MER 178 Budget

backend/app.js

@@ -2,6 +2,7 @@ const express = require('express');
 const mongoose = require('mongoose');
 const cors = require('cors');
 const path = require('path');
+const fs = require('fs');
 const cookieParser = require('cookie-parser');
 const multer = require('multer');
 const passport = require('passport');
@@ -59,6 +60,25 @@ function createApp() {
   app.use(passport.initialize());
   app.use(express.urlencoded({ extended: true }));
 
+  if (process.env.NODE_ENV !== 'production') {
+    app.post('/api/_agent-debug-log', (req, res) => {
+      try {
+        const payload = req.body || {};
+        const line = JSON.stringify({
+          hypothesisId: payload.hypothesisId || 'unknown',
+          location: payload.location || 'unknown',
+          message: payload.message || 'unknown',
+          data: payload.data && typeof payload.data === 'object' ? payload.data : {},
+          timestamp: Number(payload.timestamp) || Date.now()
+        });
+        fs.appendFileSync('/opt/cursor/logs/debug.log', `${line}\n`);
+        return res.status(200).json({ success: true });
+      } catch (error) {
+        return res.status(500).json({ success: false, message: 'debug log write failed' });
+      }
+    });
+  }
+
   app.use(async (req, res, next) => {
     try {
         // Debug logging to identify polling routes
@@ -223,8 +243,10 @@ function createApp() {
   const orgRoutes = require('./routes/orgRoutes.js');
   const orgRoleRoutes = require('./routes/orgRoleRoutes.js');
   const orgManagementRoutes = require('./routes/orgManagementRoutes.js');
+  const orgBudgetRoutes = require('./routes/orgBudgetRoutes.js');
   const orgInviteRoutes = require('./routes/orgInviteRoutes.js');
   const orgMessageRoutes = require('./routes/orgMessageRoutes.js');
+  const taskManagementRoutes = require('./routes/taskManagementRoutes.js');
   const roomRoutes = require('./routes/roomRoutes.js');
   const adminRoutes = require('./routes/adminRoutes.js');
   const eventsRoutes = require('./events/index.js');
@@ -258,9 +280,11 @@ function createApp() {
   app.use(orgRoutes);
   app.use('/org-roles', orgRoleRoutes);
   app.use('/org-management', orgManagementRoutes);
+  app.use('/org-budgets', orgBudgetRoutes);
   app.use('/org-invites', orgInviteRoutes);
   app.use('/org-messages', orgMessageRoutes);
   app.use('/org-event-management', orgEventManagementRoutes);
+  app.use('/org-event-management', taskManagementRoutes);
   app.use('/admin', roomRoutes);
   app.use(adminRoutes);
   app.use(formRoutes);
@@ -304,6 +328,8 @@ function createApp() {
     };
 
     try {
+        const getModels = require('./services/getModelService');
+        const { Classroom } = getModels(req, 'Classroom');
         // Upload image to S3
         const s3Response = await s3.upload(s3Params).promise();
         const imageUrl = s3Response.Location;
@@ -313,7 +339,7 @@ function createApp() {
             { name: classroomName },
             { image: imageUrl },
             { new: true, upsert: true }
-        );
+        ).populate('building', 'name');
 
         res.status(200).json({ message: 'Image uploaded and classroom updated.', classroom });
     } catch (error) {

backend/constants/permissions.js

@@ -25,7 +25,10 @@ const ORG_PERMISSIONS = {
 
     // Advanced features
     MANAGE_INTEGRATIONS: 'manage_integrations', // Can manage third-party integrations
-    ACCESS_ADVANCED_FEATURES: 'access_advanced_features' // Can access beta/advanced features
+    ACCESS_ADVANCED_FEATURES: 'access_advanced_features', // Can access beta/advanced features
+
+    /** Atlas CMS Phase 1: upload/version governance documents (constitution, etc.) */
+    MANAGE_GOVERNANCE: 'manage_governance'
 };
 
 // Event-specific permissions

backend/middlewares/verifyToken.js

@@ -50,6 +50,21 @@ const verifyToken = async (req, res, next) => {
     try {
         const decodedToken = jwt.verify(token, process.env.JWT_SECRET);
         await resolveRequestUser(req, decodedToken);
+        if (req.user?.userId) {
+            try {
+                const { User } = getModels(req, 'User');
+                const accountUser = await User.findById(req.user.userId).select('accessSuspended').lean();
+                if (accountUser?.accessSuspended) {
+                    return res.status(403).json({
+                        success: false,
+                        message: 'This account has been suspended.',
+                        code: 'ACCOUNT_SUSPENDED',
+                    });
+                }
+            } catch (checkErr) {
+                console.error('[verifyToken] accessSuspended check failed:', checkErr);
+            }
+        }
         return next();
     } catch (err) {
         if (err.name === 'TokenExpiredError') {

backend/migrations/migrateClassroomBuildingRefs.js

@@ -0,0 +1,152 @@
+/**
+ * One-shot migration: legacy Classroom.building (string) → ObjectId ref to Building.
+ * Uses the native driver on collection names so it stays reliable across schema changes.
+ *
+ * Deploy note: existing tenants still have string `building` values until this runs.
+ * With the ObjectId classroom schema, hydrate those docs before migration will throw CastError.
+ * Prefer running once via CLI *before* restarting app servers on this version:
+ *   MIGRATION_SCHOOL=rpi node Meridian/backend/migrations/migrateClassroomBuildingRefs.js
+ * Optional: FORCE=1 to clear the per-tenant guard row and re-run.
+ */
+
+const mongoose = require('mongoose');
+const { connectToDatabase } = require('../connectionsManager');
+
+const MIGRATION_KEY = 'classroom_building_oid_ref';
+const CLASSROOMS_COLL = 'classrooms1';
+const BUILDINGS_COLL = 'buildings';
+const RUNS_COLL = 'admin_migration_runs';
+
+const DEFAULT_BUILDING_IMAGE = '/classrooms/default.png';
+const DEFAULT_TIME = { start: 0, end: 24 * 60 };
+
+function escapeRegex(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+async function findBuildingByName(buildings, name) {
+  const trimmed = String(name || '').trim();
+  if (!trimmed) return null;
+  let doc = await buildings.findOne({ name: trimmed });
+  if (doc) return doc;
+  doc = await buildings.findOne({ name: new RegExp(`^${escapeRegex(trimmed)}$`, 'i') });
+  return doc;
+}
+
+/**
+ * @param {import('mongoose').Connection} mongooseConn
+ * @param {{ force?: boolean }} [options]
+ */
+async function runMigrateClassroomBuildingRefs(mongooseConn, options = {}) {
+  const { force = false } = options;
+  const db = mongooseConn.db;
+  const runs = db.collection(RUNS_COLL);
+  const classrooms = db.collection(CLASSROOMS_COLL);
+  const buildings = db.collection(BUILDINGS_COLL);
+
+  if (!force) {
+    const prior = await runs.findOne({ key: MIGRATION_KEY });
+    if (prior) {
+      return {
+        skipped: true,
+        reason: 'already_run',
+        ranAt: prior.completedAt || null,
+      };
+    }
+  } else {
+    await runs.deleteMany({ key: MIGRATION_KEY });
+  }
+
+  const stringRooms = await classrooms
+    .find({
+      building: { $exists: true, $type: 'string', $nin: ['', null] },
+    })
+    .toArray();
+
+  const distinctNames = [
+    ...new Set(stringRooms.map((d) => String(d.building).trim()).filter(Boolean)),
+  ];
+
+  const buildingsCreated = [];
+  const buildingsReused = [];
+  const nameToId = new Map();
+
+  for (const name of distinctNames) {
+    const existing = await findBuildingByName(buildings, name);
+    if (existing) {
+      nameToId.set(name, existing._id);
+      buildingsReused.push(name);
+      continue;
+    }
+    const ins = await buildings.insertOne({
+      name,
+      image: DEFAULT_BUILDING_IMAGE,
+      time: DEFAULT_TIME,
+    });
+    nameToId.set(name, ins.insertedId);
+    buildingsCreated.push(name);
+  }
+
+  const bulkOps = stringRooms
+    .map((doc) => {
+      const name = String(doc.building).trim();
+      const bid = nameToId.get(name);
+      if (!bid) return null;
+      return {
+        updateOne: {
+          filter: { _id: doc._id, building: { $type: 'string' } },
+          update: { $set: { building: bid } },
+        },
+      };
+    })
+    .filter(Boolean);
+
+  let classroomsUpdated = 0;
+  if (bulkOps.length) {
+    const wr = await classrooms.bulkWrite(bulkOps, { ordered: false });
+    classroomsUpdated = wr.modifiedCount || 0;
+  }
+
+  await classrooms.updateMany({ building: '' }, { $unset: { building: '' } });
+
+  const summary = {
+    skipped: false,
+    distinctBuildingNames: distinctNames.length,
+    buildingsCreatedCount: buildingsCreated.length,
+    buildingsReusedCount: buildingsReused.length,
+    buildingsCreated,
+    classroomsUpdated,
+  };
+
+  await runs.insertOne({
+    key: MIGRATION_KEY,
+    completedAt: new Date(),
+    summary,
+  });
+
+  return summary;
+}
+
+module.exports = {
+  runMigrateClassroomBuildingRefs,
+  MIGRATION_KEY,
+};
+
+async function cliMain() {
+  const school = process.env.MIGRATION_SCHOOL || process.argv[2] || 'rpi';
+  const conn = await connectToDatabase(school);
+  try {
+    const out = await runMigrateClassroomBuildingRefs(conn, { force: process.env.FORCE === '1' });
+    console.log(JSON.stringify(out, null, 2));
+  } finally {
+    await conn.close().catch(() => {});
+    await mongoose.disconnect().catch(() => {});
+  }
+}
+
+if (require.main === module) {
+  cliMain().then(() => process.exit(0)).catch((e) => {
+    console.error(e);
+    process.exit(1);
+  });
+}

backend/migrations/seedDomainSpaceGovernance.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+require('dotenv').config();
+
+const mongoose = require('mongoose');
+const { connectToDatabase } = require('../connectionsManager');
+const getModels = require('../services/getModelService');
+
+function getDefaultSpaceGovernance() {
+    return {
+        governingScope: {
+            kind: 'all_spaces',
+            buildingIds: [],
+            spaceIds: [],
+            spaceGroupIds: []
+        },
+        concernScope: {
+            kind: 'campus_wide',
+            buildingIds: [],
+            spaceIds: [],
+            spaceGroupIds: []
+        },
+        scopeMode: 'inclusive',
+        priorityRules: []
+    };
+}
+
+async function run() {
+    const school = process.env.MIGRATION_SCHOOL || process.argv[2] || 'rpi';
+    const db = await connectToDatabase(school);
+    const req = { db };
+    const { Domain } = getModels(req, 'Domain');
+
+    const result = await Domain.updateMany(
+        {
+            $or: [
+                { spaceGovernance: { $exists: false } },
+                { spaceGovernance: null }
+            ]
+        },
+        {
+            $set: {
+                spaceGovernance: getDefaultSpaceGovernance()
+            }
+        }
+    );
+
+    console.log(
+        `[seedDomainSpaceGovernance] school=${school} matched=${result.matchedCount || 0} modified=${result.modifiedCount || 0}`
+    );
+}
+
+run()
+    .catch((error) => {
+        console.error('[seedDomainSpaceGovernance] failed', error);
+        process.exitCode = 1;
+    })
+    .finally(async () => {
+        await mongoose.disconnect();
+    });