Add downloadable bootcamp session materials

[github-actions]

Officers attach files to a bootcamp session from /admin/bootcamp; everyone enrolled in that bootcamp downloads them from /club/bootcamp. Slides and notebooks were the one thing the portal could not hand a cohort.

Who can read a file

• Staff, always.
• Anyone whose member.bootcamp_term matches the term of the session the file hangs off — not the current term. Somebody who bought the fall bootcamp keeps the fall notebooks in January, and never sees the spring ones.
• Everyone else gets 404, not 403.

The material hangs off the session event rather than a week number, so the term comes with the row and the check is one lookup.

Storage

gs://dsgt-bootcamp under sessions/<eventId>/<materialId>.<ext>, already created with uniform access and public access prevention enforced, and the App Hosting runtime service account already holds objectAdmin on it. A second bucket rather than a prefix in dsgt-resumes: resumes are documents no member may read, handouts are files every enrolled member may.

Downloads are proxied, not signed. The bucket stays private, a copied link is worth nothing to somebody not signed in, and no extra IAM role is needed. The body is streamed — 25MB times a class opening the slides at once is more than an instance has.

Uploads skip tRPC, as resumes do, because superjson base64s the whole body. Kinds are an allowlist whose entry is the content type served back, so an unlisted kind has none and is refused; .html and .svg are absent because both would run script from our own origin. Objects are named by row id, never by the uploaded filename.

Member page

Rebuilt. It previously showed a work-in-progress notice while the syllabus and workspace button rendered only for people who had not joined — a paying member saw less than a stranger. One list now serves both, with room and time, a per-week Attended / Missed / Upcoming badge, and the files for members.

Deploy

drizzle-kit push creates bootcamp_material on deploy; it is additive, so nothing manual. BOOTCAMP_BUCKET is set in apphosting.yaml. The resume-bucket comment there is corrected in passing — it said us-central1 and carried a placeholder service account; the bucket is us-east4, matching the backend's Cloud Run region, and both commands are already applied.

Tests

44 new: file rules, the access gate (including the null-term trap, where a file on a non-bootcamp event against a member who bought nothing is null === null), and the upload/download/delete handlers — 401 unsigned, 404 for a member on upload, 400 on a disallowed kind, 413 on an oversized claim before the body is read, object written before the row, 404 before the bucket is touched for an unauthorised download, attachment and nosniff headers, row-then-object on delete.

Full suite green: 807 tests, 34 files, typecheck clean. packages/db/scripts/seed-club-projects.ts has two lint errors that are pre-existing on dev and untouched here.

vitest.config.ts is new at the root and does one thing: alias @ to sites/mainweb, which a test needs to import a route handler.

---

Note

Medium Risk
New authenticated file upload/download surface with term-based authorization and Cloud Storage; behavior is heavily tested but mistakes in access checks would expose handouts.

Overview
Adds bootcamp session handouts so staff attach files per session from /admin/bootcamp and enrolled members download them from /club/bootcamp, gated on the session’s bootcamp term (not the current term) with 404 for unauthorized readers.

Introduces bootcamp_material metadata in Postgres, bytes in gs://dsgt-bootcamp via new BOOTCAMP_BUCKET (App Hosting + Turbo), and Next.js API routes (POST upload, proxied streaming GET, staff DELETE) instead of tRPC. The bootcamp router’s myProgress / attendance responses now include per-session materials lists.

Member bootcamp page is rebuilt: enrolled users see meeting info, syllabus with attendance badges, and downloads; the old WIP-only enrolled experience is removed. Staff get a Handouts section with upload/remove UI. Access helpers enforce the null-term trap; extensive unit tests cover file rules, gates, and route refusals. Root vitest.config.ts adds the @ alias for route-handler tests. Docs and resume-bucket comments in apphosting.yaml are updated in passing.

^{Reviewed by Cursor Bugbot for commit 71c27f6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit e59d1ba. Configure here.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Visit the preview URL for this PR (updated for commit 71c27f6):

https://hacklytics2027--pr-390-16mdbw62.web.app

_{(expires Fri, 25 Sep 2026 03:17:42 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: c48ba34db61581e25fe2978355160b5eefe0e83f}