Merge dev into bootcamp; workshop model replaces bootcamp_material

Resolve the #390 overlap in favour of bootcamp_workshop. #390's routes,
components and tests are removed; its table stays declared so drizzle-kit
push does not stop at a DROP TABLE prompt, to be dropped separately.

Club page keeps #390's syllabus with attendance badges and adds the
welcome copy and weekly materials table, so enrolled members see both.

Fixes from review:
- Gate member reads and downloads on the workshop's own term, not
  currentTerm(), so a cohort keeps its material after the term rolls.
- upsertSession takes a workshopId and uses that row's term and week,
  and the admin page calls it only when the date or room changed, so a
  TBA save no longer detaches the live session for that week.
- Rescheduling no longer overwrites the event's title, and an omitted
  location leaves the event's room alone.
- A workshop's week is fixed after creation; the session joins on it.
- Drop the process-wide setMaxListeners(15).

Author: aamoghS

apphosting.yaml

@@ -62,16 +62,19 @@ env:
   # Cloud Storage bucket holding resume PDFs. Postgres keeps only the metadata
   # and the object key — 5000 resumes is 1.5 GB and this database is 0.5 GB.
   # The runtime service account needs objectAdmin on it:
-  #   gcloud storage buckets create gs://dsgt-resumes --location=us-central1 \
+  #   gcloud storage buckets create gs://dsgt-resumes --location=us-east4 \
   #     --uniform-bucket-level-access --public-access-prevention
   #   gcloud storage buckets add-iam-policy-binding gs://dsgt-resumes \
-  #     --member=serviceAccount:<app-hosting-runtime-sa> \
+  #     --member=serviceAccount:firebase-app-hosting-compute@dsgt-website.iam.gserviceaccount.com \
   #     --role=roles/storage.objectAdmin
+  # Both are already applied in dsgt-website. us-east4 matches the backend's
+  # Cloud Run region, so reads and writes stay in-region.
   - variable: RESUME_BUCKET
     value: dsgt-resumes
-  # Workshop ZIPs have a separate lifecycle and access policy from resumes.
-  # Local development must use a separate bucket because E2E checks delete
-  # deterministic object keys.
+  # Cloud Storage bucket holding bootcamp workshop ZIPs — notebooks,
+  # datasets. Same runtime service account, same objectAdmin grant, already
+  # applied. Separate from the resume bucket on purpose: those are documents
+  # no member may read, these are files every enrolled member may.
   - variable: BOOTCAMP_BUCKET
     value: dsgt-bootcamp
   # Consumer Gmail, which caps around 500 recipients a day — shared between

docs/README.md

@@ -16,6 +16,7 @@ Members looking for a club-language overview should start at [Club project](./cl
 | [Security](./operations/security.md) | Auth gates, rate limits, CSP, input scrubbing |
 | [Testing](./operations/testing.md) | Vitest, Playwright, and what each suite protects |
 | [Resume book](./resume-book.md) | Member uploads, the two staff views, limits, and why files skip tRPC |
+| [Bootcamp materials](./bootcamp-materials.md) | Weekly workshop ZIPs: who can download one, publishing, session dates, storage |
 | [Glossary](./glossary.md) | Club vs hackathon vocabulary |
 
 ## Packages

docs/architecture.md

@@ -42,6 +42,7 @@ Year-round DSGT operations. **Not** scoped to a hackathon row.
 - Membership (`member`, `membership_history`) — one paid year per person, defined by start/end dates
 - Club events and QR check-in (`event`, `event_check_in`)
 - Bootcamp sessions are club events with `bootcamp_week` + `bootcamp_term`
+- Bootcamp workshop material (`bootcamp_workshop`, one row per week) joins those events on `(term, week)`; the ZIPs are in Cloud Storage and downloads are gated on the workshop's own term — see [Bootcamp materials](./bootcamp-materials.md)
 - Initiatives (`initiative`, `initiative_application`) led by `project_leader`
 - Stripe payments and account linking
 

docs/bootcamp-materials.md

@@ -0,0 +1,53 @@
+# Bootcamp materials
+
+Each week of a bootcamp has one workshop row: a title, a materials ZIP, a solution ZIP and a recording link. Staff manage the rows at `/admin/bootcamp` and publish each one when it's ready. Members download from `/club/bootcamp`. Nobody else can download, including members who didn't buy the bootcamp.
+
+Sessions themselves are ordinary events carrying `bootcamp_week` and `bootcamp_term`; see [Architecture](./architecture.md). A workshop row finds its session by `(term, week)`. There is no foreign key, so deleting a session never deletes the notebooks.
+
+## Where things are
+
+| Piece | Path |
+| --- | --- |
+| Table (metadata only) | `packages/db/src/schemas/bootcamp.ts` (`bootcamp_workshop`) |
+| API | `packages/api/src/routers/bootcamp.ts` (`workshops`, `adminWorkshops`, `createWorkshop`, `updateWorkshop`, `upsertSession`, `setPublished`) |
+| Upload / serve / clear one ZIP | `sites/mainweb/app/(portal)/api/bootcamp/materials/[workshopId]/[kind]/route.ts` |
+| Delete a workshop | `sites/mainweb/app/(portal)/api/bootcamp/materials/[workshopId]/route.ts` |
+| ZIP rules (signature, cap, names) | `sites/mainweb/lib/bootcamp-file.ts` |
+| Download rule | `sites/mainweb/lib/bootcamp-route-rules.ts` |
+| Caller lookup | `sites/mainweb/lib/bootcamp-access.ts` |
+| Bucket client | `sites/mainweb/lib/bootcamp-storage.ts` |
+| Member table / staff modal | `sites/mainweb/components/portal/BootcampMaterialsTable.tsx`, `BootcampWorkshopModal.tsx` |
+
+## Who can download a file
+
+- Staff can download anything, drafts and past terms included.
+- A member can download a **published** file when their `member.bootcamp_term` equals the **workshop's term**, not the current term. Someone who bought the fall bootcamp keeps the fall notebooks in January. They don't get the spring ones.
+- Everyone else gets **404, not 403**, so a guessed workshop id can't confirm that a draft exists.
+
+Publishing is its own procedure (`setPublished`), separate from saving. That keeps a row hidden until its uploads have landed, and a failed upload can't leave it visible.
+
+## Session dates
+
+The modal's date and room fields call `upsertSession`, but only when the officer changed one of them. So saving a TBA workshop never touches an event. Term and week come from the workshop row, never from the clock, so editing a past cohort can't reach the current one.
+
+- **Setting a date** creates the week's event, or reschedules the existing one. The QR code is minted on insert only, so printed signs keep working. The event's title is left alone on reschedule.
+- **Clearing a date** detaches the event (clears `bootcamp_week`/`bootcamp_term`) rather than deleting it, because deleting an event destroys its check-ins.
+- A workshop's **week is fixed** once it's created, because moving it would leave its session behind. To renumber a workshop, delete it and create it again.
+
+## Storage
+
+ZIPs live in `gs://dsgt-bootcamp` under `bootcamp/<workshopId>/<kind>.zip`. Postgres holds the object key, file name and size. Objects are keyed by the workshop id, which never changes. A key based on `(term, week)` would let one row's upload overwrite another row's file.
+
+Uploads bypass tRPC and stream straight into the bucket. `uploadProcedure` caps at 2MB and superjson base64-encodes the body. The first four bytes are held until the ZIP signature checks out, and the stream stops at 20MB, which leaves headroom under Cloud Run's 32MiB request limit.
+
+Downloads are proxied, never redirected to a signed URL, which would leave the origin and the auth check behind. The bucket keeps uniform bucket-level access and public access prevention **enforced**. The App Hosting runtime service account has `roles/storage.objectAdmin` on it.
+
+Credentials are Application Default Credentials. Locally, run `gcloud auth application-default login`. With `BOOTCAMP_BUCKET` unset, the file routes return 503.
+
+## Known limitation
+
+An upload and a removal of the same file can race, because the object write and the row update can't be one transaction. With a handful of officers, the impact is low.
+
+## Legacy table
+
+`bootcamp_material` (#390's per-event handouts) is still declared in the schema, but nothing reads or writes it. Deploys run `drizzle-kit push`, and removing the declaration would make push stop at a DROP TABLE prompt. Drop the table in a separate change.

docs/operations/environment.md

@@ -56,7 +56,7 @@ Without `DATABASE_URL`, `db` is null, sessions fall back to JWT, and tRPC proced
 | Variable | Default / notes |
 | --- | --- |
 | `RESUME_BUCKET` | Cloud Storage bucket holding resume PDFs (App Hosting sets `dsgt-resumes`). Unset means uploads return 503 rather than failing obscurely. Credentials are ADC — the runtime service account needs `roles/storage.objectAdmin`. See [Resume book](../resume-book.md) |
-| `BOOTCAMP_BUCKET` | Cloud Storage bucket holding workshop ZIPs (App Hosting sets `dsgt-bootcamp`). Use a separate development bucket locally because uploads and deletes use deterministic workshop-id keys. Unset means file routes return 503. Credentials are ADC; the active account needs `roles/storage.objectAdmin`. |
+| `BOOTCAMP_BUCKET` | Cloud Storage bucket holding bootcamp workshop ZIPs (App Hosting sets `dsgt-bootcamp`). Unset means uploads and downloads return 503. Same ADC and same `roles/storage.objectAdmin` as above. Downloads are proxied and gated on the caller's bootcamp term, so the bucket keeps public access prevention on |
 
 ## Security / proxy
 

docs/operations/testing.md

@@ -43,7 +43,7 @@ Tests use `src/test/create-mock-context.ts` and `.internal-tests/_db-tx-mock.ts`
 
 ## Mainweb
 
-`sites/mainweb/lib/*.test.ts` — phone formatting, hackathon slugs, `safe-callback`.
+`sites/mainweb/lib/*.test.ts` — phone formatting, hackathon slugs, `safe-callback`, bootcamp ZIP rules (`bootcamp-file.test.ts`), the download gate (`bootcamp-route-rules.test.ts`, where the null-term trap is held down) and the upload and download handlers (`bootcamp-routes.test.ts` — the handlers live under `app/`, which the root script does not glob).
 
 ## Hacklytics
 

docs/packages/db.md

@@ -31,6 +31,7 @@ Files in `src/schemas/`, re-exported from `schemas/index.ts`. `drizzle.config.ts
 | `judge.ts` | `judge`, `judge_assignment`, `judging_project`, `judge_vote`, `judge_queue`, `hackathon_result` |
 | `initiatives.ts` | `project_leader`, `initiative`, `initiative_application` |
 | `events.ts` | `event`, `event_check_in` |
+| `bootcamp.ts` | `bootcamp_workshop` (metadata; the ZIPs are in Cloud Storage). `bootcamp_material` is legacy and unused |
 | `stripe.ts` | `stripe_payment`, `user_account_link` |
 | `security.ts` | `audit_logs` (+ `security_severity` enum) |
 | `settings.ts` | `system_settings` (single row, `id = 'default'`) |

docs/sites/mainweb.md

@@ -50,7 +50,7 @@ Unauthenticated and authenticated product UI. `proxy.ts` marks these prefixes `p
 | `/admin/attendees` | Attendee tools |
 | `/admin/judging` | Judging admin (sync submissions + assign judges live here) |
 | `/admin/initiatives` | Initiative / proposal review |
-| `/admin/bootcamp` | Bootcamp attendance |
+| `/admin/bootcamp` | Bootcamp attendance grid and the weekly workshop table |
 | `/admin/staff` | Admin users |
 | `/admin/analytics` | Overview |
 | `/admin/audit` | Audit log |
@@ -65,6 +65,8 @@ Unauthenticated and authenticated product UI. `proxy.ts` marks these prefixes `p
 | `/api/auth/[...nextauth]` | NextAuth handlers |
 | `/api/auth/verify-email` | Email-code verification |
 | `/api/webhooks/stripe` | Stripe webhooks |
+| `/api/bootcamp/materials/[workshopId]` | Delete a workshop and its ZIPs (`DELETE`, staff) |
+| `/api/bootcamp/materials/[workshopId]/[kind]` | Upload (`POST`, staff), download (`GET`, gated on the workshop's term and publish state) or clear (`DELETE`, staff) the `materials` or `solution` ZIP |
 
 ## Client data
 

package.json

@@ -15,12 +15,12 @@
     "test": "vitest run packages/api packages/db sites/mainweb/lib"
   },
   "dependencies": {
-    "next": "16.3.0",
+    "next": "16.3.3",
     "typescript": "^6.0.2"
   },
   "devDependencies": {
     "turbo": "^2.9.14",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   },
   "pnpm": {
     "overrides": {

packages/api/package.json

@@ -35,7 +35,7 @@
     "drizzle-orm": "0.45.2",
     "image-size": "2.0.2",
     "prom-client": "15.1.3",
-    "sanitize-html": "2.17.4",
+    "sanitize-html": "2.17.7",
     "stripe": "^22.0.0",
     "superjson": "2.2.3",
     "zod": "3.25.53"
@@ -44,6 +44,6 @@
     "@query/tsconfig": "workspace:*",
     "@types/sanitize-html": "^2.16.0",
     "typescript": "6.0.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   }
 }