Create vote.hackclub.com galleries from the series page - #121
Merged
Merged
Conversation
A vote event is per Attend event, but choosing which of a series' events get a voting gallery is a decision about the series — and vote could only be reached from each event's own integrations page, so making that choice meant walking every satellite. Series owners now get an Integrations page listing every event with its gallery or a button to create one, disabled with the reason when an event has no logo and banner yet. The create path was inline in the dashboard controller, and the order of its checks is the whole substance of it: already linked, server configured, adopt an existing vote event with this slug, insist on artwork, create, and adopt the winner if it loses the race. That moves to Vote::EventLinker so both pages share one path rather than a copy each, and gets the spec coverage it never had. The event's own page behaves exactly as before. Owner-only, the same bar as issuing a series API key: creating a gallery publishes the event's name and artwork to another service.
leowilkin
enabled auto-merge (squash)
September 9, 2026 22:53
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Brakeman's LinkToHref check flagged both links in the events table: vote decides its own admin and gallery URLs, we store whatever it sends, and by the time a view renders them they are external input — a stored `javascript:` URL would become a clickable script. `external_http_url` returns the URL only when it parses as http(s), and nil otherwise so the link is simply dropped, which is a real fix rather than an ignore entry. The event's own integrations page renders the same two URLs and Brakeman doesn't resolve them there, so it stays as it was.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A vote event is per Attend event, but choosing which of a series' events get a voting gallery is a decision about the series — and vote could only be reached from each event's own integrations page, so making that choice meant walking every satellite.
Series owners now get an Integrations page (
/admin/series/:slug/integrations) listing every event in the series with either its gallery links or a button to create one, disabled with the reason when an event has no logo and banner yet.Vote::EventLinker
The create path was inline in
Admin::DashboardController, and the order of its checks is the whole substance of it:That moves into
Vote::EventLinkerso the series page and the event page share one path instead of a copy each, and it gets the spec coverage it never had. The event's own integrations page keeps its exact behaviour — same flash strings, same redirects.Notes for review
Admin::BaseController'safter_action, which picks whichever record changed most in the request — on the first request after sign-in that's the user's own Devise trackable columns, not the event./admin/series, not the newer token-based styling.Testing
17 new examples across
Vote::EventLinkerand the request spec. Full suite green apart from the pre-existing DocuSeal webhook spec that flips when a realmaster.keyis present.