Re-apply with autofill (and the red confirm gate)

Load last time's answers, then confirm or change every red field before the form will submit.

Owned by Host / Promoter · 8 steps · about 15 minutes

Why this exists

Returning promoters re-apply constantly, and the failure mode is always the same: they copy last year's application, change the date, and leave a stale price or a stale headcount in place. The venue then approves numbers nobody meant, and those numbers get snapshotted into a contract and signed.

So autofill on this platform is deliberately uncomfortable. It is opt-in (you press "I've applied before"), it is verified by a six-digit code emailed to the address you claim, and every value it loads arrives marked, with a From last time chip beside it. The mark does not mean wrong. It means nobody has looked at this yet. You clear it one of two ways: change the value, or switch its Confirmed toggle on. Until every marked field is cleared the submit button will not submit — it reads "Review N highlighted fields".

The part that matters most is invisible in the browser: the gate is enforced on the server. When the autofill session is verified, the exact set of prefilled values is frozen onto the session row, and that frozen snapshot is the source of truth. On submit the server re-canonicalises what you actually sent and compares it, field by field, with the frozen value. Skipping the UI and posting the form directly earns a 422 listing the fields you did not review.

Be precise about which half the server decides, because a reviewer reads the scorecard on the strength of it. Edited is derived: the value you sent differs from the frozen one, and no claim from the browser can create or erase that. Confirmed is a claim — you sent the same value and said you had looked at it — and the server takes it at face value, because there is no other evidence that a person read a field. A client that auto-confirms everything therefore passes the gate having changed nothing. What stops that being invisible is that the two are recorded differently: the audit table says confirmed, not edited, and the reviewer sees which answers were re-affirmed rather than re-typed. So read a screen of confirmations as what it is — an applicant saying "still right" — and not as the platform having checked anything.

Every one of those decisions is written to an audit table, so the reviewer can see on the scorecard which answers you actively re-affirmed and which you changed. That audit trail is the point of the whole feature.

Before you start

  • An earlier application under the same email address (the seed ships three for host@club.test).
  • Access to that mailbox — or, in a demo environment, the recorded outbound mail log.

Practise with

PersonaEmailPasswordNote
host_promoterhost@club.test host123has 'Warehouse Frequencies', 'Analog Sunrise' and 'Neon Circuit Gala' on file to autofill from
venue_managermanager@club.test manager123sees the prefill audit panel on the scorecard
adminadmin@club.test admin123can read the emailed code out of the outbound call log and clear rate limits

Steps 1–6 — Host / Promoter

their manual →
  1. 1
    Open the form, type the email address you applied with last time, and press the button beside it: I've applied before.
    /host/apply intake
    Expected result A code box appears under the email field.
    Watch out for If you were already logged in when you opened the page, autofill has already happened without any code — a logged-in visit creates a pre-verified session automatically. Skip to the red fields.
  2. 2
    Request the code.
    Expected result prefill_available true plus a session id, and a six-digit code emailed to that address.
    Watch out for prefill_available comes back false when no earlier application exists for that email — the platform will not tell a stranger whose address is on file. Limits are 5 per email per hour and 20 per IP per hour, then 429.
  3. 3
    Enter the six digits and press Unlock autofill.
    Expected result Your previous answers drop into the form, a warning banner appears, and every prefilled field is marked, with a 'From last time' chip and a Confirmed toggle beside it.
    Watch out for The code lives 15 minutes and you get 5 attempts. A wrong code is 401 bad_code; an expired or exhausted session is 410 prefill_expired and you start over. Only meaningful values prefill — blanks and unticked flags are dropped rather than carried forward.
  4. 4
    Work every marked field. Change the ones that changed — the date, almost certainly the prices. Switch Confirmed on for the ones that are genuinely still true.
    Expected result The submit button counts down: 'Review 12 highlighted fields', then 11, then 10, and finally 'Submit application' when the count reaches zero.
    Watch out for Three traps. First, editing a field back to exactly the suggested value marks it again — the gate compares values, not keystrokes. Second, the whole tier table is a single field: confirm it with the one 'Tier table confirmed' toggle, not row by row. Third, the bar minimum is confirmed as cents even though you type dollars.
  5. 5
    Submit. The form sends the prefill session id and your confirmations along with the answers.
    Expected result 201 as usual, plus an audit row per prefilled field recording whether it was confirmed or edited, with the old and the new value.
    Watch out for 422 unconfirmed_prefill_fields comes back with error.fields listing the field names you skipped — that is the server gate, and no browser trick avoids it. 410 prefill_session_invalid means the session was already used, was never verified, or is more than 24 hours old: sessions are single-use on purpose.
  6. 6
    Confirm you landed on the thank-you page with a new reference.
    /apply/thanks/{app_id} intake
    Expected result A new application, entirely separate from the one you autofilled from.
    Watch out for Autofill copies values; it does not copy attachments. Re-attach your insurance certificate.

Steps 7 — Venue Manager

their manual →

Reads the prefill audit to see which answers you re-affirmed and which you changed.

  1. 7
    Open the new application and scroll to the prefill audit panel.
    /admin/intake/{app_id} intake
    Expected result A table headed 'Prefill audit (RED-field gate)' with one row per prefilled field: the field, the action (confirmed or edited), the prefilled value and the final value.
    Watch out for A wall of 'confirmed' with an unchanged ticket price on a date twelve months later is exactly the signal this panel exists to give you. Read it before you approve.

Steps 8 — Admin

their manual →

Can recover the emailed code and clear the prefill rate limits when a demo hits them.

  1. 8
    As an admin running a training session, inspect the prefill and submission counters when a room full of trainees starts hitting 429.
    Expected result The fixed-window counters keyed by email and IP.
    Watch out for Clear them with the sibling endpoint /debug/intake/clear-rate-limits. Debug routes are admin-only and the whole tree 404s when debug endpoints are disabled, so this is a training and demo tool, not a production escape hatch.