RC Console is the council’s protected operator service at admin.ihnyc-rc.org. It keeps the current roster, positions, assignments, and service access in D1. It also publishes the council-member data used by the public site and supplies the ownership map used by resident casework.
The Worker still lives under ihnyc-rc-landing/rc-admin/. That repository placement does not make it part of the public website, and it does not make the Pub an RC Console service.
Two access decisions
Cloudflare Access proves who signed in. RC Console decides what that person may do.
flowchart LR OP["Council operator"] --> ACCESS["Cloudflare Access<br/>prove identity"] ACCESS --> CONSOLE["RC Console<br/>person + current assignment"] CONSOLE --> GRANT["Position access map<br/>service role + action"] GRANT -- Allow --> DO["Open area or run action"] GRANT -- Deny or unavailable --> DENY["Deny"]
The RC Console front door uses one static steward rule plus one managed IHNYC Roster Access group. The group is reconciled from current D1 assignments. Operators do not maintain a second council roster in Cloudflare or Notion.
If that front door fails, use Restore access to RC Console.
What the Console owns
| Area | Current behavior |
|---|---|
| People | Stable person_id, names, linked identities, profile fields, and direct access overrides |
| Positions | Current council positions and their service access maps |
| Assignments | A person’s position for a term, including conflict checks |
| Term and handover | Guided term rotation with guarded grant expiry and carry-forward |
| Public council data | Public member feed and publish outbox for the resident website |
| Casework ownership | Current role-to-owner feed used for routing and alerts |
The self-service /me area lets a council member claim an identity and update their own profile. Public headshot upload still depends on a separate publisher path.
Service authorization example
The policy endpoint decides whether a person’s current role includes a requested service action. An integrated service verifies the Access token in its own code, maps the request to an action, asks RC Console, and continues only on an explicit allow: true. An unknown route, missing role, network error, or malformed response is denied, so a new admin endpoint cannot quietly bypass the role model.
House Desk used this path until it became a self-contained product. It now authorizes admin actions locally and no longer calls RC Console. See the House Desk architecture.
Boundaries
| Product or data | Relationship to RC Console |
|---|---|
| Resident Council website | Receives the public member artifact; its editorial content still has separate pipelines |
| House Desk | Independent product with its own roles and grants; no longer uses RC Console for authorization |
| Casework | Reads role owners from RC Console, but keeps its stricter Access boundary |
| Pub | Separate product, roster, permissions, and Access policy; not managed here |
| Other services | Keep their own documented authorization model until they integrate explicitly |
The former Notion role and additional-sector databases are retired as roster sources. Notion is also no longer the staging surface for Programs events or House Updates, both of which moved to Calendar; it still backs Casework.
Sensitive infrastructure role
The Worker’s Cloudflare token can edit Access configuration across the account. The code limits operations to a service registry, requires extra confirmation for sensitive services, and records before/after audits. The source still calls for moving the Worker into its own repository and account service before expanding that role.
Maintainer map
| Source | Responsibility |
|---|---|
ihnyc-rc-landing/rc-admin/src/routes/console.ts | People, positions, assignments, and access-map APIs |
ihnyc-rc-landing/rc-admin/src/derive.ts | D1-native service grant derivation |
ihnyc-rc-landing/rc-admin/src/roster.ts | D1-to-Access roster reconciliation |
ihnyc-rc-landing/rc-admin/src/handover.ts | Term rotation and carry-forward |
ihnyc-rc-landing/rc-admin/src/routes/members.ts | Public member feed |
ihnyc-rc-landing/rc-admin/src/routes/casework.ts | Current role-owner feed |
ihnyc-rc-landing/rc-admin/src/routes/authz.ts | Machine-to-machine policy endpoint |
ihnyc-rc-cal-landing/functions/api/admin/_middleware.ts | Calendar’s identity and authorization boundary |
ihnyc-rc-cal-landing/functions/_lib/route-actions.ts | Calendar route-to-action catalog |