Deploy beta to production

.gitignore

@@ -27,3 +27,4 @@ yarn-error.log*
 storybook-static
 
 .cache
+.netlify

AGENTS.md

@@ -1,2 +1,11 @@
 Use space-y instead of mt-2 for better spacing between elements.
 Always use spacing in multiples of 2 unless you need to use odd spacing for a specific reason. This helps maintain visual consistency across the app.
+
+## Branch and deployment workflow
+
+- `main` is the GitHub default branch and Netlify production branch.
+- `beta` is the permanent integration and beta-testing branch.
+- Feature and fix PRs should target `beta`, not `main`.
+- Production releases happen by opening or updating the deploy PR from `beta` into `main`.
+- Use the manual GitHub Actions `Deploy` workflow to create or update the `beta` -> `main` release PR.
+- PRs into `main` are guarded and should only come from `beta`.

netlify/functions/notify-comp-token.js

@@ -0,0 +1,182 @@
+const crypto = require('crypto');
+
+const headers = {
+  'Access-Control-Allow-Headers': 'Content-Type',
+  'Access-Control-Allow-Methods': 'POST, OPTIONS',
+  'Access-Control-Allow-Origin': '*',
+  'Content-Type': 'application/json',
+};
+
+const base64Url = (value) => Buffer.from(value).toString('base64url');
+const REMOTE_SCOPE = 'notifycomp.remote';
+const PUSH_SCOPE = 'assignment_notifications';
+const REMOTE_TOKEN_TTL_SECONDS = 12 * 60 * 60;
+const PUSH_TOKEN_TTL_SECONDS = 10 * 60;
+
+const getCompetitionManagers = (competition) => {
+  const data = competition?.competition || competition;
+  return [...(data?.organizers || []), ...(data?.delegates || [])];
+};
+
+const isListedCompetitionManager = (competition, userId) =>
+  getCompetitionManagers(competition).some((user) => Number(user?.id) === Number(userId));
+
+const getManagedCompetitionIds = (competitions, userId) =>
+  competitions
+    .filter((competition) => isListedCompetitionManager(competition, userId))
+    .map((competition) => competition.id)
+    .filter(Boolean);
+
+const signJwt = (claims, secret) => {
+  const encodedHeader = base64Url(JSON.stringify({ alg: 'HS256', typ: 'JWT' }));
+  const encodedPayload = base64Url(JSON.stringify(claims));
+  const signature = crypto
+    .createHmac('sha256', secret)
+    .update(`${encodedHeader}.${encodedPayload}`)
+    .digest('base64url');
+
+  return `${encodedHeader}.${encodedPayload}.${signature}`;
+};
+
+exports.handler = async (event) => {
+  if (event.httpMethod === 'OPTIONS') {
+    return { statusCode: 204, headers };
+  }
+
+  if (event.httpMethod !== 'POST') {
+    return {
+      statusCode: 405,
+      headers,
+      body: JSON.stringify({ message: 'Method not allowed' }),
+    };
+  }
+
+  const secret = process.env.COMPETITION_GROUPS_JWT_SECRET;
+  if (!secret) {
+    return {
+      statusCode: 500,
+      headers,
+      body: JSON.stringify({ message: 'Notification token secret is not configured' }),
+    };
+  }
+
+  let body;
+  try {
+    body = JSON.parse(event.body || '{}');
+  } catch {
+    return {
+      statusCode: 400,
+      headers,
+      body: JSON.stringify({ message: 'Invalid JSON body' }),
+    };
+  }
+
+  const { accessToken, competitionId, scope } = body;
+  const tokenScope = scope === REMOTE_SCOPE ? REMOTE_SCOPE : PUSH_SCOPE;
+  if (!accessToken) {
+    return {
+      statusCode: 400,
+      headers,
+      body: JSON.stringify({ message: 'Missing WCA access token' }),
+    };
+  }
+
+  const wcaOrigin = process.env.WCA_ORIGIN || 'https://www.worldcubeassociation.org';
+  const meParams =
+    tokenScope === REMOTE_SCOPE ? '?upcoming_competitions=true&ongoing_competitions=true' : '';
+  const meResponse = await fetch(`${wcaOrigin}/api/v0/me${meParams}`, {
+    headers: {
+      Authorization: `Bearer ${accessToken}`,
+    },
+  });
+
+  if (!meResponse.ok) {
+    return {
+      statusCode: 401,
+      headers,
+      body: JSON.stringify({ message: 'Invalid WCA access token' }),
+    };
+  }
+
+  const { me, ongoing_competitions = [], upcoming_competitions = [] } = await meResponse.json();
+  if (!me?.id) {
+    return {
+      statusCode: 401,
+      headers,
+      body: JSON.stringify({ message: 'Unable to resolve WCA user' }),
+    };
+  }
+
+  const tokenTtlSeconds =
+    tokenScope === REMOTE_SCOPE ? REMOTE_TOKEN_TTL_SECONDS : PUSH_TOKEN_TTL_SECONDS;
+  if (tokenScope === REMOTE_SCOPE && !competitionId) {
+    return {
+      statusCode: 400,
+      headers,
+      body: JSON.stringify({ message: 'Missing competition ID for remote token' }),
+    };
+  }
+
+  let remoteCompetitionIds = [];
+
+  if (tokenScope === REMOTE_SCOPE) {
+    const competitionResponse = await fetch(`${wcaOrigin}/api/v0/competitions/${competitionId}`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+      },
+    });
+
+    if (!competitionResponse.ok) {
+      return {
+        statusCode: competitionResponse.status === 404 ? 404 : 502,
+        headers,
+        body: JSON.stringify({ message: 'Unable to verify competition remote access' }),
+      };
+    }
+
+    const competition = await competitionResponse.json();
+    if (!isListedCompetitionManager(competition, me.id)) {
+      return {
+        statusCode: 403,
+        headers,
+        body: JSON.stringify({
+          message:
+            'Only listed competition delegates and organizers can use Live Activities Remote',
+        }),
+      };
+    }
+
+    // Remote tokens are scoped to competitions the WCA API says this user manages. The
+    // NotifyComp API must reject remote mutations for competition IDs outside this claim.
+    remoteCompetitionIds = [
+      ...new Set([
+        competitionId,
+        ...getManagedCompetitionIds([...ongoing_competitions, ...upcoming_competitions], me.id),
+      ]),
+    ];
+  }
+
+  const now = Math.floor(Date.now() / 1000);
+  const token = signJwt(
+    {
+      aud: process.env.COMPETITION_GROUPS_JWT_AUDIENCE || 'notifycomp',
+      competitionIds: tokenScope === REMOTE_SCOPE ? remoteCompetitionIds : undefined,
+      exp: now + tokenTtlSeconds,
+      iat: now,
+      iss: process.env.COMPETITION_GROUPS_JWT_ISSUER || 'competitiongroups.com',
+      name: me.name,
+      scope: tokenScope,
+      scopes: [tokenScope],
+      sub: `wca:${me.id}`,
+      wcaUserId: me.id,
+      wcaUserIds: [me.id],
+    },
+    secret,
+  );
+
+  return {
+    statusCode: 200,
+    headers,
+    body: JSON.stringify({ token }),
+  };
+};

public/notification-sw.js

@@ -0,0 +1,34 @@
+self.addEventListener('push', (event) => {
+  if (!event.data) {
+    return;
+  }
+
+  const payload = event.data.json();
+  const title = payload.title || 'Assignment update';
+  const options = {
+    body: payload.body,
+    data: payload,
+    tag: payload.dedupeKey || 'assignment-change',
+  };
+
+  event.waitUntil(self.registration.showNotification(title, options));
+});
+
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close();
+
+  const targetUrl = event.notification.data?.url || '/settings';
+  const url = new URL(targetUrl, self.location.origin).href;
+
+  event.waitUntil(
+    self.clients.matchAll({ includeUncontrolled: true, type: 'window' }).then((clients) => {
+      const existingClient = clients.find((client) => client.url === url);
+
+      if (existingClient) {
+        return existingClient.focus();
+      }
+
+      return self.clients.openWindow(url);
+    }),
+  );
+});

src/App.tsx

@@ -5,7 +5,9 @@ import client from './apolloClient';
 import { usePageTracking } from './hooks/usePageTracking';
 import { CompetitionLayout } from './layouts/CompetitionLayout';
 import { RootLayout } from './layouts/RootLayout';
+import { FEATURE_FLAGS } from './lib/featureFlags';
 import About from './pages/About';
+import CompetitionAdmin from './pages/Competition/Admin';
 import CompetitionEvents from './pages/Competition/ByGroup/Events';
 import CompetitionGroup from './pages/Competition/ByGroup/Group';
 import CompetitionGroupList from './pages/Competition/ByGroup/GroupList';
@@ -18,6 +20,8 @@ import CompetitionLive from './pages/Competition/Live';
 import CompetitionPerson from './pages/Competition/Person';
 import CompetitionPersonalBests from './pages/Competition/Person/PersonalBests';
 import { PsychSheetEvent } from './pages/Competition/PsychSheet/PsychSheetEvent';
+import CompetitionRemote from './pages/Competition/Remote';
+import CompetitionResults from './pages/Competition/Results';
 import {
   CompetitionActivity,
   CompetitionRoom,
@@ -27,13 +31,18 @@ import {
 import CompetitionScramblerSchedule from './pages/Competition/ScramblerSchedule';
 import CompetitionStats from './pages/Competition/Stats';
 import CompetitionStreamSchedule from './pages/Competition/StreamSchedule';
+import CompetitionSumOfRanks from './pages/Competition/SumOfRanks';
 import Home from './pages/Home';
+import LiveActivitiesAbout from './pages/LiveActivities/About';
 import Settings from './pages/Settings';
 import Support from './pages/Support';
 import Test from './pages/Test';
+import UserPage from './pages/User';
 import UserLogin from './pages/UserLogin';
 import { AppProvider } from './providers/AppProvider';
 import { AuthProvider, useAuth } from './providers/AuthProvider';
+import { ConfirmProvider } from './providers/ConfirmProvider';
+import { NotifyCompRemoteAuthProvider } from './providers/NotifyCompRemoteAuthProvider';
 import { QueryProvider } from './providers/QueryProvider/QueryProvider';
 import { UserSettingsProvider } from './providers/UserSettingsProvider';
 import { useWCIF } from './providers/WCIFProvider';
@@ -79,6 +88,30 @@ const PsychSheet = () => {
   return null;
 };
 
+const CompetitionPersonByWcaIdRedirect = ({ to }: { to: 'results' | 'records' }) => {
+  const { competitionId, wcaId } = useParams() as { competitionId: string; wcaId: string };
+  const { wcif } = useWCIF();
+  const person = wcif?.persons.find((p) => p.wcaId?.toUpperCase() === wcaId.toUpperCase());
+
+  if (!wcif) {
+    return null;
+  }
+
+  if (!person) {
+    return <Navigate to={`/competitions/${competitionId}`} replace />;
+  }
+
+  return (
+    <Navigate to={`/competitions/${competitionId}/persons/${person.registrantId}/${to}`} replace />
+  );
+};
+
+const CompetitionRedirect = ({ to }: { to: string }) => {
+  const { competitionId } = useParams() as { competitionId: string };
+
+  return <Navigate to={`/competitions/${competitionId}/${to}`} replace />;
+};
+
 const Navigation = () => {
   usePageTracking(import.meta.env.VITE_GA_MEASUREMENT_ID);
 
@@ -90,7 +123,15 @@ const Navigation = () => {
         <Route path="/competitions/:competitionId" element={<CompetitionLayout />}>
           <Route index element={<CompetitionHome />} />
 
-          <Route path="persons/:registrantId" element={<CompetitionPerson />} />
+          <Route
+            path="persons/wca/:wcaId/results"
+            element={<CompetitionPersonByWcaIdRedirect to="results" />}
+          />
+          <Route
+            path="persons/wca/:wcaId/records"
+            element={<CompetitionPersonByWcaIdRedirect to="records" />}
+          />
+          <Route path="persons/:registrantId/*" element={<CompetitionPerson />} />
           <Route path="personal-bests/:wcaId" element={<CompetitionPersonalBests />} />
           <Route path="personal-records/:wcaId" element={<CompetitionPersonalBests />} />
           <Route path="compare-schedules" element={<CompetitionCompareSchedules />} />
@@ -106,8 +147,16 @@ const Navigation = () => {
 
           <Route path="psych-sheet" element={<PsychSheet />} />
           <Route path="psych-sheet/:eventId" element={<PsychSheetEvent />} />
-
-          <Route path="scramblers" element={<CompetitionScramblerSchedule />} />
+          <Route path="results" element={<CompetitionResults />} />
+          <Route path="results/:roundId" element={<CompetitionResults />} />
+
+          <Route path="admin" element={<CompetitionAdmin />} />
+          <Route path="admin/remote" element={<CompetitionRemote />} />
+          <Route path="admin/scramblers" element={<CompetitionScramblerSchedule />} />
+          <Route path="admin/stats" element={<CompetitionStats />} />
+          <Route path="admin/sum-of-ranks" element={<CompetitionSumOfRanks />} />
+          <Route path="remote" element={<CompetitionRedirect to="admin/remote" />} />
+          <Route path="scramblers" element={<CompetitionRedirect to="admin/scramblers" />} />
           <Route path="stream" element={<CompetitionStreamSchedule />} />
           <Route path="information" element={<CompetitionInformation />} />
           <Route path="live" element={<CompetitionLive />} />
@@ -116,11 +165,23 @@ const Navigation = () => {
           <Route path="personal-schedule" element={<PersonalSchedule />} />
           <Route path="explore" element={<CompetitionGroupsOverview />} />
           <Route path="groups-schedule" element={<CompetitionGroupsSchedule />} />
-          <Route path="stats" element={<CompetitionStats />} />
+          <Route path="stats" element={<CompetitionRedirect to="admin/stats" />} />
+          <Route path="sum-of-ranks" element={<CompetitionRedirect to="admin/sum-of-ranks" />} />
           <Route path="*" element={<p>Path not resolved</p>} />
         </Route>
         <Route path="/users/:userId" element={<UserLogin />} />
+        {FEATURE_FLAGS.personalUserPage && (
+          <>
+            <Route path="/me" element={<Navigate to="/me/competitions" replace />} />
+            <Route
+              path="/me/results/:resultsMode"
+              element={<Navigate to="/me/results" replace />}
+            />
+            <Route path="/me/:tab" element={<UserPage />} />
+          </>
+        )}
         <Route path="about" element={<About />} />
+        <Route path="live-activities" element={<LiveActivitiesAbout />} />
         <Route path="settings" element={<Settings />} />
         <Route path="support" element={<Support />} />
       </Route>
@@ -136,9 +197,13 @@ const App = () => (
       <QueryProvider>
         <ApolloProvider client={client}>
           <BrowserRouter>
-            <AuthProvider>
-              <Navigation />
-            </AuthProvider>
+            <ConfirmProvider>
+              <AuthProvider>
+                <NotifyCompRemoteAuthProvider>
+                  <Navigation />
+                </NotifyCompRemoteAuthProvider>
+              </AuthProvider>
+            </ConfirmProvider>
           </BrowserRouter>
         </ApolloProvider>
       </QueryProvider>