fix student portal showing session expired and pre-cohort dates

The /api/cohorts endpoint requires instructor role, so students calling
getCohorts() got a 403 that triggered the session-expired banner and
prevented cohort dates from loading. Now /api/auth/me returns cohort
dates directly via a JOIN, avoiding the instructor-only endpoint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: dsshimel

attendabot/backend/src/api/routes/me.ts

@@ -18,22 +18,31 @@ meRouter.get("/", authenticateToken, (req: AuthRequest, res: Response) => {
     studentId?: number;
     studentName?: string;
     cohortId?: number;
+    cohortStartDate?: string;
+    cohortEndDate?: string;
   } = {
     role: user.role,
     name: user.username,
     discordAccountId: user.discordAccountId,
   };
 
-  // If student, look up student record by discord_user_id
+  // If student, look up student record and cohort dates
   if (user.role === "student" && user.discordAccountId) {
     const db = getDatabase();
     const student = db
-      .prepare(`SELECT id, name, cohort_id FROM students WHERE discord_user_id = ?`)
-      .get(user.discordAccountId) as { id: number; name: string; cohort_id: number } | undefined;
+      .prepare(`
+        SELECT s.id, s.name, s.cohort_id, c.start_date, c.end_date
+        FROM students s
+        JOIN cohorts c ON s.cohort_id = c.id
+        WHERE s.discord_user_id = ?
+      `)
+      .get(user.discordAccountId) as { id: number; name: string; cohort_id: number; start_date: string | null; end_date: string | null } | undefined;
     if (student) {
       result.studentId = student.id;
       result.studentName = student.name;
       result.cohortId = student.cohort_id;
+      if (student.start_date) result.cohortStartDate = student.start_date;
+      if (student.end_date) result.cohortEndDate = student.end_date;
     }
   }
 

attendabot/frontend/src/App.tsx

@@ -30,17 +30,18 @@ function App() {
   const [impersonating, setImpersonating] = useState<{ discordId: string; name: string; cohortId: number } | null>(null);
   const [impersonateStudents, setImpersonateStudents] = useState<{ discordId: string; name: string; cohortId: number }[]>([]);
   const [cohorts, setCohorts] = useState<Cohort[]>([]);
-  const [studentCohortId, setStudentCohortId] = useState<number | null>(null);
+  const [studentCohortDates, setStudentCohortDates] = useState<{ startDate?: string; endDate?: string }>({});
 
   /** Fetches the user's role and identity after login. */
   const fetchRole = async () => {
     const me = await getMe();
     if (me) {
       setRole(me.role);
-      if (me.role === "student" && me.cohortId) {
-        setStudentCohortId(me.cohortId);
-        const allCohorts = await getCohorts();
-        setCohorts(allCohorts);
+      if (me.role === "student") {
+        setStudentCohortDates({
+          startDate: me.cohortStartDate,
+          endDate: me.cohortEndDate,
+        });
       }
     }
   };
@@ -114,14 +115,13 @@ function App() {
 
   // Student portal
   if (role === "student") {
-    const cohort = cohorts.find((c) => c.id === studentCohortId);
     return (
       <StudentPortal
         username={username}
         sessionInvalid={sessionInvalid}
         onLogout={handleLogout}
-        cohortStartDate={cohort?.startDate ?? undefined}
-        cohortEndDate={cohort?.endDate ?? undefined}
+        cohortStartDate={studentCohortDates.startDate}
+        cohortEndDate={studentCohortDates.endDate}
       />
     );
   }

attendabot/frontend/src/api/client.ts

@@ -966,6 +966,8 @@ export interface MeResponse {
   studentId?: number;
   studentName?: string;
   cohortId?: number;
+  cohortStartDate?: string;
+  cohortEndDate?: string;
 }
 
 /** Fetches the current user's role and identity. */