Sep 15 - Update the check-in pages, employee id field limited to 4 digits/characters

templates/qr_destination.html

@@ -1203,6 +1203,7 @@
               autocomplete="off"
               inputmode="numeric"
               pattern="[0-9]*"
+              maxlength="4"
             />
           </div>
 
@@ -1666,6 +1667,12 @@
         loadOpenCheckInWorkType();
       }
 
+      // Employee IDs are at most 4 digits. Keep in sync with the maxlength on
+      // #employee_id, QR_EMPLOYEE_ID_MAX_DIGITS in qr_destination.js and
+      // CHECKIN_EMPLOYEE_ID_MAX_DIGITS in routes/qr_codes.py. (Distinct names:
+      // both scripts share the page's global scope.)
+      const EMPLOYEE_ID_MAX_DIGITS = 4;
+
       // FIXED Employee ID auto-fill functionality
       function initializeEmployeeIdAutoFill() {
         const employeeIdInput = document.getElementById("employee_id");
@@ -1681,7 +1688,9 @@
             localStorage.getItem("qr_last_employee_id") || ""
           ).replace(/[^0-9]/g, "");
 
-          if (lastEmployeeId !== "") {
+          // A stored ID longer than the limit is not filled in: cutting it
+          // down would silently check in a different employee.
+          if (lastEmployeeId !== "" && lastEmployeeId.length <= EMPLOYEE_ID_MAX_DIGITS) {
             employeeIdInput.value = lastEmployeeId;
 
             // Visual feedback that it's auto-filled
@@ -1702,10 +1711,11 @@
       function attachEmployeeIdListeners(employeeIdInput) {
         if (!employeeIdInput) return;
 
-        // Employee ID is numeric only — strip anything else as it is typed
-        // (covers paste, autofill and keyboards that ignore inputmode).
+        // Employee ID is numeric only, at most 4 digits — strip anything else as
+        // it is typed (covers paste, autofill and keyboards that ignore
+        // inputmode; maxlength alone does not limit values set by script).
         employeeIdInput.addEventListener("input", function () {
-          const digitsOnly = this.value.replace(/[^0-9]/g, "");
+          const digitsOnly = this.value.replace(/[^0-9]/g, "").slice(0, EMPLOYEE_ID_MAX_DIGITS);
           if (this.value !== digitsOnly) {
             this.value = digitsOnly;
           }
@@ -1914,6 +1924,15 @@
           return;
         }
 
+        // Refuse rather than truncate: a cut-down ID is a different employee
+        if (employeeId.length > EMPLOYEE_ID_MAX_DIGITS) {
+          showStatusMessage(
+            "Employee ID must be 4 digits or fewer / El ID de empleado debe tener 4 dígitos o menos",
+            "error"
+          );
+          return;
+        }
+
         // Save Employee ID to localStorage for next time
         try {
           localStorage.setItem("qr_last_employee_id", employeeId);