3.Staff Badges, a Logbook and a Stock Check

The Problem in Real Life

"It's Just a Hack Day Project" vs. Building It Like Real Software

Adding Authentication, a Git Workflow and Tests

• Authentication for organisers (Act 22): organisers sign up with email and password; passwords are stored only as bcrypt hashes. After login, the server creates a session and sends an HttpOnly, Secure, SameSite cookie. Fans don't need accounts — they join with just an email, which keeps joining easy.
• Authorization — who may do what (Act 22): a small middleware requireOrganiser checks the session. Then each organiser endpoint checks ownership: you can only see or edit the waitlist of an event you created — otherwise 404 (Act 25's pattern). Liam's joke now returns 401.
• Basic protections: rate-limit the join and login endpoints (bots, Act 22), validate every input, never log passwords or full emails in plain text, and keep the session secret in an environment variable (Act 16).
• Git workflow, even alone (Act 15): git init in the first minute, a .gitignore for node_modules and .env (Act 16) before the first commit, small commits with clear messages (Act 25's Conventional Commits), and a branch per feature (feature/auth) merged into main only when it works. When she breaks something at 4 PM, git diff and git restore (Act 15) get her back in seconds.
• Unit tests (Act 17): test small pieces alone: email validation, position calculation. Fast and precise.
• Integration tests (Act 17): test the real API against a test database: join returns 201; joining twice returns 409; an organiser can't see another organiser's list; a removed fan's position disappears and everyone moves up. The supertest library sends real HTTP requests to the app without starting a server.
• Run tests on every push (Act 19): a small GitHub Actions workflow runs npm ci, the linter and the tests on every push and pull request — with a PostgreSQL service container for the integration tests. Even working alone, her main branch can only receive green code.

async function requireEventOwner(req, res, next) {
  if (!req.session.organiserId) {
    return res.status(401).json({ error: { code: "login_required" } });
  }
  const { rows } = await db.query(
    "SELECT id FROM events WHERE id = $1 AND organiser_id = $2",
    [req.params.id, req.session.organiserId]
  );
  if (!rows.length) return res.status(404).json({ error: { code: "event_not_found" } });
  next();
}

app.get("/events/:id/waitlist", requireEventOwner, listWaitlist);
app.delete("/events/:id/waitlist/:entryId", requireEventOwner, removeEntry);

it("does not let one organiser read another organiser's waitlist", async () => {
  const eventId = await createEventAs("organiser-a@test.example");
  const agentB = await loggedInAgent("organiser-b@test.example");

  const res = await agentB.get(`/events/${eventId}/waitlist`);

  expect(res.status).toBe(404);
});