import type { EventerSession } from "./auth-oidc/types";
function escapeHtml(value: string): string {
return value
.replace(/&/g, "&")
.replace(//g, ">")
.replace(/"/g, """)
.replace(/'/g, "'");
}
// The real submission form -- only reachable past requireOidcSession +
// requireTeamAccess (see server.ts), so username/email are already
// verified identity, not user input. Escaped anyway before going into HTML
// as defense in depth. Plain server-rendered HTML + vanilla JS: no
// framework in this app already, so no reason to add one for one page.
export function renderSubmitPage(session: EventerSession & { teams: string[] }): string {
const username = escapeHtml(session.username);
const email = escapeHtml(session.email ?? `${session.username}@uwaterloo.ca`);
// The actual matched team(s) from the live LDAP check that just ran, not
// a hardcoded assumption -- this used to always say "progcom" regardless
// of what ALLOWED_TEAMS was actually configured to, which is exactly the
// kind of stale/inaccurate status text this project has been burned by
// before.
const teams = escapeHtml(session.teams.join(", "));
return `
EventCentral
EventCentral
Logged in as ${username} (${email}), verified against ${teams} membership.
`;
}