This time with permissions!

api/controllers/tourn/section/mergeRounds.js

@@ -1,3 +1,5 @@
+import { roundCheck } from '../../../helpers/auth.js';
+
 // Merges and unmerges all the rounds in a given timeslot and judge category
 // for unified judge placement.  This method should be more robust than the
 // stash & store method.
@@ -9,6 +11,14 @@ export const mergeTimeslotRounds = {
 		const db = req.db;
 		const roundId = req.params.roundId;
 
+		const permOK = await roundCheck(req, res, roundId);
+		if (!permOK) {
+			res.status(200).json({
+				error   : true,
+				message : `You do not have permission to merge those rounds`,
+			});
+		}
+
 		try {
 			await db.sequelize.query(`
 				update
@@ -59,6 +69,14 @@ export const unmergeTimeslotRounds = {
 		const db = req.db;
 		const roundId = req.params.roundId;
 
+		const permOK = await roundCheck(req, res, roundId);
+		if (!permOK) {
+			res.status(200).json({
+				error   : true,
+				message : `You do not have permission to merge those rounds`,
+			});
+		}
+
 		try {
 			await db.sequelize.query(`
 				update

docker-compose.yml

@@ -5,11 +5,12 @@ services:
     image: indexcards:latest
     restart: always
     ports:
-        - 3000:3000
+        - 9001:3000
     environment:
-      - NODE_ENV=production
+      - NODE_ENV=staging
     volumes:
       - /etc/tabroom/indexcards.config.js:/indexcards/config/config.js:ro
       - /var/log/indexcards:/var/log/indexcards:rw
+      - /var/lib/GeoIP:/var/lib/GeoIP
     extra_hosts:
       - "host.docker.internal:host-gateway"