The wallboard is already scaled, so both were taking height from the
technician table. The weather strip puts the temperature and conditions
on one line, the details in two columns, and each forecast day's icon
beside its temperatures. Stat tiles show the number with its note on
one line, with tighter padding, and "Unassigned requests" becomes
"Unassigned" so every label fits on one line.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The weather card becomes a full-width strip under the header. Below it
the stat tiles sit over the technician table, and the recently closed
feed runs the height of both and scrolls inside its own panel. The
"watching" text moves from under the header to the footer, which now
comes before the page script so render() can find it.
Tiles share subgrid rows so a wrapped label doesn't push its number out
of line, and the feed's age column is wider so "1h 13m" no longer runs
into the ticket number.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Feedback asked for higher contrast. Every color is now a token in
:root, with text checked for WCAG AA: faint text goes from 2.9:1 to
6:1 and muted from 7:1 to 9:1. The heat scale gets its own stronger
color with a 25% floor so a one-ticket cell is visible, and nothing is
smaller than 12px except the feed's "ago" label.
The accent changes from orange to MCCS green and the heat scale to MCCS
navy, both lifted from the colors sampled from the ITS logo, with a
green stripe under the header. Errors stay red-orange.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces the "Sort rows by" setting from the previous commit. Every
header is now a button: a new column starts A to Z for names and highest
first for counts, and a second click reverses it. Rows default to name
A to Z, and each browser remembers its own sort in localStorage, like the
sound toggle. The arrow points toward the larger end (down for A to Z
or lowest first, up for highest first). The tableSort setting is removed
from the server again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Settings has a "Sort rows by" choice: the technician list order (the
default, as before), technician name, Total open, Closed today or any
status column. Counts sort busiest first with ties by name, and the
sorted column's header gets an arrow. The browser does the sorting; the
server only validates and saves tableSort.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SDP closes a resolved ticket on its own after 2 or 3 days, so watching
only Closed gave the ding days late. Each user can now pick which
statuses count as closed for the feed (feedStatuses, defaulting to
STATUS_NAMES). With Resolved picked, tickets are timed by resolved_time
so the automatic close later doesn't ding again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Subjects can name students or describe their situation (FERPA). The
closed feed and unassigned queries no longer request subject, the
returned objects never include it, and feed cards show the ticket
number instead. SECURITY.md, NOTES.md and the README are updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Any Zoho account can approve the client, and an outside account got a
session that returned the .env site, group and technician names.
ALLOWED_EMAIL_DOMAINS is now required: the callback refuses other
domains and revokes their token, and every API call re-checks it so
older cookies stop working. /api/names also makes the caller's token
read from SDP before returning the shared names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A gear button and a setup prompt edit the saved settings, with name
suggestions, and apply them without a reload. Panels and status columns
can be hidden; the closed watcher and ding keep running.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each user now signs in with their own Zoho account through the web
OAuth flow (Server-based Application client), and every SDP query runs
with that user's token. Nobody who reaches the page can see data
without signing in.
- auth.js: authorization URL, code exchange, token renewal, revoke and
user info, replacing the device-code flow.
- session.js: tokens kept in an AES-256-GCM encrypted, HttpOnly,
SameSite=Lax cookie keyed by SESSION_SECRET. The access token renews
when due, concurrent calls share one renewal, and sessions end after
SESSION_DAYS.
- routes.js: /auth/login, /auth/callback (state checked), /auth/logout
(revokes at Zoho); /api/session, /api/closed, /api/workload and
/api/weather all need a sign-in.
- The server is stateless. boardService.js, tokenStore.js, ADMIN_KEY
and data/token.json are gone. The page runs the checks itself and
keeps the closed feed, backfilling 12 hours on first load.
- tickets.js: the closed feed query pages, and SDP 401s are rethrown
so the user is signed out.
- server.js: PUBLIC_URL, trust proxy, security headers, /healthz.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
