diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 00000000..f18a7045
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,71 @@
+# =========================================
+# Docker Build Context Ignore File
+# =========================================
+# This file is at the project root because Docker builds
+# use the root as the build context
+
+# Git
+.git
+.github
+.gitignore
+
+# All node_modules (will be installed fresh in Docker)
+node_modules
+**/node_modules
+
+# Build outputs (rebuilt in Docker)
+.next
+**/.next
+**/dist
+**/.turbo
+.turbo
+
+# Environment files (injected at runtime)
+.env
+.env.*
+!.env.example
+sites/**/.env*
+
+# Logs and temp files
+*.log
+.cache
+**/.cache
+
+# Firebase (not needed for Cloud Run)
+firebase-functions
+.firebase
+.firebaserc
+firebase.json
+
+# IDE
+.vscode
+.idea
+**/.vscode
+**/.idea
+
+# Testing and coverage
+coverage
+.nyc_output
+**/coverage
+
+# OS files
+.DS_Store
+Thumbs.db
+**/.DS_Store
+**/Thumbs.db
+
+# Documentation
+*.md
+!README.md
+
+# Lock files are needed for reproducible builds
+# !pnpm-lock.yaml
+
+# Other sites we don't need (still copied for workspace resolution, but not used)
+# sites/mainweb
+
+# Build artifacts
+build_*.log
+build_*.txt
+firebase_logs.txt
+nul
diff --git a/.firebase/hosting.c2l0ZXNcaGFja2x5dGljczIwMjZcb3V0.cache b/.firebase/hosting.c2l0ZXNcaGFja2x5dGljczIwMjZcb3V0.cache
new file mode 100644
index 00000000..52767c36
--- /dev/null
+++ b/.firebase/hosting.c2l0ZXNcaGFja2x5dGljczIwMjZcb3V0.cache
@@ -0,0 +1,111 @@
+__next.__PAGE__.txt,1772665222160,81f7074bccac06172ffb145881413b1f3fe39c5a057394a6df078441a48065c1
+__next._index.txt,1772665222161,71a0f44696c39ba58a8016c0b2290bf7808a47066ee91121418bfbf548fa9736
+__next._head.txt,1772665222161,eabbada92a13c93e9fb3457cc286f98d95e0374fbec711695c6cb0036306c59c
+__next._tree.txt,1772665222159,0ab25485370c78be7a871932fac3ebc2d76d2a48c2aa42d2f84391f1fb9bf979
+__next._full.txt,1772665222160,13fa3cf33232828e14948a337a7cc1a65bc19209637fbd3eb5088dec1d7270c8
+_not-found.txt,1772665222162,cd1f9b6d636227751cf424e2374ca52c660dad0eb9ca3d3a52c9b6f9c97b996c
+vercel.svg,1767899851759,529a1a21b4a82475a82db26173c28d7b27e2dc9d4b900eaf1c5329d96eea4ddd
+window.svg,1767899851780,6bd2003bd35bb32c1c0d99ab3aeac0cc1edaefd79f27df1d954bc87184048d74
+instagram-logo.svg,1767899851227,ea31a3cccb8118ab07e8e6826bc31775edd6958f1a503c8a47516ea0963e7a73
+_not-found.html,1772665222162,a6ac54196e5f67dd0561701c14402966c0256dc944e897b1d550e297f8f72d00
+next.svg,1767899851522,0665b9ab4493aa9d7e988b57024e28772ae543e804b8cf6b0a3633854b7c3c7f
+globe.svg,1767899851173,bb12455e97f1a6e032fb3d0c3dec4f6c6009f84dc81359819d96147d957b38d2
+file.svg,1767899851116,5a09df6187e21aa9a7d05094389385876ac93c818e1dcbb77a26a8fe408bf79c
+index.html,1772665222163,816413df2a64aefce0b3158fb013cf56060d6bb16b112e125b71540f6a94253a
+_not-found/__next._not-found.txt,1772665222158,022161998f07a54cd43dacb23118c206f6b70a90b2afa15691f560043f77bcc0
+index.txt,1772665222163,13fa3cf33232828e14948a337a7cc1a65bc19209637fbd3eb5088dec1d7270c8
+404.html,1772665222162,a6ac54196e5f67dd0561701c14402966c0256dc944e897b1d550e297f8f72d00
+_not-found/__next._tree.txt,1772665222156,f463a3a13f03fc3438ab07f5d46153291d5ac0bba7498a85fd0615e16b7d6250
+_not-found/__next._index.txt,1772665222158,71a0f44696c39ba58a8016c0b2290bf7808a47066ee91121418bfbf548fa9736
+_not-found/__next._head.txt,1772665222158,f496675d49d20d287027cfdaa88a93b0af721f3aa7722c93dbc6f50d4bcd1f44
+favicon.ico,1772665222095,aff1e4b40684df79a071d5d3d37945f7038c10732c7fdf6f91ef941fe0a169e8
+browser.svg,1767899850596,f4e3b97c508038af58cce4ab1b3943d3f4e75fee0d4abdd78056abc55b416c9d
+_not-found/__next._full.txt,1772665222158,cd1f9b6d636227751cf424e2374ca52c660dad0eb9ca3d3a52c9b6f9c97b996c
+_not-found/__next._not-found/__PAGE__.txt,1772665222158,a64c279ee7e4a6574733c4e1927e2c96812dbc5da5d5720c9db2715db4981f1c
+_next/static/media/fe48c93add1d142c-s.5dae4d58.woff2,1772665209922,172de3158a758672853066273acc7a9f9556da457e83d8c87cd5fc3623ab2723
+_next/static/media/f53f4557ddd9f7a6-s.cc1c4de3.woff2,1772665209934,124fec65f38ce992a918c92ff9c85dbeb8d76098a8c2ab4a06a46c97f29a58fc
+_next/static/media/e532fa1b9921e1cd-s.764b43eb.woff2,1772665209932,1bfa7f2c2ec8bd0d99acf712065469f99dbf6e16da39e8fe0752ddf6de413504
+_next/static/media/e390973e931a41c5-s.a82ecf4e.woff2,1772665209919,f8cc2a1058d08525f606de631b032001b74ceb8ffcd45518fdbcd8d8ed802996
+_next/static/media/a7e15459c1805da0-s.p.ec654d65.woff2,1772665209920,33963a3f29d80ccb303f467afb558534f267e9b1c16ef53d146c7089f26409d9
+_next/static/media/99e609270109b47d-s.p.64b9304e.woff2,1772665209930,5351dd9482cd8185dcd6ebd623d36bdd2451183738aa52d706b28affb167301b
+_next/static/media/favicon.46e69e6a.ico,1772665209945,aff1e4b40684df79a071d5d3d37945f7038c10732c7fdf6f91ef941fe0a169e8
+_next/static/media/59b15b4bcd7b1eb5-s.afa48be3.woff2,1772665209920,ee538d9b11e61195e44880065a6e46296f05c5e6d8b25d19c37214c1113cba8d
+_next/static/media/5256dd17dd2ccf14-s.dad649ff.woff2,1772665209924,fd78be40fa367b8f3987988b02063b16634104c738d8e80376f9ac6ae0a2f8ee
+_next/static/media/5689d89b20a4bd5b-s.4a78f533.woff2,1772665209922,bc8cad2c372a529d1efad94fe6f29f6edcaf6a96d6f396f1632058dfcb266565
+_next/static/media/2fe89d53234c61d4-s.cb53f04b.woff2,1772665209935,65f860034cae22bcbc56421abdf918957c91ee2975d0ef27a6705fd73a40433f
+_next/static/media/2426286345ee5571-s.1dc9f477.woff2,1772665209922,e1e3156ba66d6d9e2a8661801b9ce8827572b127b4eafbf7313c7110f4b54da8
+_next/static/media/2d10be662e2c0e5b-s.e2965de0.woff2,1772665209951,4ec48ca25d1c818fc1849c8fbdc8a8858b4b55edb8cdbb333a3e0c35dc38beaf
+_next/static/chunks/turbopack-3d27f3254ac6c775.js,1772665209939,f51fe246a4c9eaba8f6c2a3ade5da84b5dd7bdb84d7c490623abbb72526451d1
+_next/static/chunks/e8ea24193581b95f.css,1772665209962,02e8c0b3393fff680a9a54eb27b341e8d47bc56630920bb22b366fc3ee8d46a8
+_next/static/media/c7f42e8cc19ad0d6-s.f2f29569.woff2,1772665209922,b7bd5fe268d132079f1a8cfcf2b1ae261bf4573afe186e6a987ecf05fa53d6fd
+_next/static/media/ed54c5e5b7b70394-s.p.f46527ae.woff2,1772665209933,f84a048cd63442434d63852616ede86031928ad1ade19e480f906c5aead090f5
+_next/static/media/8704798d174a5cce-s.62086597.woff2,1772665209948,6efb00c3f52720ab022e63efa7f8775fef06c347d5d1c0e4610705f0eb67c5a5
+_next/static/media/7add437e48a3b98b-s.6e098937.woff2,1772665209917,6cc8e98078a85cf098fc1e0bb0b97168ed998abf3faf1ea0cae103be2554eb88
+_next/static/media/7629422a107fe8ce-s.p.5b18aa9b.woff2,1772665209924,eefc4f5733e28fda0e0f0a3614611670812de8aeb6683a612ed98550a6f5b48b
+logo.png,1767899851274,e9bdf6747978e426c16bd207793a493427b1b7902ac87af972869b42f2f39b6a
+_next/static/chunks/fe7cfc6e60ea45fd.js,1772665209945,f1a6b5ad503c9fe5863de73c044d1e77b17150ba6df436c80fde3a8bde445423
+_next/static/media/782e11691ef3ac99-s.3d0acae4.woff2,1772665209920,ad0a7dc49915833d5615db72d58ae6ddb450ff81bf90eacc79b5ecfe49acb4be
+_next/static/media/8d54c7e36a650870-s.p.bfa600e1.woff2,1772665209940,3020f191c2d2d8af7fe67d6e6b58da40869a929940d304f25f9722662394079e
+_next/static/chunks/b15913acaf4899ea.js,1772665209937,03059fe717c7002300d2338062959e0cce74a4daea753bf929de91d5b6c62a2f
+_next/static/chunks/8def456f388a1813.js,1772665209939,299d5c655ec813d952cbdab9b0afe5beb11452d93a6a6d3ef30d94cebfa539e5
+_next/static/chunks/7f5e3d872d6f0089.js,1772665209952,77e83508300772741c41ec79c53cb34e7e45a3409f064042994084d299c52c19
+_next/static/chunks/51e4550e998b0b2e.js,1772665209963,4c9ef2c88a9004eacc5873b859ead636d963d768da9a17c803af792b43e8d349
+_next/static/BSl1n3g-n5aeBO5szvCmP/_ssgManifest.js,1772665222264,dc28a4dc92fe352ed5d2201bd3972ce47691bc8e89e0400a68d1541d0567c6d5
+_next/static/chunks/a6063c961584c49d.css,1772665209942,5d75c405b453166d85bbd4176ac95e8e548a353046c03a8fe17eedf211d76471
+_next/static/BSl1n3g-n5aeBO5szvCmP/_clientMiddlewareManifest.json,1772665210087,61663fde99b3394d71653f41c19fe91269442622a4a6695f8352a70fbf5ca4c1
+_next/static/BSl1n3g-n5aeBO5szvCmP/_buildManifest.js,1772665210072,dcbe1c9b9159ca21caea98e1bad364012ae284e9551375ca62b83d2811efac91
+wonka/hi.txt,1767899851817,79b5adffe03ca5fa42190139e50336910f67c5316bc38db69473e728b3b4696f
+sponsors/Silver_SphinxAI.svg,1769116215657,6d6e76d35434f36b6d3241b28effb4b7f1af1ea726c8a63f76de34afd0265b15
+sponsors/silver_growthfactor.svg,1769116215664,a1f0a9d34fb4a9d81252ec27a5a85eb649b1c1b5d3d57bd9c24316ee426e39c6
+sponsors/MiniTier_Tractian.svg,1769116215653,5904197d19aa523d556446abfbaef68824df812bf433e96f8ad7ea10e5322cd6
+sponsors/MiniTier_SafetyKit.svg,1769116215653,529c26b31f4c2111d31f10e4b08c74f22b621be52ae4c292e9bfece45b93f8e4
+sponsors/bronze_figma.svg,1769116215660,20de91ede116cbfaadcd6467653bbaa4981c1a2f4d9f1b555a17e5625cd7e871
+sponsors/MiniTier_Cox.png,1770329152044,3dc1b03f27fb208a1e28b9473e5c790cc3e0576252cc2743cc8cb3f489f86218
+small-candy/pink.png,1767899851592,9ce33c90eb618386bc329821b6678ee2619b2a69b53cd292d05a29082dbb460e
+small-candy/yellow.png,1767899851610,2799ac5b91d9e70e82a21803ad01d3c3105e64c8ae1f6aa4d420f923eaaf3736
+small-candy/blue.png,1767899851552,001a1549b5442e4a54fe56dbc32f60ee421ca2a39a23d5a118b83cc23c9fcea7
+small-candy/green.png,1767899851569,3ef5aaf9f42545397d949b905d08e4288cb564e995fe96c010bfd03d312872fa
+tickets/silver.png,1767899851739,117fabef940c124b234ab7283f0df04556bf3ea5beafc3b1b144d48528d1981e
+tickets/gold.png,1767899851707,4ba03dcd7fa1dbe200f18da90ca3a64626d275e2667b0a59bbbe4b3564a7d0bc
+sponsors/silver_assurant.png,1769116215664,7bf77c81c181205be1a124d0311bf67309659957783574f60d2145fd63c6cf75
+tickets/bronze.png,1767899851661,f21a9640e7239d1c6a762f6b2e2be9d51264d5f5a66b74a405617b2d00192578
+sponsors/MiniTier_NLP.png,1770839962246,59fadf9230ba50d69c64375c207b125710dfbef9ade05aed7821897116b899c2
+sponsors/gold_databricks.png,1769116215661,0734acfd6c423230c87ac3d4c11835eafb9c88b336c27ce96fc0ff3c4642b309
+sponsors/gold_intuit.png,1770329112714,53f073fc00556dec40a6f4cc2b70e37f8e42346dabe62966cabc55d721fa349c
+sponsors/bronze_scale.png,1770329130151,08afeeb07b8004d17c08e7e871517a71473a3702a6671a9169d0a14f5d9c05ff
+sponsors/bronze_actian.png,1770839963049,117502fb5e0c27f9b0eb11e246d3c8ecfd62bbb7467ed15ef3f31e4a6d4ff3ff
+prizes/owala.jpg,1770840022506,3183879baed28b27e4321b01ada6dd324c7420810bcbb543d7279c84f4cb03df
+_next/static/chunks/57982883399a5d63.js,1772665209933,68a521f2b972e77ed82efec9836820fa1e6f2b72a218003cec103958d0ee4da0
+_next/static/chunks/21e807be38db0b14.js,1772665209958,104663db7459284aba40a3592359777c69887a68be19c45584fd6f82baa783bb
+sponsors/bronze_deshaw.png,1769116215658,74d656991e139adf4456fb451bb0b26ec53bfa9d3bca7206c5d4b57071369809
+prizes/turntable-new.jpg,1770252055694,891ce606383ba68a1e781c1bfd501457a51c0e0f3e99ff9ca03fcabb387eeafa
+sponsors/bronze_att.png,1769116292035,beb2eb81fb279a6fc64468e17a7e6dc302dc421cfef585808155fd66b147e4fd
+prizes/theragun-mini.jpg,1770251588562,6603bab6221165c6e6299d27494ac491230c0eb3111b43fcc127d5f509685757
+_next/static/chunks/a6dad97d9634a72d.js,1772665209944,18e28d3214eda45048d80d3925ea7627b809e69ad2e95f7f98459e9146a61c3d
+prizes/samsung-monitor.jpg,1770840022375,825b789d21422c00c284fba0d3e6b4b528732426b592fc3681c6b34b07d5c0b7
+cloud-main/smallCloud.png,1767899850976,b619905547bfd729a6b2c008695dcbc9c6d8ddcd90fbdf244cb086ca445d425b
+cloud-main/midCloud.png,1767899850920,4929c84fe143c7143d276f6112f8d012e1c2ea5a2d2f5b9f55be629960376f89
+cloud-main/largecloud.png,1767899850894,0187c8fa65328245ee81bb97bea69c6cc74721e62849e512734d0441fd14694b
+prizes/ninja-creami.jpg,1770840022406,e3f7f59786bce00728adb2fd47eafe145a50444489dd00bef6f17f6fbf906298
+prizes/projector-new.jpg,1770252055698,5bf704ba3b9fb253c0888f574f61bf0036d24583f3ffc68b7c15ba1b1aa86c0c
+prizes/nespresso-new.jpg,1770251588577,0806eaee73be7a4d112cd2876b586136d4049ce1486e7d7d02ea88b0a9099d97
+prizes/fitbit.jpg,1770840022471,0b51d4204df7861e8e5dc7007f4ea97ae426c4fe699b3cfc4194be7b54378394
+prizes/apple-watch.jpg,1770840022438,286282bd97bd907664492db04e51619dd339fe4ad3151be3c28eb691f9943dcb
+fonts/Willywonka.ttf,1767899851148,e5a1962f6d4dbe49207747cb5ed88b95c669900f459c478434c2ea1e6443e2c4
+cloud-main/DSGTCloud.png,1767899850787,e09f3df5b98a2606e4d56d904319f76078d186bb9bb50bef4ed8d83aea6f3ffe
+cloud-main/dateCloud.png,1767899850871,34a861a111eea4eb66667cf90b358ab3a97d4bd5207cb4aa763de70f80dec610
+cloud-main/cloudBottom.png,1767899850859,f027b3fea74bb2cc0e1443b0b6494537e80728f618b32f8458487f33547983a5
+cloud-color/cloudy/cloud-button.png,1767899850687,38f07666febeac8353bc5d829fd5076b4cad2014b03c6593ed8484e8fe10b3a3
+wonka/wonka.jpg,1770840022539,e4fccaa75fcecd55aa746916aca9adef9e578212ad10bfe9163da3e7a75f73f4
+sponsors/MiniTier_X.png,1770839963966,c0e6a9ac755ca1b7e84d7979406fd13532c18b856fe7fb7bb05191dfb5aabb97
+_next/static/chunks/f48c00b350bb3d05.js,1772665209930,a50ff5a6178fe5b20cb16bb07296fbee92ebc1fa97f8edde37deea0ea6679796
+cloud-color/cloudb/cloud-blue-down.png,1767899850657,f0e707517b534677e1a4e74d8f6b761891ce66b41e775c247d3da0a54f2f1405
+dsgt.png,1770839963890,bd930688f02c61b67ca4bef339fdbe257ff06e6cada7a3e58a1569731336105f
+cloud-end/cloudEnd.png,1767899850729,7ec7d4602c952cd5ffe1d47566a81be378e34c2799b6e5397f95b0448227bd18
+cloud-final/image.png,1767899850756,773fe5fed686393bfa8f66545aed677d76db936a599d0e4b0a46144e21f7424a
+prizes/pickleball-backpack.jpg,1770251588570,be83f86c18853d626ba5ef50194d5507baef673dfa7c7f68b4d7e1c9f20805c6
+prizes/poker-set-new.jpg,1770251588571,1a8185ef73b30b6a50d494b4a95d2ee073edbc706188c5916445ce1cfa09e78e
+mid-candy/medium.png,1767899851514,80cabc116b6bc58c4446fd4eb012b1c147b684974d0f9e1414b1e7e5f0942dcc
+prizes/karaoke-new.jpg,1770252055693,b14a63d018e2c76e9b0d49b98a76020f56022dc0175804e94c2f27dd82abbda8
+cloud-main/candy/candyEnd.png,1767899850846,2a4f89840a392592ae4ef789e9063f0191e809fd66cbca6b0042d455845f094c
+prizes/jbl-flip.jpg,1770839602435,79fb892cc062c774443a629ed9d7cc737be16232217cd2bfbcf8c3f078e8d42b
diff --git a/.firebase/hosting.c2l0ZXNcanVkZ2luZ1xwdWJsaWM.cache b/.firebase/hosting.c2l0ZXNcanVkZ2luZ1xwdWJsaWM.cache
new file mode 100644
index 00000000..f57067f4
--- /dev/null
+++ b/.firebase/hosting.c2l0ZXNcanVkZ2luZ1xwdWJsaWM.cache
@@ -0,0 +1,25 @@
+images/logos/shepcenter.jpeg,1767556163025,a57a0bf31aabaab7285fcfdb7637bf513c40bc29ec5e82fd79468d741d37f127
+images/logos/storm.png,1767556163185,49090aaf8b26eac91881de46e7c90d9eda8228af55f40b1a46f1bc0f969f2966
+images/logos/birdclef.png,1767556162911,463d632fcd787259c8aceb0f8ad53c89414eacd776b8b566e4fe1bcee70072da
+images/logos/blueconduit.png,1767556162930,726e598bbc52b99c907087d2ddced839c61df4ab32bf95d5aa00cccd3bfd140a
+images/dsgt/sports_icon.png,1767556162796,aee29d6323a3222c9393642dfd1a6b61b23890ffba2bbe484a3b3876c56615ef
+images/dsgt/financial_icon.png,1767556162685,560a6e3ba0ab30fea54596721cf16acb68c6410aeaa42e285a7cd3c8bcae72de
+images/dsgt/favicon-16x16.png,1767556162630,96e40605151630d7b4ef81deb967a1175580f4bb9c5fb332960c92af95efcc9a
+images/dsgt/favicon-32x32.png,1767556162650,1c59159f4c69cb8812c8e0b6963252b011a634f2613024785f340890175b68e0
+images/dsgt/Icon-128.png,1767556162546,b7909633f01379164dde11e53e42af2d12f7ad104762e36ebb5c8e05af0707f6
+images/dsgt/favicon.ico,1767556162666,9960c28b7d6ac352cf1ba11369584c8247271cb77e217561c647620d67872eea
+images/dsgt/Icon-196.png,1767556162563,d785daa440354422616e9889f35616604710e9dd70313c6915b06fdd630b5b5a
+images/dsgt/heathcare_icon.png,1767556162703,b6af8ce1284fff38bca3f01dc825bd6ec20923910b4f5ac1298e1096bb0bb236
+images/dsgt/apple-touch-icon.png,1767556162607,d60615679e857bfba6b5e33b60dd6b92f06af5a1b51c1ecb18aac24efec1e51d
+images/dsgt/logo20.ico,1767556162724,11235ade4b9531c843a4c099f92e7d282ba0b3e2d70c5761b84d9ef057620871
+images/logos/gtaa.png,1767556163001,615cfea20fb380d6528b2a63fab185030efc89273855b1f3202f4a301b45ceba
+images/logos/Mentra.png,1767556162851,69597ac2d91b8290d657c207b49b1a322c6066b020e1ae41f6127264c81eeaee
+images/dsgt/Icon-512.png,1767556162586,54e168ed5dcdc6fdc61bbac8c99342f016c185708d8d04efe3f0b063fb691315
+images/dsgt/logos-20.ico,1767556162747,f283f6e06664b8a6710adb6f120c5b6a7bfd7967b95ca2205c3376a51641f852
+images/logos/furnichanter.png,1767556162972,156f59d5d1dfd47a3d57212c16846f3ce0848e7268dabba3971873f685d2caf0
+images/dsgt/square-logo.png,1767556162820,5af85cd153427f89d01c1109e64d5110163bf32b6d199ea1817bd41048d106ed
+images/logos/arc-logo-v3.png,1767556162894,7d0f48acde15ea2c9dd41653ddc8a52e2b0937df99fd0f501edec6686acb9e68
+images/dsgt/logos-20.png,1767556162775,233de3c083e7fff89c44d462e56e0a813dc878b29b0329d141ebd5dc27398896
+images/logos/dlp4.png,1767556162950,14e1e01f0d3436e9c13f64f400c16d6fb52471bdb2dfccaf7bcd7acc1f579cc3
+images/logos/stock.png,1767556163164,305debac9897de35133db980e481ed646355f3af8c84aa111e5e78e12d9edee4
+images/logos/trading.png,1767556163597,187df50fb7e40b3e7c7d1a0c9b678b588a11a90c6415265cb326f284a0a75764
diff --git a/.firebase/hosting.c2l0ZXNcbWFpbndlYlxvdXQ.cache b/.firebase/hosting.c2l0ZXNcbWFpbndlYlxvdXQ.cache
new file mode 100644
index 00000000..dfd8127c
--- /dev/null
+++ b/.firebase/hosting.c2l0ZXNcbWFpbndlYlxvdXQ.cache
@@ -0,0 +1,91 @@
+next.svg,1767556162023,0665b9ab4493aa9d7e988b57024e28772ae543e804b8cf6b0a3633854b7c3c7f
+manifest.json,1767556162010,a683f0cd827b000a28a4dbbbe3d336394e1650b811b03d8d1af094a2b3add866
+turborepo.svg,1767556162054,cf4a25dc416d4668bb4afd0ca002d5263f8b50d30c67f2533be7d150bddb5456
+vercel.svg,1767556162070,41e95a86eeec887b8b898097594cf4c4bc5da8f58faf05830e1229d7dcbeea59
+robots.txt,1767556162038,2de27ad6b0ca2f3a304bc56d0096eb3a807fa97e4980bea76619f795eab38c42
+logo128.png,1767556161967,b7909633f01379164dde11e53e42af2d12f7ad104762e36ebb5c8e05af0707f6
+favicon-32x32.png,1767556161918,1c59159f4c69cb8812c8e0b6963252b011a634f2613024785f340890175b68e0
+favicon-16x16.png,1767556161905,96e40605151630d7b4ef81deb967a1175580f4bb9c5fb332960c92af95efcc9a
+circles.svg,1767556161891,91bd260651a2afe3cdc632ea37b7ace2a2a68eae6a7dca855733571e2da3ef30
+background-design-1.png,1767556161874,b65b749e62adb599e8ccd10dd31d9077ae8cd9614ee215a0467d8e3dc969a153
+index.html,1768708090230,6ee92051dcea6aeaffe134cf315d46be501c064991e45fb3dcadcddbeb3da58c
+favicon.ico,1768708090221,9960c28b7d6ac352cf1ba11369584c8247271cb77e217561c647620d67872eea
+404.html,1768708132177,8cff1af02d13106df56ea14024ecabd5a9a54867c3ee21fcd58ac402ac40fc52
+index.txt,1768708090230,927c5a4299eea16cf5312db6e838d1e2d73c4f9997b53c1ae7b9f808a5fc6323
+_next/static/media/hero3--export.7a918f56.svg,1768708021926,7d96637bc73baa76c82b880f72ca40d8d0b09db2f4496c96d8bbabe76fac7481
+_next/static/media/hero2-mobile--export.66989f90.svg,1768708021939,97132306377652a495fe096d59d235ea8f8daf4735109f72e5f1a124c6f76a2a
+logo196.png,1767556161981,d785daa440354422616e9889f35616604710e9dd70313c6915b06fdd630b5b5a
+_next/static/media/eaa89f43bcff2436-s.p.woff2,1768708056708,b515dd90e543b7d58f6deba32c34d6895dcf3d5e3e3d5551279db1b2fc01c8b8
+_next/static/media/e127622016e145c0.p.woff2,1768708056709,56a7ed1c7604f2cfad35bea5c33a72898dab050c4b4cf4f6b0d9ecbcdcda3b58
+_next/static/media/dc1cce3fa2af61db-s.p.woff2,1768708056708,ea5007c3e87efaef4c594433d50344107847559b704a986ed19aa40cfe7d44fd
+_next/static/media/da60e700622ebc65.p.woff2,1768708056710,df86e307ace4e9dc4d0bbd4455b3ab510ad7ee5b0305d8fad0fb545af47197d5
+_next/static/media/ca070aef19a160ac-s.p.woff2,1768708056708,8b34795dc5ab55699dbac35ade3c3bdc2abbee61828ae7b0048215286c57783f
+_next/static/media/b0f83fa59267e7b6.p.woff2,1768708056743,a27724d1679dc02fbafe2895542a9cd144f579fb997c6dd6788373b82c264d3f
+_next/static/media/acd8756c4a5b05ec.p.woff2,1768708056709,cffdb9897db53cb2b2eb88cae82a6f60826ae39bbbe9e9e25fb28798c0694863
+_next/static/media/7f6ca03465f53582.p.woff2,1768708056749,c6659da5b890353b05830ccb798be06955ff7b54ce373fda3e47c4f61a00fba8
+_next/static/media/8a5ed7a420e77c77-s.p.woff2,1768708056709,b8717e8eb60d08dcfba18cae79eeb20be95d9cbfd40667041074b210b19d3036
+_next/static/media/apple-touch-icon.18c4af19.png,1768708021926,d60615679e857bfba6b5e33b60dd6b92f06af5a1b51c1ecb18aac24efec1e51d
+_next/static/media/gtaa.f15d59c5.png,1768708021918,615cfea20fb380d6528b2a63fab185030efc89273855b1f3202f4a301b45ceba
+_next/static/gLTOM3eqSFXM4mqD3_5m4/_ssgManifest.js,1768708094318,dc28a4dc92fe352ed5d2201bd3972ce47691bc8e89e0400a68d1541d0567c6d5
+_next/static/gLTOM3eqSFXM4mqD3_5m4/_buildManifest.js,1768708056831,abbd52ad9fb4d9039bd92c66348455081f45f37fb8753f37027e3ca1cd20d391
+_next/static/chunks/webpack-ebdc40c7b3df2980.js,1768708056885,4bff4e745acf5d229cbe7fefad9ee483ea0b2c91ca399b8c2af3dd729955d07f
+_next/static/chunks/main-app-fb0ee16db92b0db2.js,1768708056838,a5620191ca8912b0173dfb441d409609c7c57ad5f49dea0cfa0489c81c26ecf7
+_next/static/css/d91cb33af42543fa.css,1768708056890,3300026f05ef1229e748ea5bb9d3ec0735955a37a0b32c167f704ca433fabf64
+_next/static/media/785370768b5a7618-s.p.woff2,1768708056709,4d57ef2b25f85cfc72aa89a350aa17081f5b4204134268004284ac3840a4ae73
+_next/static/media/6c2eb4a4397e6726.p.woff2,1768708056742,1022b6f49b0a6cb7773bbeac2e0ae4783a7a82901d63dd9fab9d2c8ba929ef29
+_next/static/media/7d612f06858af31a.p.woff2,1768708056709,ba4574a042d8dd5fb294d93fd1074fb47aaf9ec5002370d72f71ca41c9d3daca
+_next/static/media/48c373c2bbb15a2a-s.p.woff2,1768708056709,5f07aee36dbc4e16a91aee45a14789d35a5dc6bf70574e90b5aec569041b173b
+_next/static/media/26e35e3aa0f2ff52-s.p.woff2,1768708056709,6fb115d592dd310235d18c4a3a705f2479fbdb337125b6e9657e7b7e32b7d7d5
+_next/static/media/24faed2484bb8b0c-s.p.woff2,1768708056708,2beb4c5a53ddd5120a6179a6973bf8f68a362dbcf04ded082243904a381f19ed
+_next/static/media/26bfa5f558072926.p.woff2,1768708056749,c2b783736b2280a4caf39dffbff10f1f7e8fc128b57825f76ea620c5ec297664
+_next/static/media/1e2bfed25cc02ae1.p.woff2,1768708056756,9d09d0dd38814ecb1af5e8f50657fc42b7ee79105a23b6bb2ebe3b0ffe050e80
+_next/static/chunks/826.20e7545f83ce1c50.js,1768708056886,0fc60d2cd606d4f6d4aa18202a02cc9a348f855d5a2a364ab200ef9abe1518d9
+logo512.png,1767556161997,54e168ed5dcdc6fdc61bbac8c99342f016c185708d8d04efe3f0b063fb691315
+_next/static/chunks/511.c4afe65fc4aa4b0f.js,1768708056888,322ba9eebff4554218a30e045e9ecae983a07c6cdc060d604541943ff73d92cf
+_next/static/chunks/655.3fc65d6d0da75415.js,1768708056888,70d459f941bded717619bb4275d1d8e9c8d05ccdef6c69d10b84d4f350e0c388
+_next/static/chunks/269-919ec01a9f151dc1.js,1768708056982,b0a21a14f646e03693da70414f2feaca73cd39f6113528295c2cdbdb29324dab
+_next/static/chunks/pages/_error-7d5be752d8cdda07.js,1768708056844,bd7dd331671838f8d34ecdbb64775d82e78fcf238d0a8ec8b1ceea50571187c5
+_next/static/chunks/pages/_app-552893fa4c6cf2f7.js,1768708056836,4720aed646bb80aff9c09b485fd892b021dc8030d777ae7b45b096ecedf3bc0f
+_next/static/media/alysha.814d9539.png,1768708021847,76d2d5ccb459d41e819df9528f9f55d8c32158cb2a5f054077ef651ff35aab55
+_next/static/media/69a390d3fcb2378e-s.p.woff2,1768708056708,a49cfd8fbbac9317a0ac77278a7297578cc2ef9882b276378033380ddec9b661
+_next/static/chunks/134-e0329fa0531c866d.js,1768708056983,51948439b1d455bf116ad9f4625434cff68bf4f0af71d80424a8ce7f7bb114ff
+_next/static/media/square-logo.1162872e.png,1768708021927,5af85cd153427f89d01c1109e64d5110163bf32b6d199ea1817bd41048d106ed
+_next/static/media/slide7.882e33a7.jpg,1768708021900,a41caad5bdf1dbd5b6e87fd7864b14df9e8564ac1d96a89bc23bbaeec654f0b2
+_next/static/chunks/app/page-1619d8c9c53625b8.js,1768708056876,6ebfa0fed16c569d8eca8d81a7c12bc951d5b0d37f6dc4b1dc539fd11d20b88f
+_next/static/media/arc-logo-v3.65ac35df.png,1768708021915,7d0f48acde15ea2c9dd41653ddc8a52e2b0937df99fd0f501edec6686acb9e68
+_next/static/chunks/polyfills-42372ed130431b0a.js,1768708056817,18e28d3214eda45048d80d3925ea7627b809e69ad2e95f7f98459e9146a61c3d
+_next/static/chunks/app/layout-3653b3f5ef654d9b.js,1768708056850,09490e394ad4630bb56c39759384707980a88c18289c7d7df57252034886d87e
+_next/static/chunks/app/_not-found/page-b0df47e0e9abfe0b.js,1768708056877,ce582249fe109f72039542c65dde5b8d8fe5f5dc3dc00b23c0d8dee2c21fb140
+_next/static/chunks/app/not-found-399d6e2b47282562.js,1768708056847,b21d94723ff49f11fce4046c79d001b6b1a27aa363567ef5d15d0f8a70c2e8e9
+_next/static/chunks/app/tbd/page-c92a566dd2b74e85.js,1768708056888,cb4fd9424577e55085233e98c565bf758292bd45e21ff1b8fa31d636a4122459
+_next/static/chunks/app/team/page-b91a6d408568e234.js,1768708056846,a91cc0be81726f781db63621be79263285a4c6c1726b46e2f67be71cc1ad6802
+_next/static/chunks/main-5c47ec2c271ec1ec.js,1768708056833,1dfc848920f74066d5030ea77dae0a01cb1dda7b834eaf68b6be02076ea9a8a4
+_next/static/chunks/app/projects/page-fd46ebc20602844f.js,1768708056888,df6e9c138682fc25a2d7238a6a0360d09cb954a09956c8b1ae1283fb2bf09780
+team/index.txt,1768708090231,fef28476786ca59b85837659de74ee9ffee9d9eead629d0c102da5ec665d81ee
+tbd/index.txt,1768708090230,1c8bec8c2aab9bec460aeeb7b43b8fd31deaecb2412aa1a0515468cb8b5e3606
+team/index.html,1768708090231,30522bc36aff00b585363d04b0a11c953884c6ca140c5af26d0f5644664c8e28
+projects/index.txt,1768708090231,c88e184c620f8aa87136c85f3a74e721a035032d19e9de8381893e947ca775d4
+tbd/index.html,1768708090230,3123732518aa172aa83a39f0f90e2600d2500ffafbc37f44e4458e0cc1ebf1b6
+404/index.html,1768708132177,8cff1af02d13106df56ea14024ecabd5a9a54867c3ee21fcd58ac402ac40fc52
+projects/index.html,1768708090244,5c7de5760d780c2f24238c7dd44e9cd28a68c54d0620c0b942b7c3911ecd30fc
+_next/static/chunks/framework-d8f01f7e25201916.js,1768708056890,389bb15fe322617d2a34782dc4ff3622720e8f0bc10c532a6c0b352f8bde5397
+_next/static/chunks/c3110d36-a7f5a75547d2754b.js,1768708056930,c6f94895a614d996dcd3733502b10910142e5528b983de8d41ef15a70e22aebf
+_next/static/chunks/18-63cc162f64059731.js,1768708056982,e607ca174a7d251cdee00056f04286b4369e4197e45f27fb10a688cc6a69bd8d
+_next/static/media/slide1.f133cdb4.jpg,1768708021876,a4efbbc9c3b91bd3fc2825f9cca88b2f26f1bc3c101c61e0d8dbf35f69e72fe7
+_next/static/chunks/87c73c54-24122e7b92478d00.js,1768708056973,985e59d795f31f3b06c2d8160c095b89482c97f1cb818a7b8c0ce0ba2a13de5d
+_next/static/media/jake.0864e5b5.png,1768708021863,614dcd549127c320fddd39b2ca528b6900165e9de5ac4424a32c81d591603172
+_next/static/media/vidhi.ce363692.jpeg,1768708021888,49cad84fd0da2e2153012f6d84c21c082960f9c77f704235bb88f5d9e8a86338
+_next/static/media/glenne.edd0c12b.png,1768708021862,3bbf2bc89221e96c0692271b78e920ac61e41782214e83b8c7293ba06c9ab4ca
+_next/static/media/aryan.bd018210.jpeg,1768708021848,9a52fccffd26cd4450758c86ef9fa9038a36bbe4408e1d2ba187dead318816d9
+_next/static/media/anika.09d741f4.jpg,1768708021863,2ecf43df467962740bfee3d4542b533d44078b5d7e3622992b494ef03eb2c50d
+_next/static/media/nitika.e02fb00c.jpg,1768708021857,a78a264b1092a2d0ad221e38dc05b3c41f7570f1ef8f6268320a64f7a6376798
+_next/static/media/stock.5069275c.png,1768708021917,305debac9897de35133db980e481ed646355f3af8c84aa111e5e78e12d9edee4
+_next/static/media/aamogh.d983fd4b.png,1768708021860,635d4527701ec0d20f20b07553f822973404318cef573172178ff177f157fb09
+_next/static/media/anushka.94e3b405.jpg,1768708021858,a00e0c86a798d053352b2f75c39da92557743a9addd0206f1de7c68d4721c565
+_next/static/media/squad.04ba39fe.jpg,1768708021891,4f80fded3e892e7066dce70fd331dfbbc05b9f35fb478dcf16025b5670895a76
+_next/static/media/diya.3fcfa32b.jpeg,1768708021862,54f1ecd202837c6bf2baa160b495e7a6c994a9d953e8ab1f24e59e76d3067452
+_next/static/media/aditi.6e5dd091.jpg,1768708021851,bba26c574f86bf90a44f6558f369a08d91aeb4c5709da7f523f1370401989750
+_next/static/media/smera.a263dea9.png,1768708021866,43a3f97edab937f3407546d41fd85dc254e964d2ab680d752a666e0e3d6bcc1f
+_next/static/media/trading.472a7ca9.png,1768708021925,187df50fb7e40b3e7c7d1a0c9b678b588a11a90c6415265cb326f284a0a75764
+_next/static/media/slide9.1a72b7f1.jpg,1768708021933,2c3ee5fa094edfc8ff10d8f209a3bd8909d37f8e95827e40e47bf35a1f38e95a
+_next/static/media/slide6.51ff6d7a.jpg,1768708022250,b416386125adb61d55800836777af4e7c90eb8c557901b8411fb2305cd10545e
diff --git a/.firebase/hosting.c2l0ZXNccG9ydGFsXHB1YmxpYw.cache b/.firebase/hosting.c2l0ZXNccG9ydGFsXHB1YmxpYw.cache
new file mode 100644
index 00000000..a4d811ee
--- /dev/null
+++ b/.firebase/hosting.c2l0ZXNccG9ydGFsXHB1YmxpYw.cache
@@ -0,0 +1,25 @@
+images/logos/trading.png,1767556163597,187df50fb7e40b3e7c7d1a0c9b678b588a11a90c6415265cb326f284a0a75764
+images/logos/storm.png,1767556163185,49090aaf8b26eac91881de46e7c90d9eda8228af55f40b1a46f1bc0f969f2966
+images/logos/stock.png,1767556163164,305debac9897de35133db980e481ed646355f3af8c84aa111e5e78e12d9edee4
+images/logos/shepcenter.jpeg,1767556163025,a57a0bf31aabaab7285fcfdb7637bf513c40bc29ec5e82fd79468d741d37f127
+images/logos/Mentra.png,1767556162851,69597ac2d91b8290d657c207b49b1a322c6066b020e1ae41f6127264c81eeaee
+images/logos/gtaa.png,1767556163001,615cfea20fb380d6528b2a63fab185030efc89273855b1f3202f4a301b45ceba
+images/logos/furnichanter.png,1767556162972,156f59d5d1dfd47a3d57212c16846f3ce0848e7268dabba3971873f685d2caf0
+images/logos/dlp4.png,1767556162950,14e1e01f0d3436e9c13f64f400c16d6fb52471bdb2dfccaf7bcd7acc1f579cc3
+images/logos/blueconduit.png,1767556162930,726e598bbc52b99c907087d2ddced839c61df4ab32bf95d5aa00cccd3bfd140a
+images/logos/birdclef.png,1767556162911,463d632fcd787259c8aceb0f8ad53c89414eacd776b8b566e4fe1bcee70072da
+images/logos/arc-logo-v3.png,1767556162894,7d0f48acde15ea2c9dd41653ddc8a52e2b0937df99fd0f501edec6686acb9e68
+images/dsgt/square-logo.png,1767556162820,5af85cd153427f89d01c1109e64d5110163bf32b6d199ea1817bd41048d106ed
+images/dsgt/sports_icon.png,1767556162796,aee29d6323a3222c9393642dfd1a6b61b23890ffba2bbe484a3b3876c56615ef
+images/dsgt/logos-20.png,1767556162775,233de3c083e7fff89c44d462e56e0a813dc878b29b0329d141ebd5dc27398896
+images/dsgt/logos-20.ico,1767556162747,f283f6e06664b8a6710adb6f120c5b6a7bfd7967b95ca2205c3376a51641f852
+images/dsgt/logo20.ico,1767556162724,11235ade4b9531c843a4c099f92e7d282ba0b3e2d70c5761b84d9ef057620871
+images/dsgt/Icon-512.png,1767556162586,54e168ed5dcdc6fdc61bbac8c99342f016c185708d8d04efe3f0b063fb691315
+images/dsgt/Icon-196.png,1767556162563,d785daa440354422616e9889f35616604710e9dd70313c6915b06fdd630b5b5a
+images/dsgt/Icon-128.png,1767556162546,b7909633f01379164dde11e53e42af2d12f7ad104762e36ebb5c8e05af0707f6
+images/dsgt/heathcare_icon.png,1767556162703,b6af8ce1284fff38bca3f01dc825bd6ec20923910b4f5ac1298e1096bb0bb236
+images/dsgt/financial_icon.png,1767556162685,560a6e3ba0ab30fea54596721cf16acb68c6410aeaa42e285a7cd3c8bcae72de
+images/dsgt/favicon.ico,1767556162666,9960c28b7d6ac352cf1ba11369584c8247271cb77e217561c647620d67872eea
+images/dsgt/favicon-32x32.png,1767556162650,1c59159f4c69cb8812c8e0b6963252b011a634f2613024785f340890175b68e0
+images/dsgt/favicon-16x16.png,1767556162630,96e40605151630d7b4ef81deb967a1175580f4bb9c5fb332960c92af95efcc9a
+images/dsgt/apple-touch-icon.png,1767556162607,d60615679e857bfba6b5e33b60dd6b92f06af5a1b51c1ecb18aac24efec1e51d
diff --git a/.firebaserc b/.firebaserc
new file mode 100644
index 00000000..86b848f8
--- /dev/null
+++ b/.firebaserc
@@ -0,0 +1,15 @@
+{
+ "projects": {
+ "default": "dsgt-website"
+ },
+ "targets": {
+ "dsgt-website": {
+ "hosting": {
+ "judging": ["dsgt-judging"],
+ "portal": ["dsgt-portal"],
+ "mainweb": ["dsgt-website"],
+ "hacklytics-2": ["hacklytics-2"]
+ }
+ }
+ }
+}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..5990d9c6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+ - package-ecosystem: "" # See documentation for possible values
+ directory: "/" # Location of package manifests
+ schedule:
+ interval: "weekly"
diff --git a/.github/workflows/cloudrun-deploy.yml b/.github/workflows/cloudrun-deploy.yml
new file mode 100644
index 00000000..9286e705
--- /dev/null
+++ b/.github/workflows/cloudrun-deploy.yml
@@ -0,0 +1,72 @@
+name: Deploy Portal to Cloud Run
+
+on:
+ push:
+ branches: [main]
+ paths:
+ - 'sites/portal/**'
+ - 'packages/**'
+ - 'sites/portal/Dockerfile'
+ workflow_dispatch:
+
+env:
+ PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+ REGION: us-central1
+ SERVICE_NAME: portal
+
+jobs:
+ deploy:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ id-token: write
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+
+ - name: Authenticate to Google Cloud
+ uses: google-github-actions/auth@v2
+ with:
+ credentials_json: ${{ secrets.GCP_SA_KEY }}
+
+ - name: Set up Cloud SDK
+ uses: google-github-actions/setup-gcloud@v2
+ with:
+ project_id: ${{ env.PROJECT_ID }}
+
+ - name: Configure Docker for GCR
+ run: gcloud auth configure-docker --quiet
+
+ - name: Build Docker image
+ run: |
+ docker build \
+ -t gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} \
+ -t gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:latest \
+ -f sites/portal/Dockerfile .
+
+ - name: Push to Container Registry
+ run: |
+ docker push gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
+ docker push gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:latest
+
+ - name: Deploy to Cloud Run
+ run: |
+ gcloud run deploy ${{ env.SERVICE_NAME }} \
+ --image gcr.io/${{ env.PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }} \
+ --platform managed \
+ --region ${{ env.REGION }} \
+ --allow-unauthenticated \
+ --memory 1Gi \
+ --cpu 1 \
+ --min-instances 0 \
+ --max-instances 10 \
+ --port 8080 \
+ --timeout 60s
+
+ - name: Get Service URL
+ run: |
+ URL=$(gcloud run services describe ${{ env.SERVICE_NAME }} \
+ --region ${{ env.REGION }} \
+ --format 'value(status.url)')
+ echo "::notice::Deployed to $URL"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..4b68181b
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,541 @@
+name: "CodeQL Advanced Security Analysis"
+
+on:
+ push:
+ branches: [ "main", "develop", "release/**" ]
+ pull_request:
+ branches: [ "main", "develop" ]
+ schedule:
+ # Run at 2 AM UTC every day for continuous monitoring
+ - cron: '0 2 * * *'
+ workflow_dispatch:
+ inputs:
+ scan_level:
+ description: 'Security scan level'
+ required: true
+ default: 'standard'
+ type: choice
+ options:
+ - standard
+ - aggressive
+ - maximum
+
+# Prevent multiple scans running simultaneously
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ analyze:
+ name: Analyze TypeScript/Next.js/tRPC
+ runs-on: ubuntu-latest
+ timeout-minutes: 360
+
+ permissions:
+ security-events: write
+ packages: read
+ actions: read
+ contents: read
+ pull-requests: write
+ issues: write
+
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@v2
+ with:
+ egress-policy: audit
+ disable-sudo: true
+ disable-file-monitoring: false
+
+ - name: Checkout repository
+ uses: actions/checkout@v4
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+
+ - name: Setup pnpm
+ uses: pnpm/action-setup@v4
+ with:
+ run_install: false
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ node-version: 20
+ cache: pnpm
+
+ - name: Install Dependencies
+ run: pnpm install
+
+ - name: Setup CodeQL Custom Queries
+ run: |
+ # Only create files if they don't exist
+ if [ ! -d ".github/codeql/custom-queries" ]; then
+ echo "Creating CodeQL custom queries..."
+ mkdir -p .github/codeql/custom-queries
+
+ # Create qlpack.yml for custom queries
+ cat > .github/codeql/custom-queries/qlpack.yml << 'QLPACKEOF'
+name: custom/security-queries
+version: 1.0.0
+dependencies:
+ codeql/javascript-all: "*"
+QLPACKEOF
+
+ # tRPC Input Validation Query
+ cat > .github/codeql/custom-queries/trpc-input-validation.ql << 'TRPCEOF'
+ /**
+ * @name tRPC Missing Input Validation
+ * @description Detects tRPC procedures without proper input validation using Zod
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 8.5
+ * @precision high
+ * @id custom/trpc-input-validation
+ * @tags security
+ * trpc
+ * input-validation
+ */
+
+ import javascript
+
+ from DataFlow::CallNode procedureCall
+ where
+ procedureCall.getCalleeName().regexpMatch(".*(query|mutation)") and
+ procedureCall.getReceiver().toString().matches("%router%") and
+ not exists(DataFlow::MethodCallNode inputCall |
+ inputCall.getMethodName() = "input" and
+ inputCall.flowsTo(procedureCall)
+ )
+ select procedureCall, "tRPC procedure without input validation schema"
+ TRPCEOF
+
+ # SQL Injection Detection for Prisma/TypeORM
+ cat > .github/codeql/custom-queries/sql-injection.ql << 'SQLEOF'
+ /**
+ * @name SQL Injection via Raw Queries
+ * @description Detects potential SQL injection in raw database queries
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id custom/sql-injection
+ * @tags security
+ * external/cwe/cwe-089
+ */
+
+ import javascript
+ import DataFlow::PathGraph
+
+ class SqlInjectionConfig extends TaintTracking::Configuration {
+ SqlInjectionConfig() { this = "SqlInjectionConfig" }
+
+ override predicate isSource(DataFlow::Node source) {
+ source instanceof RemoteFlowSource
+ }
+
+ override predicate isSink(DataFlow::Node sink) {
+ exists(DataFlow::MethodCallNode call |
+ call.getMethodName().regexpMatch("(\\$queryRaw|\\$executeRaw|query|raw)") and
+ sink = call.getArgument(0)
+ )
+ }
+ }
+
+ from SqlInjectionConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+ where config.hasFlowPath(source, sink)
+ select sink.getNode(), source, sink,
+ "Potential SQL injection from $@", source.getNode(), "user input"
+ SQLEOF
+
+ # NoSQL Injection Detection
+ cat > .github/codeql/custom-queries/nosql-injection.ql << 'NOSQLEOF'
+ /**
+ * @name NoSQL Injection Detection
+ * @description Detects potential NoSQL injection in MongoDB queries
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.8
+ * @precision high
+ * @id custom/nosql-injection
+ * @tags security
+ * external/cwe/cwe-943
+ */
+
+ import javascript
+ import DataFlow::PathGraph
+
+ class NoSqlInjectionConfig extends TaintTracking::Configuration {
+ NoSqlInjectionConfig() { this = "NoSqlInjectionConfig" }
+
+ override predicate isSource(DataFlow::Node source) {
+ source instanceof RemoteFlowSource
+ }
+
+ override predicate isSink(DataFlow::Node sink) {
+ exists(DataFlow::MethodCallNode call |
+ call.getMethodName().regexpMatch("(find|findOne|findMany|update|delete|aggregate)") and
+ sink = call.getArgument(0)
+ )
+ }
+ }
+
+ from NoSqlInjectionConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+ where config.hasFlowPath(source, sink)
+ select sink.getNode(), source, sink,
+ "Potential NoSQL injection from $@", source.getNode(), "user input"
+ NOSQLEOF
+
+ # API Over-fetching Detection
+ cat > .github/codeql/custom-queries/api-overfetching.ql << 'APIEOF'
+ /**
+ * @name Database Query Over-fetching
+ * @description Detects database queries without pagination or field selection
+ * @kind problem
+ * @problem.severity warning
+ * @security-severity 6.0
+ * @precision medium
+ * @id custom/api-overfetching
+ * @tags security
+ * performance
+ * database
+ */
+
+ import javascript
+
+ from DataFlow::MethodCallNode call
+ where
+ call.getMethodName().regexpMatch("(findMany|findAll)") and
+ not exists(DataFlow::Node arg |
+ arg = call.getArgument(0) and
+ arg.asExpr().(ObjectExpr).getAProperty().getName().matches("take")
+ ) and
+ not exists(DataFlow::Node arg |
+ arg = call.getArgument(0) and
+ arg.asExpr().(ObjectExpr).getAProperty().getName().matches("select")
+ )
+ select call, "Database query without pagination (take/skip) or field selection (select)"
+ APIEOF
+
+ # Next.js Server-Side Security
+ cat > .github/codeql/custom-queries/nextjs-server-security.ql << 'NEXTEOF'
+ /**
+ * @name Next.js Exposed Server-Side Data
+ * @description Detects sensitive data potentially exposed to client
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 7.5
+ * @precision medium
+ * @id custom/nextjs-server-security
+ * @tags security
+ * nextjs
+ * data-exposure
+ */
+
+ import javascript
+
+ from DataFlow::Node returnNode
+ where
+ exists(Function f |
+ f.getName().regexpMatch("(getServerSideProps|getStaticProps)") and
+ returnNode.asExpr().getEnclosingFunction() = f
+ ) and
+ returnNode.toString().regexpMatch(".*(password|secret|token|key|credential).*")
+ select returnNode, "Potential exposure of sensitive data in server-side props"
+ NEXTEOF
+
+ # Create CodeQL configuration file
+ cat > codeql-config.yml << 'CONFIGEOF'
+name: "Next.js tRPC Security Configuration"
+
+disable-default-queries: false
+
+queries:
+ - uses: security-extended
+ - uses: security-and-quality
+ - uses: ./.github/codeql/custom-queries
+
+query-filters:
+ - exclude:
+ id: js/unused-local-variable
+ - exclude:
+ tags: documentation
+
+paths-ignore:
+ - node_modules
+ - .next
+ - out
+ - dist
+ - build
+ - coverage
+ - public
+ - '**/*.test.ts'
+ - '**/*.test.tsx'
+ - '**/*.spec.ts'
+ - '**/*.spec.tsx'
+ - '**/test/**'
+ - '**/tests/**'
+ - '**/__tests__/**'
+ - '**/__mocks__/**'
+
+paths:
+ - src
+ - app
+ - pages
+ - server
+ - lib
+ - utils
+ - api
+CONFIGEOF
+
+ # Authentication & Authorization Checks
+ cat > .github/codeql/custom-queries/missing-auth.ql << 'AUTHEOF'
+ /**
+ * @name Missing Authentication Check
+ * @description Detects API routes or tRPC procedures without authentication
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 8.0
+ * @precision medium
+ * @id custom/missing-auth
+ * @tags security
+ * authentication
+ * authorization
+ */
+
+ import javascript
+
+ from DataFlow::FunctionNode handler
+ where
+ (
+ // Next.js API routes
+ exists(ExportAssignment exp |
+ exp.getExpression() = handler.asExpr()
+ ) or
+ // tRPC procedures
+ exists(DataFlow::MethodCallNode call |
+ call.getMethodName().regexpMatch("(query|mutation)") and
+ handler = call.getArgument(0)
+ )
+ ) and
+ not exists(DataFlow::Node authCheck |
+ authCheck.toString().regexpMatch(".*(auth|session|token|user).*") and
+ authCheck.asExpr().getEnclosingFunction() = handler.getFunction()
+ )
+ select handler, "Handler without apparent authentication check"
+ AUTHEOF
+
+ # XSS Detection
+ cat > .github/codeql/custom-queries/xss-detection.ql << 'XSSEOF'
+ /**
+ * @name Cross-Site Scripting (XSS) Vulnerability
+ * @description Detects potential XSS vulnerabilities in React components
+ * @kind path-problem
+ * @problem.severity error
+ * @security-severity 9.0
+ * @precision high
+ * @id custom/xss-detection
+ * @tags security
+ * external/cwe/cwe-079
+ */
+
+ import javascript
+ import DataFlow::PathGraph
+
+ class XssConfig extends TaintTracking::Configuration {
+ XssConfig() { this = "XssConfig" }
+
+ override predicate isSource(DataFlow::Node source) {
+ source instanceof RemoteFlowSource
+ }
+
+ override predicate isSink(DataFlow::Node sink) {
+ exists(JSXElement jsx |
+ sink.asExpr() = jsx.getAttributeByName("dangerouslySetInnerHTML").getValue()
+ )
+ }
+ }
+
+ from XssConfig config, DataFlow::PathNode source, DataFlow::PathNode sink
+ where config.hasFlowPath(source, sink)
+ select sink.getNode(), source, sink,
+ "Potential XSS vulnerability from $@", source.getNode(), "user input"
+ XSSEOF
+
+ # Environment Variable Exposure
+ cat > .github/codeql/custom-queries/env-exposure.ql << 'ENVEOF'
+ /**
+ * @name Environment Variable Client Exposure
+ * @description Detects server-side environment variables exposed to client
+ * @kind problem
+ * @problem.severity error
+ * @security-severity 8.0
+ * @precision high
+ * @id custom/env-exposure
+ * @tags security
+ * configuration
+ */
+
+ import javascript
+
+ from DataFlow::PropRead envAccess
+ where
+ envAccess.getBase().toString().matches("%process.env%") and
+ not envAccess.getPropertyName().matches("NEXT_PUBLIC_%") and
+ exists(File f |
+ f = envAccess.getFile() and
+ not f.getRelativePath().matches("%/server/%") and
+ not f.getRelativePath().matches("%/api/%")
+ )
+ select envAccess, "Server-side environment variable potentially exposed to client"
+ ENVEOF
+
+ - name: Initialize CodeQL
+ uses: github/codeql-action/init@v4
+ with:
+ languages: javascript-typescript
+ build-mode: none
+ config-file: ./codeql-config.yml
+ db-location: '${{ runner.temp }}/codeql_databases'
+ setup-python-dependencies: false
+ tools: linked
+ ram: 8192
+ threads: 0
+
+ - name: Perform CodeQL Analysis
+ uses: github/codeql-action/analyze@v4
+ with:
+ category: "/language:typescript"
+ output: sarif-results
+ upload: true
+ checkout_path: ${{ github.workspace }}
+ add-snippets: true
+
+ - name: Upload SARIF Results
+ uses: github/codeql-action/upload-sarif@v4
+ if: always()
+ with:
+ sarif_file: sarif-results/javascript-typescript.sarif
+ category: typescript
+ wait-for-processing: true
+
+ - name: Generate Security Report
+ if: always()
+ run: |
+ echo "## Security Analysis Report" > security-report.md
+ echo "**Language:** TypeScript (Next.js/tRPC)" >> security-report.md
+ echo "**Timestamp:** $(date -u)" >> security-report.md
+ echo "" >> security-report.md
+
+ if [ -d "sarif-results" ]; then
+ echo "### Analysis Complete" >> security-report.md
+ echo "Results have been uploaded to GitHub Security tab." >> security-report.md
+
+ if command -v jq &> /dev/null && [ -f "sarif-results/javascript-typescript.sarif" ]; then
+ CRITICAL=$(jq '[.runs[].results[] | select(.level=="error")] | length' sarif-results/javascript-typescript.sarif 2>/dev/null || echo "0")
+ WARNING=$(jq '[.runs[].results[] | select(.level=="warning")] | length' sarif-results/javascript-typescript.sarif 2>/dev/null || echo "0")
+ NOTE=$(jq '[.runs[].results[] | select(.level=="note")] | length' sarif-results/javascript-typescript.sarif 2>/dev/null || echo "0")
+ echo "" >> security-report.md
+ echo "**Findings Summary:**" >> security-report.md
+ echo "- Critical Issues: $CRITICAL" >> security-report.md
+ echo "- Warnings: $WARNING" >> security-report.md
+ echo "- Notes: $NOTE" >> security-report.md
+
+ if [ "$CRITICAL" -gt 0 ]; then
+ echo "" >> security-report.md
+ echo "**Action Required:** Critical security issues detected. Review immediately." >> security-report.md
+ fi
+ fi
+ fi
+
+ - name: Comment PR with Results
+ if: github.event_name == 'pull_request'
+ uses: actions/github-script@v7
+ with:
+ script: |
+ const fs = require('fs');
+ if (fs.existsSync('security-report.md')) {
+ const report = fs.readFileSync('security-report.md', 'utf8');
+ github.rest.issues.createComment({
+ issue_number: context.issue.number,
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ body: report
+ });
+ }
+
+ - name: Check for Critical Vulnerabilities
+ if: always()
+ run: |
+ if [ -d "sarif-results" ] && command -v jq &> /dev/null && [ -f "sarif-results/javascript-typescript.sarif" ]; then
+ CRITICAL=$(jq '[.runs[].results[] | select(.level=="error")] | length' sarif-results/javascript-typescript.sarif 2>/dev/null || echo "0")
+
+ if [ "$CRITICAL" -gt 0 ]; then
+ echo "::error::Found $CRITICAL critical security issues!"
+ echo "Please review the Security tab for details."
+ echo ""
+ echo "Critical issues found in:"
+ jq -r '.runs[].results[] | select(.level=="error") | "- \(.ruleId): \(.message.text)"' sarif-results/javascript-typescript.sarif 2>/dev/null || true
+ exit 1
+ else
+ echo "::notice::No critical security issues found."
+ fi
+ fi
+
+ dependency-review:
+ name: Dependency Security Review
+ runs-on: ubuntu-latest
+ if: github.event_name == 'pull_request'
+
+ permissions:
+ contents: read
+ pull-requests: write
+
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@v4
+
+ - name: Dependency Review
+ uses: actions/dependency-review-action@v4
+ with:
+ fail-on-severity: moderate
+ deny-licenses: GPL-3.0, AGPL-3.0
+ comment-summary-in-pr: always
+ vulnerability-check: true
+ license-check: true
+
+ security-summary:
+ name: Security Analysis Summary
+ needs: [analyze, dependency-review]
+ runs-on: ubuntu-latest
+ if: always()
+
+ permissions:
+ security-events: read
+ contents: read
+
+ steps:
+ - name: Generate Summary
+ run: |
+ echo "# Security Analysis Complete" >> $GITHUB_STEP_SUMMARY
+ echo "" >> $GITHUB_STEP_SUMMARY
+ echo "## Analysis Results" >> $GITHUB_STEP_SUMMARY
+ echo "- CodeQL Analysis: ${{ needs.analyze.result }}" >> $GITHUB_STEP_SUMMARY
+ if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+ echo "- Dependency Review: ${{ needs.dependency-review.result }}" >> $GITHUB_STEP_SUMMARY
+ fi
+ echo "" >> $GITHUB_STEP_SUMMARY
+ echo "## Checks Performed" >> $GITHUB_STEP_SUMMARY
+ echo "- SQL Injection (Prisma raw queries)" >> $GITHUB_STEP_SUMMARY
+ echo "- NoSQL Injection (MongoDB queries)" >> $GITHUB_STEP_SUMMARY
+ echo "- tRPC input validation" >> $GITHUB_STEP_SUMMARY
+ echo "- Database over-fetching" >> $GITHUB_STEP_SUMMARY
+ echo "- XSS vulnerabilities" >> $GITHUB_STEP_SUMMARY
+ echo "- Authentication checks" >> $GITHUB_STEP_SUMMARY
+ echo "- Environment variable exposure" >> $GITHUB_STEP_SUMMARY
+ echo "- Next.js server-side data leaks" >> $GITHUB_STEP_SUMMARY
+ echo "" >> $GITHUB_STEP_SUMMARY
+ echo "View detailed results in the [Security tab](https://github.com/${{ github.repository }}/security/code-scanning)" >> $GITHUB_STEP_SUMMARY
diff --git a/.github/workflows/deploy-hacklytics.yml b/.github/workflows/deploy-hacklytics.yml
new file mode 100644
index 00000000..4692fcad
--- /dev/null
+++ b/.github/workflows/deploy-hacklytics.yml
@@ -0,0 +1,42 @@
+name: Deploy Hacklytics to Firebase Hosting
+
+on:
+ push:
+ branches:
+ - main
+ pull_request:
+
+permissions:
+ contents: read
+ pull-requests: write
+ checks: write
+
+jobs:
+ build_and_deploy:
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - name: Setup Node.js
+ uses: actions/setup-node@v3
+ with:
+ node-version: 20
+
+ - name: Install pnpm
+ run: npm install -g pnpm
+
+ - name: Install dependencies
+ run: pnpm install
+
+ - name: Build
+ run: pnpm turbo build --filter=hacklytics2026
+
+ - name: Deploy to Firebase Hosting
+ uses: FirebaseExtended/action-hosting-deploy@v0
+ with:
+ # repoToken is removed to prevent PR comments
+ firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DSGT }}
+ projectId: dsgt-website
+ channelId: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || 'live' }}
+ target: hacklytics-2
diff --git a/.github/workflows/pnpm-build.yml b/.github/workflows/pnpm-build.yml
new file mode 100644
index 00000000..2f2fa72d
--- /dev/null
+++ b/.github/workflows/pnpm-build.yml
@@ -0,0 +1,29 @@
+name: PNPM Build Test
+
+on:
+ push:
+ branches: ["main"]
+ pull_request:
+ branches: ["*"]
+
+jobs:
+ build:
+ permissions:
+ contents: read
+ runs-on: ubuntu-latest
+
+ steps:
+ - uses: actions/checkout@v4
+
+ - uses: pnpm/action-setup@v4
+ with:
+ run_install: false
+
+ - uses: actions/setup-node@v3
+ with:
+ node-version: 20
+ cache: pnpm
+
+ - run: pnpm install
+
+ - run: pnpm turbo run build
diff --git a/.gitignore b/.gitignore
index 79e0077c..103f2ca4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,36 +1,74 @@
-# See https://help.github.com/articles/ignoring-files/ for more about ignoring files.
-
-# dependencies
+# Dependencies
node_modules
.pnp
.pnp.js
-# testing
+# Testing
coverage
-# next.js
+# Next.js
.next/
out/
build
-.swc/
+dist/
-# misc
+# Production
+build
+
+# Misc
.DS_Store
*.pem
+nul
-# debug
+# Debug
npm-debug.log*
yarn-debug.log*
yarn-error.log*
+yarn-error.log*
+.pnpm-debug.log*
+*.log
-# local env files
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
+# Local env files
+.env
+.env*.local
+.env.production
-# turbo
+# Vercel
+.vercel
+
+# Turbo
.turbo
# ui
dist/
+
+# TypeScript
+*.tsbuildinfo
+next-env.d.ts
+
+# Database
+*.db
+*.db-journal
+migrations/
+
+# Editor
+.vscode/*
+!.vscode/settings.json
+!.vscode/extensions.json
+.idea
+.claude/settings.local.json
+
+# Scripts & Data (sensitive/generated)
+seed-super.ts
+.reset.ts
+packages/db/scripts/seed.ts
+packages/db/scripts/seed2.ts
+packages/db/scripts/seed-judges.ts
+packages/db/scripts/seed-projects.ts
+packages/db/scripts/seed-2026.ts
+packages/db/scripts/assign-*.ts
+scripts/seed-stripe.ts
+packages/db/final_judge_assignments.csv
+packages/db/scripts/*.csv
+*.csv
+output.txt
\ No newline at end of file
diff --git a/.npmrc b/.npmrc
index ded82e2f..bf938061 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,8 @@
-auto-install-peers = true
+node-linker=hoisted
+public-hoist-pattern[]=*eslint*
+public-hoist-pattern[]=*prettier*
+public-hoist-pattern[]=*typescript*
+auto-install-peers=true
+strict-peer-dependencies=false
+shamefully-hoist=true
+frozen-lockfile=false
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000..7af24b7d
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+22.11.0
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 00000000..36b3d97f
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,7 @@
+{
+ "accessibility.signals.terminalBell": {
+ "announcement": "off",
+ "sound": "off"
+ },
+ "compile-hero.disable-compile-files-on-did-save-code": true
+}
\ No newline at end of file
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 00000000..261eeb9e
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,201 @@
+ Apache License
+ Version 2.0, January 2004
+ http://www.apache.org/licenses/
+
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+ 1. Definitions.
+
+ "License" shall mean the terms and conditions for use, reproduction,
+ and distribution as defined by Sections 1 through 9 of this document.
+
+ "Licensor" shall mean the copyright owner or entity authorized by
+ the copyright owner that is granting the License.
+
+ "Legal Entity" shall mean the union of the acting entity and all
+ other entities that control, are controlled by, or are under common
+ control with that entity. For the purposes of this definition,
+ "control" means (i) the power, direct or indirect, to cause the
+ direction or management of such entity, whether by contract or
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
+ outstanding shares, or (iii) beneficial ownership of such entity.
+
+ "You" (or "Your") shall mean an individual or Legal Entity
+ exercising permissions granted by this License.
+
+ "Source" form shall mean the preferred form for making modifications,
+ including but not limited to software source code, documentation
+ source, and configuration files.
+
+ "Object" form shall mean any form resulting from mechanical
+ transformation or translation of a Source form, including but
+ not limited to compiled object code, generated documentation,
+ and conversions to other media types.
+
+ "Work" shall mean the work of authorship, whether in Source or
+ Object form, made available under the License, as indicated by a
+ copyright notice that is included in or attached to the work
+ (an example is provided in the Appendix below).
+
+ "Derivative Works" shall mean any work, whether in Source or Object
+ form, that is based on (or derived from) the Work and for which the
+ editorial revisions, annotations, elaborations, or other modifications
+ represent, as a whole, an original work of authorship. For the purposes
+ of this License, Derivative Works shall not include works that remain
+ separable from, or merely link (or bind by name) to the interfaces of,
+ the Work and Derivative Works thereof.
+
+ "Contribution" shall mean any work of authorship, including
+ the original version of the Work and any modifications or additions
+ to that Work or Derivative Works thereof, that is intentionally
+ submitted to Licensor for inclusion in the Work by the copyright owner
+ or by an individual or Legal Entity authorized to submit on behalf of
+ the copyright owner. For the purposes of this definition, "submitted"
+ means any form of electronic, verbal, or written communication sent
+ to the Licensor or its representatives, including but not limited to
+ communication on electronic mailing lists, source code control systems,
+ and issue tracking systems that are managed by, or on behalf of, the
+ Licensor for the purpose of discussing and improving the Work, but
+ excluding communication that is conspicuously marked or otherwise
+ designated in writing by the copyright owner as "Not a Contribution."
+
+ "Contributor" shall mean Licensor and any individual or Legal Entity
+ on behalf of whom a Contribution has been received by Licensor and
+ subsequently incorporated within the Work.
+
+ 2. Grant of Copyright License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ copyright license to reproduce, prepare Derivative Works of,
+ publicly display, publicly perform, sublicense, and distribute the
+ Work and such Derivative Works in Source or Object form.
+
+ 3. Grant of Patent License. Subject to the terms and conditions of
+ this License, each Contributor hereby grants to You a perpetual,
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+ (except as stated in this section) patent license to make, have made,
+ use, offer to sell, sell, import, and otherwise transfer the Work,
+ where such license applies only to those patent claims licensable
+ by such Contributor that are necessarily infringed by their
+ Contribution(s) alone or by combination of their Contribution(s)
+ with the Work to which such Contribution(s) was submitted. If You
+ institute patent litigation against any entity (including a
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
+ or a Contribution incorporated within the Work constitutes direct
+ or contributory patent infringement, then any patent licenses
+ granted to You under this License for that Work shall terminate
+ as of the date such litigation is filed.
+
+ 4. Redistribution. You may reproduce and distribute copies of the
+ Work or Derivative Works thereof in any medium, with or without
+ modifications, and in Source or Object form, provided that You
+ meet the following conditions:
+
+ (a) You must give any other recipients of the Work or
+ Derivative Works a copy of this License; and
+
+ (b) You must cause any modified files to carry prominent notices
+ stating that You changed the files; and
+
+ (c) You must retain, in the Source form of any Derivative Works
+ that You distribute, all copyright, patent, trademark, and
+ attribution notices from the Source form of the Work,
+ excluding those notices that do not pertain to any part of
+ the Derivative Works; and
+
+ (d) If the Work includes a "NOTICE" text file as part of its
+ distribution, then any Derivative Works that You distribute must
+ include a readable copy of the attribution notices contained
+ within such NOTICE file, excluding those notices that do not
+ pertain to any part of the Derivative Works, in at least one
+ of the following places: within a NOTICE text file distributed
+ as part of the Derivative Works; within the Source form or
+ documentation, if provided along with the Derivative Works; or,
+ within a display generated by the Derivative Works, if and
+ wherever such third-party notices normally appear. The contents
+ of the NOTICE file are for informational purposes only and
+ do not modify the License. You may add Your own attribution
+ notices within Derivative Works that You distribute, alongside
+ or as an addendum to the NOTICE text from the Work, provided
+ that such additional attribution notices cannot be construed
+ as modifying the License.
+
+ You may add Your own copyright statement to Your modifications and
+ may provide additional or different license terms and conditions
+ for use, reproduction, or distribution of Your modifications, or
+ for any such Derivative Works as a whole, provided Your use,
+ reproduction, and distribution of the Work otherwise complies with
+ the conditions stated in this License.
+
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
+ any Contribution intentionally submitted for inclusion in the Work
+ by You to the Licensor shall be under the terms and conditions of
+ this License, without any additional terms or conditions.
+ Notwithstanding the above, nothing herein shall supersede or modify
+ the terms of any separate license agreement you may have executed
+ with Licensor regarding such Contributions.
+
+ 6. Trademarks. This License does not grant permission to use the trade
+ names, trademarks, service marks, or product names of the Licensor,
+ except as required for reasonable and customary use in describing the
+ origin of the Work and reproducing the content of the NOTICE file.
+
+ 7. Disclaimer of Warranty. Unless required by applicable law or
+ agreed to in writing, Licensor provides the Work (and each
+ Contributor provides its Contributions) on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ implied, including, without limitation, any warranties or conditions
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+ PARTICULAR PURPOSE. You are solely responsible for determining the
+ appropriateness of using or redistributing the Work and assume any
+ risks associated with Your exercise of permissions under this License.
+
+ 8. Limitation of Liability. In no event and under no legal theory,
+ whether in tort (including negligence), contract, or otherwise,
+ unless required by applicable law (such as deliberate and grossly
+ negligent acts) or agreed to in writing, shall any Contributor be
+ liable to You for damages, including any direct, indirect, special,
+ incidental, or consequential damages of any character arising as a
+ result of this License or out of the use or inability to use the
+ Work (including but not limited to damages for loss of goodwill,
+ work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses), even if such Contributor
+ has been advised of the possibility of such damages.
+
+ 9. Accepting Warranty or Additional Liability. While redistributing
+ the Work or Derivative Works thereof, You may choose to offer,
+ and charge a fee for, acceptance of support, warranty, indemnity,
+ or other liability obligations and/or rights consistent with this
+ License. However, in accepting such obligations, You may act only
+ on Your own behalf and on Your sole responsibility, not on behalf
+ of any other Contributor, and only if You agree to indemnify,
+ defend, and hold each Contributor harmless for any liability
+ incurred by, or claims asserted against, such Contributor by reason
+ of your accepting any such warranty or additional liability.
+
+ END OF TERMS AND CONDITIONS
+
+ APPENDIX: How to apply the Apache License to your work.
+
+ To apply the Apache License to your work, attach the following
+ boilerplate notice, with the fields enclosed by brackets "[]"
+ replaced with your own identifying information. (Don't include
+ the brackets!) The text should be enclosed in the appropriate
+ comment syntax for the file format. We also recommend that a
+ file or class name and description of purpose be included on the
+ same "printed page" as the copyright notice for easier
+ identification within third-party archives.
+
+ Copyright [yyyy] [name of copyright owner]
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
diff --git a/README.md b/README.md
index 438763d5..bb09873c 100644
--- a/README.md
+++ b/README.md
@@ -1,58 +1,3 @@
-# Turborepo Tailwind CSS starter
+# query
-This Turborepo starter is maintained by the Turborepo core team.
-
-## Using this example
-
-Run the following command:
-
-```sh
-npx create-turbo@latest -e with-tailwind
-```
-
-## What's inside?
-
-This Turborepo includes the following packages/apps:
-
-### Apps and Packages
-
-- `docs`: a [Next.js](https://nextjs.org/) app with [Tailwind CSS](https://tailwindcss.com/)
-- `web`: another [Next.js](https://nextjs.org/) app with [Tailwind CSS](https://tailwindcss.com/)
-- `ui`: a stub React component library with [Tailwind CSS](https://tailwindcss.com/) shared by both `web` and `docs` applications
-- `@repo/eslint-config`: `eslint` configurations (includes `eslint-config-next` and `eslint-config-prettier`)
-- `@repo/typescript-config`: `tsconfig.json`s used throughout the monorepo
-
-Each package/app is 100% [TypeScript](https://www.typescriptlang.org/).
-
-### Building packages/ui
-
-This example is set up to produce compiled styles for `ui` components into the `dist` directory. The component `.tsx` files are consumed by the Next.js apps directly using `transpilePackages` in `next.config.ts`. This was chosen for several reasons:
-
-- Make sharing one `tailwind.config.ts` to apps and packages as easy as possible.
-- Make package compilation simple by only depending on the Next.js Compiler and `tailwindcss`.
-- Ensure Tailwind classes do not overwrite each other. The `ui` package uses a `ui-` prefix for it's classes.
-- Maintain clear package export boundaries.
-
-Another option is to consume `packages/ui` directly from source without building. If using this option, you will need to update the `tailwind.config.ts` in your apps to be aware of your package locations, so it can find all usages of the `tailwindcss` class names for CSS compilation.
-
-For example, in [tailwind.config.ts](packages/tailwind-config/tailwind.config.ts):
-
-```js
- content: [
- // app content
- `src/**/*.{js,ts,jsx,tsx}`,
- // include packages if not transpiling
- "../../packages/ui/*.{js,ts,jsx,tsx}",
- ],
-```
-
-If you choose this strategy, you can remove the `tailwindcss` and `autoprefixer` dependencies from the `ui` package.
-
-### Utilities
-
-This Turborepo has some additional tools already setup for you:
-
-- [Tailwind CSS](https://tailwindcss.com/) for styles
-- [TypeScript](https://www.typescriptlang.org/) for static type checking
-- [ESLint](https://eslint.org/) for code linting
-- [Prettier](https://prettier.io) for code formatting
+The central monorepo for club operations and digital infrastructure.
diff --git a/apphosting.yaml b/apphosting.yaml
new file mode 100644
index 00000000..4ab1b239
--- /dev/null
+++ b/apphosting.yaml
@@ -0,0 +1,54 @@
+# Monorepo - app is in sites/portal
+
+scripts:
+ buildCommand: pnpm --filter web build && mkdir -p sites/mainweb/.next/standalone/sites/mainweb/.next && cp -r sites/mainweb/.next/static sites/mainweb/.next/standalone/sites/mainweb/.next/static && (cp -r sites/mainweb/public sites/mainweb/.next/standalone/sites/mainweb/public || true)
+ runCommand: node sites/mainweb/.next/standalone/sites/mainweb/server.js
+
+runConfig:
+ runtime: nodejs20
+ concurrency: 80
+ cpu: 1
+ memoryMiB: 1024
+ minInstances: 0
+ maxInstances: 10
+
+env:
+ - variable: PORT
+ value: "8080"
+ - variable: HOSTNAME
+ value: "0.0.0.0"
+ - variable: DATABASE_URL
+ secret: DATABASE_URL
+ - variable: AUTH_SECRET
+ secret: AUTH_SECRET
+ - variable: NEXTAUTH_SECRET
+ secret: AUTH_SECRET
+ - variable: GOOGLE_CLIENT_ID
+ secret: AUTH_GOOGLE_ID
+ - variable: GOOGLE_CLIENT_SECRET
+ secret: AUTH_GOOGLE_SECRET
+ - variable: AUTH_URL
+ value: https://datasciencegt.org
+ - variable: NEXTAUTH_URL
+ value: https://datasciencegt.org
+ # Stripe Configuration
+ - variable: STRIPE_SECRET_KEY
+ # Project Number identifier (safe to commit) used for robust resolution
+ secret: projects/672446353769/secrets/STRIPE_SECRET_KEY
+ - variable: NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
+ secret: projects/672446353769/secrets/NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
+ - variable: STRIPE_WEBHOOK_SECRET
+ secret: projects/672446353769/secrets/STRIPE_WEBHOOK_SECRET
+ - variable: NODE_ENV
+ value: production
+ # Email Provider (Magic Link Login via Gmail)
+ - variable: EMAIL_SERVER_HOST
+ value: smtp.gmail.com
+ - variable: EMAIL_SERVER_PORT
+ value: "587"
+ - variable: EMAIL_SERVER_USER
+ value: datascience.gt@gmail.com
+ - variable: EMAIL_SERVER_PASSWORD
+ secret: projects/672446353769/secrets/EMAIL_SERVER_PASSWORD
+ - variable: EMAIL_FROM
+ value: datascience.gt@gmail.com
diff --git a/apps/docs/README.md b/apps/docs/README.md
deleted file mode 100644
index 04c1d97b..00000000
--- a/apps/docs/README.md
+++ /dev/null
@@ -1,28 +0,0 @@
-## Getting Started
-
-First, run the development server:
-
-```bash
-yarn dev
-```
-
-Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
-
-You can start editing the page by modifying `src/app/page.tsx`. The page auto-updates as you edit the file.
-
-To create [API routes](https://nextjs.org/docs/app/building-your-application/routing/router-handlers) add an `api/` directory to the `app/` directory with a `route.ts` file. For individual endpoints, create a subfolder in the `api` directory, like `api/hello/route.ts` would map to [http://localhost:3000/api/hello](http://localhost:3000/api/hello).
-
-## Learn More
-
-To learn more about Next.js, take a look at the following resources:
-
-- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
-- [Learn Next.js](https://nextjs.org/learn/foundations/about-nextjs) - an interactive Next.js tutorial.
-
-You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js/) - your feedback and contributions are welcome!
-
-## Deploy on Vercel
-
-The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_source=github.com&utm_medium=referral&utm_campaign=turborepo-readme) from the creators of Next.js.
-
-Check out our [Next.js deployment documentation](https://nextjs.org/docs/deployment) for more details.
diff --git a/apps/docs/app/favicon.ico b/apps/docs/app/favicon.ico
deleted file mode 100644
index 3f804c02..00000000
Binary files a/apps/docs/app/favicon.ico and /dev/null differ
diff --git a/apps/docs/app/globals.css b/apps/docs/app/globals.css
deleted file mode 100644
index fd853867..00000000
--- a/apps/docs/app/globals.css
+++ /dev/null
@@ -1,26 +0,0 @@
-@import "tailwindcss";
-@import "@repo/tailwind-config";
-
-:root {
- --foreground-rgb: 0, 0, 0;
- --background-start-rgb: 214, 219, 220;
- --background-end-rgb: 255, 255, 255;
-}
-
-@media (prefers-color-scheme: dark) {
- :root {
- --foreground-rgb: 255, 255, 255;
- --background-start-rgb: 0, 0, 0;
- --background-end-rgb: 0, 0, 0;
- }
-}
-
-body {
- color: rgb(var(--foreground-rgb));
- background: linear-gradient(
- to bottom,
- transparent,
- rgb(var(--background-end-rgb))
- )
- rgb(var(--background-start-rgb));
-}
diff --git a/apps/docs/app/layout.tsx b/apps/docs/app/layout.tsx
deleted file mode 100644
index 5912a62b..00000000
--- a/apps/docs/app/layout.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-import "@repo/ui/styles.css";
-import "./globals.css";
-import type { Metadata } from "next";
-import { Geist } from "next/font/google";
-
-const geist = Geist({ subsets: ["latin"] });
-
-export const metadata: Metadata = {
- title: "Create Turborepo",
- description: "Generated by create turbo",
-};
-
-export default function RootLayout({
- children,
-}: {
- children: React.ReactNode;
-}) {
- return (
-
- {children}
-
- );
-}
diff --git a/apps/docs/app/page.tsx b/apps/docs/app/page.tsx
deleted file mode 100644
index 213a94bd..00000000
--- a/apps/docs/app/page.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-import Image from "next/image";
-import { Card } from "@repo/ui/card";
-import { Gradient } from "@repo/ui/gradient";
-import { TurborepoLogo } from "@repo/ui/turborepo-logo";
-
-const LINKS = [
- {
- title: "Docs",
- href: "https://turborepo.com/docs",
- description: "Find in-depth information about Turborepo features and API.",
- },
- {
- title: "Learn",
- href: "https://turborepo.com/docs/handbook",
- description: "Learn more about monorepos with our handbook.",
- },
- {
- title: "Templates",
- href: "https://turborepo.com/docs/getting-started/from-example",
- description: "Choose from over 15 examples and deploy with a single click.",
- },
- {
- title: "Deploy",
- href: "https://vercel.com/new",
- description:
- "Instantly deploy your Turborepo to a shareable URL with Vercel.",
- },
-];
-
-export default function Page() {
- return (
-
-
-
- examples/with-tailwind -
- docs
-
-
-
-
-
-
-
-
- Turborepo logo
-
-
-
-
- {LINKS.map(({ title, href, description }) => (
-
- {description}
-
- ))}
-
-
- );
-}
diff --git a/apps/docs/eslint.config.js b/apps/docs/eslint.config.js
deleted file mode 100644
index e8759ff5..00000000
--- a/apps/docs/eslint.config.js
+++ /dev/null
@@ -1,4 +0,0 @@
-import { nextJsConfig } from "@repo/eslint-config/next-js";
-
-/** @type {import("eslint").Linter.Config} */
-export default nextJsConfig;
diff --git a/apps/docs/next-env.d.ts b/apps/docs/next-env.d.ts
deleted file mode 100644
index 1b3be084..00000000
--- a/apps/docs/next-env.d.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-///
-
-
- examples/with-tailwind -
- web
-
-
-
-
-
-
-
-
- Turborepo logo
-
-
-
-
- {LINKS.map(({ title, href, description }) => (
-
- {description}
-
- ))}
-
-
- );
-}
diff --git a/apps/web/eslint.config.js b/apps/web/eslint.config.js
deleted file mode 100644
index e8759ff5..00000000
--- a/apps/web/eslint.config.js
+++ /dev/null
@@ -1,4 +0,0 @@
-import { nextJsConfig } from "@repo/eslint-config/next-js";
-
-/** @type {import("eslint").Linter.Config} */
-export default nextJsConfig;
diff --git a/apps/web/next-env.d.ts b/apps/web/next-env.d.ts
deleted file mode 100644
index 1b3be084..00000000
--- a/apps/web/next-env.d.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-///
-
-
-
-
-
-
-
-
-
-
\ No newline at end of file
diff --git a/apps/web/public/turborepo.svg b/apps/web/public/turborepo.svg
deleted file mode 100644
index 2f9aa1f3..00000000
--- a/apps/web/public/turborepo.svg
+++ /dev/null
@@ -1,32 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/apps/web/public/vercel.svg b/apps/web/public/vercel.svg
deleted file mode 100644
index d2f84222..00000000
--- a/apps/web/public/vercel.svg
+++ /dev/null
@@ -1 +0,0 @@
- } | null = null;
+
+async function getAuth() {
+ if (authModule === null) {
+ try {
+ authModule = await import("@query/auth");
+ } catch (error) {
+ console.warn("Auth module not available:", error);
+ authModule = { auth: async () => null };
+ }
+ }
+ return authModule.auth;
+}
+
+export async function createContext(
+ opts?: Partial & { clientIp?: string; req?: Request }
+) {
+ let session = null;
+
+ // Extract request from opts if available
+ const req = opts?.req;
+
+ // Only attempt auth if database is available
+ if (db) {
+ try {
+ const auth = await getAuth();
+ session = await auth();
+ } catch (error) {
+ console.warn("Failed to fetch auth session:", error);
+ }
+ }
+
+ return {
+ db,
+ session,
+ userId: session?.user?.id,
+ cache,
+ clientIp: opts?.clientIp || req?.headers.get("x-forwarded-for")?.split(",")[0] || 'unknown',
+ req
+ };
+}
+
+export type Context = Awaited>;
\ No newline at end of file
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
new file mode 100644
index 00000000..9b4587bf
--- /dev/null
+++ b/packages/api/src/index.ts
@@ -0,0 +1,6 @@
+
+export { appRouter, type AppRouter } from "./root";
+export { createContext, type Context } from "./context";
+export { createTRPCRouter, publicProcedure, protectedProcedure } from "./trpc";
+export { rateLimit, RATE_LIMITS } from "./middleware/security";
+export { cache, CacheKeys } from "./middleware/cache";
\ No newline at end of file
diff --git a/packages/api/src/middleware/cache.ts b/packages/api/src/middleware/cache.ts
new file mode 100644
index 00000000..e9e43cf1
--- /dev/null
+++ b/packages/api/src/middleware/cache.ts
@@ -0,0 +1,184 @@
+/**
+ * In-Memory Cache Service
+ * Provides TTL-based caching with automatic cleanup
+ */
+
+interface CacheEntry {
+ value: T;
+ expiresAt: number;
+}
+
+interface CacheStats {
+ hits: number;
+ misses: number;
+ size: number;
+}
+
+export class CacheService {
+ private cache = new Map>();
+ private stats: CacheStats = { hits: 0, misses: 0, size: 0 };
+ private cleanupInterval: NodeJS.Timeout;
+
+ constructor(private defaultTTL: number = 300) {
+ // Cleanup expired entries every 60 seconds
+ this.cleanupInterval = setInterval(() => {
+ this.cleanup();
+ }, 60 * 1000);
+ }
+
+ /**
+ * Get a value from cache
+ */
+ get(key: string): T | null {
+ const entry = this.cache.get(key) as CacheEntry | undefined;
+
+ if (!entry) {
+ this.stats.misses++;
+ return null;
+ }
+
+ if (Date.now() > entry.expiresAt) {
+ this.cache.delete(key);
+ this.stats.misses++;
+ this.stats.size = this.cache.size;
+ return null;
+ }
+
+ this.stats.hits++;
+ return entry.value;
+ }
+
+ /**
+ * Set a value in cache with optional TTL
+ */
+ set(key: string, value: T, ttl?: number): void {
+ const expiresAt = Date.now() + (ttl || this.defaultTTL) * 1000;
+ this.cache.set(key, { value, expiresAt });
+ this.stats.size = this.cache.size;
+ }
+
+ /**
+ * Delete a specific key from cache
+ */
+ delete(key: string): boolean {
+ const result = this.cache.delete(key);
+ this.stats.size = this.cache.size;
+ return result;
+ }
+
+ /**
+ * Delete all keys matching a pattern (glob-style with * wildcard)
+ */
+ deletePattern(pattern: string): number {
+ let count = 0;
+ // Escape regex special chars, then convert * to .*
+ const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
+ const regex = new RegExp(`^${escaped.replace(/\*/g, '.*')}$`);
+
+ for (const key of this.cache.keys()) {
+ if (regex.test(key)) {
+ this.cache.delete(key);
+ count++;
+ }
+ }
+
+ this.stats.size = this.cache.size;
+ return count;
+ }
+
+ /**
+ * Clear all cache entries
+ */
+ clear(): void {
+ this.cache.clear();
+ this.stats = { hits: 0, misses: 0, size: 0 };
+ }
+
+ /**
+ * Get cache statistics
+ */
+ getStats(): CacheStats {
+ return { ...this.stats };
+ }
+
+ /**
+ * Check if a key exists and is not expired
+ */
+ has(key: string): boolean {
+ return this.get(key) !== null;
+ }
+
+ /**
+ * Get or set pattern - fetch from cache or compute and cache
+ */
+ async getOrSet(
+ key: string,
+ factory: () => Promise | T,
+ ttl?: number
+ ): Promise {
+ const cached = this.get(key);
+ if (cached !== null) {
+ return cached;
+ }
+
+ const value = await factory();
+ this.set(key, value, ttl);
+ return value;
+ }
+
+ /**
+ * Remove expired entries
+ */
+ private cleanup(): void {
+ const now = Date.now();
+ let removed = 0;
+
+ for (const [key, entry] of this.cache.entries()) {
+ if (now > entry.expiresAt) {
+ this.cache.delete(key);
+ removed++;
+ }
+ }
+
+ if (removed > 0) {
+ this.stats.size = this.cache.size;
+ }
+ }
+
+ /**
+ * Destroy the cache service and cleanup intervals
+ */
+ destroy(): void {
+ clearInterval(this.cleanupInterval);
+ this.cache.clear();
+ }
+}
+
+// Global cache instance
+export const cache = new CacheService(300); // 5 minutes default TTL
+
+// Cache key builders for consistency
+export const CacheKeys = {
+ user: (userId: string) => `user:${userId}`,
+ userProfile: (userId: string) => `user:${userId}:profile`,
+ admin: (userId: string) => `admin:${userId}`,
+ hackathon: (id: string) => `hackathon:${id}`,
+ hackathons: () => `hackathons:list`,
+ event: (id: string) => `event:${id}`,
+ events: () => `events:list`,
+ judge: (userId: string) => `judge:${userId}`,
+ member: (userId: string) => `member:${userId}`,
+} as const;
+
+// Cache invalidation helpers
+export const invalidateUser = (userId: string) => {
+ cache.deletePattern(`user:${userId}*`);
+};
+
+export const invalidateHackathons = () => {
+ cache.deletePattern('hackathon*');
+};
+
+export const invalidateEvents = () => {
+ cache.deletePattern('event*');
+};
diff --git a/packages/api/src/middleware/http-security.ts b/packages/api/src/middleware/http-security.ts
new file mode 100644
index 00000000..60bbe701
--- /dev/null
+++ b/packages/api/src/middleware/http-security.ts
@@ -0,0 +1,219 @@
+/**
+ * HTTP Security Headers and Utilities
+ * Provides comprehensive security headers for API responses
+ */
+
+export interface SecurityHeaders {
+ 'X-Content-Type-Options': string;
+ 'X-Frame-Options': string;
+ 'X-XSS-Protection': string;
+ 'Strict-Transport-Security': string;
+ 'Content-Security-Policy': string;
+ 'Referrer-Policy': string;
+ 'Permissions-Policy': string;
+}
+
+export interface CacheHeaders {
+ 'Cache-Control': string;
+ 'Vary': string;
+}
+
+export interface RateLimitHeaders {
+ 'X-RateLimit-Limit': string;
+ 'X-RateLimit-Remaining': string;
+ 'X-RateLimit-Reset': string;
+ 'Retry-After'?: string;
+}
+
+/**
+ * Generate strict security headers for API responses
+ */
+export function getSecurityHeaders(): SecurityHeaders {
+ return {
+ // Prevent MIME type sniffing
+ 'X-Content-Type-Options': 'nosniff',
+
+ // Prevent clickjacking
+ 'X-Frame-Options': 'DENY',
+
+ // Enable XSS protection (legacy but still useful)
+ 'X-XSS-Protection': '1; mode=block',
+
+ // Force HTTPS for 1 year
+ 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
+
+ // Content Security Policy - strict for API
+ 'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'",
+
+ // Referrer policy
+ 'Referrer-Policy': 'strict-origin-when-cross-origin',
+
+ // Permissions policy - disable all features
+ 'Permissions-Policy': 'geolocation=(), microphone=(), camera=()',
+ };
+}
+
+/**
+ * Generate cache control headers based on cacheability
+ */
+export function getCacheHeaders(options: {
+ cacheable: boolean;
+ maxAge?: number;
+ private?: boolean;
+ mustRevalidate?: boolean;
+}): CacheHeaders {
+ const { cacheable, maxAge = 300, private: isPrivate = true, mustRevalidate = true } = options;
+
+ if (!cacheable) {
+ return {
+ 'Cache-Control': 'no-store, no-cache, must-revalidate, private',
+ 'Vary': 'Accept-Encoding, Authorization',
+ };
+ }
+
+ const directives = [
+ isPrivate ? 'private' : 'public',
+ `max-age=${maxAge}`,
+ ];
+
+ if (mustRevalidate) {
+ directives.push('must-revalidate');
+ }
+
+ return {
+ 'Cache-Control': directives.join(', '),
+ 'Vary': 'Accept-Encoding, Authorization',
+ };
+}
+
+/**
+ * Generate rate limit headers
+ */
+export function getRateLimitHeaders(
+ limit: number,
+ remaining: number,
+ resetTimestamp: number,
+ retryAfter?: number
+): RateLimitHeaders {
+ const headers: RateLimitHeaders = {
+ 'X-RateLimit-Limit': limit.toString(),
+ 'X-RateLimit-Remaining': Math.max(0, remaining).toString(),
+ 'X-RateLimit-Reset': resetTimestamp.toString(),
+ };
+
+ if (retryAfter !== undefined) {
+ headers['Retry-After'] = retryAfter.toString();
+ }
+
+ return headers;
+}
+
+/**
+ * Get client IP address from request, considering proxies
+ */
+export function getClientIp(request: Request): string {
+ // Check X-Forwarded-For header (from proxies/load balancers)
+ const forwardedFor = request.headers.get('x-forwarded-for');
+ if (forwardedFor) {
+ // Take the first IP in the chain
+ return forwardedFor.split(',')[0]?.trim() || 'unknown';
+ }
+
+ // Check X-Real-IP header
+ const realIp = request.headers.get('x-real-ip');
+ if (realIp) {
+ return realIp.trim();
+ }
+
+ // Fallback to unknown
+ return 'unknown';
+}
+
+/**
+ * Generate a fingerprint for rate limiting
+ * Combines IP, user agent, and other factors
+ */
+export function getRequestFingerprint(request: Request, userId?: string): string {
+ const ip = getClientIp(request);
+ const userAgent = request.headers.get('user-agent') || 'unknown';
+
+ // Hash the user agent to keep fingerprint shorter
+ const uaHash = simpleHash(userAgent);
+
+ if (userId) {
+ return `user:${userId}:${ip}`;
+ }
+
+ return `anon:${ip}:${uaHash}`;
+}
+
+/**
+ * Simple hash function for strings
+ */
+function simpleHash(str: string): string {
+ let hash = 0;
+ for (let i = 0; i < str.length; i++) {
+ const char = str.charCodeAt(i);
+ hash = ((hash << 5) - hash) + char;
+ hash = hash & hash; // Convert to 32-bit integer
+ }
+ return Math.abs(hash).toString(36);
+}
+
+/**
+ * Apply all headers to a Response object
+ */
+export async function applySecurityHeaders(
+ response: Response,
+ options?: {
+ cacheable?: boolean;
+ maxAge?: number;
+ rateLimit?: {
+ limit: number;
+ remaining: number;
+ reset: number;
+ retryAfter?: number;
+ };
+ }
+): Promise {
+ const headers = new Headers(response.headers);
+
+ // Apply security headers
+ const securityHeaders = getSecurityHeaders();
+ Object.entries(securityHeaders).forEach(([key, value]) => {
+ headers.set(key, value);
+ });
+
+ // Apply cache headers
+ const cacheHeaders = getCacheHeaders({
+ cacheable: options?.cacheable ?? false,
+ maxAge: options?.maxAge,
+ });
+ Object.entries(cacheHeaders).forEach(([key, value]) => {
+ headers.set(key, value);
+ });
+
+ // Apply rate limit headers if provided
+ if (options?.rateLimit) {
+ const rateLimitHeaders = getRateLimitHeaders(
+ options.rateLimit.limit,
+ options.rateLimit.remaining,
+ options.rateLimit.reset,
+ options.rateLimit.retryAfter
+ );
+ Object.entries(rateLimitHeaders).forEach(([key, value]) => {
+ if (value !== undefined) {
+ headers.set(key, value);
+ }
+ });
+ }
+
+ // Clone and read the body to avoid "body already consumed" errors
+ const body = await response.clone().arrayBuffer();
+
+ return new Response(body, {
+ status: response.status,
+ statusText: response.statusText,
+ headers,
+ });
+}
diff --git a/packages/api/src/middleware/procedures.ts b/packages/api/src/middleware/procedures.ts
new file mode 100644
index 00000000..cc47259f
--- /dev/null
+++ b/packages/api/src/middleware/procedures.ts
@@ -0,0 +1,62 @@
+import { TRPCError } from "@trpc/server";
+import { protectedProcedure } from "../trpc";
+import { admins, judges } from "@query/db";
+import { eq, and } from "drizzle-orm";
+
+/**
+ * Middleware that verifies the current user is an active admin.
+ * Adds the admin object to the context.
+ */
+export const isAdmin = protectedProcedure.use(async ({ ctx, next }) => {
+ const admin = await ctx.db!.query.admins.findFirst({
+ where: and(
+ eq(admins.userId, ctx.userId!),
+ eq(admins.isActive, true)
+ ),
+ });
+
+ if (!admin) {
+ throw new TRPCError({
+ code: "FORBIDDEN",
+ message: "Admin access required",
+ });
+ }
+
+ return next({ ctx: { ...ctx, admin } });
+});
+
+/**
+ * Middleware that verifies the current user is a super admin.
+ * Must be used after isAdmin.
+ */
+export const isSuperAdmin = isAdmin.use(async ({ ctx, next }) => {
+ if (ctx.admin.role !== "super_admin") {
+ throw new TRPCError({
+ code: "FORBIDDEN",
+ message: "Super admin access required",
+ });
+ }
+ return next({ ctx });
+});
+
+/**
+ * Middleware that verifies the current user is an active judge.
+ * Adds the judge object to the context.
+ */
+export const isJudge = protectedProcedure.use(async ({ ctx, next }) => {
+ const judge = await ctx.db!.query.judges.findFirst({
+ where: and(
+ eq(judges.userId, ctx.userId!),
+ eq(judges.isActive, true)
+ ),
+ });
+
+ if (!judge) {
+ throw new TRPCError({
+ code: "FORBIDDEN",
+ message: "Judge access required",
+ });
+ }
+
+ return next({ ctx: { ...ctx, judge } });
+});
diff --git a/packages/api/src/middleware/security.ts b/packages/api/src/middleware/security.ts
new file mode 100644
index 00000000..6955377d
--- /dev/null
+++ b/packages/api/src/middleware/security.ts
@@ -0,0 +1,440 @@
+import { TRPCError } from "@trpc/server";
+import sanitizeHtml from "sanitize-html";
+
+interface RateLimitRecord {
+ tokens: number;
+ lastRefill: number;
+ violations: number;
+ blockedUntil: number;
+}
+
+const rateLimitStore = new Map();
+
+interface IPRecord {
+ requests: number;
+ firstRequest: number;
+ suspiciousActivity: number;
+ isBlocked: boolean;
+ blockedUntil: number;
+}
+
+const ipTrackingStore = new Map();
+
+// DDoS Protection Constants
+const DDOS_CONFIG = {
+ maxRequestsPerMinute: 3000, // Increased for venue WiFi (100 judges @ 30rpm)
+ suspiciousThreshold: 2000,
+ blockDurationMs: 5 * 60 * 1000,
+ burstThreshold: 500, // Allow 100 concurrent page loads
+ burstWindowMs: 5 * 1000,
+ cleanupIntervalMs: 60 * 1000,
+};
+
+// Cleanup expired records
+setInterval(() => {
+ const now = Date.now();
+ for (const [key, value] of rateLimitStore.entries()) {
+ if (now > value.lastRefill + 30 * 60 * 1000 && now > value.blockedUntil) {
+ rateLimitStore.delete(key);
+ }
+ }
+ // Cleanup IP tracking records older than 5 minutes
+ for (const [ip, record] of ipTrackingStore.entries()) {
+ if (now - record.firstRequest > 5 * 60 * 1000 && !record.isBlocked) {
+ ipTrackingStore.delete(ip);
+ }
+ // Unblock IPs after block duration
+ if (record.isBlocked && now > record.blockedUntil) {
+ record.isBlocked = false;
+ record.requests = 0;
+ record.suspiciousActivity = 0;
+ record.firstRequest = now;
+ }
+ }
+}, DDOS_CONFIG.cleanupIntervalMs);
+
+export function rateLimit(
+ identifier: string,
+ maxTokens: number,
+ refillRatePerSecond: number,
+ tokensToConsume: number = 1
+): { allowed: boolean; retryAfter?: number } {
+ const now = Date.now();
+ let record = rateLimitStore.get(identifier);
+
+ if (!record) {
+ record = {
+ tokens: maxTokens,
+ lastRefill: now,
+ violations: 0,
+ blockedUntil: 0,
+ };
+ rateLimitStore.set(identifier, record);
+ }
+
+ if (now < record.blockedUntil) {
+ return {
+ allowed: false,
+ retryAfter: Math.ceil((record.blockedUntil - now) / 1000),
+ };
+ }
+
+ const elapsed = (now - record.lastRefill) / 1000;
+ const refill = elapsed * refillRatePerSecond;
+ record.tokens = Math.min(maxTokens, record.tokens + refill);
+ record.lastRefill = now;
+
+ if (record.tokens < tokensToConsume) {
+ record.violations++;
+ const backoffSeconds = Math.min(Math.pow(2, record.violations - 1), 300);
+ record.blockedUntil = now + backoffSeconds * 1000;
+
+ return {
+ allowed: false,
+ retryAfter: backoffSeconds,
+ };
+ }
+
+ record.tokens -= tokensToConsume;
+
+ if (record.violations > 0 && elapsed > 600) {
+ record.violations = Math.max(0, record.violations - 1);
+ }
+
+ return { allowed: true };
+}
+
+export const RATE_LIMITS = {
+ public: {
+ maxTokens: 1000,
+ refillRate: 50,
+ queryTokens: 1,
+ mutationTokens: 3,
+ },
+ authenticated: {
+ maxTokens: 100,
+ refillRate: 2,
+ queryTokens: 1,
+ mutationTokens: 2,
+ },
+ judge: {
+ maxTokens: 200,
+ refillRate: 5,
+ queryTokens: 1,
+ mutationTokens: 1,
+ },
+ admin: {
+ maxTokens: 150,
+ refillRate: 3,
+ queryTokens: 1,
+ mutationTokens: 2,
+ },
+} as const;
+
+const SANITIZE_OPTIONS: sanitizeHtml.IOptions = {
+ allowedTags: [],
+ allowedAttributes: {},
+ disallowedTagsMode: 'discard',
+};
+
+export function sanitizeInput(input: unknown, depth: number = 0): unknown {
+ if (depth > 10) {
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Input too deeply nested",
+ });
+ }
+
+ if (input === null || input === undefined) {
+ return input;
+ }
+
+ if (typeof input === 'string') {
+ const sanitized = sanitizeHtml(input, SANITIZE_OPTIONS)
+ .trim()
+ .slice(0, 10000);
+
+ if (hasInjectionPattern(sanitized)) {
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Invalid input",
+ });
+ }
+
+ return sanitized;
+ }
+
+ if (typeof input === 'number') {
+ if (!Number.isFinite(input)) {
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Invalid number",
+ });
+ }
+ return input;
+ }
+
+ if (typeof input === 'boolean') {
+ return input;
+ }
+
+ if (Array.isArray(input)) {
+ if (input.length > 500) {
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Array too large",
+ });
+ }
+ return input.map(item => sanitizeInput(item, depth + 1));
+ }
+
+ if (typeof input === 'object') {
+ const keys = Object.keys(input as object);
+ if (keys.length > 50) {
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Object too complex",
+ });
+ }
+
+ const sanitized: Record = {};
+ for (const [key, value] of Object.entries(input as object)) {
+ if (!/^[\w\-\.]{1,100}$/.test(key)) {
+ continue;
+ }
+ sanitized[key] = sanitizeInput(value, depth + 1);
+ }
+ return sanitized;
+ }
+
+ throw new TRPCError({
+ code: "BAD_REQUEST",
+ message: "Invalid input type",
+ });
+}
+
+function hasInjectionPattern(str: string): boolean {
+ const patterns = [
+ /(\b(union|select|insert|update|delete|drop|create|alter|exec|execute)\b.*\b(from|into|table|database)\b)/i,
+ /(--|\#|\/\*)/,
+ /(\bor\b|\band\b)\s*[\d\w]+\s*=\s*[\d\w]+/i,
+ /\$where/i,
+ /\$gt|\$lt|\$ne|\$eq/i,
+ /
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Welcome
+
Firebase Hosting Setup Complete
+
You're seeing this because you've successfully setup Firebase Hosting. Now it's time to go build something extraordinary!
+
Open Hosting Documentation
+
Firebase SDK Loading…
+
+
+
+