INSIDE THE PANEL

One place for the whole club

Events, payments, applications and team tasks used to live in group chats and spreadsheets, so every screening night depended on a few people remembering everything. The brief: one place the whole club can run from, safe enough to trust with money and personal details.

Live numbers

Signing in opens on the day’s call sheet. Management sees the cash balance, payments waiting for approval, new applications and the next event at a glance, with their own open tasks and the latest announcements below.

Menu by role

The menu changes with the role: a crew member sees 4 sections, management 9 and the executive board all 11. Hiding a link is only a convenience. Every page checks the role again on the server, and the database enforces it too.

Published from the panel

An event starts as a draft in the panel: poster, date, venue, capacity and price. Publishing gives it its own page on the club site, and the team opens registration when they’re ready.

Sign-up, checked on the server

Students reserve a seat right on the page. The form is validated on the server, rate-limited and set with a trap for bots, and seats are counted under a database lock, so a sold-out night can’t be oversold.

One screen per event

Every event gets its own control room: seats confirmed against capacity, payments still waiting, who has checked in and ticket revenue so far.

Approve payment

Paid by bank transfer? One click confirms it. The ticket email goes out on its own and the income is booked in the cash ledger exactly once. Cancel a registration and its income is voided automatically.

Private ticket page

Each registrant gets a ticket page at an unguessable address, with a QR code. Bank details for paying appear only here, never on a public page, and the page is kept out of search engines and caches.

Door check-in

On the night, the door team opens the event on a phone and scans tickets with the camera. A valid ticket checks in instantly, a ticket that’s already been used is flagged with the time it was scanned, and a code field covers the moments the camera won’t cooperate.

Attendee list

The attendee list exports to a spreadsheet for the venue or the university office.

Balance, income, spend

Every lira in and out goes into one ledger, sorted into tickets, sponsorship, equipment, venue, printing and more. The balance and totals update as entries go in.

Voided, never deleted

Entries can’t be edited or deleted, not even by the board. A mistake is voided and entered again, so the history stays honest and anyone on the management team can follow it.

Export for reports

The whole ledger exports to a spreadsheet when the treasurer needs to report to the university.

Tasks by team

Tasks go to people and teams with due dates, and move from to-do to “on set” to done. Everyone finds their own open tasks on the overview the moment they sign in.

Public or crew only

Announcements either go public, straight onto the club homepage, or stay inside the crew. Important ones can be pinned and carry an image.

Reply in place

Membership applications and messages from the site’s join form land in one inbox. The team moves each one from new to accepted, keeps private notes and replies by email without leaving the panel.

Invite-only accounts

There’s no public sign-up. The executive board opens accounts from the panel and new members set their own password from a one-time email link. Roles change in one place, and people who leave are switched off, not deleted.

Two-step sign-in

Every account can add authenticator-app sign-in. Once it’s on, the database itself refuses any session that hasn’t passed the second step, so a stolen password alone gets nowhere.

Audit log

Changes to accounts, events, payment details, registrations, the ledger and applications are recorded by the database itself, with contact details left out. Only the executive board can read the log.

Tested like an attacker

Before any database change ships, an automated test builds the schema in memory and tries to break the rules as five different visitors: anonymous, a self-registered stranger, a crew member, management and the executive board.

Films and credits

The club’s short films are run from here too: video link, poster, synopsis and full cast and crew credits. Publish one and it appears on the public site; feature one and it leads the homepage. No code, no developer needed.