VITE_BASE_API_URL with a localhost:3001/api fallback was re-derived in six
files across libs/api, libs/auth, the portal and the backoffice — and a seventh
site (UserManagementPage) read the env raw with no fallback at all, handing the
IAM user-management app an undefined apiUrl whenever no .env was present.
BASE_API_URL in base-query-with-reauth.ts is now the single definition,
exported from @ema-platform/api; every other site imports it. Trims the env
value and treats blank as unset, matching how the backend reads its own keys.
Submitting from Basic Info complained that required fields on the Settings
tab were empty — a correct error the user could not act on, since Settings
had not been shown yet.
The primary action now reads "Next" while Basic Info is open and validates
only that tab before moving on; Create/Update appears on Settings, the final
step, alongside a Back button. Submit still checks both tabs, since the tab
headers stay clickable and a user can reach Settings without going through
Next.
The Fayda redirect URI registered for local testing is
http://localhost:3000/callback, matched exactly by the provider, so the portal
has to be the thing listening there. Its dev and preview servers move from 4200
to 3000 and the API moves to 3001.
Every hardcoded fallback to http://localhost:3000/api follows — six copies of
the same default across libs/api, libs/auth, the portal and the backoffice —
otherwise a developer without a .env would have had the app calling itself.
e2e is unaffected: it binds its own ports (3011/4302/4303) explicitly.
README.md line 72 says `cp .env.example .env`, but no such file existed and
.gitignore's `.env.*` rule would have swallowed it — hence the explicit
negation alongside it.
Documents the two variables the code actually reads, VITE_BASE_API_URL and
VITE_USE_MOCKS, rather than the longer list in the README, none of which is
referenced anywhere in apps/ or libs/. Notes that Vite resolves this from the
workspace root via envDir, and that Fayda needs nothing here beyond the callback
path matching the API's FAYDA_REDIRECT_URI.
Fayda matches the registered redirect URI exactly, and the value being
registered first is a bare /callback. The descriptive path stays so the route
still reads as part of signup once that can be changed.
Follows the API back to a single endpoint. The page posts { action: 'start' }
to open the attempt, the callback page posts { action: 'verify', ... } to get
the verified identity, and the existing signup submission is unchanged.
Drops the post-signup link call: there is no longer a link endpoint, and the
account is created by the signup endpoint that already owns user creation.
Adds "Continue with Fayda" to the existing signup page. It is an alternative
way to fill the form, not a second signup: the applicant still submits to
/auth/signup-with-pwd through the same schema, the same validation and the same
redirect to OTP verification, and signing up without Fayda is unchanged.
The page asks the API for an authorization URL, keeps the returned handle and
state in sessionStorage for the round trip, and FaydaCallbackPage hands the
code back to /auth/fayda/callback. No Fayda protocol logic lives here — the
PKCE verifier, the client key and the token exchange stay on the server. Once
the account exists the page posts the verification token to /auth/fayda/link so
the identity is recorded against it; that call is best-effort, since the
account is already usable without it.
Prefilled fields carry a "From Fayda" badge and stay editable, and a value
that already belongs to another account is badged as such so the applicant can
see which one to change rather than reading a single opaque signup error.
Cancellation, an expired session, a mismatched state and an incomplete callback
each get their own message.
Amharic strings are a first pass and want a native speaker's review.
The detail page fired assign/draw requests blind and surfaced the raw
backend key to the user — a locked paper showed up as the literal string
"paper_locked_after_registration" in a toast.
Manage Questions is now disabled once any candidate has registered, with a
tooltip and badge explaining why; both the manual assign and the random draw
live behind that modal, so one guard covers the same ground the backend's
assertPaperEditable does. The empty-paper alert now explains the deadlock
instead of telling the user to click a button that will fail, and both
error handlers translate paper_locked_after_registration in case someone
registers while the modal is open.
Registrations come from the query ExamCandidatesPanel already runs on this
page, so RTK Query serves it from cache rather than issuing a second request.
Wires useGetGradingSheetQuery into the grading modal: a new 'Candidate's
Answer' column shows the selected option or essay text per question, and
whichever CHOICE scores auto-grading could already compute get prefilled
into the score inputs (tagged 'Auto-graded', still editable — the examiner
can override). Grading a mixed or ESSAY paper no longer means guessing at
what was answered or re-deriving the CHOICE portion by eye.
Degrades to blank inputs exactly as before for an OFFLINE candidate or one
who hasn't sat an online attempt (gradingSheet returns empty answers for
those, not an error).
Frontend half of the backend change: ExamPage no longer disables the
form Select or force-resets it to CHOICE when administrationMethod is
ONLINE (backend's assertOnlineIsChoiceOnly is gone, matching gate
removed here). Also wires up GET .../grading-sheet as
useGetGradingSheetQuery — RecordResultModal wiring (show candidate
answers, prefill auto-computed CHOICE scores) is next.
eligibleQuestions filtered by q.form === exam.form, which matched the
backend's own restriction (assertUsable) only for ONLINE exams. Once
exam.form gained the "BOTH" value for OFFLINE mixed papers, no question
ever has form "BOTH", so the picker silently emptied out or, for a
plain CHOICE-form exam, looked CHOICE-only regardless of administration
method. Now mirrors the backend: CHOICE-only gate applies only when
administrationMethod is ONLINE.
