+
Test Email
+
+
+
+
Volunteer Signup
+
+
+
+
+
+
+ Signup form: /#/volunteer-signup
+
+
+
+
+
+
Shift Signups
+
+
+ Status: {shiftSignupsOpen ? 'Open' : 'Closed'}
+
+
+
+ {#if !shiftSignupsOpen}
+
+ Opening signups will email all confirmed volunteers their shift signup links.
+
+ {/if}
+
{/if}
diff --git a/frontend/src/pages/VolunteerSignup.svelte b/frontend/src/pages/VolunteerSignup.svelte
new file mode 100644
index 0000000..8681265
--- /dev/null
+++ b/frontend/src/pages/VolunteerSignup.svelte
@@ -0,0 +1,241 @@
+
+
+
+
+
+
+ {#if loading}
+
Loading...
+ {:else if submitted}
+
+
Thank you!
+
+ We've sent a confirmation email to {email}.
+ Please check your inbox and click the link to confirm your signup.
+
+
+ {:else}
+ {#if config?.event_name && config.event_name !== 'the event'}
+
{config.event_name}
+ {/if}
+
+ {#if error}
+
{error}
+ {/if}
+
+
+ {/if}
+
+
+
+
diff --git a/handle_settings.go b/handle_settings.go
index bf19d13..27420fa 100644
--- a/handle_settings.go
+++ b/handle_settings.go
@@ -19,14 +19,25 @@ func (app *App) handleGetSettings(w http.ResponseWriter, r *http.Request) {
pass = "***"
}
+ var noteLabel, noteRequired, signupsOpen string
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'volunteer_note_label'`).Scan(¬eLabel)
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'volunteer_note_required'`).Scan(¬eRequired)
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'shift_signups_open'`).Scan(&signupsOpen)
+ if noteLabel == "" {
+ noteLabel = "Additional note"
+ }
+
writeJSON(w, map[string]any{
- "smtp_host": cfg.Host,
- "smtp_port": cfg.Port,
- "smtp_user": cfg.User,
- "smtp_password": pass,
- "smtp_from": cfg.From,
- "smtp_from_name": cfg.FromName,
- "base_url": baseURL,
+ "smtp_host": cfg.Host,
+ "smtp_port": cfg.Port,
+ "smtp_user": cfg.User,
+ "smtp_password": pass,
+ "smtp_from": cfg.From,
+ "smtp_from_name": cfg.FromName,
+ "base_url": baseURL,
+ "volunteer_note_label": noteLabel,
+ "volunteer_note_required": noteRequired == "true",
+ "shift_signups_open": signupsOpen == "true",
})
}
@@ -37,7 +48,8 @@ func (app *App) handleUpdateSettings(w http.ResponseWriter, r *http.Request) {
return
}
- keys := []string{"smtp_host", "smtp_port", "smtp_user", "smtp_password", "smtp_from", "smtp_from_name", "base_url"}
+ keys := []string{"smtp_host", "smtp_port", "smtp_user", "smtp_password", "smtp_from", "smtp_from_name", "base_url",
+ "volunteer_note_label", "volunteer_note_required"}
for _, k := range keys {
v, ok := body[k]
if !ok {
@@ -47,11 +59,17 @@ func (app *App) handleUpdateSettings(w http.ResponseWriter, r *http.Request) {
switch vv := v.(type) {
case string:
if k == "smtp_password" && vv == "" {
- continue // don't erase the stored password with an empty value
+ continue
}
val = vv
case float64:
val = strconv.Itoa(int(vv))
+ case bool:
+ if vv {
+ val = "true"
+ } else {
+ val = "false"
+ }
default:
continue
}
diff --git a/handle_signup.go b/handle_signup.go
new file mode 100644
index 0000000..62ab6c2
--- /dev/null
+++ b/handle_signup.go
@@ -0,0 +1,247 @@
+package main
+
+import (
+ "encoding/json"
+ "fmt"
+ "log"
+ "net/http"
+ "strings"
+)
+
+func (app *App) handlePublicSignupConfig(w http.ResponseWriter, r *http.Request) {
+ var noteLabel, noteRequired string
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'volunteer_note_label'`).Scan(¬eLabel)
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'volunteer_note_required'`).Scan(¬eRequired)
+ if noteLabel == "" {
+ noteLabel = "Additional note"
+ }
+
+ depts, _ := app.listDepartments("")
+ deptList := []map[string]any{}
+ for _, d := range depts {
+ deptList = append(deptList, map[string]any{"id": d.ID, "name": d.Name, "color": d.Color})
+ }
+
+ eventName := app.eventName()
+
+ writeJSON(w, map[string]any{
+ "event_name": eventName,
+ "departments": deptList,
+ "volunteer_note_label": noteLabel,
+ "volunteer_note_required": noteRequired == "true",
+ })
+}
+
+func (app *App) handlePublicSignup(w http.ResponseWriter, r *http.Request) {
+ var body struct {
+ PreferredName string `json:"preferred_name"`
+ TicketName string `json:"ticket_name"`
+ Email string `json:"email"`
+ Pronouns string `json:"pronouns"`
+ Phone string `json:"phone"`
+ DepartmentID *int `json:"department_id"`
+ Note string `json:"note"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ writeError(w, "invalid request", http.StatusBadRequest)
+ return
+ }
+
+ body.PreferredName = strings.TrimSpace(body.PreferredName)
+ body.Email = strings.TrimSpace(body.Email)
+ if body.PreferredName == "" || body.Email == "" {
+ writeError(w, "preferred name and email are required", http.StatusBadRequest)
+ return
+ }
+
+ var noteRequired string
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'volunteer_note_required'`).Scan(¬eRequired)
+ if noteRequired == "true" && strings.TrimSpace(body.Note) == "" {
+ writeError(w, "note field is required", http.StatusBadRequest)
+ return
+ }
+
+ // Don't reveal whether email is already registered
+ existing, _ := app.getVolunteerByEmail(body.Email)
+ if existing != nil {
+ writeJSON(w, map[string]any{"ok": true})
+ return
+ }
+
+ // Auto-match attendee by email or create new
+ var attendeeID *int
+ attendees, _ := app.listAttendees("", "", "")
+ for _, a := range attendees {
+ if strings.EqualFold(a.Email, body.Email) {
+ id := a.ID
+ attendeeID = &id
+ break
+ }
+ }
+
+ if attendeeID == nil {
+ name := body.PreferredName
+ if body.TicketName != "" {
+ name = body.TicketName
+ }
+ newAttendee, err := app.createAttendee(Attendee{
+ Name: name,
+ Email: body.Email,
+ Phone: body.Phone,
+ })
+ if err != nil {
+ writeError(w, "internal error", http.StatusInternalServerError)
+ return
+ }
+ attendeeID = &newAttendee.ID
+ }
+
+ confirmToken, err := generateConfirmationToken()
+ if err != nil {
+ writeError(w, "internal error", http.StatusInternalServerError)
+ return
+ }
+
+ vol := Volunteer{
+ AttendeeID: attendeeID,
+ Name: body.PreferredName,
+ PreferredName: body.PreferredName,
+ TicketName: body.TicketName,
+ Email: body.Email,
+ Phone: body.Phone,
+ Pronouns: body.Pronouns,
+ DepartmentID: body.DepartmentID,
+ Note: body.Note,
+ ConfirmationToken: &confirmToken,
+ }
+
+ if _, err := app.createVolunteer(vol); err != nil {
+ writeError(w, "internal error", http.StatusInternalServerError)
+ return
+ }
+
+ go func() {
+ if err := app.sendConfirmationEmail(body.Email, body.PreferredName, confirmToken); err != nil {
+ log.Printf("confirmation email to %s failed: %v", body.Email, err)
+ }
+ }()
+
+ writeJSON(w, map[string]any{"ok": true})
+}
+
+func (app *App) handleConfirmEmail(w http.ResponseWriter, r *http.Request) {
+ var body struct {
+ Token string `json:"token"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Token == "" {
+ writeError(w, "invalid request", http.StatusBadRequest)
+ return
+ }
+
+ vol, err := app.getVolunteerByConfirmationToken(body.Token)
+ if err != nil || vol == nil {
+ writeJSON(w, map[string]any{"status": "invalid"})
+ return
+ }
+
+ if vol.EmailConfirmed {
+ writeJSON(w, map[string]any{"status": "already_confirmed"})
+ return
+ }
+
+ if err := app.confirmVolunteerEmail(vol.ID); err != nil {
+ writeError(w, "internal error", http.StatusInternalServerError)
+ return
+ }
+
+ response := map[string]any{"status": "confirmed"}
+
+ var signupsOpen string
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'shift_signups_open'`).Scan(&signupsOpen)
+
+ if signupsOpen == "true" && vol.AttendeeID != nil {
+ a, _ := app.getAttendee(*vol.AttendeeID)
+ if a != nil && a.VolunteerToken == nil {
+ t, err := app.generateUniqueToken()
+ if err == nil {
+ app.db.Exec(`UPDATE attendees SET volunteer_token=?, updated_at=? WHERE id=?`, t, now(), a.ID)
+ a.VolunteerToken = &t
+ }
+ }
+ if a != nil && a.VolunteerToken != nil {
+ kioskLink := fmt.Sprintf("%s/#/v/%s", app.resolveBaseURL(), *a.VolunteerToken)
+ response["kiosk_link"] = kioskLink
+ go func() {
+ if err := app.sendShiftSignupEmail(vol.Email, vol.PreferredName, kioskLink); err != nil {
+ log.Printf("shift signup email to %s failed: %v", vol.Email, err)
+ }
+ }()
+ }
+ }
+
+ writeJSON(w, response)
+}
+
+func (app *App) handleToggleShiftSignups(w http.ResponseWriter, r *http.Request) {
+ var body struct {
+ Open bool `json:"open"`
+ }
+ if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+ writeError(w, "invalid request", http.StatusBadRequest)
+ return
+ }
+ val := "false"
+ if body.Open {
+ val = "true"
+ }
+ app.db.Exec(`INSERT OR REPLACE INTO config (key, value) VALUES ('shift_signups_open', ?)`, val)
+
+ if body.Open {
+ go app.openShiftSignups()
+ }
+ writeJSON(w, map[string]any{"shift_signups_open": body.Open})
+}
+
+func (app *App) openShiftSignups() {
+ // Generate kiosk tokens for confirmed volunteers whose attendees lack one
+ vols, _ := app.listConfirmedVolunteersWithoutKioskToken()
+ for _, v := range vols {
+ if v.AttendeeID == nil {
+ continue
+ }
+ t, err := app.generateUniqueToken()
+ if err != nil {
+ continue
+ }
+ app.db.Exec(`UPDATE attendees SET volunteer_token=?, updated_at=? WHERE id=?`, t, now(), *v.AttendeeID)
+ }
+
+ // Email all confirmed volunteers with kiosk links
+ confirmed, _ := queryVolunteers(app.db, `
+ SELECT `+volunteerCols+`
+ FROM volunteers
+ WHERE email_confirmed = 1 AND deleted_at IS NULL AND attendee_id IS NOT NULL`)
+ baseURL := app.resolveBaseURL()
+ sent := 0
+
+ for _, v := range confirmed {
+ if v.AttendeeID == nil || v.Email == "" {
+ continue
+ }
+ a, _ := app.getAttendee(*v.AttendeeID)
+ if a == nil || a.VolunteerToken == nil {
+ continue
+ }
+ kioskLink := fmt.Sprintf("%s/#/v/%s", baseURL, *a.VolunteerToken)
+ name := v.PreferredName
+ if name == "" {
+ name = v.Name
+ }
+ if err := app.sendShiftSignupEmail(v.Email, name, kioskLink); err == nil {
+ sent++
+ } else {
+ log.Printf("shift signup email to %s failed: %v", v.Email, err)
+ }
+ }
+ log.Printf("Shift signups opened: sent %d emails", sent)
+}
diff --git a/handle_signup_test.go b/handle_signup_test.go
new file mode 100644
index 0000000..a59da69
--- /dev/null
+++ b/handle_signup_test.go
@@ -0,0 +1,333 @@
+package main
+
+import (
+ "net/http/httptest"
+ "testing"
+)
+
+func TestPublicSignupConfig(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ app.createDepartment(Department{Name: "Setup", Color: "#ff0000"})
+ app.createDepartment(Department{Name: "Teardown", Color: "#00ff00"})
+ app.db.Exec(`INSERT OR REPLACE INTO config (key, value) VALUES ('volunteer_note_label', 'Who sent you?')`)
+ app.db.Exec(`INSERT OR REPLACE INTO config (key, value) VALUES ('volunteer_note_required', 'true')`)
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("GET", "/api/public/signup-config", nil))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d", w.Code)
+ }
+ result := parseJSON(t, w)
+ depts, ok := result["departments"].([]any)
+ if !ok || len(depts) != 2 {
+ t.Fatalf("expected 2 departments, got %v", result["departments"])
+ }
+ if result["volunteer_note_label"] != "Who sent you?" {
+ t.Errorf("expected 'Who sent you?', got %v", result["volunteer_note_label"])
+ }
+ if result["volunteer_note_required"] != true {
+ t.Errorf("expected note required true, got %v", result["volunteer_note_required"])
+ }
+}
+
+func TestPublicSignup(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+ app.createDepartment(Department{Name: "Setup", Color: "#ff0000"})
+
+ w := httptest.NewRecorder()
+ deptID := 1
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Titania",
+ "email": "titania@example.com",
+ "pronouns": "she/they",
+ "department_id": deptID,
+ }))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+ }
+ result := parseJSON(t, w)
+ if result["ok"] != true {
+ t.Fatalf("expected ok true, got %v", result)
+ }
+
+ // Volunteer should exist
+ vol, err := app.getVolunteerByEmail("titania@example.com")
+ if err != nil || vol == nil {
+ t.Fatal("volunteer not created")
+ }
+ if vol.PreferredName != "Titania" {
+ t.Errorf("preferred_name = %q, want Titania", vol.PreferredName)
+ }
+ if vol.Pronouns != "she/they" {
+ t.Errorf("pronouns = %q, want she/they", vol.Pronouns)
+ }
+ if vol.ConfirmationToken == nil || *vol.ConfirmationToken == "" {
+ t.Error("expected confirmation token to be set")
+ }
+ if vol.EmailConfirmed {
+ t.Error("should not be confirmed yet")
+ }
+
+ // Attendee should be auto-created and linked
+ if vol.AttendeeID == nil {
+ t.Fatal("expected attendee to be linked")
+ }
+ a, _ := app.getAttendee(*vol.AttendeeID)
+ if a == nil {
+ t.Fatal("linked attendee not found")
+ }
+ if a.Email != "titania@example.com" {
+ t.Errorf("attendee email = %q, want titania@example.com", a.Email)
+ }
+}
+
+func TestPublicSignupAutoMatchAttendee(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ // Pre-existing attendee
+ existing, _ := app.createAttendee(Attendee{Name: "Titania Fairweather", Email: "titania@example.com"})
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Titania",
+ "ticket_name": "Titania Fairweather",
+ "email": "titania@example.com",
+ }))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d", w.Code)
+ }
+
+ vol, _ := app.getVolunteerByEmail("titania@example.com")
+ if vol == nil {
+ t.Fatal("volunteer not created")
+ }
+ if vol.AttendeeID == nil || *vol.AttendeeID != existing.ID {
+ t.Errorf("expected volunteer linked to existing attendee %d, got %v", existing.ID, vol.AttendeeID)
+ }
+}
+
+func TestPublicSignupDuplicateEmail(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ // First signup
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Titania",
+ "email": "titania@example.com",
+ }))
+ if w.Code != 200 {
+ t.Fatalf("first signup: expected 200, got %d", w.Code)
+ }
+
+ // Second signup with same email — should silently succeed
+ w = httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Puck",
+ "email": "titania@example.com",
+ }))
+ if w.Code != 200 {
+ t.Fatalf("duplicate signup: expected 200, got %d", w.Code)
+ }
+ result := parseJSON(t, w)
+ if result["ok"] != true {
+ t.Fatalf("expected ok true for duplicate, got %v", result)
+ }
+
+ // Should still be only one volunteer
+ vols, _ := app.listVolunteers("", nil, "")
+ if len(vols) != 1 {
+ t.Errorf("expected 1 volunteer, got %d", len(vols))
+ }
+}
+
+func TestPublicSignupMissingFields(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ tests := []struct {
+ name string
+ body map[string]any
+ }{
+ {"no name", map[string]any{"email": "a@b.com"}},
+ {"no email", map[string]any{"preferred_name": "Titania"}},
+ {"empty both", map[string]any{}},
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", tt.body))
+ if w.Code != 400 {
+ t.Errorf("expected 400, got %d", w.Code)
+ }
+ })
+ }
+}
+
+func TestPublicSignupNoteRequired(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+ app.db.Exec(`INSERT OR REPLACE INTO config (key, value) VALUES ('volunteer_note_required', 'true')`)
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Titania",
+ "email": "titania@example.com",
+ "note": "",
+ }))
+ if w.Code != 400 {
+ t.Fatalf("expected 400 when note required but empty, got %d", w.Code)
+ }
+
+ // With note provided
+ w = httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/signup", map[string]any{
+ "preferred_name": "Titania",
+ "email": "titania@example.com",
+ "note": "A friend sent me",
+ }))
+ if w.Code != 200 {
+ t.Fatalf("expected 200 with note, got %d: %s", w.Code, w.Body.String())
+ }
+}
+
+func TestConfirmEmail(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ token := "abc123def456"
+ app.createVolunteer(Volunteer{
+ Name: "Titania",
+ PreferredName: "Titania",
+ Email: "titania@example.com",
+ ConfirmationToken: &token,
+ })
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/confirm", map[string]any{"token": token}))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d", w.Code)
+ }
+ result := parseJSON(t, w)
+ if result["status"] != "confirmed" {
+ t.Errorf("expected confirmed, got %v", result["status"])
+ }
+
+ // Verify volunteer is confirmed
+ vol, _ := app.getVolunteerByEmail("titania@example.com")
+ if vol == nil || !vol.EmailConfirmed {
+ t.Error("volunteer should be email confirmed")
+ }
+ if vol.ConfirmationToken != nil {
+ t.Error("confirmation token should be cleared after confirmation")
+ }
+}
+
+func TestConfirmEmailInvalid(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/confirm", map[string]any{"token": "nonexistent"}))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d", w.Code)
+ }
+ result := parseJSON(t, w)
+ if result["status"] != "invalid" {
+ t.Errorf("expected invalid, got %v", result["status"])
+ }
+}
+
+func TestConfirmEmailAlreadyConfirmed(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ token := "abc123def456"
+ app.createVolunteer(Volunteer{
+ Name: "Titania",
+ PreferredName: "Titania",
+ Email: "titania@example.com",
+ ConfirmationToken: &token,
+ })
+
+ // Confirm first time
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/confirm", map[string]any{"token": token}))
+ if parseJSON(t, w)["status"] != "confirmed" {
+ t.Fatal("first confirm should succeed")
+ }
+
+ // Second confirm with same token should be invalid (token cleared)
+ w = httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/confirm", map[string]any{"token": token}))
+ result := parseJSON(t, w)
+ if result["status"] != "invalid" {
+ t.Errorf("expected invalid after token cleared, got %v", result["status"])
+ }
+}
+
+func TestConfirmEmailWithSignupsOpen(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+
+ app.db.Exec(`INSERT OR REPLACE INTO config (key, value) VALUES ('shift_signups_open', 'true')`)
+ app.baseURL = "https://example.com"
+
+ attendee, _ := app.createAttendee(Attendee{Name: "Titania", Email: "titania@example.com"})
+ token := "abc123def456"
+ app.createVolunteer(Volunteer{
+ Name: "Titania",
+ PreferredName: "Titania",
+ Email: "titania@example.com",
+ AttendeeID: &attendee.ID,
+ ConfirmationToken: &token,
+ })
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testRequest("POST", "/api/public/confirm", map[string]any{"token": token}))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d", w.Code)
+ }
+ result := parseJSON(t, w)
+ if result["status"] != "confirmed" {
+ t.Fatalf("expected confirmed, got %v", result["status"])
+ }
+ kioskLink, ok := result["kiosk_link"].(string)
+ if !ok || kioskLink == "" {
+ t.Error("expected kiosk_link when signups are open")
+ }
+
+ // Attendee should now have a kiosk token
+ a, _ := app.getAttendee(attendee.ID)
+ if a.VolunteerToken == nil {
+ t.Error("attendee should have kiosk token after confirm with signups open")
+ }
+}
+
+func TestToggleShiftSignups(t *testing.T) {
+ app := testApp(t)
+ mux := testMux(app)
+ admin := testAdminUser(t, app)
+ tok := testToken(t, app, admin)
+
+ w := httptest.NewRecorder()
+ mux.ServeHTTP(w, testAuthRequest("POST", "/api/settings/shift-signups", map[string]any{"open": true}, tok))
+ if w.Code != 200 {
+ t.Fatalf("expected 200, got %d: %s", w.Code, w.Body.String())
+ }
+ result := parseJSON(t, w)
+ if result["shift_signups_open"] != true {
+ t.Errorf("expected shift_signups_open true, got %v", result)
+ }
+
+ // Check config stored
+ var val string
+ app.db.QueryRow(`SELECT value FROM config WHERE key = 'shift_signups_open'`).Scan(&val)
+ if val != "true" {
+ t.Errorf("config not stored, got %q", val)
+ }
+}
diff --git a/main.go b/main.go
index aca8086..fa05ac6 100644
--- a/main.go
+++ b/main.go
@@ -151,6 +151,13 @@ func (app *App) registerRoutes(mux *http.ServeMux) {
writeJSON(w, map[string]string{"build": buildID})
})
+ mux.HandleFunc("POST /api/settings/shift-signups", auth(app.handleToggleShiftSignups, "admin", "volunteer_lead"))
+
+ // Public endpoints — no JWT required.
+ mux.HandleFunc("GET /api/public/signup-config", app.handlePublicSignupConfig)
+ mux.HandleFunc("POST /api/public/signup", app.handlePublicSignup)
+ mux.HandleFunc("POST /api/public/confirm", app.handleConfirmEmail)
+
// Kiosk — authenticated by volunteer token, no JWT required.
mux.HandleFunc("GET /api/v/{token}", app.handleKioskGet)
mux.HandleFunc("POST /api/v/{token}/shifts/{id}", app.handleKioskClaim)