feat: core team

Author: rahulbangera

package.json

@@ -77,6 +77,7 @@
     "react": "19.2.3",
     "react-day-picker": "9.13.2",
     "react-dom": "19.2.3",
+    "react-easy-crop": "^5.5.7",
     "react-hook-form": "7.67.0",
     "react-markdown": "10.1.0",
     "react-pdf": "10.3.0",

pnpm-lock.yaml

@@ -1,6 +1,6 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { permissionProtected, type RouteContext } from "~/auth/routes-wrapper";
+import { adminProtected, type RouteContext } from "~/auth/routes-wrapper";
 import {
   deleteFacultyMember,
   findFacultyMemberById,
@@ -21,8 +21,7 @@ const updateFacultyRequestSchema = updateFacultySchema.extend({
   socialLinks: updateFacultySchema.shape.socialLinks.optional(),
 });
 
-export const PUT = permissionProtected<FacultyMemberParams>(
-  ["team:view_all"],
+export const PUT = adminProtected<FacultyMemberParams>(
   async (
     request: NextRequest,
     { params }: RouteContext<FacultyMemberParams>,
@@ -73,8 +72,7 @@ export const PUT = permissionProtected<FacultyMemberParams>(
   },
 );
 
-export const DELETE = permissionProtected<FacultyMemberParams>(
-  ["team:view_all"],
+export const DELETE = adminProtected<FacultyMemberParams>(
   async (
     _request: NextRequest,
     { params }: RouteContext<FacultyMemberParams>,

src/app/api/admin/faculty/[id]/route.ts

@@ -1,5 +1,5 @@
 import { type NextRequest, NextResponse } from "next/server";
-import { permissionProtected, type RouteContext } from "~/auth/routes-wrapper";
+import { adminProtected, type RouteContext } from "~/auth/routes-wrapper";
 import {
   normalizeFacultyMember,
   toggleFacultyMemberStatus,
@@ -9,8 +9,7 @@ type FacultyMemberParams = {
   id: string;
 };
 
-export const PATCH = permissionProtected<FacultyMemberParams>(
-  ["team:view_all"],
+export const PATCH = adminProtected<FacultyMemberParams>(
   async (
     _request: NextRequest,
     { params }: RouteContext<FacultyMemberParams>,

src/app/api/admin/faculty/[id]/toggle/route.ts

@@ -1,6 +1,6 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { permissionProtected } from "~/auth/routes-wrapper";
+import { adminProtected } from "~/auth/routes-wrapper";
 import {
   createFacultyMember,
   listAllFacultyMembers,
@@ -9,8 +9,7 @@ import {
 import { AppError } from "~/lib/errors/app-error";
 import { createFacultySchema } from "~/lib/validation/faculty";
 
-export const GET = permissionProtected(
-  ["team:view_all"],
+export const GET = adminProtected(
   async (_request: NextRequest) => {
     try {
       const faculty = await listAllFacultyMembers();
@@ -27,8 +26,7 @@ export const GET = permissionProtected(
   },
 );
 
-export const POST = permissionProtected(
-  ["team:view_all"],
+export const POST = adminProtected(
   async (request: NextRequest) => {
     const requestStart = Date.now();
 

src/app/api/admin/faculty/route.ts

@@ -1,6 +1,10 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { permissionProtected, type RouteContext } from "~/auth/routes-wrapper";
+import {
+  type DashboardUser,
+  permissionProtected,
+  type RouteContext,
+} from "~/auth/routes-wrapper";
 import {
   deleteTeamMember,
   findTeamMemberById,
@@ -11,6 +15,11 @@ import {
   deleteCloudinaryAsset,
   extractCloudinaryPublicId,
 } from "~/lib/cloudinary/server";
+import {
+  getAllowedCommittees,
+  type TeamCommittee,
+} from "~/lib/constants/team-committees";
+import { isAdmin } from "~/lib/auth/permissions";
 import { updateTeamMemberSchema } from "~/lib/validation/team-member";
 
 type TeamMemberParams = {
@@ -21,13 +30,35 @@ const updateTeamMemberRequestSchema = updateTeamMemberSchema.extend({
   socialLinks: updateTeamMemberSchema.shape.socialLinks.optional(),
 });
 
+function getUserPermissionKeys(user: NonNullable<DashboardUser>): string[] {
+  return user.roles.flatMap((r) => r.permissions).map((p) => p.key);
+}
+function canManageCommittee(
+  user: NonNullable<DashboardUser>,
+  committee: string,
+): boolean {
+  const allowed = getAllowedCommittees(
+    getUserPermissionKeys(user),
+    isAdmin(user),
+  );
+  return allowed.includes(committee as TeamCommittee);
+}
+
 export const PUT = permissionProtected<TeamMemberParams>(
-  ["team:view_all"],
-  async (request: NextRequest, { params }: RouteContext<TeamMemberParams>) => {
+  ["core:manage"],
+  async (request: NextRequest, { params }: RouteContext<TeamMemberParams>, user) => {
     try {
       const { id } = await params;
       const existing = await findTeamMemberById(id);
 
+      // Verify the user can manage this member's committee
+      if (!canManageCommittee(user, existing.committee)) {
+        return NextResponse.json(
+          { message: "You do not have permission to manage this committee" },
+          { status: 403 },
+        );
+      }
+
       const body = await request.json();
       const parsed = updateTeamMemberRequestSchema.safeParse(body);
 
@@ -38,6 +69,17 @@ export const PUT = permissionProtected<TeamMemberParams>(
         );
       }
 
+      if (
+        parsed.data.committee &&
+        parsed.data.committee !== existing.committee &&
+        !canManageCommittee(user, parsed.data.committee)
+      ) {
+        return NextResponse.json(
+          { message: "You do not have permission to move members to that committee" },
+          { status: 403 },
+        );
+      }
+
       const nextPhoto = parsed.data.photo;
       const hasPhotoReplacement = !!nextPhoto && nextPhoto !== existing.photo;
 
@@ -71,10 +113,21 @@ export const PUT = permissionProtected<TeamMemberParams>(
 );
 
 export const DELETE = permissionProtected<TeamMemberParams>(
-  ["team:view_all"],
-  async (_request: NextRequest, { params }: RouteContext<TeamMemberParams>) => {
+  ["core:manage"],
+  async (_request: NextRequest, { params }: RouteContext<TeamMemberParams>, user) => {
     try {
       const { id } = await params;
+
+      // Fetch member first to check committee
+      const existing = await findTeamMemberById(id);
+
+      if (!canManageCommittee(user, existing.committee)) {
+        return NextResponse.json(
+          { message: "You do not have permission to manage this committee" },
+          { status: 403 },
+        );
+      }
+
       const member = await deleteTeamMember(id);
 
       const cloudinaryId =

src/app/api/admin/teams/[id]/route.ts

@@ -1,19 +1,42 @@
 import { type NextRequest, NextResponse } from "next/server";
-import { permissionProtected, type RouteContext } from "~/auth/routes-wrapper";
 import {
+  type DashboardUser,
+  permissionProtected,
+  type RouteContext,
+} from "~/auth/routes-wrapper";
+import {
+  findTeamMemberById,
   normalizeTeamMember,
   toggleTeamMemberStatus,
 } from "~/db/services/team-member-services";
+import {
+  getAllowedCommittees,
+  type TeamCommittee,
+} from "~/lib/constants/team-committees";
+import { isAdmin } from "~/lib/auth/permissions";
 
 type TeamMemberParams = {
   id: string;
 };
 
 export const PATCH = permissionProtected<TeamMemberParams>(
-  ["team:view_all"],
-  async (_request: NextRequest, { params }: RouteContext<TeamMemberParams>) => {
+  ["core:manage"],
+  async (_request: NextRequest, { params }: RouteContext<TeamMemberParams>, user) => {
     try {
       const { id } = await params;
+
+      // Verify the user can manage this member's committee
+      const existing = await findTeamMemberById(id);
+      const permKeys = user.roles.flatMap((r) => r.permissions).map((p) => p.key);
+      const allowed = getAllowedCommittees(permKeys, isAdmin(user));
+
+      if (!allowed.includes(existing.committee as TeamCommittee)) {
+        return NextResponse.json(
+          { message: "You do not have permission to manage this committee" },
+          { status: 403 },
+        );
+      }
+
       const member = await toggleTeamMemberStatus(id);
 
       return NextResponse.json({

src/app/api/admin/teams/[id]/toggle/route.ts

@@ -1,20 +1,42 @@
 import { type NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
-import { permissionProtected } from "~/auth/routes-wrapper";
+import {
+  type DashboardUser,
+  permissionProtected,
+} from "~/auth/routes-wrapper";
 import {
   createTeamMember,
   listAllTeamMembers,
   normalizeTeamMember,
 } from "~/db/services/team-member-services";
+import {
+  getAllowedCommittees,
+  type TeamCommittee,
+} from "~/lib/constants/team-committees";
+import { isAdmin } from "~/lib/auth/permissions";
 import { createTeamMemberSchema } from "~/lib/validation/team-member";
 
+function getUserPermissionKeys(user: NonNullable<DashboardUser>): string[] {
+  return user.roles.flatMap((r) => r.permissions).map((p) => p.key);
+}
+
 export const GET = permissionProtected(
-  ["team:view_all"],
-  async (_request: NextRequest) => {
+  ["core:manage"],
+  async (_request: NextRequest, _ctx, user) => {
     try {
       const members = await listAllTeamMembers();
+
+      const allowed = getAllowedCommittees(
+        getUserPermissionKeys(user),
+        isAdmin(user),
+      );
+
+      const filtered = members.filter((m) =>
+        allowed.includes(m.committee as TeamCommittee),
+      );
+
       return NextResponse.json({
-        members: members.map(normalizeTeamMember),
+        members: filtered.map(normalizeTeamMember),
       });
     } catch (error) {
       console.error("Error fetching team members:", error);
@@ -27,12 +49,25 @@ export const GET = permissionProtected(
 );
 
 export const POST = permissionProtected(
-  ["team:view_all"],
-  async (request: NextRequest) => {
+  ["core:manage"],
+  async (request: NextRequest, _ctx, user) => {
     const requestStart = Date.now();
 
     try {
       const body = await request.json();
+
+      const allowed = getAllowedCommittees(
+        getUserPermissionKeys(user),
+        isAdmin(user),
+      );
+
+      if (body?.committee && !allowed.includes(body.committee as TeamCommittee)) {
+        return NextResponse.json(
+          { message: "You do not have permission to add members to this committee" },
+          { status: 403 },
+        );
+      }
+
       console.info("[API][admin/teams][POST] Request received", {
         hasPhoto: Boolean(body?.photo),
         committee: body?.committee,