From 29423f0ecc13969e900650892139f3183eb8a883 Mon Sep 17 00:00:00 2001 From: sultanaalyami <12185541+sultanaalyami@users.noreply.github.com> Date: Fri, 14 Aug 2026 06:59:03 +0300 Subject: [PATCH] feat: publish ADG adjudication domain and social sharing Move the canonical portal to adg.sbay.sa, preserve legacy redirects, add private social usernames and ready-made invitation sharing, and refresh the production import actions.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/import-msa-adjudication.yml | 6 +- .../msa-adjudication-portal-security.yml | 6 +- README.md | 10 +- .../msa-adjudication-workbench/DEPLOYMENT.md | 8 +- tools/msa-adjudication-workbench/PRIVACY.md | 14 +- tools/msa-adjudication-workbench/README.md | 8 +- .../package-lock.json | 4 +- tools/msa-adjudication-workbench/package.json | 2 +- .../public/admin/admin.css | 18 +++ .../public/admin/admin.js | 70 ++++++++- .../msa-adjudication-workbench/public/app.js | 134 ++++++++++++++-- .../public/index.html | 118 ++++++++++++-- .../public/styles.css | 134 ++++++++++++++++ tools/msa-adjudication-workbench/src/index.js | 144 ++++++++++++++---- .../tests/worker.test.mjs | 75 +++++++-- .../wrangler.example.jsonc | 15 +- 16 files changed, 674 insertions(+), 92 deletions(-) diff --git a/.github/workflows/import-msa-adjudication.yml b/.github/workflows/import-msa-adjudication.yml index 355b8fa..91d5769 100644 --- a/.github/workflows/import-msa-adjudication.yml +++ b/.github/workflows/import-msa-adjudication.yml @@ -20,10 +20,10 @@ jobs: environment: msa-adjudication-production steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Sign in to Azure with OIDC - uses: azure/login@v2 + uses: azure/login@v3 with: client-id: ${{ vars.ADG_AZURE_CLIENT_ID }} tenant-id: ${{ vars.ADG_AZURE_TENANT_ID }} @@ -110,7 +110,7 @@ jobs: --base main ` --head $branch ` --title "evidence: import anonymized MSA adjudication" ` - --body "Imports signed, PII-free submissions from ads.sbay.sa. Human identity remains in private Azure storage. Every artifact still requires repository review before use." + --body "Imports signed, PII-free submissions from adg.sbay.sa. Human identity remains in private Azure storage. Every artifact still requires repository review before use." "url=$url" | Out-File $env:GITHUB_OUTPUT -Append - name: Archive accepted queue items diff --git a/.github/workflows/msa-adjudication-portal-security.yml b/.github/workflows/msa-adjudication-portal-security.yml index c4ff1c4..f0c16a0 100644 --- a/.github/workflows/msa-adjudication-portal-security.yml +++ b/.github/workflows/msa-adjudication-portal-security.yml @@ -17,10 +17,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v7 with: node-version: 22 cache: npm @@ -88,7 +88,7 @@ jobs: Set-Content security/reports/msa-adjudication-portal.json - name: Upload security report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: msa-adjudication-portal-security path: security/reports/msa-adjudication-portal.json diff --git a/README.md b/README.md index 7180cd1..03fea38 100644 --- a/README.md +++ b/README.md @@ -41,14 +41,16 @@ This public repository is the official community-facing language repository for: Arabic teachers and linguists can evaluate the parser without GitHub or command-line knowledge at: -**https://ads.sbay.sa** +**https://adg.sbay.sa** The Arabic-first portal explains every criterion, hides parser predictions, keeps participant identity encrypted outside GitHub, and is designed to import only signed, pseudonymous linguistic evidence through a review pull request. -Passkey accounts and encrypted draft resumption are live; central submission -remains disabled until the import workflow is merged and revalidated. Its -source and security model are under `tools\msa-adjudication-workbench`. +Passkey accounts, encrypted draft resumption, optional private social +usernames, and central submission are live. Ready-made WhatsApp and X/Twitter +buttons help invite other experts. Every submitted artifact still enters the +repository through an automated validation and review pull request. Its source +and security model are under `tools\msa-adjudication-workbench`. ## Start Here diff --git a/tools/msa-adjudication-workbench/DEPLOYMENT.md b/tools/msa-adjudication-workbench/DEPLOYMENT.md index b862eaf..569be71 100644 --- a/tools/msa-adjudication-workbench/DEPLOYMENT.md +++ b/tools/msa-adjudication-workbench/DEPLOYMENT.md @@ -1,6 +1,8 @@ # ADS deployment -Target: `https://ads.sbay.sa` +Canonical target: `https://adg.sbay.sa` + +Legacy target: `https://ads.sbay.sa` (HTTP 308 redirect) ## Azure resources @@ -59,7 +61,9 @@ Entra ordinary variables: The Entra application must include this Web redirect URI: -`https://ads.sbay.sa/signin-microsoft` +`https://adg.sbay.sa/signin-microsoft` + +The Turnstile widget hostname allowlist must contain `adg.sbay.sa`. It requires delegated `User.Read` and the existing application permission `RoleManagement.Read.Directory` with tenant-admin consent. The administrative diff --git a/tools/msa-adjudication-workbench/PRIVACY.md b/tools/msa-adjudication-workbench/PRIVACY.md index c3ad23f..34d6342 100644 --- a/tools/msa-adjudication-workbench/PRIVACY.md +++ b/tools/msa-adjudication-workbench/PRIVACY.md @@ -2,7 +2,9 @@ ## البيانات التي نجمعها -- الاسم والبريد ورقم الهاتف؛ +- الاسم والبريد؛ +- أسماء المستخدم الاختيارية في حسابات التواصل، ومنها اسم مستخدم + واتساب بدل رقم الهاتف؛ - سنوات الخبرة والتخصص والجهة الاختيارية؛ - الموافقات وتعهدات الاستقلال والتعمية؛ - القرارات اللغوية المسجلة في العينة. @@ -12,7 +14,7 @@ تُشفّر بيانات الهوية أولًا بملف EntityCrypt Matryoshka العشوائي `AES-256-GCM` ومفتاح محفوظ في Azure Key Vault، ثم تحفظ في حاوية Azure خاصة. تُحفظ النتيجة اللغوية في حاوية منفصلة بمعرف عشوائي وتوقيع HMAC. لا يصل إلى -GitHub الاسم أو البريد أو الهاتف أو الجهة. +GitHub الاسم أو البريد أو حسابات التواصل أو الجهة. عند إنشاء حساب الاستكمال، يسجل المتصفح مفتاح مرور عام فقط، وتبقى مادته الخاصة داخل الجهاز أو مدير مفاتيح المرور. تحفظ قاعدة D1 المفتاح العام والعداد @@ -26,9 +28,11 @@ GitHub الاسم أو البريد أو الهاتف أو الجهة. ## الاحتفاظ والوصول -يجب على مشغل المنصة تحديد مدة احتفاظ معلنة قبل دعوة المحكّمين، وقصر الوصول -إلى سجلات الهوية على منسق التقييم المخول. حذف الهوية لا يقتضي حذف النتيجة -المجهّلة إذا تعذر عمليًا ربطها بالشخص. +تُحفظ المسودات غير النشطة مدة 90 يومًا، وتُحفظ بيانات الهوية والتواصل مدة +12 شهرًا من إغلاق جولة التحكيم ثم تحذف، ما لم يطلب صاحبها الحذف قبل ذلك أو +توجد موافقة صريحة على جولة لاحقة. يمكن الاحتفاظ بالنتيجة المجهّلة بوصفها +دليلًا بحثيًا بعد حذف الهوية إذا تعذر عمليًا ربطها بالشخص. يقتصر الوصول إلى +سجلات الهوية على منسق التقييم المخول. لوحة المتابعة منفصلة على `/admin/`، ولا تفك بيانات التواصل لعرضها إلا بعد دخول Microsoft Entra والتحقق الخادمي من دور Global Administrator. لا تمنح diff --git a/tools/msa-adjudication-workbench/README.md b/tools/msa-adjudication-workbench/README.md index 656b7e7..f5176bd 100644 --- a/tools/msa-adjudication-workbench/README.md +++ b/tools/msa-adjudication-workbench/README.md @@ -1,9 +1,13 @@ # Arabic Adjudication Studio (ADS) -`ads.sbay.sa` is the Arabic-first human adjudication portal for ADG-Lang. It is +`adg.sbay.sa` is the Arabic-first human adjudication portal for ADG-Lang. It is designed for experienced Arabic teachers who should not need GitHub, JSON, or command-line knowledge. +The previous `ads.sbay.sa` address redirects to the canonical domain so old +invitations remain usable. The public page includes ready-made WhatsApp and +X/Twitter invitation actions. + ## User workflow 1. Read the Arabic criteria and parser summary. @@ -26,6 +30,8 @@ organization member has authoritative Global Administrator proof. - Parser predictions are never displayed. - Packet and submission roots are recomputed in the browser and in .NET. - Azure stores identity separately from linguistic evidence. +- Optional social usernames, including the WhatsApp username rather than a + phone number, remain encrypted with the private identity record. - GitHub receives only a pseudonymous, HMAC-signed envelope. - Cloudflare Turnstile and same-origin checks protect the public endpoint. - D1 stores opaque account identifiers, Passkey public keys and counters, diff --git a/tools/msa-adjudication-workbench/package-lock.json b/tools/msa-adjudication-workbench/package-lock.json index da4fcbb..feed9e1 100644 --- a/tools/msa-adjudication-workbench/package-lock.json +++ b/tools/msa-adjudication-workbench/package-lock.json @@ -1,12 +1,12 @@ { "name": "adg-msa-adjudication-workbench", - "version": "14.1.0", + "version": "14.2.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "adg-msa-adjudication-workbench", - "version": "14.1.0", + "version": "14.2.0", "dependencies": { "@simplewebauthn/server": "^13.3.2" }, diff --git a/tools/msa-adjudication-workbench/package.json b/tools/msa-adjudication-workbench/package.json index 9bf55aa..29eb90f 100644 --- a/tools/msa-adjudication-workbench/package.json +++ b/tools/msa-adjudication-workbench/package.json @@ -1,6 +1,6 @@ { "name": "adg-msa-adjudication-workbench", - "version": "14.1.0", + "version": "14.2.0", "private": true, "type": "module", "scripts": { diff --git a/tools/msa-adjudication-workbench/public/admin/admin.css b/tools/msa-adjudication-workbench/public/admin/admin.css index acc69b8..f923c2d 100644 --- a/tools/msa-adjudication-workbench/public/admin/admin.css +++ b/tools/msa-adjudication-workbench/public/admin/admin.css @@ -206,6 +206,24 @@ font-size: .83rem; } +.social-handles { + display: flex; + flex-wrap: wrap; + gap: .25rem .4rem; + margin-top: .4rem; +} + +.participant-name .social-handles a, +.participant-name .social-handles span { + display: inline-flex; + padding: .15rem .4rem; + border-radius: .45rem; + color: var(--green-800); + background: var(--green-100); + font-size: .72rem; + text-decoration: none; +} + .participant-name span, .assignment small, .muted { diff --git a/tools/msa-adjudication-workbench/public/admin/admin.js b/tools/msa-adjudication-workbench/public/admin/admin.js index 1ff6673..785f845 100644 --- a/tools/msa-adjudication-workbench/public/admin/admin.js +++ b/tools/msa-adjudication-workbench/public/admin/admin.js @@ -107,8 +107,8 @@ function renderParticipants() { const haystack = [ participant.fullName, participant.email, - participant.phone, - participant.affiliation + participant.affiliation, + ...Object.values(participant.socialAccounts || {}) ].filter(Boolean).join(" ").toLocaleLowerCase("ar"); return matchesStatus && (!query || haystack.includes(query)); }); @@ -142,16 +142,74 @@ function participantCell(participant) { const email = document.createElement("a"); email.href = `mailto:${participant.email}`; email.textContent = participant.email; - const phone = document.createElement("a"); - phone.href = `tel:${participant.phone.replace(/[ ()-]/g, "")}`; - phone.textContent = participant.phone; const affiliation = document.createElement("span"); affiliation.textContent = participant.affiliation || "بلا جهة مسجلة"; - wrapper.append(name, email, phone, affiliation); + wrapper.append(name, email, affiliation); + const social = socialAccountsElement(participant.socialAccounts); + if (social) wrapper.append(social); cell.append(wrapper); return cell; } +function socialAccountsElement(accounts = {}) { + const labels = { + whatsapp: "واتساب", + x: "X", + tiktok: "TikTok", + instagram: "Instagram", + threads: "Threads", + telegram: "Telegram", + snapchat: "Snapchat", + facebook: "Facebook", + linkedin: "LinkedIn", + youtube: "YouTube", + bluesky: "Bluesky" + }; + const links = { + x: handle => `https://x.com/${encodeURIComponent(handle)}`, + tiktok: handle => + `https://www.tiktok.com/@${encodeURIComponent(handle)}`, + instagram: handle => + `https://www.instagram.com/${encodeURIComponent(handle)}`, + threads: handle => + `https://www.threads.net/@${encodeURIComponent(handle)}`, + telegram: handle => `https://t.me/${encodeURIComponent(handle)}`, + snapchat: handle => + `https://www.snapchat.com/add/${encodeURIComponent(handle)}`, + facebook: handle => + `https://www.facebook.com/${encodeURIComponent(handle)}`, + linkedin: handle => + `https://www.linkedin.com/in/${encodeURIComponent(handle)}`, + youtube: handle => + `https://www.youtube.com/@${encodeURIComponent(handle)}`, + bluesky: handle => + `https://bsky.app/profile/${encodeURIComponent(handle)}` + }; + const container = document.createElement("div"); + container.className = "social-handles"; + for (const [key, label] of Object.entries(labels)) { + const handle = accounts[key]; + if (!handle) continue; + const element = links[key] + ? document.createElement("a") + : document.createElement("span"); + if (links[key]) { + element.href = links[key](handle); + element.target = "_blank"; + element.rel = "noopener noreferrer"; + } + element.textContent = `${label}: @${handle}`; + container.append(element); + } + if (accounts.otherPlatform && accounts.otherUsername) { + const other = document.createElement("span"); + other.textContent = + `${accounts.otherPlatform}: @${accounts.otherUsername}`; + container.append(other); + } + return container.childElementCount === 0 ? null : container; +} + function experienceCell(participant) { const label = specializationLabel(participant.specialization); return textCell(`${label} · ${participant.experienceYears} سنة`); diff --git a/tools/msa-adjudication-workbench/public/app.js b/tools/msa-adjudication-workbench/public/app.js index 388f04a..01e4559 100644 --- a/tools/msa-adjudication-workbench/public/app.js +++ b/tools/msa-adjudication-workbench/public/app.js @@ -76,6 +76,25 @@ const IRAB = [ ["mafool-maah", "مفعول معه"] ]; +const PUBLIC_PORTAL_URL = "https://adg.sbay.sa/"; +const INVITATION_TEXT = + "دعوة لمعلمي اللغة العربية وخبرائها للمشاركة في التحكيم اللغوي " + + "المستقل لمحلل ADG-Lang. لا تحتاج إلى خبرة تقنية، ويمكن حفظ " + + "العمل والعودة إليه لاحقًا."; +const SOCIAL_FIELDS = [ + ["whatsapp", "social-whatsapp"], + ["x", "social-x"], + ["tiktok", "social-tiktok"], + ["instagram", "social-instagram"], + ["threads", "social-threads"], + ["telegram", "social-telegram"], + ["snapchat", "social-snapchat"], + ["facebook", "social-facebook"], + ["linkedin", "social-linkedin"], + ["youtube", "social-youtube"], + ["bluesky", "social-bluesky"] +]; + const FIELD_HELP = { upos: "الصنف العام للكلمة، مثل اسم أو فعل أو ضمير.", head: "رقم الكلمة التي تتعلق بها؛ استخدم 0 لجذر الجملة.", @@ -134,6 +153,10 @@ const saveDraftButton = document.querySelector("#save-draft"); const draftStatus = document.querySelector("#draft-status"); const savedDrafts = document.querySelector("#saved-drafts"); const draftList = document.querySelector("#draft-list"); +const shareWhatsapp = document.querySelector("#share-whatsapp"); +const shareX = document.querySelector("#share-x"); +const copyInvitationButton = document.querySelector("#copy-invitation"); +const shareStatus = document.querySelector("#share-status"); document.querySelectorAll('input[name="role"]').forEach(control => { control.addEventListener("change", syncRoleControls); @@ -149,6 +172,7 @@ registerPasskeyButton.addEventListener("click", registerPasskey); loginPasskeyButton.addEventListener("click", loginWithPasskey); logoutAccountButton.addEventListener("click", logoutAccount); saveDraftButton.addEventListener("click", saveDraft); +copyInvitationButton.addEventListener("click", copyInvitation); workspace.addEventListener("input", () => { updateCompletion(); scheduleAutosave(); @@ -169,8 +193,30 @@ document.addEventListener("visibilitychange", () => { } }); +configureSharing(); initialize(); +function configureSharing() { + const message = `${INVITATION_TEXT}\n\n${PUBLIC_PORTAL_URL}`; + shareWhatsapp.href = + `https://wa.me/?text=${encodeURIComponent(message)}`; + shareX.href = + "https://twitter.com/intent/tweet?text=" + + encodeURIComponent(INVITATION_TEXT) + + `&url=${encodeURIComponent(PUBLIC_PORTAL_URL)}`; +} + +async function copyInvitation() { + const message = `${INVITATION_TEXT}\n\n${PUBLIC_PORTAL_URL}`; + try { + await navigator.clipboard.writeText(message); + shareStatus.textContent = "نُسخت الدعوة."; + } catch { + shareStatus.textContent = + "تعذر النسخ الآلي؛ استخدم خيار واتساب أو X."; + } +} + async function initialize() { applyRoleFromQuery(); syncRoleControls(); @@ -248,6 +294,11 @@ function showStep(step) { previousButton.hidden = step === 1; nextButton.hidden = step === 5; nextButton.textContent = step === 4 ? "مراجعة النتيجة" : "التالي"; + if (step === 5) { + void ensureTurnstileWidget().catch(error => { + showStatus(error.message, true); + }); + } document.querySelector("#adjudication").scrollIntoView({ behavior: "smooth", block: "start" @@ -257,21 +308,17 @@ function showStep(step) { function validateProfile() { const fullName = value("full-name"); const email = value("email"); - const phone = value("phone"); const years = Number(value("experience-years")); requireText(fullName, "الاسم الكامل"); requireText(email, "البريد الإلكتروني"); - requireText(phone, "رقم الهاتف"); requireText(value("specialization"), "مجال التخصص"); if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) { throw new Error("أدخل بريدًا إلكترونيًا صالحًا."); } - if (!/^\+?[0-9 ()-]{7,24}$/.test(phone)) { - throw new Error("أدخل رقم هاتف صالحًا مع رمز الدولة."); - } if (!Number.isInteger(years) || years < 0 || years > 80) { throw new Error("سنوات الخبرة يجب أن تكون بين صفر و80."); } + validateSocialAccounts(socialAccounts()); if (!checked("privacy-consent")) { throw new Error("الموافقة على حفظ بيانات التواصل مطلوبة للإرسال."); } @@ -281,13 +328,62 @@ function accountProfile() { return { fullName: value("full-name"), email: value("email"), - phone: value("phone"), experienceYears: Number(value("experience-years")), specialization: value("specialization"), - affiliation: nullable(value("affiliation")) + affiliation: nullable(value("affiliation")), + socialAccounts: socialAccounts() }; } +function socialAccounts() { + const accounts = {}; + for (const [key, id] of SOCIAL_FIELDS) { + const handle = normalizeSocialHandle(value(id)); + if (handle) accounts[key] = handle; + } + const otherPlatform = value("social-other-platform"); + const otherUsername = normalizeSocialHandle( + value("social-other-username") + ); + if (otherPlatform) accounts.otherPlatform = otherPlatform; + if (otherUsername) accounts.otherUsername = otherUsername; + return accounts; +} + +function normalizeSocialHandle(handle) { + return handle.trim().replace(/^@+/, ""); +} + +function validateSocialAccounts(accounts) { + if (accounts.whatsapp + && !/^[a-z][a-z0-9._]{2,34}$/.test(accounts.whatsapp)) { + throw new Error( + "اسم مستخدم واتساب يجب أن يبدأ بحرف لاتيني صغير، وأن يتكون " + + "من 3 إلى 35 حرفًا أو رقمًا أو نقطة أو شرطة سفلية." + ); + } + for (const [key, handle] of Object.entries(accounts)) { + if (key === "otherPlatform") continue; + if (!/^[^\s/@?#]{1,80}$/u.test(handle)) { + throw new Error( + "اكتب أسماء المستخدم من دون @ أو مسافات أو روابط كاملة." + ); + } + } + const hasOtherPlatform = Boolean(accounts.otherPlatform); + const hasOtherUsername = Boolean(accounts.otherUsername); + if (hasOtherPlatform !== hasOtherUsername) { + throw new Error( + "أكمل اسم المنصة الأخرى واسم المستخدم فيها معًا." + ); + } + if (hasOtherPlatform + && (accounts.otherPlatform.length < 2 + || accounts.otherPlatform.length > 40)) { + throw new Error("اسم المنصة الأخرى غير صالح."); + } +} + function accountConsent() { return { identityStorage: checked("privacy-consent"), @@ -321,13 +417,20 @@ function fillProfile(profile, consent) { if (!profile) return; document.querySelector("#full-name").value = profile.fullName ?? ""; document.querySelector("#email").value = profile.email ?? ""; - document.querySelector("#phone").value = profile.phone ?? ""; document.querySelector("#experience-years").value = profile.experienceYears ?? ""; document.querySelector("#specialization").value = profile.specialization ?? ""; document.querySelector("#affiliation").value = profile.affiliation ?? ""; + const social = profile.socialAccounts ?? {}; + for (const [key, id] of SOCIAL_FIELDS) { + document.querySelector(`#${id}`).value = social[key] ?? ""; + } + document.querySelector("#social-other-platform").value = + social.otherPlatform ?? ""; + document.querySelector("#social-other-username").value = + social.otherUsername ?? ""; document.querySelector("#privacy-consent").checked = consent?.identityStorage === true; document.querySelector("#contact-consent").checked = @@ -1268,8 +1371,9 @@ function renderReview() {
طريقة النشر
نتيجة مجهّلة

- راجع التعهدات أدناه. سيُحفظ اسمك وبريدك وهاتفك في Azure منفصلًا، - بينما تُرسل القرارات اللغوية إلى قناة الاستيراد الخاصة بالمستودع. + راجع التعهدات أدناه. سيُحفظ اسمك وبريدك وحسابات التواصل التي + أضفتها في Azure منفصلة، بينما تُرسل القرارات اللغوية إلى قناة + الاستيراد الخاصة بالمستودع.

`; } @@ -1333,7 +1437,7 @@ async function submitEvaluation() { artifactType: artifact.kind, artifactSha256, artifact, - clientVersion: "ads-v14.1", + clientVersion: "adg-v14.2", turnstileToken }; const body = JSON.stringify(payload); @@ -1369,6 +1473,14 @@ async function configureTurnstile() { await loadScript( "https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit" ); +} + +async function ensureTurnstileWidget() { + if (!state.config.turnstileSiteKey + || state.turnstileWidgetId !== null) { + return; + } + if (!window.turnstile) await configureTurnstile(); state.turnstileWidgetId = turnstile.render("#turnstile-slot", { sitekey: state.config.turnstileSiteKey, language: "ar", diff --git a/tools/msa-adjudication-workbench/public/index.html b/tools/msa-adjudication-workbench/public/index.html index 5175cea..10fa2cb 100644 --- a/tools/msa-adjudication-workbench/public/index.html +++ b/tools/msa-adjudication-workbench/public/index.html @@ -46,6 +46,23 @@

خبرتك اللغوية هي المعيار،
ولا تحتاج أي خ صفحة المشروع +
+ شارك الدعوة + +

+
+ حسابات التواصل الاجتماعي (اختيارية) +

+ اكتب اسم المستخدم من دون علامة @. لا نطلب رقم هاتف؛ + وفي واتساب نستخدم خاصية اسم المستخدم الجديدة فقط. + اترك أي منصة لا تستخدمها فارغة. +

+
+ + + + + + + + + + + + + +
+

تُحفظ الهوية منفصلة عن النتيجة، ويصل إلى GitHub معرف - عشوائي لا يكشف اسمك أو بريدك أو هاتفك. + عشوائي لا يكشف اسمك أو بريدك أو حساباتك التواصلية.

diff --git a/tools/msa-adjudication-workbench/public/styles.css b/tools/msa-adjudication-workbench/public/styles.css index 75b2518..595ea9d 100644 --- a/tools/msa-adjudication-workbench/public/styles.css +++ b/tools/msa-adjudication-workbench/public/styles.css @@ -220,6 +220,90 @@ h3 { margin: 1.7rem 0; } +.share-control { + position: relative; +} + +.share-control > summary { + list-style: none; +} + +.share-control > summary::-webkit-details-marker { + display: none; +} + +.share-control > summary::after { + content: "⌄"; + font-size: 1rem; +} + +.share-control[open] > summary::after { + transform: rotate(180deg); +} + +.share-options { + position: absolute; + z-index: 20; + inset-block-start: calc(100% + .65rem); + inset-inline-start: 0; + display: grid; + width: min(340px, calc(100vw - 2rem)); + gap: .5rem; + padding: 1rem; + border: 1px solid #d8e2dc; + border-radius: .9rem; + color: var(--green-950); + background: white; + box-shadow: 0 18px 45px rgba(6, 28, 20, .28); +} + +.share-options::before { + content: ""; + position: absolute; + inset-block-start: -.45rem; + inset-inline-start: 1.4rem; + width: .8rem; + height: .8rem; + border-top: 1px solid #d8e2dc; + border-left: 1px solid #d8e2dc; + background: white; + transform: rotate(45deg); +} + +.share-options p { + margin-bottom: .2rem; + color: var(--muted-ink); + font-size: .84rem; +} + +.share-options a, +.share-options button { + display: flex; + min-height: 42px; + align-items: center; + justify-content: center; + padding: .55rem .8rem; + border: 1px solid var(--line); + border-radius: .65rem; + color: var(--green-800); + background: #f7faf8; + text-decoration: none; + font-weight: 750; +} + +.share-options a:hover, +.share-options button:hover { + border-color: var(--green-650); + background: var(--green-100); +} + +.share-options output { + min-height: 1.2rem; + color: var(--green-650); + font-size: .78rem; + text-align: center; +} + .button { display: inline-flex; min-height: 48px; @@ -643,6 +727,45 @@ h3 { grid-template-columns: repeat(2, minmax(0, 1fr)); } +.social-accounts { + margin: 1.2rem 0 0; + padding: 1rem; + border: 1px solid var(--line); + border-radius: 1rem; + background: #f8fbf9; +} + +.social-accounts legend { + padding: 0 .45rem; + color: var(--green-800); + font-size: 1.02rem; + font-weight: 800; +} + +.social-accounts > p { + max-width: 850px; + margin-bottom: 1rem; + color: var(--muted-ink); + font-size: .86rem; +} + +.social-grid { + display: grid; + grid-template-columns: repeat(3, minmax(0, 1fr)); + gap: .8rem; +} + +.social-grid label { + display: grid; + gap: .35rem; + font-size: .86rem; + font-weight: 700; +} + +.social-grid input { + min-width: 0; +} + .form-grid label, .token-field, .sentence-flags label { @@ -1137,10 +1260,21 @@ footer { .criteria-grid, .timeline, .form-grid, + .social-grid, .sentence-flags { grid-template-columns: 1fr; } + .share-control, + .share-control > summary { + width: 100%; + } + + .share-options { + inset-inline-start: auto; + inset-inline-end: 0; + } + .steps { grid-template-columns: repeat(5, minmax(52px, 1fr)); } diff --git a/tools/msa-adjudication-workbench/src/index.js b/tools/msa-adjudication-workbench/src/index.js index 01413a5..708ef29 100644 --- a/tools/msa-adjudication-workbench/src/index.js +++ b/tools/msa-adjudication-workbench/src/index.js @@ -10,11 +10,13 @@ const JSON_HEADERS = { "cache-control": "no-store" }; -const SESSION_COOKIE_NAME = "ads_session"; +const DEFAULT_ORIGIN = "https://adg.sbay.sa"; +const LEGACY_HOST = "ads.sbay.sa"; +const SESSION_COOKIE_NAME = "adg_session"; const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; const CHALLENGE_TTL_MS = 5 * 60 * 1000; const MAX_ACCOUNT_BODY_BYTES = 750000; -const ADMIN_COOKIE_NAME = "ads_admin"; +const ADMIN_COOKIE_NAME = "adg_admin"; const ADMIN_SESSION_TTL_MS = 8 * 60 * 60 * 1000; const ADMIN_STATE_TTL_MS = 10 * 60 * 1000; const GLOBAL_ADMIN_ROLE_TEMPLATE_ID = @@ -24,7 +26,37 @@ const PII_KEYS = new Set([ "fullName", "email", "phone", - "affiliation" + "affiliation", + "socialAccounts", + "whatsapp", + "x", + "tiktok", + "instagram", + "threads", + "telegram", + "snapchat", + "facebook", + "linkedin", + "youtube", + "bluesky", + "otherPlatform", + "otherUsername" +]); + +const SOCIAL_ACCOUNT_KEYS = new Set([ + "whatsapp", + "x", + "tiktok", + "instagram", + "threads", + "telegram", + "snapchat", + "facebook", + "linkedin", + "youtube", + "bluesky", + "otherPlatform", + "otherUsername" ]); const FORBIDDEN_ANALYSIS_KEYS = new Set([ @@ -51,6 +83,9 @@ export default { async fetch(request, env) { const url = new URL(request.url); try { + const legacyRedirect = redirectLegacyOrigin(request, env, url); + if (legacyRedirect) return legacyRedirect; + if (url.pathname === "/api/config" && request.method === "GET") { return json({ submissionEnabled: @@ -95,7 +130,7 @@ export default { return withSecurityHeaders(asset); } catch (error) { if (!(error instanceof PublicError && error.status < 500)) { - console.error("ADS request failed", { + console.error("ADG request failed", { path: url.pathname, name: error?.name, message: error?.message @@ -449,7 +484,7 @@ async function getAdminProgress(request, env) { userId: user.id, fullName: profile.fullName, email: profile.email, - phone: profile.phone, + socialAccounts: profile.socialAccounts ?? {}, specialization: profile.specialization, affiliation: profile.affiliation, experienceYears: profile.experienceYears, @@ -1512,7 +1547,7 @@ async function readJsonBody(request) { } } -function validateAccountProfile(profile) { +export function validateAccountProfile(profile) { if (!profile || typeof profile !== "object" || Array.isArray(profile)) { throw new PublicError("بيانات المحكّم غير صالحة.", 400); @@ -1529,7 +1564,6 @@ function validateAccountProfile(profile) { 160, "البريد الإلكتروني" ).toLowerCase(); - const phone = normalizedText(profile.phone, 7, 32, "رقم الهاتف"); const experienceYears = Number(profile.experienceYears); const specialization = normalizedText( profile.specialization, @@ -1548,9 +1582,6 @@ function validateAccountProfile(profile) { if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) { throw new PublicError("البريد الإلكتروني غير صالح.", 400); } - if (!/^\+?[0-9 ()-]{7,24}$/.test(phone)) { - throw new PublicError("رقم الهاتف غير صالح.", 400); - } if (!Number.isInteger(experienceYears) || experienceYears < 0 || experienceYears > 80) { throw new PublicError("سنوات الخبرة غير صالحة.", 400); @@ -1562,16 +1593,65 @@ function validateAccountProfile(profile) { || String(profile.affiliation).trim() === "" ? null : normalizedText(profile.affiliation, 1, 160, "الجهة العلمية"); + const socialAccounts = validateSocialAccounts(profile.socialAccounts); return { fullName, email, - phone, experienceYears, specialization, - affiliation + affiliation, + socialAccounts }; } +function validateSocialAccounts(value) { + if (value == null) return {}; + if (typeof value !== "object" || Array.isArray(value)) { + throw new PublicError("حسابات التواصل غير صالحة.", 400); + } + const unknownKeys = Object.keys(value).filter( + key => !SOCIAL_ACCOUNT_KEYS.has(key) + ); + if (unknownKeys.length !== 0) { + throw new PublicError("تحتوي حسابات التواصل حقولًا غير معروفة.", 400); + } + const normalized = {}; + for (const key of SOCIAL_ACCOUNT_KEYS) { + if (key === "otherPlatform") continue; + const raw = value[key]; + if (raw == null || String(raw).trim() === "") continue; + const handle = String(raw).trim().replace(/^@+/, ""); + if (!/^[^\s/@?#]{1,80}$/u.test(handle)) { + throw new PublicError( + "اسم المستخدم في حسابات التواصل غير صالح.", + 400 + ); + } + normalized[key] = handle; + } + if (normalized.whatsapp + && !/^[a-z][a-z0-9._]{2,34}$/.test(normalized.whatsapp)) { + throw new PublicError("اسم مستخدم واتساب غير صالح.", 400); + } + const otherPlatform = value.otherPlatform == null + || String(value.otherPlatform).trim() === "" + ? null + : normalizedText( + value.otherPlatform, + 2, + 40, + "اسم المنصة الأخرى" + ); + if (Boolean(otherPlatform) !== Boolean(normalized.otherUsername)) { + throw new PublicError( + "يجب إدخال اسم المنصة الأخرى واسم المستخدم معًا.", + 400 + ); + } + if (otherPlatform) normalized.otherPlatform = otherPlatform; + return normalized; +} + function validateAccountConsent(consent) { if (!consent || consent.identityStorage !== true) { throw new PublicError( @@ -1812,7 +1892,7 @@ async function receiveSubmission(request, env) { const publicEnvelope = { schema: "adg-msa-github-inbox-v1", receiptId, - participantPseudonym: `ads-${receiptId.slice(0, 12)}`, + participantPseudonym: `adg-${receiptId.slice(0, 12)}`, receivedAtUtc, artifactType: submission.artifactType, artifactSha256: actualArtifactSha256, @@ -1907,21 +1987,7 @@ function validateSubmission(value) { throw new PublicError("غلاف التقييم غير صالح.", 400); } - const profile = value.profile; - if (!profile - || !boundedText(profile.fullName, 2, 120) - || !boundedText(profile.email, 5, 160) - || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(profile.email) - || !boundedText(profile.phone, 7, 32) - || !/^\+?[0-9 ()-]{7,24}$/.test(profile.phone) - || !Number.isInteger(profile.experienceYears) - || profile.experienceYears < 0 - || profile.experienceYears > 80 - || !boundedText(profile.specialization, 2, 60) - || (profile.affiliation !== null - && !boundedText(profile.affiliation, 1, 160))) { - throw new PublicError("بيانات المحكّم ناقصة أو غير صالحة.", 400); - } + validateAccountProfile(value.profile); if (value.consent?.identityStorage !== true || value.attestation?.independent !== true @@ -2191,17 +2257,29 @@ function containsKey(value, keys) { } function enforceOrigin(request, env) { - const expected = env.ALLOWED_ORIGIN || "https://ads.sbay.sa"; + const expected = env.ALLOWED_ORIGIN || DEFAULT_ORIGIN; const origin = request.headers.get("origin"); if (origin && origin !== expected) { throw new PublicError("مصدر الطلب غير مسموح.", 403); } } -function boundedText(value, minimum, maximum) { - return typeof value === "string" - && value.trim().length >= minimum - && value.trim().length <= maximum; +function redirectLegacyOrigin(request, env, url) { + if (!["GET", "HEAD"].includes(request.method) + || url.hostname !== LEGACY_HOST) { + return null; + } + const target = new URL(env.ALLOWED_ORIGIN || DEFAULT_ORIGIN); + if (target.hostname === LEGACY_HOST) return null; + target.pathname = url.pathname; + target.search = url.search; + return new Response(null, { + status: 308, + headers: { + location: target.toString(), + "cache-control": "public, max-age=3600" + } + }); } function isUuid(value) { diff --git a/tools/msa-adjudication-workbench/tests/worker.test.mjs b/tools/msa-adjudication-workbench/tests/worker.test.mjs index a6bb16c..7dc021a 100644 --- a/tools/msa-adjudication-workbench/tests/worker.test.mjs +++ b/tools/msa-adjudication-workbench/tests/worker.test.mjs @@ -6,12 +6,13 @@ import worker, { base64UrlToBytes, calculateDraftProgress, decryptEntityCryptForTest, - encryptEntityCrypt + encryptEntityCrypt, + validateAccountProfile } from "../src/index.js"; test("config exposes no server secrets", async () => { const response = await worker.fetch( - new Request("https://ads.sbay.sa/api/config"), + new Request("https://adg.sbay.sa/api/config"), { SUBMISSION_ENABLED: "false", MAX_SUBMISSION_BYTES: "900000", @@ -65,8 +66,61 @@ test("draft progress follows the enabled linguistic controls", () => { test("admin callback uses the registered Microsoft redirect path", () => { assert.equal( - adminCallbackUri({ ALLOWED_ORIGIN: "https://ads.sbay.sa" }), - "https://ads.sbay.sa/signin-microsoft" + adminCallbackUri({ ALLOWED_ORIGIN: "https://adg.sbay.sa" }), + "https://adg.sbay.sa/signin-microsoft" + ); +}); + +test("legacy ADS links redirect to the canonical ADG domain", async () => { + const response = await worker.fetch( + new Request("https://ads.sbay.sa/admin/?from=old"), + { ALLOWED_ORIGIN: "https://adg.sbay.sa" } + ); + assert.equal(response.status, 308); + assert.equal( + response.headers.get("location"), + "https://adg.sbay.sa/admin/?from=old" + ); +}); + +test("social usernames are normalized without collecting a phone number", () => { + assert.deepEqual( + validateAccountProfile({ + fullName: "محكّم تجريبي", + email: "JUDGE@example.test", + experienceYears: 12, + specialization: "grammar", + affiliation: null, + socialAccounts: { + whatsapp: "@judge_2026", + x: "@ArabicJudge", + otherPlatform: "منصة علمية", + otherUsername: "@judge" + } + }), + { + fullName: "محكّم تجريبي", + email: "judge@example.test", + experienceYears: 12, + specialization: "grammar", + affiliation: null, + socialAccounts: { + whatsapp: "judge_2026", + x: "ArabicJudge", + otherUsername: "judge", + otherPlatform: "منصة علمية" + } + } + ); + assert.throws( + () => validateAccountProfile({ + fullName: "محكّم تجريبي", + email: "judge@example.test", + experienceYears: 12, + specialization: "grammar", + socialAccounts: { whatsapp: "123456" } + }), + /واتساب/ ); }); @@ -79,7 +133,7 @@ test("WebAuthn base64url values round-trip without padding", () => { test("admin identity is anonymous without an admin cookie", async () => { const response = await worker.fetch( - new Request("https://ads.sbay.sa/api/admin/auth/me"), + new Request("https://adg.sbay.sa/api/admin/auth/me"), { DB: {}, ENTRA_TENANT_ID: "tenant", @@ -96,7 +150,7 @@ test("admin identity is anonymous without an admin cookie", async () => { test("admin progress fails closed without an admin cookie", async () => { const response = await worker.fetch( - new Request("https://ads.sbay.sa/api/admin/progress"), + new Request("https://adg.sbay.sa/api/admin/progress"), { DB: {}, ENTRA_TENANT_ID: "tenant", @@ -109,7 +163,7 @@ test("admin progress fails closed without an admin cookie", async () => { test("foreign origins are rejected before processing", async () => { const response = await worker.fetch( - new Request("https://ads.sbay.sa/api/submissions", { + new Request("https://adg.sbay.sa/api/submissions", { method: "POST", headers: { origin: "https://evil.example", @@ -118,7 +172,7 @@ test("foreign origins are rejected before processing", async () => { body: "{}" }), { - ALLOWED_ORIGIN: "https://ads.sbay.sa", + ALLOWED_ORIGIN: "https://adg.sbay.sa", SUBMISSION_ENABLED: "true" } ); @@ -127,7 +181,7 @@ test("foreign origins are rejected before processing", async () => { test("static responses receive restrictive headers", async () => { const response = await worker.fetch( - new Request("https://ads.sbay.sa/"), + new Request("https://adg.sbay.sa/"), { ASSETS: { fetch: async () => new Response("

ok

", { @@ -147,7 +201,8 @@ test("static responses receive restrictive headers", async () => { test("EntityCrypt Matryoshka profile encrypts identities with AES-GCM", async () => { const plainText = JSON.stringify({ fullName: "محكّم تجريبي", - email: "judge@example.test" + email: "judge@example.test", + socialAccounts: { whatsapp: "judge_2026" } }); const masterKey = "test-master-key-with-sufficient-entropy"; const first = await encryptEntityCrypt(plainText, masterKey); diff --git a/tools/msa-adjudication-workbench/wrangler.example.jsonc b/tools/msa-adjudication-workbench/wrangler.example.jsonc index 5520544..06ee2ae 100644 --- a/tools/msa-adjudication-workbench/wrangler.example.jsonc +++ b/tools/msa-adjudication-workbench/wrangler.example.jsonc @@ -3,7 +3,8 @@ "name": "adg-msa-adjudication", "main": "src/index.js", "compatibility_date": "2026-08-14", - "workers_dev": true, + "workers_dev": false, + "preview_urls": false, "assets": { "directory": "./public", "binding": "ASSETS", @@ -18,8 +19,18 @@ "migrations_dir": "migrations" } ], + "routes": [ + { + "pattern": "adg.sbay.sa", + "custom_domain": true + }, + { + "pattern": "ads.sbay.sa", + "custom_domain": true + } + ], "vars": { - "ALLOWED_ORIGIN": "https://your-domain.example", + "ALLOWED_ORIGIN": "https://adg.sbay.sa", "SUBMISSION_ENABLED": "false", "MAX_SUBMISSION_BYTES": "900000", "TURNSTILE_SITE_KEY": "",