Office Updates

A super admin chooses which feed posts appear on the public Office Updates page on superlabs.co. Nothing is copied: the website reads the same post, with the same photos and video, through the same query the feed uses. Editing, hiding or deleting a post in Super People reaches the website on its next request.

• Route reference: Office Updates API
• Base URLs: http://localhost:3101 local, https://api-peoples.superlabs.co production

StatusesCopy Anchor Link

Every post in the feed carries websiteStatus. It is stored in its own post_website table, one row per reviewed post, and the post table is unchanged. A post with no row is pending.

A deleted or hidden post is never public, whatever its status says.

Editing an approved post sets it back to pending. The edited text is something no reviewer has seen, so the post leaves the website until a super admin approves it again.

DecisionsCopy Anchor Link

Any other move answers 409 with a message saying why. For example, rejecting an approved post is refused with "Unpublish it instead". A deleted, hidden or unknown post answers 404.

Reject and unpublish take an optional reason of up to 500 characters. The last decision, who made it and the reason are recorded on the post and returned by the review routes. They are not part of the feed.

Who can decideCopy Anchor Link

Only a super admin, in one of two ways:

• From Super People. The post's … menu has a superlabs.co website section with two options. While the post is off the website they are Approve for website and Reject for website. Once it is on, they are Approved for website (shown as done) and Remove from website. This uses the super admin's own session. A member gets 403.
• From the superlabs.co admin. That admin's server sends x-website-review-key: <WEBSITE_REVIEW_API_KEY> in place of a session, and names the person clicking in x-reviewer for the audit line.
  • The key is server-to-server only. It must never be sent from a browser.
  • A wrong key answers 401, even if a valid cookie is sent with it.
  • An unset key, or one shorter than 32 characters, turns this path off.

What the website receivesCopy Anchor Link

The public routes need no session:

• GET /api/v1/public/office-updates
• GET /api/v1/public/office-updates/:postId

Both return the narrower OfficeUpdate shape, not Post:

• Content is plain text. Mention tokens are already replaced with names.
• People appear as name, job title and photo only. There are no ids, no email addresses and no roles.
• Media is images and video. Every URL is presigned and lasts about a day, so a page should fetch it on each request and never store it.
• Left out: polls, documents, reactions, comment counts and anything about the viewer. A reviewer sees the parts that will be dropped in notShownPublicly.
• Responses are sent with Cache-Control: public, max-age=60. After an unpublish, the post can therefore stay visible for up to a minute in a cache.