Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

README.md

@@ -20,6 +20,7 @@ two factor.
 | | Guest sign in | Recurring visitor |
 |---|---|---|
 | First and last name | typed each visit | on file |
+| Company or organisation | optional, typed each visit | on file |
 | Person being visited | picked from the list | picked each visit |
 | Photo | taken at the kiosk | on file if saved, otherwise taken at the kiosk |
 | WWCC / VIT / none | typed each visit | on file |
@@ -27,6 +28,11 @@ two factor.
 
 Sign out only needs a **last name** plus a **mobile number or email**, which works for both.
 
+The company field is optional and clearly marked as such — plenty of visitors are not from
+anywhere in particular. When it is filled in it appears on the badge, in the on-site list, on the
+evacuation sheet, and in the visit log, and the log search matches on it, so you can pull up every
+visit from one contractor.
+
 ## Quick start
 
 ```bash
@@ -439,6 +445,24 @@ docker compose up -d --build
 **Changes to the code do nothing** — Compose reuses the existing image. Always
 `docker compose up -d --build` after a `git pull`.
 
+**Google Sheet says "The caller does not have permission"** — the app authenticated fine and
+Google refused the spreadsheet. Work through these in order:
+
+1. **Admin → System** shows the service account address. Open the sheet, press Share, paste that
+   address, set it to **Editor**, and untick "Notify people". This is the cause about nine times
+   in ten.
+2. If your Google Workspace blocks sharing outside the organisation, the share will silently fail
+   or be refused — a service account address is external. Ask your Workspace admin to allow it,
+   or create the sheet in an account that permits external sharing.
+3. If the sheet lives in a **Shared drive**, share the drive with the service account, not just
+   the file.
+4. Check the spreadsheet ID matches the one in the sheet's URL. A wrong ID usually gives a 404,
+   but a valid ID for someone else's sheet gives this same 403.
+5. Confirm the **Google Sheets API** is enabled on the project the key belongs to. A key from
+   project A cannot use an API enabled only on project B.
+
+Press **Test the sheet connection** after each step.
+
 **Browser still warns about the certificate** — the authority is installed but not trusted. On
 iOS that is a second, separate step under Settings → General → About → Certificate Trust
 Settings. On Android, use a hostname rather than a bare IP.