDate(ev.dates.submission_open, locale, true) })
- : fill(s.closedNote, { date: fmtDate(ev.dates.submission_close, locale, true) })}
+ {beforeOpen ? windowNotOpen : windowClosed}
{existing ? (
@@ -88,11 +96,11 @@ const readonlyRows = existing
))}
- {ev.submission.checks.length > 0 && (
+ {checks.length > 0 && (
{s.checks}: {existing.auto_points ?? 0}/{ev.voting.auto_max}
- {ev.submission.checks.map((k) => (
+ {checks.map((k) => (
- {existing.checks?.[k]?.pass ? '✓' : '✗'} {options[k] ?? k}
))}
diff --git a/src/pages/events/admin/[slug]/_auditoria.astro b/src/pages/events/admin/[slug]/_auditoria.astro
new file mode 100644
index 0000000..33c0745
--- /dev/null
+++ b/src/pages/events/admin/[slug]/_auditoria.astro
@@ -0,0 +1,157 @@
+---
+// Auditoría y backups del evento (SPEC v3 §6.6, §6.7 y §8, W-09): las
+// líneas de audit.jsonl con filtros (desde, acción, límite), más recientes
+// primero, con antes/después desplegable; y la lista de backups con
+// restaurar en dos pasos (previsualización dry_run y confirmación). El POST
+// lo procesa el envoltorio de ruta; aquí solo se consulta y se pinta.
+import '../../../../styles/global.css';
+import EventsAdmin from '../../../../layouts/EventsAdmin.astro';
+import AdminNotices from '../../../../components/events/admin/AdminNotices.astro';
+import { adminFetch, adminHref, fmtAdminDate, type AdminScreenProps } from '../../../../lib/eventsAdmin';
+import { isoToLocal, readFlash } from '../../../../lib/eventsAdminForms';
+import {
+ actorLabel, auditSearch, backupDate, fmtBytes, readAuditFilters,
+ AUDIT_ACTION_GROUPS, AUDIT_DEFAULT_LIMIT, AUDIT_MAX_LIMIT,
+ type AuditEntry, type BackupInfo, type RestoreResult,
+} from '../../../../lib/eventsAdminAudit';
+
+type Props = AdminScreenProps;
+const { staff, cookie, view, outcome } = Astro.props;
+const ev = view.event;
+const archived = Boolean(ev.archived_at);
+const flash = readFlash(Astro.url, outcome);
+const filters = readAuditFilters(Astro.url);
+
+const [auditRes, backupsRes] = await Promise.all([
+ adminFetch
(cookie, `${ev.slug}/admin/audit`, { search: auditSearch(filters) }),
+ adminFetch(cookie, `${ev.slug}/admin/backups`),
+]);
+const entries = auditRes.data ?? [];
+const backups = backupsRes.data ?? [];
+
+// Previsualización de restaurar: la respuesta de dry_run se queda en la página con el botón de confirmar.
+const preview = outcome.result?.ok && outcome.action === 'restore_preview' ? (outcome.result.data as RestoreResult | null) : null;
+const previewWarnings = outcome.action === 'restore_preview' && outcome.result?.ok ? outcome.result.warnings : [];
+
+const json = (v: unknown) => (v === null || v === undefined ? '—' : JSON.stringify(v, null, 2));
+const fileLabel = (f: string) => f.replace(/\.json$/, '');
+// Las acciones con sujeto van con el id del sujeto en `target`; las del evento llevan el slug.
+const targetText = (e: AuditEntry) => (e.target && e.target !== ev.slug ? e.target : '');
+---
+
+
+
+
+ {preview && (
+
+
+ Simulación de restaurar {fileLabel(preview.file)} desde el backup {preview.timestamp}: el fichero valida y no se ha cambiado nada todavía.
+ Al confirmar, el fichero actual se guarda como backup nuevo y se sustituye por el elegido; si el resultado no valida, se deshace.
+
+ {previewWarnings.length > 0 &&
}
+
+
Auditoría ({entries.length}{entries.length >= filters.limit ? `, límite ${filters.limit}` : ''})
+
+
+ Cada línea es un cambio hecho por la API o el panel: quién, qué y el antes y después. Más recientes primero. También se puede leer con
+ GET /api/events/{ev.slug}/admin/audit?since=&action=&limit=.
+
+
+
+ {!auditRes.ok && }
+
+ {auditRes.ok && entries.length === 0 && No hay líneas de auditoría{filters.since || filters.action ? ' con estos filtros' : ''}.
}
+
+ {entries.length > 0 && (
+
+
+ | Fecha | Actor | Acción | Sujeto | Avisos | Cambio |
|---|
+
+ {entries.map((e) => (
+
+ | {fmtAdminDate(e.ts)} |
+ {actorLabel(e.actor)} |
+ {e.action} |
+ {targetText(e) ? {targetText(e)} : —} |
+ {e.warnings.length ? {e.warnings.join(', ')} : —} |
+
+
+ antes / después
+
+ {json(e.before)}
+ {json(e.after)}
+
+ |
+
+ ))}
+
+
+
Backups ({backups.length})
+
+ Antes de cada escritura el backend guarda una copia del fichero que va a cambiar. Restaurar hace backup del fichero actual,
+ sustituye, recarga y valida; si no valida, lo deshace. {archived && 'Evento archivado: no se puede restaurar.'}
+
+ {!backupsRes.ok && }
+ {backupsRes.ok && backups.length === 0 && Todavía no hay backups.
}
+ {backups.length > 0 && (
+
+
+ | Fichero | Copia | Fecha | Tamaño | {!archived && | }
|---|
+
+ {backups.map((b) => (
+
+ | {fileLabel(b.file)} |
+ {b.timestamp} |
+ {fmtAdminDate(backupDate(b.timestamp)) || '—'} |
+ {fmtBytes(b.size)} |
+ {!archived && (
+
+
+ |
+ )}
+
+ ))}
+
+
+
Este evento no tiene el módulo de entregas. Se activa en la ficha del evento.
+ )}
+
+ {enabled && (
+
+
+ - Entregas activas
- {active.length}
+ - Retiradas
- {rows.length - active.length}
+ - Ventana
- {view.windows.submission.open ? 'abierta' : 'cerrada'}
+ - Checks
- {checks.length ? checks.map(checkLabel).join(', ') : ninguno}
+ - Premio exige
- {prizeRequires.length ? prizeRequires.map(checkLabel).join(', ') : nada}
+
+
+ Los checks se ejecutan al entregar y al cambiar una URL. "Verificar todas" los repite en las entregas activas sin pisar los fijados a mano.
+ Retirar no borra: la entrega se puede restaurar mientras su propietario siga en el evento.
+
+ {!archived && checks.length > 0 && (
+
+ )}
+
+ )}
+
+ {res && !res.ok && }
+ {res?.ok && rows.length === 0 && Todavía no hay entregas.
}
+
+ {rows.length > 0 && (
+
+
+
+
+ | Propietario |
+ Entrega |
+ {checks.length > 0 && Checks | }
+ Puntos |
+ Premio |
+ Estado |
+ Acciones |
+
+
+
+ {rows.map((r) => (
+
+ |
+ {r.owner.name}
+ {ownerKind(r.owner.type)} · {r.owner_emails.join(', ') || '—'}
+ |
+
+ {r.title}
+
+ {urlKeys.filter((k) => r[k]).map((k) => (
+ <> {URL_LABELS[k]}{' '}
+ ))}
+ |
+ {checks.length > 0 && (
+
+ {checks.map((name) => {
+ const c = r.checks?.[name];
+ return (
+
+ {c ? (c.pass ? '✓' : '✗') : '·'} {checkLabel(name)}{c?.forced ? ' *' : ''}
+
+ );
+ })}
+ |
+ )}
+ {r.auto_points} / {ev.voting.auto_max} |
+
+ {prizeText(r)}
+ {r.prize_reason && motivo: {r.prize_reason} }
+ |
+
+ {r.withdrawn_at
+ ? <>retirada {fmtAdminDate(r.withdrawn_at)}
+ : <>activa{fmtAdminDate(r.submitted_at)} }
+ |
+
+ {!archived && Editar}
+ {!archived && !r.withdrawn_at && (
+
+ )}
+ {!archived && r.withdrawn_at && (
+
+ )}
+ {archived && solo lectura}
+ |
+
+ ))}
+
+
+ {checks.length > 0 &&
* check fijado a mano por un admin (verify no lo pisa).
}
+
Editar: {editRow.title}
+
+ {ownerKind(editRow.owner.type)} {editRow.owner.name} · entregada el {fmtAdminDate(editRow.submitted_at)}
+ {editRow.withdrawn_at ? ` · retirada el ${fmtAdminDate(editRow.withdrawn_at)}` : ''} · {editRow.id}
+
+
+
+ {checks.length > 0 && (
+ <>
+ Checks
+
+
+ | Check | Resultado | Fijar a mano |
|---|
+
+ {checks.map((name) => {
+ const c = editRow.checks?.[name];
+ return (
+
+ | {checkLabel(name)} |
+
+ {c ? {c.pass ? 'pasa' : 'falla'}{c.forced ? ' (fijado)' : ''} : sin ejecutar}
+
+ {c?.checked_at ? fmtAdminDate(c.checked_at) : ''}{c?.http_status ? ` · HTTP ${c.http_status}` : ''}{c?.host ? ` · ${c.host}` : ''}{c?.reason ? ` · ${c.reason}` : ''}
+
+ |
+
+
+ |
+
+ );
+ })}
+
+
+
Premio
+
+ Ahora: {prizeText(editRow)}{editRow.prize_reason ? ` · ${editRow.prize_reason}` : ''}.
+ {prizeRequires.length ? ` En automático exige: ${prizeRequires.map(checkLabel).join(', ')}.` : ' En automático todas optan.'}
+
+
+
+ )}
+
diff --git a/src/pages/events/admin/[slug]/_equipos.astro b/src/pages/events/admin/[slug]/_equipos.astro
new file mode 100644
index 0000000..ae6d34d
--- /dev/null
+++ b/src/pages/events/admin/[slug]/_equipos.astro
@@ -0,0 +1,200 @@
+---
+// Equipos del evento (SPEC v3 §6.3 y §8, W-06): tablero con una columna por
+// equipo y otra con los inscritos sin equipo; mover entre columnas, crear,
+// renombrar, disolver y generar con previsualización. El POST lo procesa el
+// envoltorio de ruta; aquí solo se consulta y se pinta.
+import '../../../../styles/global.css';
+import EventsAdmin from '../../../../layouts/EventsAdmin.astro';
+import AdminNotices from '../../../../components/events/admin/AdminNotices.astro';
+import { adminFetch, adminHref, type AdminScreenProps } from '../../../../lib/eventsAdmin';
+import { readFlash, warningLabel } from '../../../../lib/eventsAdminForms';
+import { adminOptionLabel, participantProfile, type AdminParticipantRow } from '../../../../lib/eventsAdminParticipants';
+import { NO_TEAM, TEAM_ORIGIN_LABELS, type AdminTeamRow, type GenerateReport } from '../../../../lib/eventsAdminTeams';
+
+type Props = AdminScreenProps;
+const { staff, cookie, view, outcome } = Astro.props;
+const ev = view.event;
+const archived = Boolean(ev.archived_at);
+const isTeam = ev.format === 'team';
+const flash = readFlash(Astro.url, outcome);
+const limits = ev.team ?? null;
+
+const teamsRes = isTeam ? await adminFetch(cookie, `${ev.slug}/admin/teams`) : null;
+const freeRes = isTeam ? await adminFetch(cookie, `${ev.slug}/admin/participants`, { search: '?team=none' }) : null;
+const teams = (teamsRes?.data ?? []).slice().sort((a, b) => a.id.localeCompare(b.id));
+// Solo los inscritos activos pueden entrar en un equipo (reserva y bajas no).
+const free = (freeRes?.data ?? []).filter((p) => p.status !== 'withdrawn' && !p.is_reserve).sort((a, b) => a.position - b.position);
+const locked = teams.filter((t) => t.locked).length;
+
+const previewing = outcome.action === 'generate_preview' && outcome.result?.ok;
+const report = previewing ? (outcome.result?.data as GenerateReport | null) : null;
+const topResult = previewing ? undefined : outcome.result;
+const v = (k: string, action: string, fallback = '') => (outcome.action === action && outcome.values ? String(outcome.values[k] ?? '') : fallback);
+
+const SIZE_PILLS: Record = { team_empty: 'vacío', team_under_min: 'bajo mínimo', team_over_size: 'sobre tamaño' };
+const profile = participantProfile;
+const balance = (t: AdminTeamRow) => {
+ const parts = Object.entries(t.balance_score.specialties ?? {}).map(([k, n]) => `${adminOptionLabel(k)}×${n}`);
+ return [t.balance_score.avg_level ? `nivel medio ${t.balance_score.avg_level.toFixed(1)}` : '', ...parts].filter(Boolean).join(' · ');
+};
+---
+
+
+
+
+ {!isTeam && (
+ Este evento es individual: no tiene equipos. El formato se cambia en la ficha del evento (solo en borrador).
+ )}
+
+ {isTeam && (
+
+
+ - Equipos
- {teams.length} / máx {limits?.max_teams || '∞'}
+ - Tamaño
- {limits?.min_size ?? '—'}–{limits?.size ?? '—'} (mín–objetivo)
+ - Sin equipo
- {free.length}
+ - Con entrega
- {locked} bloqueados
+ - Inscritos activos
- {view.counts.registered}
+
+
+ Los límites de tamaño solo avisan. Un equipo con entrega activa queda bloqueado: no se mueve a nadie ni se disuelve (decisión 19).
+ A los de reserva o de baja primero hay que promoverlos o reincorporarlos.
+
+
+ )}
+
+ {teamsRes && !teamsRes.ok && }
+ {freeRes && !freeRes.ok && }
+
+ {isTeam && (
+
+
+ Sin equipo ({free.length})
+ {free.length === 0 && Todos los inscritos activos tienen equipo.
}
+
+ {free.map((p) => (
+ -
+
{p.name}
+ {profile(p) || p.email}
+ {!archived && teams.some((t) => !t.locked) && (
+
+ )}
+
+ ))}
+
+
+
+ {teams.map((t) => (
+
+
+ {t.name} · {t.size}
+
+
+ {TEAM_ORIGIN_LABELS[t.origin] ?? t.origin}
+ {t.locked && con entrega}
+ {t.warnings.map((w) => {SIZE_PILLS[w] ?? w})}
+
+ {balance(t) && {balance(t)}
}
+
+ {t.members.length === 0 && - Sin miembros.
}
+ {t.members.map((m) => (
+ -
+
{m.name}
+ {profile(m) || m.email}
+ {!archived && !t.locked && (
+
+ )}
+
+ ))}
+
+ {!archived && (
+
+ )}
+
+ ))}
+
+ Crear equipo
+
+
+ )}
+
+ {isTeam && !archived && (
+
+ Generar equipos automáticamente
+
+
+ Reparte a los inscritos activos equilibrando especialidad y nivel. Sin "conservar manuales" descarta todos los equipos actuales;
+ con ella conserva los manuales y reparte solo al resto. No se puede generar con entregas hechas.
+
+
+ {report && (
+
+
+ Previsualización (no se ha escrito nada): quedarían {report.teams} equipos, {report.kept} conservados y {report.created} nuevos.
+
+ {(outcome.result?.warnings ?? []).length > 0 && (
+
{(outcome.result?.warnings ?? []).map((w) => {w} — {warningLabel(w)}
+ )}
+
+ )}
+
+ )}
+
diff --git a/src/pages/events/admin/[slug]/_index.astro b/src/pages/events/admin/[slug]/_index.astro
new file mode 100644
index 0000000..5a766c8
--- /dev/null
+++ b/src/pages/events/admin/[slug]/_index.astro
@@ -0,0 +1,116 @@
+---
+// Ficha del evento (SPEC v3 §8, W-03): resumen (fase, ventanas, contadores,
+// avisos de coherencia), control de estado (W-04), editor del event.json,
+// clonado y archivado. El POST lo procesa el envoltorio de ruta.
+import '../../../../styles/global.css';
+import EventsAdmin from '../../../../layouts/EventsAdmin.astro';
+import AdminNotices from '../../../../components/events/admin/AdminNotices.astro';
+import EventForm from '../../../../components/events/admin/EventForm.astro';
+import StateControl from '../../../../components/events/admin/StateControl.astro';
+import { adminHref, fmtAdminDate, PHASE_LABELS, type AdminScreenProps } from '../../../../lib/eventsAdmin';
+import { eventToForm, readFlash, warningLabel } from '../../../../lib/eventsAdminForms';
+
+type Props = AdminScreenProps;
+const { staff, view, outcome } = Astro.props;
+const ev = view.event;
+const archived = Boolean(ev.archived_at);
+const flash = readFlash(Astro.url, outcome);
+const values = outcome.values && ['save', 'simulate'].includes(outcome.action ?? '') ? outcome.values : eventToForm(ev);
+const cloneSlug = outcome.action === 'clone' && outcome.values ? String(outcome.values.clone_slug ?? '') : '';
+const canArchiveDirect = ev.status === 'closed' || ev.status === 'cancelled';
+// La previsualización de estado y el sweep sin transición los pinta StateControl; arriba solo van los errores.
+const topResult = ['state_preview', 'sweep'].includes(outcome.action ?? '') && outcome.result?.ok ? undefined : outcome.result;
+const windows = [
+ { label: 'Inscripción', open: view.windows.registration.open },
+ { label: 'Entregas', open: view.windows.submission.open },
+ { label: 'Votación', open: view.windows.voting.open },
+ { label: 'Galería', open: view.windows.gallery.visible },
+ { label: 'Ranking', open: view.windows.leaderboard.visible },
+];
+---
+
+
+
+
+
+ Ahora mismo
+
+ - Fase
- {PHASE_LABELS[view.phase] ?? view.phase}
+ - Inscritos
- {view.counts.registered} / {ev.registration.capacity || '∞'}
+ - Reserva
- {view.counts.reserve}
+ - Bajas
- {view.counts.withdrawn}
+ - Equipos
- {view.counts.teams}
+ - Entregas
- {view.counts.submissions}
+ - Votos
- {view.counts.votes}
+ - Actualizado
- {fmtAdminDate(ev.updated_at)}
+ {archived && - Archivado
- {fmtAdminDate(ev.archived_at)}
}
+
+
+ {windows.map((w) => {w.label}: {w.open ? 'abierta' : 'cerrada'})}
+
+ {view.warnings.length > 0 && (
+
+
Avisos de coherencia:
+
{view.warnings.map((w) => {w} — {warningLabel(w)}
+
+ Público: /events/{ev.slug} (solo a partir de inscripción).
+ Pantallas: participantes,
+ equipos,
+ entregas,
+ votos y
+ auditoría.
+
+
+
+ {archived && Evento archivado: solo lectura. Para editarlo hay que desarchivarlo.
}
+
+
+
+
+
+
+ Clonar
+
+ Copia la configuración a un evento nuevo en borrador, sin participantes, equipos, entregas ni votos y con las fechas vacías.
+
+
+
+
+
+ {archived ? 'Desarchivar' : 'Archivar'}
+ {archived ? (
+
+ ) : (
+
+ )}
+
+
diff --git a/src/pages/events/admin/[slug]/_participantes.astro b/src/pages/events/admin/[slug]/_participantes.astro
new file mode 100644
index 0000000..0c23fe1
--- /dev/null
+++ b/src/pages/events/admin/[slug]/_participantes.astro
@@ -0,0 +1,292 @@
+---
+// Participantes del evento (SPEC v3 §6.2 y §8, W-05): tabla con filtros,
+// acciones por fila (baja, reincorporar, promover, reserva, editar), alta
+// manual, importación CSV con previsualización y exportación. El POST lo
+// procesa el envoltorio de ruta; aquí solo se consulta y se pinta.
+import '../../../../styles/global.css';
+import EventsAdmin from '../../../../layouts/EventsAdmin.astro';
+import AdminNotices from '../../../../components/events/admin/AdminNotices.astro';
+import { adminFetch, adminHref, fmtAdminDate, type AdminScreenProps } from '../../../../lib/eventsAdmin';
+import { readFlash, warningLabel } from '../../../../lib/eventsAdminForms';
+import {
+ adminOptionLabel, IMPORT_ACTION_LABELS, participantProfile, PARTICIPANT_SOURCE_LABELS, PARTICIPANT_STATUS_LABELS,
+ participantsSearch, readParticipantFilters, type AdminParticipantRow, type ImportReport,
+} from '../../../../lib/eventsAdminParticipants';
+
+type Props = AdminScreenProps;
+const { staff, cookie, view, outcome } = Astro.props;
+const ev = view.event;
+const archived = Boolean(ev.archived_at);
+const isTeam = ev.format === 'team';
+const flash = readFlash(Astro.url, outcome);
+const filters = readParticipantFilters(Astro.url);
+const here = adminHref(ev.slug, 'participantes');
+
+const res = await adminFetch(cookie, `${ev.slug}/admin/participants`, { search: participantsSearch(filters) });
+const rows = (res.data ?? []).slice().sort((a, b) => a.position - b.position);
+const teams = [...new Map(rows.filter((r) => r.team_id).map((r) => [r.team_id as string, r.team_name ?? r.team_id])).entries()];
+
+// Edición: ?editar= abre la tarjeta con los datos de esa fila (o los que se escribieron si falló).
+const editId = outcome.action === 'update' && outcome.values ? String(outcome.values.id ?? '') : (Astro.url.searchParams.get('editar') ?? '');
+const editRow = rows.find((r) => r.id === editId) ?? null;
+const ev2 = (k: string, fallback: string) => (outcome.action === 'update' && outcome.values ? String(outcome.values[k] ?? '') : fallback);
+const addV = (k: string) => (outcome.action === 'add' && outcome.values ? String(outcome.values[k] ?? '') : '');
+
+const importing = outcome.action === 'import_preview' || outcome.action === 'import';
+const report = importing && outcome.result?.ok ? (outcome.result.data as ImportReport | null) : null;
+// Un error de importación (csv_invalid…) y el informe los pinta esta página; arriba van el resto de errores.
+const topResult = importing && outcome.result?.ok ? undefined : outcome.result;
+// La API devuelve listas, pero un event.json editado a mano (o una versión
+// vieja del backend) puede traer null: nunca reventamos la pantalla por eso.
+const specialties = ev.registration.specialties ?? [];
+const levels = ev.registration.levels ?? [];
+const hasSpecialties = specialties.length > 0;
+const hasLevels = levels.length > 0;
+const statusOf = (r: AdminParticipantRow) => PARTICIPANT_STATUS_LABELS[r.status] ?? r.status;
+---
+
+
+
+
+
+
+ - Inscritos
- {view.counts.registered} / {ev.registration.capacity || '∞'}
+ - Reserva
- {view.counts.reserve} / {ev.registration.reserve_capacity || '∞'}
+ - Bajas
- {view.counts.withdrawn}
+ - Inscripción
- {view.windows.registration.open ? 'abierta' : 'cerrada'}
+ - Formato
- {isTeam ? 'equipos' : 'individual'}
+
+
+
+
+ {!res.ok && }
+ {res.ok && rows.length === 0 && No hay participantes con ese filtro.
}
+
+ {rows.length > 0 && (
+
+
+
+
+ | # |
+ Participante |
+ {(hasSpecialties || hasLevels) && Perfil | }
+ Estado |
+ {isTeam && Equipo | }
+ Entrega |
+ Origen |
+ Acciones |
+
+
+
+ {rows.map((r) => (
+
+ | {r.position} |
+
+ {r.name}
+ {r.email}{r.discord_user ? ` · ${r.discord_user}` : ''}
+ {r.notes && ✎ {r.notes} }
+ |
+ {(hasSpecialties || hasLevels) && {participantProfile(r) || '—'} | }
+
+ {statusOf(r)}
+ {r.is_reserve && r.status !== 'withdrawn' && reserva}
+ {r.status === 'withdrawn' && r.withdrawn_reason && motivo: {r.withdrawn_reason} }
+ |
+ {isTeam && {r.team_name ?? —} | }
+ {r.submission_id ? sí : no} |
+ {PARTICIPANT_SOURCE_LABELS[r.source] ?? r.source}
{fmtAdminDate(r.created_at)} |
+
+ {!archived && r.status !== 'withdrawn' && (
+
+ )}
+ {!archived && r.is_reserve && r.status !== 'withdrawn' && (
+
+ )}
+ {!archived && !r.is_reserve && r.status !== 'withdrawn' && !r.team_id && !r.submission_id && (
+
+ )}
+ {!archived && r.status === 'withdrawn' && (
+
+ )}
+ {archived && solo lectura}
+ |
+
+ ))}
+
+
+
Editar: {editRow.name}
+ {editRow.email} · {statusOf(editRow)} · inscrito el {fmtAdminDate(editRow.created_at)}
+
+
+ )}
+
+ {!archived && (
+
+ Alta manual
+
+
+ Solo cuentas de NaN: el email tiene que existir en la plataforma. No hace falta que la inscripción esté abierta; por encima del aforo se crea con aviso.
+
+
+
+ )}
+
+ {!archived && (
+
+ Importar CSV
+
+
+ Cabecera obligatoria; columnas email,name,discord_user,specialty,level,reserve en cualquier orden (solo email es imprescindible).
+ Emails sin cuenta de NaN se rechazan; los ya inscritos se actualizan. Previsualiza primero: no escribe nada.
+
+
+ {report && (
+
+
+ {outcome.action === 'import' ? 'Importación aplicada' : 'Previsualización (no se ha escrito nada)'}:
+ {' '}{report.created} nuevas, {report.updated} actualizadas, {report.restored} reincorporadas, {report.unchanged} sin cambios, {report.rejected} rechazadas.
+
+ {report.rows.length > 0 && (
+
+
+ | Línea | Email | Resultado | Detalle |
|---|
+
+ {report.rows.map((row) => (
+
+ | {row.line} |
+ {row.email} |
+ {IMPORT_ACTION_LABELS[row.action] ?? row.action} |
+
+ {row.error ? warningLabel(row.error) : ''}
+ {(row.warnings ?? []).map((w) => {warningLabel(w)})}
+ |
+
+ ))}
+
+
+
+ )}
+
+ )}
+
+ )}
+
diff --git a/src/pages/events/admin/[slug]/_votos.astro b/src/pages/events/admin/[slug]/_votos.astro
new file mode 100644
index 0000000..adc5d19
--- /dev/null
+++ b/src/pages/events/admin/[slug]/_votos.astro
@@ -0,0 +1,163 @@
+---
+// Votos y ranking del evento (SPEC v3 §6.5 y §8, W-08): resumen de la
+// votación, ranking calculado al momento (aunque no sea público), lista de
+// votos solo lectura (decisión 23: no se anulan ni se editan) y los atajos
+// de abrir y cerrar la votación con previsualización. El POST lo procesa el
+// envoltorio de ruta; aquí solo se consulta y se pinta.
+import '../../../../styles/global.css';
+import EventsAdmin from '../../../../layouts/EventsAdmin.astro';
+import AdminNotices from '../../../../components/events/admin/AdminNotices.astro';
+import { adminFetch, adminHref, fmtAdminDate, ownerKind, STATUS_LABELS, type AdminScreenProps } from '../../../../lib/eventsAdmin';
+import { readFlash } from '../../../../lib/eventsAdminForms';
+import { voteStats, type AdminVoteRow, type LeaderboardView } from '../../../../lib/eventsAdminVotes';
+
+type Props = AdminScreenProps;
+const { staff, cookie, view, outcome } = Astro.props;
+const ev = view.event;
+const archived = Boolean(ev.archived_at);
+const enabled = ev.modules.voting;
+const flash = readFlash(Astro.url, outcome);
+
+const [votesRes, boardRes] = enabled
+ ? await Promise.all([
+ adminFetch(cookie, `${ev.slug}/admin/votes`),
+ adminFetch(cookie, `${ev.slug}/admin/leaderboard`),
+ ])
+ : [null, null];
+// Más recientes primero.
+const votes = (votesRes?.data ?? []).slice().sort((a, b) => b.created_at.localeCompare(a.created_at));
+const stats = voteStats(votes);
+const board = boardRes?.data ?? { rows: [], public: ev.voting.leaderboard_public };
+
+// Atajos de §4.4: abrir solo en building/submission/voting con la votación cerrada; cerrar solo en voting.
+const canOpen = !archived && enabled && !ev.voting.open && ['building', 'submission', 'voting'].includes(ev.status);
+const canClose = !archived && enabled && ev.status === 'voting';
+
+// Previsualización: la respuesta de `?dry_run=true` se queda en la página con el botón de confirmar.
+const preview = outcome.result?.ok && (outcome.action === 'open_preview' || outcome.action === 'close_preview') ? outcome.result : null;
+const previewVerb = outcome.action === 'close_preview' ? 'close' : 'open';
+const previewBoard = previewVerb === 'close' ? (preview?.data as LeaderboardView | null) : null;
+
+const voteState = (v: AdminVoteRow) => (!v.owner ? 'entrega eliminada' : v.withdrawn ? 'entrega retirada' : 'cuenta');
+const num = (n: number) => (Number.isInteger(n) ? String(n) : n.toFixed(2));
+---
+
+
+
+
+ {!enabled && (
+ Este evento no tiene el módulo de votación. Se activa en la ficha del evento.
+ )}
+
+ {enabled && (
+
+
+ - Estado
- {STATUS_LABELS[ev.status] ?? ev.status}
+ - Votación
- {ev.voting.open ? 'abierta' : 'cerrada'}{view.windows.voting.open ? '' : ev.voting.open ? (fuera de fecha) : ''}
+ - Ranking
- {board.public ? 'público' : solo admin}
+ - Votos
- {stats.counted}{stats.discarded ? + {stats.discarded} que no cuentan : ''}
+ - Votantes
- {stats.voters}
+ - Peso del voto
- {ev.voting.vote_weight} + hasta {ev.voting.auto_max} por checks
+
+
+ Total = peso · votos / máximo de votos + puntos por checks. Los votos a entregas retiradas no cuentan ni fijan el máximo.
+ Los votos no se anulan ni se editan (decisión 23). Cerrar la votación congela el ranking y lo publica.
+
+ {/*
+ Los dos atajos pueden convivir: en `voting` con la votación todavía
+ cerrada se puede abrir Y se puede cerrar (que congela el ranking). Antes
+ se pintaba solo uno y ganaba el de cerrar, así que desde ese estado —el
+ que deja `voting_not_open`— no había forma de abrir la votación.
+ */}
+ {(canOpen || canClose) && (
+
+ )}
+ {!archived && enabled && !canOpen && !canClose && (
+
+ La votación se abre desde construcción, entrega o votación, y se cierra desde votación. El estado se cambia en la ficha del evento.
+
+ )}
+
+ )}
+
+ {preview && (
+
+
+ Simulación de {previewVerb === 'close' ? 'cerrar' : 'abrir'} la votación: no se ha cambiado nada todavía.
+ {previewVerb === 'close' ? ' El evento pasaría a Cerrado y este ranking quedaría congelado y público.' : ' El evento pasaría a Votación si no lo estaba.'}
+
+ {preview.warnings.length > 0 &&
}
+ {previewBoard && previewBoard.rows.length > 0 && (
+
+ {previewBoard.rows.map((r) => - {r.title} ({r.owner.name}) · {num(r.total)} puntos{r.not_prize_eligible ? ' · no opta a premio' : ''}
)}
+
+ )}
+
+
Ranking {board.public ? '' : (no publicado)}
+ {board.rows.length === 0 && Todavía no hay entregas activas que clasificar.
}
+ {board.rows.length > 0 && (
+
+
+
+ | # | Entrega | Propietario | Votos | Puntos voto | Checks | Total | Premio |
|---|
+
+
+ {board.rows.map((r) => (
+
+ | {r.rank} |
+ {r.title} |
+ {r.owner.name} ({ownerKind(r.owner.type)}) |
+ {r.votes} |
+ {num(r.vote_points)} |
+ {r.auto_points} / {ev.voting.auto_max} |
+ {num(r.total)} |
+ {r.not_prize_eligible ? 'no opta' : 'opta'} |
+
+ ))}
+
+
+
Votos ({votes.length})
+ {votes.length === 0 && Todavía no hay votos.
}
+ {votes.length > 0 && (
+
+
+ | Votante | Entrega | Propietario | Fecha | Estado |
|---|
+
+ {votes.map((v) => (
+
+ | {v.voter_email} |
+ {v.submission_title || —} |
+ {v.owner ? <>{v.owner.name} ({ownerKind(v.owner.type)}) : —} |
+ {fmtAdminDate(v.created_at)} |
+ {voteState(v)} |
+
+ ))}
+
+
+
No hay eventos {filtro === 'activos' ? 'activos' : filtro === 'archivados' ? 'archivados' : ''}.
+ )}
+
+ {events.length > 0 && (
+
+
+
+
+ | Evento |
+ Estado |
+ Inscritos |
+ Equipos |
+ Entregas |
+ Votos |
+ Avisos |
+ Actualizado |
+
+
+
+ {events.map((e) => (
+
+ |
+ {e.name}
+ {e.slug} · {e.kind} · {e.format === 'team' ? 'equipos' : 'individual'}
+ |
+
+ {STATUS_LABELS[e.status] ?? e.status}
+ {e.archived_at && archivado}
+ {PHASE_LABELS[e.phase] ?? e.phase}
+ |
+ {e.counts.registered}{e.counts.reserve ? +{e.counts.reserve} reserva : null} |
+ {e.counts.teams} |
+ {e.counts.submissions} |
+ {e.counts.votes} |
+ {e.warnings.length ? {e.warnings.length} : —} |
+ {fmtAdminDate(e.updated_at)} |
+
+ ))}
+
+
+
+ El evento se crea en borrador: no es visible hasta pasarlo a inscripción. Todo se puede cambiar después desde su ficha.
+
+
+
+
diff --git a/src/pages/events/admin/index.astro b/src/pages/events/admin/index.astro
new file mode 100644
index 0000000..b660f60
--- /dev/null
+++ b/src/pages/events/admin/index.astro
@@ -0,0 +1,14 @@
+---
+// Envoltorio de ruta del panel (SPEC v3 §8): la guardia de staff se resuelve
+// AQUÍ (fichero de ruta) para que el 404 funcione; el cuerpo vive en el
+// fichero _ vecino, fuera del árbol de rutas (ver routeWrappers.test.ts).
+import Page from './_index.astro';
+import { resolveAdminRoute } from '../../../lib/eventsAdmin';
+
+export const prerender = false;
+
+const route = await resolveAdminRoute(Astro);
+if (route.notFound) return route.notFound;
+---
+
+
diff --git a/src/pages/events/admin/nuevo.astro b/src/pages/events/admin/nuevo.astro
new file mode 100644
index 0000000..4c31e06
--- /dev/null
+++ b/src/pages/events/admin/nuevo.astro
@@ -0,0 +1,16 @@
+---
+// Envoltorio de ruta del alta de eventos (SPEC v3 §8, W-03): guardia de
+// staff y procesado del POST aquí (fichero de ruta), cuerpo en _nuevo.astro.
+import Page from './_nuevo.astro';
+import { resolveAdminRoute } from '../../../lib/eventsAdmin';
+import { handleNewEventForm } from '../../../lib/eventsAdminForms';
+
+export const prerender = false;
+
+const route = await resolveAdminRoute(Astro);
+if (route.notFound) return route.notFound;
+const outcome = await handleNewEventForm(Astro.request, route.cookie);
+if (outcome.redirect) return Astro.redirect(outcome.redirect, 303);
+---
+
+
diff --git a/src/styles/events-admin.css b/src/styles/events-admin.css
new file mode 100644
index 0000000..d9de0e4
--- /dev/null
+++ b/src/styles/events-admin.css
@@ -0,0 +1,167 @@
+/*
+ * Piezas comunes del panel de administración de eventos (SPEC v3 §8).
+ * CSS plano (sin @apply) con la paleta neutral/violeta del resto de la web;
+ * el contenido de cada pantalla llega por slot, así que las clases son
+ * globales con prefijo `adm-`.
+ */
+
+.adm-card {
+ margin-top: 2rem;
+ border: 1px solid #262626;
+ border-radius: 0.75rem;
+ background: rgb(23 23 23 / 0.3);
+ padding: 1.5rem;
+}
+.adm-h2 {
+ font-family: var(--font-mono);
+ font-size: 0.75rem;
+ letter-spacing: 0.1em;
+ text-transform: uppercase;
+ color: #737373;
+}
+.adm-h2 + p { margin-top: 0.5rem; }
+.adm-grid {
+ margin-top: 1rem;
+ display: grid;
+ gap: 1rem;
+}
+@media (min-width: 640px) {
+ .adm-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+ .adm-grid > .adm-span { grid-column: 1 / -1; }
+}
+.adm-label {
+ display: block;
+ font-family: var(--font-mono);
+ font-size: 11px;
+ letter-spacing: 0.06em;
+ text-transform: uppercase;
+ color: #737373;
+}
+.adm-input {
+ margin-top: 0.25rem;
+ width: 100%;
+ border: 1px solid #404040;
+ border-radius: 0.375rem;
+ background: #0a0a0a;
+ padding: 0.5rem 0.75rem;
+ font-family: var(--font-mono);
+ font-size: 0.875rem;
+ color: #f5f5f5;
+}
+.adm-input:focus { outline: none; border-color: #a78bfa; }
+.adm-input:disabled { opacity: 0.5; }
+textarea.adm-input { min-height: 5.5rem; resize: vertical; }
+.adm-check {
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+ font-family: var(--font-mono);
+ font-size: 0.875rem;
+ color: #d4d4d4;
+}
+.adm-check input { width: 1rem; height: 1rem; accent-color: #8b5cf6; }
+.adm-checks { margin-top: 0.5rem; display: grid; gap: 0.5rem; }
+.adm-actions {
+ margin-top: 1.5rem;
+ display: flex;
+ flex-wrap: wrap;
+ align-items: center;
+ gap: 0.75rem;
+}
+.adm-btn {
+ border: 1px solid #404040;
+ border-radius: 0.375rem;
+ padding: 0.5rem 1rem;
+ font-family: var(--font-mono);
+ font-size: 0.875rem;
+ color: #e5e5e5;
+ background: transparent;
+ cursor: pointer;
+ transition: border-color 150ms, color 150ms, background 150ms;
+}
+.adm-btn:hover { border-color: #a78bfa; color: #c4b5fd; }
+.adm-btn:disabled { opacity: 0.5; cursor: default; }
+.adm-btn-primary { border-color: #8b5cf6; background: #7c3aed; color: #fff; }
+.adm-btn-primary:hover { background: #8b5cf6; color: #fff; }
+.adm-btn-danger { border-color: #7f1d1d; color: #fca5a5; }
+.adm-btn-danger:hover { border-color: #ef4444; color: #fecaca; }
+.adm-msg {
+ margin-top: 1.5rem;
+ border: 1px solid #404040;
+ border-radius: 0.375rem;
+ padding: 0.75rem 1rem;
+ font-family: var(--font-mono);
+ font-size: 0.875rem;
+ color: #d4d4d4;
+}
+.adm-msg ul { margin: 0.25rem 0 0 1rem; list-style: disc; }
+.adm-msg-ok { border-color: #065f46; background: rgb(2 44 34 / 0.4); color: #a7f3d0; }
+.adm-msg-warn { border-color: #92400e; background: rgb(69 26 3 / 0.4); color: #fde68a; }
+.adm-msg-error { border-color: #7f1d1d; background: rgb(69 10 10 / 0.4); color: #fecaca; }
+.adm-table-wrap { margin-top: 1rem; overflow-x: auto; }
+.adm-table {
+ width: 100%;
+ border-collapse: collapse;
+ font-family: var(--font-mono);
+ font-size: 0.875rem;
+ font-variant-numeric: tabular-nums;
+}
+.adm-table th {
+ border-bottom: 1px solid #262626;
+ padding: 0.5rem 1rem 0.5rem 0;
+ text-align: left;
+ font-size: 11px;
+ font-weight: 400;
+ letter-spacing: 0.06em;
+ text-transform: uppercase;
+ color: #737373;
+ white-space: nowrap;
+}
+.adm-table td {
+ border-bottom: 1px solid #171717;
+ padding: 0.5rem 1rem 0.5rem 0;
+ vertical-align: top;
+ color: #d4d4d4;
+}
+.adm-table a { color: #f5f5f5; }
+.adm-table a:hover { color: #a78bfa; }
+.adm-pill {
+ display: inline-block;
+ border: 1px solid #404040;
+ border-radius: 9999px;
+ padding: 0.125rem 0.5rem;
+ font-size: 11px;
+ color: #d4d4d4;
+ white-space: nowrap;
+}
+.adm-pill-warn { border-color: #92400e; color: #fde68a; }
+.adm-muted { color: #737373; }
+.adm-filters { display: flex; flex-wrap: wrap; gap: 1rem; font-family: var(--font-mono); font-size: 0.75rem; }
+.adm-filters a { color: #a3a3a3; }
+.adm-filters a:hover { color: #a78bfa; }
+.adm-filters [aria-current="page"] { color: #fff; }
+.adm-facts { margin-top: 1rem; display: grid; gap: 0.75rem 1.5rem; grid-template-columns: repeat(auto-fit, minmax(9rem, 1fr)); font-family: var(--font-mono); font-size: 0.875rem; }
+.adm-facts dt { font-size: 11px; letter-spacing: 0.06em; text-transform: uppercase; color: #737373; }
+.adm-facts dd { margin: 0.125rem 0 0; color: #f5f5f5; }
+
+/* Bloques plegables (alta, importación) y formularios en línea de la tabla */
+.adm-details { margin-top: 1.5rem; border: 1px solid #262626; border-radius: 0.5rem; background: #0a0a0a; }
+.adm-details > summary { cursor: pointer; padding: 0.875rem 1.25rem; font-family: var(--font-mono); font-size: 0.875rem; color: #e5e5e5; list-style: none; }
+.adm-details > summary::-webkit-details-marker { display: none; }
+.adm-details > summary::before { content: '▸ '; color: #8b5cf6; }
+.adm-details[open] > summary::before { content: '▾ '; }
+.adm-details > .adm-details-body { padding: 0 1.25rem 1.25rem; }
+.adm-inline { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 0.375rem; margin: 0; }
+.adm-btn-sm { padding: 0.25rem 0.625rem; font-size: 12px; }
+.adm-table td.adm-actions-cell { white-space: normal; min-width: 14rem; }
+
+/* Tablero de equipos (W-06): una columna por equipo más la de "sin equipo". */
+.adm-board { margin-top: 1.5rem; display: grid; gap: 1rem; grid-template-columns: repeat(auto-fill, minmax(16rem, 1fr)); align-items: start; }
+.adm-col { display: flex; flex-direction: column; gap: 0.75rem; padding: 1rem; border: 1px solid #262626; border-radius: 0.5rem; background: #0a0a0a; }
+.adm-col-free { border-style: dashed; }
+.adm-col h3 { margin: 0; font-family: var(--font-mono); font-size: 0.875rem; color: #f5f5f5; }
+.adm-members { margin: 0; padding: 0; list-style: none; display: grid; gap: 0.5rem; font-size: 13px; color: #e5e5e5; }
+.adm-members li { padding-top: 0.5rem; border-top: 1px solid #1f1f1f; }
+.adm-members li form { margin-top: 0.25rem; }
+.adm-col-foot { margin-top: auto; padding-top: 0.75rem; border-top: 1px solid #262626; display: grid; gap: 0.5rem; }
+.adm-input-sm { padding: 0.25rem 0.5rem; font-size: 12px; }
diff --git a/src/styles/nan-system.css b/src/styles/nan-system.css
index 70abd79..0d02779 100644
--- a/src/styles/nan-system.css
+++ b/src/styles/nan-system.css
@@ -21,12 +21,28 @@
Quedan sueltos algunos 520/720/760/900 de la primera iteración; migrarlos
pide un repaso visual ancho a ancho, no un buscar-y-reemplazar. */
+/* BASE EN CAPA. El reset y los estilos de elemento (p, a, button…) van dentro
+ de @layer base para que las utilidades de Tailwind (que viven en la capa
+ utilities, siempre posterior) puedan pisarlos: sin la capa, una regla sin
+ capa como `* { margin: 0 }` o `p { color: … }` gana a cualquier utilidad por
+ muy específica que sea, y las pantallas escritas con utilidades (eventos,
+ community) pierden márgenes, centrado, colores y monoespaciada. Para el
+ resto del CSS (scoped, sin capa) no cambia nada: ya ganaba a estas reglas.
+ La esquina recta se queda FUERA de la capa a propósito: es regla de la casa
+ y debe ganar también a cualquier rounded-* que quede por ahí. */
+*,
+*::before,
+*::after {
+ border-radius: var(--radius-ui);
+}
+
+@layer base {
+
*,
*::before,
*::after {
box-sizing: border-box;
margin: 0;
- border-radius: var(--radius-ui);
}
html {
@@ -66,6 +82,8 @@ body {
}
main, footer { position: relative; z-index: 1; }
+} /* @layer base (sigue más abajo con p, a, button…) */
+
/* Titulares: Archivo variable EXPANDIDO (wdth+wght) y en mayúsculas.
Sistema UNIFORME en toda la web (mismos tamaños). El !important gana a los
estilos scoped de cada componente (clase + atributo de Astro > h1 pelado). */
@@ -105,6 +123,8 @@ main, footer { position: relative; z-index: 1; }
/* segunda línea de un titular en violeta (como "Start burning tokens") */
.hl { color: var(--color-violet-2); }
+@layer base {
+
strong, b { font-weight: 700; }
/* párrafo de la casa: Archivo, anchura por defecto, blanco */
p { color: var(--color-text); font-family: var(--font-serif); font-variation-settings: normal; }
@@ -115,6 +135,8 @@ code, pre, kbd { font-family: var(--font-mono); font-size: 0.9em; }
img, svg { max-width: 100%; display: block; }
button { font: inherit; cursor: pointer; border: none; background: none; color: inherit; }
+} /* @layer base */
+
::selection { background: var(--color-violet); color: #fff; }
/* Anillo de foco en violeta CLARO: el violeta base sobre off-black se queda en
3.4:1 y encima desaparece sobre los paneles con tinte violeta. */
diff --git a/src/tests/api/events.test.ts b/src/tests/api/events.test.ts
index d6de49a..8a1e70e 100644
--- a/src/tests/api/events.test.ts
+++ b/src/tests/api/events.test.ts
@@ -3,12 +3,31 @@ import { describe, it, expect, vi, afterEach } from 'vitest';
// Mock de cloudflare:workers env (patrón del repo).
vi.mock('cloudflare:workers', () => ({ env: { CLOUD_API_URL: 'https://api.test' } }));
-import { isAdminPath, backendURL } from '../../lib/events';
+import { isAdminPath, backendURL, cookieHeaderHasSession, hasSessionCookie } from '../../lib/events';
import { GET, POST } from '../../pages/api/events/[...path]';
import { POST as LOGIN_POST } from '../../pages/api/auth/login-request';
describe('events proxy lib', () => {
- it('bloquea paths admin, globales y por evento (SPEC §8.1)', () => {
+ it('cookieHeaderHasSession compares the cookie name, not a substring', () => {
+ expect(cookieHeaderHasSession('basura=xx-nan_session-xx')).toBe(false);
+ expect(cookieHeaderHasSession('no_es_nan_session_de_verdad=1')).toBe(false);
+ expect(cookieHeaderHasSession('a=1; nan_session=abc')).toBe(true);
+ expect(cookieHeaderHasSession('')).toBe(false);
+ });
+
+ it('hasSessionCookie mira el nombre de la cookie, no la subcadena', () => {
+ const req = (cookie?: string) => new Request('https://nan.builders/api/events/admin', { headers: cookie ? { cookie } : {} });
+ expect(hasSessionCookie(req())).toBe(false);
+ expect(hasSessionCookie(req('nan_session=abc'))).toBe(true);
+ expect(hasSessionCookie(req('otra=1; nan_session=abc; mas=2'))).toBe(true);
+ expect(hasSessionCookie(req(' nan_session=abc'))).toBe(true);
+ // Señuelos: el texto aparece, la cookie no.
+ expect(hasSessionCookie(req('basura=xx-nan_session-xx'))).toBe(false);
+ expect(hasSessionCookie(req('no_es_nan_session_de_verdad=1'))).toBe(false);
+ expect(hasSessionCookie(req('nan_session_old=1'))).toBe(false);
+ });
+
+ it('detecta paths admin, globales y por evento (SPEC v3 §8)', () => {
expect(isAdminPath('admin')).toBe(true);
expect(isAdminPath('admin/reload')).toBe(true);
expect(isAdminPath('gauntlet-2026-08/admin')).toBe(true);
@@ -98,15 +117,95 @@ function ctx(path: string, init?: { method?: string; cookie?: string; ip?: strin
describe('events proxy handler', () => {
afterEach(() => vi.restoreAllMocks());
- it('responde 404 a paths admin sin llamar al backend', async () => {
+ it('responde 404 a paths admin sin cookie de sesión, sin llamar al backend', async () => {
const spy = vi.spyOn(globalThis, 'fetch');
expect((await GET(ctx('admin/reload'))).status).toBe(404);
- const resp = await GET(ctx('gauntlet-2026-08/admin/state'));
+ const resp = await GET(ctx('gauntlet-2026-08/admin/state', { cookie: 'otra=1' }));
expect(resp.status).toBe(404);
+ // El texto `nan_session` dentro de otra cookie no es la cookie de sesión.
+ expect((await GET(ctx('admin/events', { cookie: 'basura=xx-nan_session-xx' }))).status).toBe(404);
expect(spy).not.toHaveBeenCalled();
expect(await resp.json()).toEqual({ ok: false, error: 'not_found' });
});
+ it('deja pasar paths admin con cookie de sesión y nunca reenvía la admin key (SPEC v3 §8)', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('{"ok":false,"error":"forbidden"}', { status: 403 }));
+ const headers = new Headers({ cookie: 'nan_session=xyz', 'x-hackaton-admin-key': 'no-debe-pasar', 'x-hackaton-actor': 'x' });
+ const request = new Request('https://nan.builders/api/events/gauntlet-2026-08/admin/state', {
+ method: 'POST', headers, body: '{"status":"registration","dry_run":true}',
+ });
+ const resp = await POST({ params: { path: 'gauntlet-2026-08/admin/state' }, request, url: new URL(request.url) } as never);
+ // La autorización la decide el backend: el proxy propaga su respuesta tal cual.
+ expect(resp.status).toBe(403);
+ expect(spy).toHaveBeenCalledOnce();
+ const [target, reqInit] = spy.mock.calls[0] as [string, RequestInit];
+ expect(target).toBe('https://api.test/api/events/gauntlet-2026-08/admin/state');
+ const h = reqInit.headers as Headers;
+ expect(h.get('cookie')).toBe('nan_session=xyz');
+ expect(h.get('origin')).toBe('https://nan.builders');
+ expect(h.get('x-hackaton-admin-key')).toBeNull();
+ expect(h.get('x-hackaton-actor')).toBeNull();
+ expect(reqInit.body).toBe('{"status":"registration","dry_run":true}');
+ });
+
+ it('conserva content-type y Content-Disposition (CSV de import/export del panel)', async () => {
+ const upstream = new Response('email,name\n', {
+ status: 200,
+ headers: { 'content-type': 'text/csv; charset=utf-8', 'content-disposition': 'attachment; filename="p.csv"' },
+ });
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(upstream);
+ const headers = new Headers({ cookie: 'nan_session=xyz', 'content-type': 'text/csv' });
+ const request = new Request('https://nan.builders/api/events/gauntlet-2026-08/admin/participants/import?dry_run=true', {
+ method: 'POST', headers, body: 'email\na@b.c\n',
+ });
+ const resp = await POST({ params: { path: 'gauntlet-2026-08/admin/participants/import' }, request, url: new URL(request.url) } as never);
+ const [target, reqInit] = spy.mock.calls[0] as [string, RequestInit];
+ expect(target).toBe('https://api.test/api/events/gauntlet-2026-08/admin/participants/import?dry_run=true');
+ expect((reqInit.headers as Headers).get('content-type')).toBe('text/csv');
+ expect(resp.headers.get('content-type')).toBe('text/csv; charset=utf-8');
+ expect(resp.headers.get('content-disposition')).toBe('attachment; filename="p.csv"');
+ expect(await resp.text()).toBe('email,name\n');
+ });
+
+ it('forwards an empty CSV body as is instead of padding it with {}', async () => {
+ const upstream = new Response('', {
+ status: 200,
+ headers: { 'content-type': 'text/csv; charset=utf-8', 'content-disposition': 'attachment; filename="p.csv"' },
+ });
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(upstream);
+ const resp = await GET(ctx('gauntlet-2026-08/admin/participants/export.csv', { cookie: 'nan_session=xyz', search: '?download=1' }));
+ expect(resp.headers.get('content-type')).toBe('text/csv; charset=utf-8');
+ expect(await resp.text()).toBe('');
+ // The JSON fallback is untouched: an empty JSON upstream still parses.
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 200 }));
+ const empty = await GET(ctx('gauntlet-2026-08/me', { cookie: 'nan_session=xyz' }));
+ expect(await empty.text()).toBe('{}');
+ });
+
+ it('deja pasar el feed iCalendar con su content-type y su caché (W-10)', async () => {
+ const upstream = new Response('BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n', {
+ status: 200,
+ headers: { 'content-type': 'text/calendar; charset=utf-8', 'cache-control': 'public, max-age=300', 'content-disposition': 'inline; filename="nan-eventos.ics"' },
+ });
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(upstream);
+ const resp = await GET(ctx('calendar.ics'));
+ expect(spy.mock.calls[0][0]).toBe('https://api.test/api/events/calendar.ics');
+ expect(resp.headers.get('content-type')).toBe('text/calendar; charset=utf-8');
+ expect(resp.headers.get('cache-control')).toBe('public, max-age=300');
+ expect(resp.headers.get('content-disposition')).toBe('inline; filename="nan-eventos.ics"');
+ expect(await resp.text()).toBe('BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n');
+ // Por evento, mismo camino.
+ expect(backendURL('taller-agentes/calendar.ics', '')).toBe('https://api.test/api/events/taller-agentes/calendar.ics');
+ });
+
+ it('sigue enviando JSON por defecto a las rutas públicas', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('{"ok":true}', { status: 200 }));
+ const resp = await POST(ctx('gauntlet-2026-08/register', { method: 'POST', body: '{}' }));
+ expect((spy.mock.calls[0][1] as RequestInit).headers as Headers).toBeInstanceOf(Headers);
+ expect(((spy.mock.calls[0][1] as RequestInit).headers as Headers).get('content-type')).toBe('application/json');
+ expect(resp.headers.get('content-type')).toBe('application/json');
+ });
+
it('responde 404 a una ruta fuera del prefijo sin llamar al backend', async () => {
const spy = vi.spyOn(globalThis, 'fetch');
// Importa que no llegue a llamar: el proxy adjunta la cookie del visitante.
diff --git a/src/tests/layouts/NanBase.test.ts b/src/tests/layouts/NanBase.test.ts
index 45feeaa..fa4eb5d 100644
--- a/src/tests/layouts/NanBase.test.ts
+++ b/src/tests/layouts/NanBase.test.ts
@@ -63,6 +63,15 @@ describe('NanBase — accesibilidad y SEO que no deben desaparecer', () => {
expect(nanBase).toContain('id="main"');
});
+ it('lets a page replace the social image and NanPage forwards it (event covers, B-27)', () => {
+ expect(nanBase).toContain('image?: string');
+ expect(nanBase).toContain('const ogImage = image || absAsset(');
+ expect(nanBase).toContain('');
+ expect(nanBase).toContain('');
+ expect(nanPage).toContain('image?: string');
+ expect(nanPage).toContain('image={image}');
+ });
+
it('emite canonical y alternates hreflang', () => {
expect(nanBase).toContain('rel="canonical"');
expect(nanBase).toContain('hreflang');
diff --git a/src/tests/lib/adminRoutes.test.ts b/src/tests/lib/adminRoutes.test.ts
new file mode 100644
index 0000000..750bd57
--- /dev/null
+++ b/src/tests/lib/adminRoutes.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, test } from 'vitest';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { basename, dirname, join, resolve } from 'node:path';
+
+/**
+ * Guarda del panel de administración (SPEC v3 §8).
+ *
+ * Cada FICHERO DE RUTA bajo `src/pages/events/admin` resuelve la guardia de
+ * staff con `resolveAdminRoute(Astro)` y devuelve el 404 si toca; el cuerpo
+ * (`_x.astro`) recibe `staff` y `cookie` como props y no toca la sesión. Si
+ * una ruta nueva se olvida de la guardia, cualquier visitante vería el
+ * esqueleto de la pantalla. El panel es SSR (`prerender = false`) y solo
+ * existe en español: no hay `src/pages/es/events/admin`.
+ */
+
+const here = dirname(fileURLToPath(import.meta.url));
+const adminDir = resolve(here, '../../pages/events/admin');
+
+function astroFiles(dir: string, found: string[] = []): string[] {
+ for (const entry of readdirSync(dir)) {
+ const full = join(dir, entry);
+ if (statSync(full).isDirectory()) astroFiles(full, found);
+ else if (entry.endsWith('.astro')) found.push(full);
+ }
+ return found;
+}
+
+const all = astroFiles(adminDir);
+const routes = all.filter((f) => !basename(f).startsWith('_'));
+const bodies = all.filter((f) => basename(f).startsWith('_'));
+
+describe('rutas de /events/admin', () => {
+ test('hay rutas y cuerpos que revisar', () => {
+ expect(routes.length).toBeGreaterThan(0);
+ expect(bodies.length).toBeGreaterThan(0);
+ });
+
+ test.each(routes)('%s resuelve la guardia de staff y es SSR', (route) => {
+ const src = readFileSync(route, 'utf-8');
+ // Rutas globales: resolveAdminRoute; rutas por evento: resolveAdminEventRoute (añade la ficha y el 404 de slug).
+ expect(src).toMatch(/const route = await resolveAdmin(Event)?Route\(Astro\);/);
+ expect(src).toMatch(/if \(route\.notFound\) return route\.notFound;/);
+ expect(src).toMatch(/export const prerender = false;/);
+ expect(src).toMatch(/staff=\{route\.staff\}/);
+ expect(src).toMatch(/cookie=\{route\.cookie\}/);
+ });
+
+ test.each(bodies)('%s no hace rewrite ni consulta la sesión', (body) => {
+ const src = readFileSync(body, 'utf-8');
+ expect(src).not.toMatch(/Astro\.rewrite/);
+ expect(src).not.toMatch(/resolveAdmin(Event)?Route/);
+ expect(src).not.toMatch(/fetchStaffSession/);
+ expect(src).not.toMatch(/handle\w+Form\(/);
+ });
+
+ test('el panel no tiene variante /es/', () => {
+ expect(existsSync(resolve(here, '../../pages/es/events/admin'))).toBe(false);
+ });
+});
diff --git a/src/tests/lib/eventsAdmin.test.ts b/src/tests/lib/eventsAdmin.test.ts
new file mode 100644
index 0000000..5f2c1f8
--- /dev/null
+++ b/src/tests/lib/eventsAdmin.test.ts
@@ -0,0 +1,209 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+// Mock de cloudflare:workers env (patrón del repo).
+vi.mock('cloudflare:workers', () => ({ env: { CLOUD_API_URL: 'https://api.test/' } }));
+
+import { adminFetch, adminHref, fetchStaffSession, reloadAdminEventView, resolveAdminEventRoute, resolveAdminRoute } from '../../lib/eventsAdmin';
+
+const me = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
+
+describe('fetchStaffSession (guardia SSR, SPEC v3 §8)', () => {
+ afterEach(() => vi.restoreAllMocks());
+
+ it('sin cookie de sesión no llama a la plataforma', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch');
+ expect(await fetchStaffSession('')).toBeNull();
+ expect(await fetchStaffSession('otra=1')).toBeNull();
+ expect(await fetchStaffSession('basura=xx-nan_session-xx')).toBeNull();
+ expect(spy).not.toHaveBeenCalled();
+ });
+
+ it('staff → sesión; reenvía la cookie y el Origin a /api/auth/me', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(me({ role: 'staff', email: 'a@nan.builders', userUUID: 'u1' }));
+ expect(await fetchStaffSession('nan_session=xyz')).toEqual({ email: 'a@nan.builders', userUUID: 'u1' });
+ const [target, init] = spy.mock.calls[0] as [string, RequestInit];
+ expect(target).toBe('https://api.test/api/auth/me');
+ const h = init.headers as Record;
+ expect(h.cookie).toBe('nan_session=xyz');
+ expect(h.origin).toBe('https://nan.builders');
+ });
+
+ it('miembro, sesión caducada, respuesta rara o fallo de red → null', async () => {
+ const cases: Array<() => Promise> = [
+ () => Promise.resolve(me({ role: 'member', email: 'm@x.y' })),
+ () => Promise.resolve(me({ ok: false }, 401)),
+ () => Promise.resolve(new Response('no json', { status: 200 })),
+ () => Promise.reject(new Error('boom')),
+ ];
+ for (const impl of cases) {
+ vi.spyOn(globalThis, 'fetch').mockImplementation(impl as never);
+ expect(await fetchStaffSession('nan_session=xyz')).toBeNull();
+ vi.restoreAllMocks();
+ }
+ });
+});
+
+describe('resolveAdminRoute', () => {
+ afterEach(() => vi.restoreAllMocks());
+
+ const ctx = (cookie?: string) => {
+ const headers = new Headers();
+ if (cookie) headers.set('cookie', cookie);
+ const rewrite = vi.fn(async (to: string) => new Response(`rewrite:${to}`, { status: 404 }));
+ return { astro: { request: new Request('https://nan.builders/events/admin', { headers }), rewrite }, rewrite };
+ };
+
+ it('staff: devuelve la sesión y la cookie sin rewrite', async () => {
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(me({ role: 'staff', email: 's@nan.builders', userUUID: 'u' }));
+ const { astro, rewrite } = ctx('nan_session=abc');
+ const route = await resolveAdminRoute(astro);
+ expect(route.notFound).toBeNull();
+ expect(route.staff?.email).toBe('s@nan.builders');
+ expect(route.cookie).toBe('nan_session=abc');
+ expect(rewrite).not.toHaveBeenCalled();
+ });
+
+ it('no staff: 404 por rewrite, nunca 403 (el panel no se anuncia)', async () => {
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(me({ role: 'member' }));
+ const { astro, rewrite } = ctx('nan_session=abc');
+ const route = await resolveAdminRoute(astro);
+ expect(route.staff).toBeNull();
+ expect(rewrite).toHaveBeenCalledWith('/404');
+ expect(await route.notFound?.text()).toBe('rewrite:/404');
+ });
+
+ it('sin cookie: 404 sin llamar a la plataforma', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch');
+ const { astro, rewrite } = ctx();
+ const route = await resolveAdminRoute(astro);
+ expect(route.staff).toBeNull();
+ expect(spy).not.toHaveBeenCalled();
+ expect(rewrite).toHaveBeenCalledWith('/404');
+ });
+});
+
+describe('resolveAdminEventRoute / reloadAdminEventView', () => {
+ afterEach(() => vi.restoreAllMocks());
+
+ const staff = { role: 'staff', email: 's@nan.builders', userUUID: 'u' };
+ const ficha = { event: { slug: 'gauntlet-2026-08', name: 'Gauntlet' }, phase: 'building', windows: {}, counts: { registered: 3 }, warnings: [] };
+
+ // fetch simulado: /api/auth/me y /api/events/{slug}/admin, por URL.
+ const plataforma = (opts: { me?: unknown; meStatus?: number; admin?: unknown; adminStatus?: number }) =>
+ vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+ const url = String(input);
+ if (url.endsWith('/api/auth/me')) return me(opts.me ?? staff, opts.meStatus ?? 200);
+ if (url.includes('/admin')) return me(opts.admin ?? { ok: true, data: ficha }, opts.adminStatus ?? 200);
+ throw new Error(`fetch inesperado: ${url}`);
+ });
+
+ const ctx = (slug: string, cookie = 'nan_session=abc') => {
+ const rewrite = vi.fn(async (to: string) => new Response(`rewrite:${to}`, { status: 404 }));
+ return {
+ astro: { request: new Request(`https://nan.builders/events/admin/${slug}`, { headers: { cookie } }), rewrite, params: { slug } },
+ rewrite,
+ };
+ };
+
+ it('staff y evento existente → ficha, slug del backend y sin rewrite', async () => {
+ const spy = plataforma({});
+ const { astro, rewrite } = ctx('gauntlet-2026-08');
+ const route = await resolveAdminEventRoute(astro);
+ expect(route.notFound).toBeNull();
+ expect(route.view?.counts.registered).toBe(3);
+ expect(route.slug).toBe('gauntlet-2026-08');
+ expect(rewrite).not.toHaveBeenCalled();
+ expect(spy).toHaveBeenCalledTimes(2);
+ });
+
+ it('staff y evento inexistente → 404 por rewrite', async () => {
+ plataforma({ admin: { ok: false, error: 'event_not_found' }, adminStatus: 404 });
+ const { astro, rewrite } = ctx('nope');
+ const route = await resolveAdminEventRoute(astro);
+ expect(route.view).toBeNull();
+ expect(rewrite).toHaveBeenCalledWith('/404');
+ expect(route.notFound?.status).toBe(404);
+ });
+
+ it('sin staff → 404 sin pedir la ficha', async () => {
+ const spy = plataforma({ me: { role: 'member' } });
+ const { astro, rewrite } = ctx('gauntlet-2026-08');
+ const route = await resolveAdminEventRoute(astro);
+ expect(route.view).toBeNull();
+ expect(rewrite).toHaveBeenCalledWith('/404');
+ expect(spy).toHaveBeenCalledTimes(1); // solo /api/auth/me
+ });
+
+ it('reloadAdminEventView devuelve la ficha nueva, o la anterior si la recarga falla', async () => {
+ const nueva = { ...ficha, counts: { registered: 4 } };
+ plataforma({ admin: { ok: true, data: nueva } });
+ expect((await reloadAdminEventView('nan_session=abc', 'gauntlet-2026-08', ficha as never)).counts.registered).toBe(4);
+ vi.restoreAllMocks();
+ plataforma({ admin: { ok: false, error: 'server_error' }, adminStatus: 500 });
+ expect((await reloadAdminEventView('nan_session=abc', 'gauntlet-2026-08', ficha as never)).counts.registered).toBe(3);
+ });
+});
+
+describe('adminFetch (cliente SSR de la API de administración)', () => {
+ afterEach(() => vi.restoreAllMocks());
+
+ it('lee el envelope de éxito con warnings y dry_run', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+ me({ ok: true, data: { status: 'registration' }, warnings: ['teams_missing'], dry_run: true }),
+ );
+ const res = await adminFetch<{ status: string }>('nan_session=x', 'demo-2027/admin/state', {
+ method: 'POST', body: { status: 'registration', dry_run: true },
+ });
+ expect(res).toMatchObject({ ok: true, status: 200, data: { status: 'registration' }, warnings: ['teams_missing'], dryRun: true, fields: [] });
+ const [target, init] = spy.mock.calls[0] as [string, RequestInit];
+ expect(target).toBe('https://api.test/api/events/demo-2027/admin/state');
+ expect(init.method).toBe('POST');
+ expect(init.body).toBe('{"status":"registration","dry_run":true}');
+ const h = init.headers as Record;
+ expect(h['content-type']).toBe('application/json');
+ expect(h.cookie).toBe('nan_session=x');
+ expect(h.origin).toBe('https://nan.builders');
+ });
+
+ it('lee el envelope de error con message, fields y detail', async () => {
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+ me({ ok: false, error: 'validation_failed', message: 'datos inválidos', data: { fields: ['slug'], detail: 'slug ocupado' } }, 400),
+ );
+ const res = await adminFetch('nan_session=x', 'admin/events', { method: 'POST', body: { slug: 'X' } });
+ expect(res).toMatchObject({ ok: false, status: 400, data: null, error: 'validation_failed', message: 'datos inválidos', fields: ['slug'], detail: 'slug ocupado' });
+ });
+
+ it('un cuerpo de texto va como text/csv (import de participantes) y conserva la query', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(me({ ok: true, data: { rows: [] }, warnings: [], dry_run: true }));
+ await adminFetch('nan_session=x', 'demo-2027/admin/participants/import', { method: 'POST', body: 'email\na@b.c\n', search: '?dry_run=true' });
+ const [target, init] = spy.mock.calls[0] as [string, RequestInit];
+ expect(target).toBe('https://api.test/api/events/demo-2027/admin/participants/import?dry_run=true');
+ expect((init.headers as Record)['content-type']).toBe('text/csv');
+ expect(init.body).toBe('email\na@b.c\n');
+ });
+
+ it('no sale del prefijo ni llama al backend con una ruta rara', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch');
+ expect((await adminFetch('nan_session=x', '../auth/me')).error).toBe('not_found');
+ expect((await adminFetch('nan_session=x', 'demo%2fadmin')).error).toBe('not_found');
+ expect((await adminFetch('nan_session=x', '')).error).toBe('not_found');
+ expect(spy).not.toHaveBeenCalled();
+ });
+
+ it('fallo de red y respuesta no JSON no lanzan', async () => {
+ vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('boom'));
+ expect(await adminFetch('nan_session=x', 'admin/events')).toMatchObject({ ok: false, status: 0, error: 'server_error' });
+ vi.restoreAllMocks();
+ vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('', { status: 502 }));
+ expect(await adminFetch('nan_session=x', 'admin/events')).toMatchObject({ ok: false, status: 502, error: 'server_error' });
+ });
+});
+
+describe('adminHref', () => {
+ it('lista, ficha y pantallas por evento', () => {
+ expect(adminHref()).toBe('/events/admin');
+ expect(adminHref('demo-2027')).toBe('/events/admin/demo-2027');
+ expect(adminHref('demo-2027', 'equipos')).toBe('/events/admin/demo-2027/equipos');
+ expect(adminHref('demo-2027', 'auditoria')).toBe('/events/admin/demo-2027/auditoria');
+ });
+});
diff --git a/src/tests/lib/eventsAdminAudit.test.ts b/src/tests/lib/eventsAdminAudit.test.ts
new file mode 100644
index 0000000..bc7af5a
--- /dev/null
+++ b/src/tests/lib/eventsAdminAudit.test.ts
@@ -0,0 +1,104 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+vi.mock('cloudflare:workers', () => ({ env: { CLOUD_API_URL: 'https://api.test' } }));
+
+import {
+ actorLabel, auditSearch, backupDate, fmtBytes, handleAuditForm, readAuditFilters,
+ AUDIT_DEFAULT_LIMIT, AUDIT_MAX_LIMIT,
+} from '../../lib/eventsAdminAudit';
+
+const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
+const PAGE = 'https://nan.builders/events/admin/demo/auditoria';
+
+function post(fields: Record): Request {
+ return new Request(PAGE, {
+ method: 'POST',
+ headers: { 'content-type': 'application/x-www-form-urlencoded', origin: 'https://nan.builders' },
+ body: new URLSearchParams(fields).toString(),
+ });
+}
+
+function lastCall(spy: ReturnType) {
+ const [url, init] = spy.mock.calls.at(-1) as [string, RequestInit];
+ return { url, init, body: JSON.parse(String(init.body)) as Record };
+}
+
+afterEach(() => vi.restoreAllMocks());
+
+describe('filtros de auditoría (W-09)', () => {
+ it('sin parámetros: sin since ni action y el límite por defecto del backend', () => {
+ const f = readAuditFilters(new URL(PAGE));
+ expect(f).toEqual({ since: '', action: '', limit: AUDIT_DEFAULT_LIMIT });
+ expect(auditSearch(f)).toBe(`?limit=${AUDIT_DEFAULT_LIMIT}`);
+ });
+
+ it('desde acepta datetime-local (UTC) y fecha suelta; acción y límite se acotan', () => {
+ const f = readAuditFilters(new URL(`${PAGE}?desde=2026-09-05T10:30&accion=state.&limite=5000`));
+ expect(f).toEqual({ since: '2026-09-05T10:30:00.000Z', action: 'state.', limit: AUDIT_MAX_LIMIT });
+ expect(auditSearch(f)).toBe(`?since=2026-09-05T10%3A30%3A00.000Z&action=state.&limit=${AUDIT_MAX_LIMIT}`);
+ expect(readAuditFilters(new URL(`${PAGE}?desde=2026-09-05`)).since).toBe('2026-09-05T00:00:00.000Z');
+ });
+
+ it('lo que no vale se ignora en vez de provocar un 400', () => {
+ const f = readAuditFilters(new URL(`${PAGE}?desde=ayer&accion=DROP%20TABLE&limite=-3`));
+ expect(f).toEqual({ since: '', action: '', limit: AUDIT_DEFAULT_LIMIT });
+ });
+});
+
+describe('textos auxiliares', () => {
+ it('actor, tamaño y fecha del backup', () => {
+ expect(actorLabel(null)).toBe('sistema');
+ expect(actorLabel({ kind: 'staff', email: 'a@nan.builders', user_uuid: 'u1' })).toBe('a@nan.builders');
+ expect(actorLabel({ kind: 'admin_key', label: 'saul-curl' })).toBe('saul-curl (clave de admin)');
+ expect(actorLabel({ kind: 'admin_key' })).toBe('clave de admin');
+ expect(fmtBytes(512)).toBe('512 B');
+ expect(fmtBytes(1616)).toBe('1.6 KB');
+ expect(fmtBytes(3 * 1024 * 1024)).toBe('3.0 MB');
+ expect(backupDate('20260905T100000Z-2')).toBe('2026-09-05T10:00:00Z');
+ expect(backupDate('raro')).toBe('');
+ });
+});
+
+describe('handleAuditForm (W-09)', () => {
+ it('ignora el GET y rechaza otro origen', async () => {
+ expect(await handleAuditForm(new Request(PAGE), 'c', 'demo')).toEqual({});
+ const foreign = new Request(PAGE, { method: 'POST', headers: { origin: 'https://evil.test', 'content-type': 'application/x-www-form-urlencoded' }, body: 'action=restore' });
+ expect(await handleAuditForm(foreign, 'c', 'demo')).toEqual({ forbidden: true });
+ });
+
+ it('acción desconocida o backup sin indicar: no llama al backend', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch');
+ const unknown = await handleAuditForm(post({ action: 'delete' }), 'c', 'demo');
+ expect(unknown.result?.fields).toEqual(['action']);
+ const missing = await handleAuditForm(post({ action: 'restore', file: 'event.json' }), 'c', 'demo');
+ expect(missing.result?.ok).toBe(false);
+ expect(missing.result?.fields).toEqual(['timestamp']);
+ expect(spy).not.toHaveBeenCalled();
+ });
+
+ it('previsualizar: POST …/backups/restore con dry_run y se queda en la página', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => json({ ok: true, data: { file: 'participants.json', timestamp: '20260905T100000Z' }, warnings: [], dry_run: true }));
+ const out = await handleAuditForm(post({ action: 'restore_preview', file: 'participants.json', timestamp: '20260905T100000Z' }), 'c', 'demo');
+ expect(out.redirect).toBeUndefined();
+ expect(out.action).toBe('restore_preview');
+ expect(out.result?.ok).toBe(true);
+ const { url, init, body } = lastCall(spy);
+ expect(url).toBe('https://api.test/api/events/demo/admin/backups/restore');
+ expect(init.method).toBe('POST');
+ expect(body).toEqual({ file: 'participants.json', timestamp: '20260905T100000Z', dry_run: true });
+ });
+
+ it('restaurar de verdad redirige con el flash y los avisos', async () => {
+ const spy = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => json({ ok: true, data: { file: 'event.json', timestamp: '20260905T100000Z', previous_backup: '20260906T120000Z' }, warnings: ['automation_dates_missing'] }));
+ const out = await handleAuditForm(post({ action: 'restore', file: 'event.json', timestamp: '20260905T100000Z' }), 'c', 'demo');
+ expect(out.redirect).toBe('/events/admin/demo/auditoria?ok=restaurado&warn=automation_dates_missing');
+ expect(lastCall(spy).body).toEqual({ file: 'event.json', timestamp: '20260905T100000Z', dry_run: false });
+ });
+
+ it('un backup que no valida (409) se queda en la página sin redirigir', async () => {
+ vi.spyOn(globalThis, 'fetch').mockImplementation(async () => json({ ok: false, error: 'backup_invalid', message: 'el backup no valida' }, 409));
+ const out = await handleAuditForm(post({ action: 'restore', file: 'event.json', timestamp: 'x' }), 'c', 'demo');
+ expect(out.redirect).toBeUndefined();
+ expect(out.result?.error).toBe('backup_invalid');
+ });
+});
diff --git a/src/tests/lib/eventsAdminForms.test.ts b/src/tests/lib/eventsAdminForms.test.ts
new file mode 100644
index 0000000..f8905c5
--- /dev/null
+++ b/src/tests/lib/eventsAdminForms.test.ts
@@ -0,0 +1,336 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+
+vi.mock('cloudflare:workers', () => ({ env: { CLOUD_API_URL: 'https://api.test' } }));
+
+import {
+ doneHref, eventToForm, formToEventBody, formValues, handleEventForm, handleNewEventForm,
+ isoToLocal, localToIso, NEW_EVENT_DEFAULTS, readFlash, sameOrigin, splitList, stateTargets, statusSequence,
+} from '../../lib/eventsAdminForms';
+
+const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), { status });
+
+function post(fields: Record, headers: Record = {}): Request {
+ const fd = new URLSearchParams();
+ for (const [k, v] of Object.entries(fields)) {
+ for (const item of Array.isArray(v) ? v : [v]) fd.append(k, item);
+ }
+ return new Request('https://nan.builders/events/admin/nuevo', {
+ method: 'POST',
+ headers: { 'content-type': 'application/x-www-form-urlencoded', origin: 'https://nan.builders', ...headers },
+ body: fd.toString(),
+ });
+}
+
+describe('fechas y listas', () => {
+ it('convierte RFC 3339 ⇄ datetime-local en UTC', () => {
+ expect(isoToLocal('2027-01-10T00:00:00Z')).toBe('2027-01-10T00:00');
+ expect(isoToLocal(null)).toBe('');
+ expect(isoToLocal('no es fecha')).toBe('');
+ expect(localToIso('2027-01-10T00:00')).toBe('2027-01-10T00:00:00Z');
+ expect(localToIso('2027-02-12T18:30')).toBe('2027-02-12T18:30:00Z');
+ expect(localToIso('')).toBeNull();
+ expect(localToIso('basura')).toBeNull();
+ });
+
+ it('parte listas por comas o saltos de línea sin vacíos ni duplicados', () => {
+ expect(splitList(' backend, frontend ,\ndevops,backend,, ')).toEqual(['backend', 'frontend', 'devops']);
+ expect(splitList('')).toEqual([]);
+ });
+});
+
+describe('formToEventBody', () => {
+ it('produce el event.json de §5.1 a partir de los valores por defecto', () => {
+ const body = formToEventBody(eventToForm({ ...NEW_EVENT_DEFAULTS, slug: 'demo-2027', name: 'Demo' })) as Record;
+ expect(body.slug).toBe('demo-2027');
+ expect(body.name).toBe('Demo');
+ expect(body.kind).toBe('hackathon');
+ expect(body.format).toBe('team');
+ expect(body.modules).toEqual({ registration: true, teams: true, submissions: true, voting: true });
+ expect(body.automation).toEqual({ date_transitions: true });
+ expect(body.dates).toEqual({
+ registration_open: null, registration_close: null, submission_open: null, submission_close: null,
+ voting_open: null, voting_close: null, demo_day: null,
+ });
+ expect(body.registration).toEqual({
+ capacity: 40, reserve_capacity: 10, discord_user: 'required',
+ specialties: ['backend', 'frontend', 'devops', 'data'], levels: ['junior', 'mid', 'senior'],
+ });
+ expect(body.team).toEqual({ size: 4, min_size: 3, max_teams: 10 });
+ expect(body.submission).toEqual({
+ fields: { description: 'optional', repo_url: 'required', space_url: 'optional', image_url: 'optional', video_url: 'optional' },
+ checks: ['url_live', 'repo_public'], prize_requires: ['repo_public'], gallery_visibility: 'from_voting',
+ });
+ // auto_max se deriva de los checks que puntúan (url_live sí, repo_public no).
+ expect(body.voting).toEqual({ enabled: true, vote_weight: 8, auto_max: 1 });
+ });
+
+ it('formato individual: sin bloque team y modules.teams=false; votación apagada apaga modules.voting', () => {
+ const body = formToEventBody({
+ slug: 's', name: 'S', format: 'solo', module_registration: 'on', module_submissions: 'on',
+ checks: ['url_live', 'in_nan_space'], prize_requires: ['repo_public'],
+ }) as Record;
+ expect(body.team).toBeUndefined();
+ expect(body.modules).toEqual({ registration: true, teams: false, submissions: true, voting: false });
+ expect(body.voting.enabled).toBe(false);
+ expect(body.voting.auto_max).toBe(2);
+ // prize_requires solo con checks activos.
+ expect(body.submission.prize_requires).toEqual([]);
+ });
+
+ it('las fechas del formulario van en UTC y los números se truncan', () => {
+ const body = formToEventBody({
+ slug: 's', name: 'S', format: 'team', date_registration_open: '2027-01-10T00:00', date_demo_day: '2027-02-12T18:00',
+ capacity: '12.7', team_size: '5', team_min_size: '2', team_max_teams: 'x', checks: [], prize_requires: [],
+ }) as Record;
+ expect(body.dates.registration_open).toBe('2027-01-10T00:00:00Z');
+ expect(body.dates.demo_day).toBe('2027-02-12T18:00:00Z');
+ expect(body.dates.voting_close).toBeNull();
+ expect(body.registration.capacity).toBe(12);
+ expect(body.team).toEqual({ size: 5, min_size: 2, max_teams: 0 });
+ });
+
+ it('eventToForm → formToEventBody conserva un event.json real', () => {
+ const ev = {
+ ...NEW_EVENT_DEFAULTS, slug: 'gauntlet-2026-08', name: 'Gauntlet', description: 'd', rules: 'r', prize: 'p',
+ location: 'Madrid', url: 'https://nan.builders/gauntlet', image_url: 'https://nan.builders/img/events/gauntlet.webp',
+ dates: { registration_open: '2026-08-01T00:00:00Z', registration_close: '2026-08-10T00:00:00Z', submission_open: null, submission_close: '2026-08-20T00:00:00Z', voting_open: null, voting_close: null, demo_day: null, demo_day_end: '2026-08-25T18:00:00Z' },
+ submission: { ...NEW_EVENT_DEFAULTS.submission!, checks: ['url_live', 'in_nan_space', 'repo_public'], prize_requires: ['repo_public'] },
+ voting: { enabled: true, vote_weight: 8, auto_max: 2 },
+ };
+ const body = formToEventBody(eventToForm(ev)) as Record;
+ expect(body.submission.checks).toEqual(ev.submission.checks);
+ expect(body.voting).toEqual(ev.voting);
+ expect(body.description).toBe('d');
+ // El formulario no expone location, url, image_url ni demo_day_end: NO van en el
+ // cuerpo, y sobreviven al guardar porque el PUT del backend es un merge
+ // por claves (UpdateEvent hace json.Unmarshal sobre el evento actual).
+ // Si algún día el formulario mandara location/url/image_url como cadena
+ // vacía (null no toca un string en Go) o demo_day_end como null, se
+ // borrarían; este test es el que lo detectaría.
+ expect(body).not.toHaveProperty('location');
+ expect(body).not.toHaveProperty('url');
+ expect(body).not.toHaveProperty('image_url');
+ expect(body.dates).not.toHaveProperty('demo_day_end');
+ const { demo_day_end: _omitido, ...fechasDelFormulario } = ev.dates;
+ expect(body.dates).toEqual(fechasDelFormulario);
+ });
+});
+
+describe('formValues', () => {
+ it('agrupa los checkboxes múltiples y deja el resto como texto', () => {
+ const fd = new FormData();
+ fd.append('name', 'X');
+ fd.append('checks', 'url_live');
+ fd.append('checks', 'repo_public');
+ expect(formValues(fd)).toEqual({ name: 'X', checks: ['url_live', 'repo_public'], prize_requires: [] });
+ });
+});
+
+describe('sameOrigin y flash', () => {
+ it('acepta same-origin y rechaza otro sitio', () => {
+ expect(sameOrigin(new Request('https://nan.builders/x', { method: 'POST' }))).toBe(true);
+ expect(sameOrigin(new Request('https://nan.builders/x', { method: 'POST', headers: { origin: 'https://nan.builders' } }))).toBe(true);
+ expect(sameOrigin(new Request('https://nan.builders/x', { method: 'POST', headers: { origin: 'https://evil.test' } }))).toBe(false);
+ expect(sameOrigin(new Request('https://nan.builders/x', { method: 'POST', headers: { 'sec-fetch-site': 'cross-site' } }))).toBe(false);
+ expect(sameOrigin(new Request('https://nan.builders/x', { method: 'POST', headers: { 'sec-fetch-site': 'same-origin' } }))).toBe(true);
+ });
+
+ it('doneHref y readFlash solo usan claves conocidas', () => {
+ expect(doneHref('demo', 'creado')).toBe('/events/admin/demo?ok=creado');
+ expect(doneHref('demo', 'guardado', ['no_change', 'slug_changed'])).toBe('/events/admin/demo?ok=guardado&warn=slug_changed');
+ expect(readFlash(new URL('https://nan.builders/events/admin/demo?ok=guardado&warn=slug_changed,x-y'))).toEqual({ ok: 'Cambios guardados.', warnings: ['slug_changed'] });
+ expect(readFlash(new URL('https://nan.builders/events/admin/demo?ok=