Merge pull request #3 from SGAOperations/fix/calendar-deactivated-email-guard

SGA Space Calendar Rendering & Onboarding Bug Fixes

Author: pataniaeli

app/(dashboard)/layout.tsx

@@ -233,7 +233,7 @@ export default function DashboardLayout({
               <span className="text-[#c8102e] font-bold text-xl tracking-tight">Chambers</span>
             </div>
             <p className="text-slate-500 text-xs mt-0.5">NU Student Gov. Association</p>
-            <p className="text-slate-600 text-xs mt-1">v1.12.0</p>
+            <p className="text-slate-600 text-xs mt-1">v1.12.1</p>
             {userName && (
               <div className="flex items-start justify-between mt-2">
                 <p className="text-slate-500 text-xs italic">{getGreeting()},<br />{userName}</p>

app/(dashboard)/sga-spaces/space-calendar.tsx

@@ -302,10 +302,10 @@ export default function SpaceCalendar({
   const totalHeight = TOTAL_SLOTS * SLOT_HEIGHT
 
   return (
-    <div className="rounded-xl border border-[#1e5080] overflow-hidden bg-[#0a1628] select-none">
+    <div className="rounded-xl border border-[#1e5080] overflow-hidden bg-[#0a1628] select-none isolate">
       <div ref={scrollRef} className="overflow-y-auto" style={{ maxHeight: '648px' }}>
         {/* Sticky day header */}
-        <div ref={headerRef} className="flex border-b border-[#1e5080] sticky top-0 z-10 bg-[#0a1628]">
+        <div ref={headerRef} className="flex border-b border-[#1e5080] sticky top-0 z-[60] bg-[#0a1628]">
           <div className="w-14 flex-shrink-0 border-r border-[#1e5080]" />
           {dayLabels.map((dl, i) => (
             <div

app/api/administrator/users/route.ts

@@ -55,6 +55,20 @@ export async function POST(request: Request) {
 
   const { email, full_name, admin_role, iems_role } = await request.json()
 
+  // Block re-inviting a deactivated account — admin must reactivate instead
+  const { count: deactivatedCount } = await adminSupabase
+    .from('users')
+    .select('id', { count: 'exact', head: true })
+    .eq('email', email.trim().toLowerCase())
+    .eq('is_active', false)
+
+  if (deactivatedCount && deactivatedCount > 0) {
+    return NextResponse.json(
+      { error: 'A deactivated account already exists for this email. Reactivate the account instead of sending a new invite.' },
+      { status: 400 }
+    )
+  }
+
   const otp = randomBytes(8).toString('base64url').slice(0, 12)
   const otpHash = createHash('sha256').update(otp).digest('hex')
   const otpExpiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString()

app/api/onboarding/profile/route.ts

@@ -34,5 +34,11 @@ export async function PATCH(request: Request) {
 
   if (error) return NextResponse.json({ error: error.message }, { status: 500 })
 
+  const { error: metaError } = await adminSupabase.auth.admin.updateUserById(user.id, {
+    user_metadata: { full_name },
+  })
+
+  if (metaError) return NextResponse.json({ error: metaError.message }, { status: 500 })
+
   return NextResponse.json({ success: true })
 }

app/api/signup/request/route.ts

@@ -23,6 +23,20 @@ export async function POST(request: Request) {
 
   const normalizedEmail = email.trim().toLowerCase()
 
+  // Block deactivated accounts — generic message to avoid leaking account status
+  const { count: deactivatedCount } = await adminSupabase
+    .from('users')
+    .select('id', { count: 'exact', head: true })
+    .eq('email', normalizedEmail)
+    .eq('is_active', false)
+
+  if (deactivatedCount && deactivatedCount > 0) {
+    return NextResponse.json(
+      { error: 'This email is not eligible for registration. Please contact an administrator.' },
+      { status: 400 }
+    )
+  }
+
   // Check if a fully set-up account already exists (head-only, no data returned)
   const { count: existingCount } = await adminSupabase
     .from('users')

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "chambers",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "private": true,
   "scripts": {
     "dev": "next dev",