RC Console is the council’s protected operator service at admin.ihnyc-rc.org. It keeps the current roster, positions, assignments, and service access in D1. It also publishes the council-member data used by the public site and supplies the ownership map used by resident casework.
The Worker still lives under ihnyc-rc-landing/rc-admin/. That repository placement does not make it part of the public website, and it does not make the Pub an RC Console service.
Two access decisions
Cloudflare Access proves who signed in. RC Console decides what that person may do.
flowchart LR OP["Council operator"] --> ACCESS["Cloudflare Access<br/>prove identity"] ACCESS --> CONSOLE["RC Console<br/>person + current assignment"] CONSOLE --> GRANT["Position access map<br/>service role + action"] GRANT -- Allow --> DO["Open area or run action"] GRANT -- Deny or unavailable --> DENY["Deny"]
The RC Console front door uses one static steward rule plus one managed IHNYC Roster Access group. The group is reconciled from current D1 assignments. Operators do not maintain a second council roster in Cloudflare or Notion.
If that front door fails, use Restore access to RC Console.
What the Console owns
| Area | Current behavior |
|---|---|
| People | Stable person_id, names, linked identities, profile fields, and direct access overrides |
| Positions | Current council positions and their service access maps |
| Assignments | A person’s position for a term, including conflict checks |
| Term and handover | Guided term rotation with guarded grant expiry and carry-forward |
| Public council data | Public member feed and publish outbox for the resident website |
| Casework ownership | Current role-to-owner feed used for routing and alerts |
| Calendar authorization | Role-to-action decision for every protected Calendar admin request |
The self-service /me area lets a council member claim an identity and update their own profile. Public headshot upload still depends on a separate publisher path.
Calendar example
When an operator revokes a Calendar subscriber:
- Cloudflare Access admits the signed-in person to the protected Calendar surface.
- Calendar verifies the Access token again in application code.
- Calendar maps the request to
subscriber.revoke. - It asks the RC Console policy service whether that person’s current Calendar role includes that action.
- Calendar continues only when the answer is an explicit
allow: true.
An unknown route, missing role, network error, or malformed response is denied. This is intentional: a new admin endpoint cannot quietly bypass the role model.
Boundaries
| Product or data | Relationship to RC Console |
|---|---|
| Resident Council website | Receives the public member artifact; its editorial content still has separate pipelines |
| Programs Calendar | Uses RC Console for action-level admin authorization |
| Casework | Reads role owners from RC Console, but keeps its stricter Access boundary |
| I-House Pub | Separate product, roster, permissions, and Access policy; not managed here |
| Other services | Keep their own documented authorization model until they integrate explicitly |
The former Notion role and additional-sector databases are retired as roster sources. Notion remains an editorial staging surface for events and House Updates; that is a different job.
Sensitive infrastructure role
The Worker’s Cloudflare token can edit Access configuration across the account. The code limits operations to a service registry, requires extra confirmation for sensitive services, and records before/after audits. The source still calls for moving the Worker into its own repository and account service before expanding that role.
Maintainer map
| Source | Responsibility |
|---|---|
ihnyc-rc-landing/rc-admin/src/routes/console.ts | People, positions, assignments, and access-map APIs |
ihnyc-rc-landing/rc-admin/src/derive.ts | D1-native service grant derivation |
ihnyc-rc-landing/rc-admin/src/roster.ts | D1-to-Access roster reconciliation |
ihnyc-rc-landing/rc-admin/src/handover.ts | Term rotation and carry-forward |
ihnyc-rc-landing/rc-admin/src/routes/members.ts | Public member feed |
ihnyc-rc-landing/rc-admin/src/routes/casework.ts | Current role-owner feed |
ihnyc-rc-landing/rc-admin/src/routes/authz.ts | Machine-to-machine policy endpoint |
ihnyc-rc-cal-landing/functions/api/admin/_middleware.ts | Calendar’s identity and authorization boundary |
ihnyc-rc-cal-landing/functions/_lib/route-actions.ts | Calendar route-to-action catalog |