Backend security, scoped access, and visitor API refactor

[devcavin]

Summary

Implements Sprint 1–3 backend improvements:

• Hardened authorization and site access scope.
• Enforced site-scoped visitor data access for reads and mutations.
• Standardized visitor/profile API response contracts.
• Separated visit responsibilities from visitor profile responsibilities.
• Refactored Visitor to use VisitorProfile as the single source of truth for visitor identity.
• Removed duplicated visitor name/phone data from Visitor.
• Updated visitor registration, lookup, search, and returning-visitor flows.
• Added/updated authorization, scope, and visitor/profile regression tests.
• Added the migration required to normalize existing visitor records.

Result

VisitorProfile owns visitor identity, while Visitor represents an individual visit.

VisitorProfile
  ├── name
  ├── phoneNumber
  └── site

Visitor
  ├── visitorProfile
  ├── site
  ├── zone
  ├── visitorType
  ├── purpose
  ├── visitStatus
  └── check-in/out

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gatelog	Ready	Preview	Aug 20, 2026 10:56am