This view spans every Cup in the RowOn Beach Sprint Cup Series. It needs the series code from Row Ontario, which is not the same as an event's organiser code. Once paired, this device also opens every event's organiser screens without pairing again.
Demo series code: SERIES
Shown against this device so a lost or old pairing can be spotted and revoked.
Numbers refresh each time this page loads. People and task counts are totals only; names and contact details stay on each event's own roster, which is one tap away and scoped the same way it always is.
Row Ontario issues one series code per person. That way one person can be revoked without re-issuing to everyone, and every action on this layer has a name against it.
These devices hold the series grant right now. Each one opens every Cup's organiser screens.
What exists to be handed out. A code with no person set on it shows as an unnamed code.
Codes are minted in the Firebase console, never in this app. The rules make
seriesCodes unwritable by any client, deliberately: a device that could mint
its own code could grant itself the whole series.
Each code carries an optional person field. That is the name shown above, and
it is what makes a pairing attributable, so it is worth setting on every code.
There are two separate switches, and they do different jobs. Setting
revoked: true on a code blocks NEW pairings, but a device already paired with
it keeps working. Deleting the grant is what cuts an existing device off, and that is what
Revoke does here.
Open a Cup's screens the way another role sees them, without asking anyone to send a screenshot. An organiser and a team lead land on the roster, timing on the timing board, and a volunteer on the event hub. Cup #1 and Cup #4 are not in the app, so they cannot be previewed.
The preview reproduces what that role's SCREEN shows, because it applies the same client-side scoping their own device applies.
It is not a security test. The session underneath is still a series admin, so the server returns everything and the filtering happens here in the browser. A clean preview is not evidence that team lead scoping is enforced.
This matters because this project has repeatedly found bugs where the demo store filtered
and the live store did not. Treat a preview as a check on the screen, never as a check on
the rules. The rules are proven by firestore.rules and
tests/live-rules-proof.mjs, and by nothing else.
What people have sent from the in-development note in the footer of every page. Only a series admin can read this. It carries no name, no contact details and no link back to a volunteer record; the form asks people not to include personal details and there is nowhere to put them.
Loading...