Release: The Forum 1.0 (forum.tigerapps.org)

.cursor/rules/project-conventions.mdc

@@ -27,7 +27,7 @@ bun run format    # format only
 ### Monorepo structure
 
 ```
-apps/web        — Next.js 15 (App Router)  → @the-forum/web
+apps/web        — Next.js 16 (App Router)  → @the-forum/web
 apps/database   — Drizzle ORM              → @the-forum/database
 backends/fastapi — FastAPI Python          → @the-forum/fastapi
 ```

.env.example

@@ -12,36 +12,29 @@ POSTGRES_PORT=5434
 # ----- Database URL (used by Drizzle & Next.js) -----
 DATABASE_URL=postgresql://forum:forum_password@localhost:5434/the_forum
 
-# ----- Auth.js (Microsoft Entra ID) -----
+# ----- Auth.js + Princeton CAS -----
+# Generate with: openssl rand -base64 32
 AUTH_SECRET=your-auth-secret-here
-AUTH_AZURE_AD_CLIENT_ID=your-client-id
-AUTH_AZURE_AD_CLIENT_SECRET=your-client-secret
-AUTH_AZURE_AD_TENANT_ID=YOUR_TENANT_ID_HERE
+# Canonical public URL of the app. Required in production (pins the CAS service
+# URL and Auth.js callbacks to this origin). Optional locally.
+# AUTH_URL=https://forum.example.edu
+# Trust X-Forwarded-Host/Proto from your reverse proxy (not needed on Vercel or when AUTH_URL is set).
+# AUTH_TRUST_HOST=true
+# Princeton CAS server (default shown).
+# CAS_BASE_URL=https://fed.princeton.edu/cas/
 
 # ----- AWS S3 (image uploads) -----
 # AWS_S3_BUCKET=the-forum-uploads
 # AWS_REGION=us-east-1
 
 # ----- Next.js public vars (prefix with NEXT_PUBLIC_) -----
-# NEXT_PUBLIC_API_URL=http://localhost:8000
+# Public origin for metadata / Open Graph / sitemap (defaults to https://forum.tigerapps.org)
+# NEXT_PUBLIC_SITE_URL=https://forum.tigerapps.org
 NEXT_PUBLIC_MAPBOX_TOKEN=YOUR_CAMPUS_MAPBOX_TOKEN_HERE
 NEXT_PUBLIC_CAMPUS_MAP_TOKEN=YOUR_CAMPUS_MAP_TOKEN_HERE
 NEXT_PUBLIC_CAMPUS_MAP_STYLE=YOUR_CAMPUS_MAP_STYLE_HERE
 
-# ----- FastAPI -----
-# FASTAPI_SECRET_KEY=changeme
+# ----- InboxEngine (org/venue/event sync, apps/database) -----
+# INBOX_ENGINE_URL=https://inbox-engine.tigerapps.org
+# INBOX_ENGINE_TOKEN=ask-a-tigerapps-admin
 
-# ----- Pipeline (Phase 7) -----
-# Gmail API — OAuth2 credentials JSON (from Google Cloud Console)
-# GMAIL_CREDENTIALS_JSON={"installed":{"client_id":"...","client_secret":"...",...}}
-# GMAIL_TOKEN_PATH=./gmail_token.json
-
-# OpenRouter API key for LLM extraction (Gemini 3.1 Flash Lite)
-# OPENROUTER_API_KEY=sk-or-...
-
-# Admin API key for pipeline management endpoints
-# ADMIN_API_KEY=your-secret-admin-key
-
-# ----- Listserv Scraper -----
-LISTSERV_EMAIL=tigerapp@princeton.edu
-LISTSERV_PASSWORD=YOUR_LISTSERV_PASSWORD_HERE

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [staging, main]
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  web:
+    name: lint / typecheck / test / build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      # No secrets needed: env validation is skipped and every value is a dummy.
+      SKIP_ENV_VALIDATION: "1"
+      AUTH_SECRET: ci-dummy-auth-secret
+      DATABASE_URL: postgresql://ci:ci@localhost:5432/ci
+      NEXT_PUBLIC_MAPBOX_TOKEN: pk.ci-dummy
+      NEXT_PUBLIC_CAMPUS_MAP_TOKEN: pk.ci-dummy
+      NEXT_PUBLIC_CAMPUS_MAP_STYLE: mapbox://styles/ci/dummy
+      NEXT_TELEMETRY_DISABLED: "1"
+      TURBO_TELEMETRY_DISABLED: "1"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          # bun.lock uses configVersion (Bun >= 1.3).
+          bun-version: 1.3.5
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Lint (Biome)
+        run: bun run lint
+
+      - name: Typecheck (apps/web)
+        run: bunx tsc --noEmit -p apps/web
+
+      - name: Unit tests (apps/web)
+        working-directory: apps/web
+        run: bun test
+
+      - name: Build (apps/web)
+        run: bun run build --filter=@the-forum/web

.github/workflows/deploy.yml

@@ -0,0 +1,115 @@
+name: Deploy
+
+# staging → forumdev.tigerapps.org, main → forum.tigerapps.org, after the CI checks pass.
+on:
+  push:
+    branches: [staging, main]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Environment to deploy from this ref
+        type: choice
+        options: [staging, production]
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  deploy:
+    needs: ci
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    concurrency:
+      group: theforum-deploy-${{ github.ref_name }}
+      cancel-in-progress: false
+    env:
+      AWS_REGION: us-east-1
+      BUCKET: theforum-deploy-104733724423-us-east-1
+      INSTANCE_ID: i-00a811982e8784203
+      SHA: ${{ github.sha }}
+      BRANCH: ${{ github.ref_name }}
+    steps:
+      - name: Choose environment
+        run: |
+          if [ "${{ github.event_name }}" = workflow_dispatch ]; then target="${{ inputs.environment }}";
+          elif [ "$BRANCH" = main ]; then target=production; else target=staging; fi
+          if [ "$target" = production ]; then site=https://forum.tigerapps.org; else site=https://forumdev.tigerapps.org; fi
+          echo "TARGET=$target" >> "$GITHUB_ENV"
+          echo "NEXT_PUBLIC_SITE_URL=$site" >> "$GITHUB_ENV"
+          echo "Deploying $SHA ($BRANCH) to $target"
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.SHA }}
+
+      - name: Fetch the InboxEngine submodule (private)
+        env:
+          KEY: ${{ secrets.INBOX_ENGINE_DEPLOY_KEY }}
+        run: |
+          install -m 700 -d ~/.ssh
+          printf '%s\n' "$KEY" > ~/.ssh/inbox_engine && chmod 600 ~/.ssh/inbox_engine
+          ssh-keyscan -t ed25519 github.com >> ~/.ssh/known_hosts 2>/dev/null
+          git -c url."git@github.com:TigerAppsOrg/InboxEngine".insteadOf="https://github.com/TigerAppsOrg/InboxEngine" \
+            -c core.sshCommand="ssh -i ~/.ssh/inbox_engine -o IdentitiesOnly=yes" \
+            submodule update --init --depth 1
+          rm -f ~/.ssh/inbox_engine
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.5
+
+      - run: bun install --frozen-lockfile --ignore-scripts
+
+      - name: Build
+        env:
+          SKIP_ENV_VALIDATION: "1"
+          # Placeholders for build-time module evaluation; nothing connects during the build.
+          DATABASE_URL: postgresql://build:build@localhost:5432/build
+          AUTH_SECRET: build-time-placeholder
+          NEXT_TELEMETRY_DISABLED: "1"
+          TURBO_TELEMETRY_DISABLED: "1"
+          NEXT_PUBLIC_MAPBOX_TOKEN: ${{ vars.NEXT_PUBLIC_MAPBOX_TOKEN }}
+          NEXT_PUBLIC_CAMPUS_MAP_TOKEN: ${{ vars.NEXT_PUBLIC_CAMPUS_MAP_TOKEN }}
+          NEXT_PUBLIC_CAMPUS_MAP_STYLE: ${{ vars.NEXT_PUBLIC_CAMPUS_MAP_STYLE }}
+        run: |
+          bun run build --filter=@the-forum/web
+          deploy/build-release.sh /tmp/release.tar.gz
+          echo "DIGEST=$(sha256sum /tmp/release.tar.gz | cut -d' ' -f1)" >> "$GITHUB_ENV"
+
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::104733724423:role/TheForumGitHubDeployRole
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Upload release
+        run: aws s3 cp /tmp/release.tar.gz "s3://$BUCKET/releases/theforum/$TARGET/$SHA.tar.gz" --only-show-errors
+
+      - name: Deploy through SSM
+        run: |
+          set -euo pipefail
+          params=$(jq -n --arg e "$TARGET" --arg r "$SHA" --arg c "$DIGEST" '{Environment:[$e],Release:[$r],Checksum:[$c]}')
+          id=$(aws ssm send-command --instance-ids "$INSTANCE_ID" --document-name TheForumDeploy --parameters "$params" --query Command.CommandId --output text)
+          echo "SSM command $id"
+          for _ in $(seq 1 100); do
+            status=$(aws ssm get-command-invocation --command-id "$id" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
+            case "$status" in
+              Success) aws ssm get-command-invocation --command-id "$id" --instance-id "$INSTANCE_ID" --query StandardOutputContent --output text | tail -8; exit 0 ;;
+              Failed|Cancelled|TimedOut|Cancelling)
+                aws ssm get-command-invocation --command-id "$id" --instance-id "$INSTANCE_ID" --query '{out:StandardOutputContent,err:StandardErrorContent}'; exit 1 ;;
+            esac
+            sleep 10
+          done
+          echo 'Deployment did not finish in time'; exit 1
+
+      - name: Smoke test through Cloudflare
+        run: |
+          if [ "$TARGET" = production ]; then url=https://forum.tigerapps.org; else url=https://forumdev.tigerapps.org; fi
+          for _ in $(seq 1 10); do
+            code=$(curl -s -o /dev/null -w '%{http_code}' "$url/") && [ "$code" = 200 ] && { echo "$url is up"; exit 0; }
+            sleep 6
+          done
+          echo "$url did not return 200"; exit 1

.gitignore

@@ -57,3 +57,8 @@ Thumbs.db
 *.ntvs*
 *.njsproj
 *.sln
+
+# ---- Secrets / local artifacts ----
+gmail_token.json
+**/cookies.json
+*.tsbuildinfo

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "packages/inbox-engine"]
+	path = packages/inbox-engine
+	url = https://github.com/TigerAppsOrg/InboxEngine.git

AGENTS.md

@@ -3,9 +3,9 @@
 ## Project Overview
 
 Turborepo monorepo with:
-- `apps/web` — Next.js 15 (App Router, Turbopack, Tailwind v4, shadcn/ui)
+- `apps/web` — Next.js 16 (App Router, Turbopack, Tailwind v4, shadcn/ui), Auth.js v5 + Princeton CAS login
 - `apps/database` — Drizzle ORM + PostgreSQL
-- `backends/fastapi` — FastAPI (Python 3.12, uv)
+- `packages/inbox-engine` — git submodule (TigerAppsOrg/InboxEngine): shared org/venue/event source of truth; sync with `bun run db:sync-engine`. Don't edit it here — change InboxEngine and bump the submodule.
 
 ---
 

CLAUDE.md

@@ -3,9 +3,9 @@
 ## Project Overview
 
 Turborepo monorepo with:
-- `apps/web` — Next.js 15 (App Router, Turbopack, Tailwind v4, shadcn/ui)
+- `apps/web` — Next.js 16 (App Router, Turbopack, Tailwind v4, shadcn/ui), Auth.js v5 + Princeton CAS login
 - `apps/database` — Drizzle ORM + PostgreSQL
-- `backends/fastapi` — FastAPI (Python 3.12, uv)
+- `packages/inbox-engine` — git submodule (TigerAppsOrg/InboxEngine): shared org/venue/event source of truth; sync with `bun run db:sync-engine`. Don't edit it here — change InboxEngine and bump the submodule.
 
 ---