Gate Admissions (gate scanner + personal staff PINs) — to QA

[peterdrier]

Gate Admissions — routed to QA (origin) from upstream PR 895

Brings @veryaaron's Gate admissions feature (originally opened as a cross-fork PR straight to upstream, nobodies-collective/Humans#895) through our origin → QA → prod flow. Feature authored by Aaron with Claude Code; reviewed and fixed-forward here before QA.

Posture sign-off: Peter has blessed making Humans the system-of-record for gate admission (append-only gate_scan_events) and the new public surface (gate_staff_pins, IGateService.GetEnrolledSupervisorIdsAsync, ITicketVendorService.CreateCheckInAsync).

What it does

Gate ticket scanning that decides entry against three layers: (1) ticket valid, (2) name matches photo ID (manual Yes/No), (3) before the general-entry cutoff a holder needs an Early Entry grant. Too-early/child-without-ID admits require an attributable supervisor override (server-verified PIN + live Admin/Board/TicketAdmin role). Staff claim the shared scanner with a personal 4-digit PIN (hashed via Identity). Includes GDPR export contributor, account-merge re-FK, daily retention purge, and a flag-gated (Gate:VendorMirrorEnabled, default off) TicketTailor check-in mirror.

Review findings fixed-forward in this branch

A full structured review (rule-conformance + code/security + a focused auth/PIN/override audit) found the override security model sound (no path admits a too-early/no-ID scan without a genuine server-verified supervisor PIN). Four issues were fixed on top of Aaron's work (commit fix(gate): …):

• F1 — orphaned admin page: /Gate/Admin (the cutoff-setting screen) had no nav link, so the section shipped unreachable and every scan fell back to AMBER. Added a "Gate settings" entry to the Tickets admin nav.
• F2 — dead kiosk search: the route-locked kiosk can't reach /api/profiles/search, so the claim-screen search box was dead. Added a Gate-scoped, name-only /Gate/Search (inside the route-lock; no email/directory exposure) and pointed the picker at it. Overrides stay tap-list-only.
• S1 — gate-wide lockout DoS (Medium): PIN throttle keyed on the (proxy-collapsed) device IP, so 5 wrong PINs froze every claim/override at the terminal for 15 min. Now throttles per target user only (brute-force ceiling unchanged at 5/15 min).
• S2 — forgeable attribution (Low–Med): ClaimPin accepted an arbitrary userId; now validates the claimant resolves to an active member before enrolling a PIN or stamping the session.

New tests: GateControllerClaimTests (per-user throttle, claimant validation, kiosk search).

Migration consolidation

The two in-flight Gate migrations were consolidated into one (/ef-regen) — origin/main had raced ahead with a later-timestamped migration, leaving them mid-chain. Snapshot restored from origin/main as the sanctioned /ef-regen first step; one fresh end-of-chain AddGateSection migration regenerated. Clears the "≤1 migration per PR" CI gate.

Verification

• dotnet build clean; dotnet format --verify-no-changes clean.
• Application.Tests 3825 passed; Web.Tests 339 passed.

Deferred to tracked issues (non-blocking)

PIN-set/supervisor-status disclosure at the kiosk (low, trusted device); roster sort sitting in the service layer; IGateRepository doc comment omits gate_staff_pins; vendor job enqueued-but-no-op when the flag is off.

To verify on this preview deploy before prod

• Too-early → supervisor-override end-to-end against a real ticket (AdmittedEarlyOverride recorded).
• Claim via the restored /Gate/Search name picker (non-rostered staffer).
• /Gate/Admin reachable from the Tickets admin nav; setting the cutoff clears the AMBER fail-safe.
• Per-user throttle: a locked-out staffer doesn't block others at the same terminal.
• Before enabling Gate:VendorMirrorEnabled: verify the TicketTailor POST /v1/check_ins body against the live API.

Original feature: @veryaaron · 🤖 Review + fixes generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 779fb0215a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use CheckedInAt for vendor duplicate detection

When a ticket has already been checked in through TicketTailor and the sync has run, the ticket row records that in TicketAttendee.CheckedInAt while the attendee Status remains Valid (the sync path applies check-ins without changing status). This leaves CheckedInAtVendor false here, so Gate will present the ticket as admissible and can record a second local admit instead of stopping as a duplicate for tickets first processed by the vendor app; the gate projection needs to carry and check the persisted check-in timestamp, not only the status enum.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Include override authorizations in user exports

Supervisor overrides store the authorizing supervisor's user id in OverrideByUserId, but this export query only returns rows where the user was the guest or scanner. A supervisor who authorized a too-early or child-without-ID admit therefore gets a DSAR export that omits records containing their identifier; include OverrideByUserId == userId here and distinguish that role in the exported slice.

Useful? React with 👍 / 👎.

[claude]

WARN — anonymous search response violates memory/code/search-endpoint-response-shape.md

Rule: "search/autocomplete endpoints return typed DTOs/records, not anonymous objects — anonymous JSON payloads drift easily and make it harder to reuse search behavior safely."

The Select(m => new { userId, displayName, detail, profilePictureUrl }) here is an anonymous type. Any JavaScript consumer that depends on these property names has no compile-time contract to catch accidental renames.

Fix: define a named record in GateViewModels.cs and project into it:

Suggested change

	return Json(rows);
	var rows = matches
	.OrderByRelevance()
	.Select(m => new GateSearchResult(m.UserId, m.BurnerName, m.ProfilePictureUrl))
	.ToList();
	return Json(rows);

Add to GateViewModels.cs:

public sealed record GateSearchResult(Guid UserId, string? DisplayName, string? ProfilePictureUrl);

(The detail field was always null, so it can be dropped.)

[claude]

WARN — display sort in Application service violates memory/architecture/display-sort-in-controllers.md

Rule: "display ordering belongs at the presentation layer (controllers / views / view-model assembly), not in services or repositories." The atom is explicit that .OrderBy(...) for display ordering inside src/Humans.Application/Services/**/*.cs is a layer leak — "sort for display" is not the service's job.

This OrderBy(u => u.DisplayName, ...) is alphabetical for display. It should move to the controller.

Fix in GateService.GetShiftRosterAsync — drop the sort and leave the projected list:

Suggested change

	.OrderBy(u => u.DisplayName, StringComparer.CurrentCultureIgnoreCase)
	.Select(u => new GateRosterEntry(u.UserId, u.DisplayName))
	.ToList();

Fix in GateController.BuildRosterAsync — sort after the service call:

var roster = await gate.GetShiftRosterAsync(teamId, ct);
return roster
    .OrderBy(r => r.DisplayName, StringComparer.CurrentCultureIgnoreCase)
    .Select(r => new GateRosterMember(r.UserId, r.DisplayName))
    .ToList();

[claude]

Reviewed commit 779fb02. 2 inline finding(s) posted.