Refactor assignment-assistant routing, schemas, and components (#300)

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

Author: Strehk

.trivyignore

@@ -3,3 +3,9 @@ CVE-2025-47907
 CVE-2025-58754
 CVE-2025-47906
 AVD-DS-0029
+CVE-2025-61724
+CVE-2025-58188
+CVE-2025-58187
+CVE-2025-58186
+CVE-2025-58183
+CVE-2025-47912

Dockerfile

@@ -1,4 +1,4 @@
-FROM oven/bun:1.2-slim AS base
+FROM oven/bun:1.3-slim AS base
 
 FROM base AS dual
 WORKDIR /temp

WARP.md

@@ -0,0 +1,225 @@
+# WARP.md
+
+This file provides guidance to WARP (warp.dev) when working with code in this repository.
+
+## Project Overview
+
+MUNify DELEGATOR is a registration and organization management system for Model United Nations conferences. Built with SvelteKit 2, it handles delegation registration, assignment, and management workflows for MUN conferences.
+
+**Tech Stack**: SvelteKit 2 (Svelte 5 runes mode), TypeScript, Prisma ORM (PostgreSQL), GraphQL (Pothos + Yoga), Tailwind CSS 4 + DaisyUI, Houdini (GraphQL client), Paraglide (i18n)
+
+## Development Commands
+
+### Setup & Running
+
+```bash
+# Install dependencies
+bun install
+
+# Start full dev environment (Docker services + dev server)
+bun run dev
+
+# OR run separately:
+bun run dev:docker   # Start PostgreSQL and other services
+bun run dev:server   # Start SvelteKit dev server with Vite
+
+# Install git hooks for automated linting
+bunx lefthook install
+```
+
+### Database Management
+
+```bash
+# Migrate database to latest schema
+bunx prisma migrate dev
+
+# Reset database (WARNING: deletes all data)
+bunx prisma migrate reset
+
+# Seed database with development data
+bun prisma/seed/dev/seed.ts
+
+# Open Prisma Studio (database GUI)
+bun run studio
+```
+
+### Code Quality
+
+```bash
+# Format code
+bun run format
+
+# Lint (runs both prettier check and eslint)
+bun run lint
+
+# Type check
+bun run typecheck
+
+# Svelte type checking
+bun run check
+
+# Continuous type checking
+bun run check:watch
+```
+
+### Building
+
+```bash
+# Build for production
+bun run build
+```
+
+### Translations
+
+```bash
+# Add new translation key
+bun run add-translation
+
+# Machine translate missing keys
+bun run machine-translate
+```
+
+## Architecture Overview
+
+### Directory Structure
+
+- **`src/routes/`** - SvelteKit file-based routing
+  - `(authenticated)/` - Protected routes requiring authentication
+    - `dashboard/[conferenceId]/` - Participant-facing conference dashboard
+    - `management/[conferenceId]/` - Admin conference management UI
+    - `registration/[conferenceId]/` - Registration flows (delegation, individual, supervisor)
+    - `assignment-assistant/` - Committee assignment tooling
+  - `api/graphql/` - GraphQL API endpoint
+  - `auth/` - OIDC authentication flows
+
+- **`src/api/`** - GraphQL API implementation
+  - `resolvers/` - Pothos GraphQL resolvers organized by entity
+  - `abilities/` - CASL permission definitions per entity
+  - `context/` - Request context (OIDC, permissions)
+  - `services/` - Business logic services
+
+- **`src/lib/`** - Shared utilities
+  - `components/` - Reusable Svelte components
+  - `queries/` - Houdini GraphQL queries/mutations
+  - `services/` - Frontend services
+  - `schemata/` - Zod validation schemas
+  - `db/` - Database utilities
+  - `paraglide/` - Generated i18n code
+
+- **`src/tasks/`** - Background tasks (email sync, conference status updates)
+
+- **`prisma/`** - Database schema, migrations, and seed scripts
+  - `schema.prisma` - Main database schema
+  - `migrations/` - Database migration history
+  - `seed/dev/` - Development seed scripts
+
+### Key Architectural Patterns
+
+#### GraphQL API Layer
+
+- **Schema Generation**: Pothos schema builder with Prisma plugin generates GraphQL schema from Prisma models
+- **Resolvers**: Organized by entity in `src/api/resolvers/modules/` (e.g., `conference.ts`, `delegation.ts`)
+- **Auto-generated CRUD**: `prisma-generator-pothos-codegen` creates base CRUD operations
+- **Server**: GraphQL Yoga serves the API at `/api/graphql`
+
+#### Frontend Data Flow
+
+- **Houdini Client**: Type-safe GraphQL client with automatic cache management
+- **Code Generation**: `houdini.config.js` watches schema and generates TypeScript types
+- **Queries**: Store queries in `src/lib/queries/` for reuse across components
+- **Load Functions**: SvelteKit `+page.ts` files use Houdini queries for SSR/CSR data loading
+
+#### Authentication & Authorization
+
+- **OIDC Integration**: Uses OpenID Connect (designed for ZITADEL but supports any OIDC provider)
+- **Context Building**: `src/api/context/context.ts` constructs request context with OIDC data
+- **Permission System**: CASL ability-based authorization
+  - Definitions in `src/api/abilities/entities/`
+  - Admins get full access, team members get scoped access based on roles
+  - Roles: `admin`, `PROJECT_MANAGEMENT`, `PARTICIPANT_CARE`, etc.
+
+#### Database & ORM
+
+- **Prisma Models**: Single source of truth in `prisma/schema.prisma`
+- **Generators**: Three generators run on schema changes:
+  1. `@prisma/client` - TypeScript client
+  2. `prisma-pothos-types` - Pothos integration types
+  3. `prisma-generator-pothos-codegen` - Auto-generated resolvers
+- **Migrations**: All schema changes must create migrations (`bunx prisma migrate dev`)
+
+#### Internationalization
+
+- **Paraglide.js**: Compile-time i18n with URL-based locale switching
+- **Message Files**: JSON files in `messages/` directory per locale
+- **Middleware**: `hooks.server.ts` uses `paraglideMiddleware` to set locale from URL
+
+#### UI Components
+
+- **Tailwind CSS 4**: Utility-first styling with DaisyUI component library
+- **Svelte 5 Runes**: Uses modern runes mode (`$state`, `$derived`, `$effect`)
+- **Houdini Integration**: `houdini-svelte` plugin provides reactive stores
+
+### State Management Concepts
+
+- **Conference States**: `PRE` → `PARTICIPANT_REGISTRATION` → `PREPARATION` → `ACTIVE` → `POST`
+- **Delegations**: Groups of participants representing countries
+- **Single Participants**: Individuals applying for custom roles
+- **Committee Assignment**: Matching delegations to nations in committees
+- **Background Tasks**: `src/tasks/` contains scheduled jobs (mail sync, status updates)
+
+### Testing Database Changes
+
+After modifying `prisma/schema.prisma`:
+
+1. Run `bunx prisma migrate dev` to create migration
+2. Run `bun prisma/seed/dev/seed.ts` to seed test data
+3. Use Prisma Studio (`bun run studio`) to verify data structure
+
+### Configuration
+
+- **Environment Variables**: Copy `.env.example` to `.env` and configure:
+  - `DATABASE_URL` - PostgreSQL connection string
+  - `PUBLIC_OIDC_AUTHORITY` - OIDC provider URL
+  - `PUBLIC_OIDC_CLIENT_ID` - OIDC client identifier
+  - `SECRET` - Session encryption key
+  - `CERTIFICATE_SECRET` - Certificate signing key (generate with `openssl rand -base64 32`)
+
+- **Aliases**: Configured in `svelte.config.js`:
+  - `$api` → `src/api`
+  - `$assets` → `src/assets`
+  - `$db` → `prisma`
+  - `$config` → `src/config`
+  - `$houdini` → `.houdini`
+
+## Development Workflow
+
+1. **Schema Changes**: Edit `prisma/schema.prisma` → run migrations → regenerate GraphQL schema
+2. **API Changes**: Modify resolvers in `src/api/resolvers/modules/` → schema regenerates automatically
+3. **Frontend Changes**: Edit Svelte components → Vite hot-reloads
+4. **Adding GraphQL Operations**: Create `.gql` files or use `graphql()` function → Houdini generates types
+5. **Permission Changes**: Edit ability files in `src/api/abilities/entities/`
+
+## Commit Convention
+
+Follow [Conventional Commits](https://www.conventionalcommits.org/):
+
+- `feat:` - New feature
+- `fix:` - Bug fix
+- `refactor:` - Code restructure without behavior change
+- `style:` - UI/UX changes
+- `docs:` - Documentation
+- `test:` - Tests
+- `chore:` - Maintenance
+- `ci:` - CI/CD changes
+- `build:` - Build system changes
+- `perf:` - Performance improvements
+
+Example: `feat(delegation): add nation preference selection`
+
+## Docker Deployment
+
+Use provided Docker images: `deutschemodelunitednations/delegator`
+
+- Example compose file in `example/` directory
+- Requires external OIDC provider (ZITADEL recommended)
+- Environment variables must be configured (see `.env.example`)

messages/de.json

@@ -168,6 +168,22 @@
 	"cleanupIndividualParticipantsButton": "Einzelteilnehmende aufräumen",
 	"cleanupIndividualParticipantsDescription": "Mit einem Klick auf den unteren Button werden alle Einzelteilnehmende, die keine zugewiesenen Rollen haben, aus der Konferenz entfernt.",
 	"cleanupIndividualParticipantsSuccess": "Einzelteilnehmende wurden erfolgreich aufgeräumt.",
+	"cleanupNormalizeSchoolsClearSelected": "Auswahl löschen: {count} Schule(n)",
+	"cleanupNormalizeSchoolsColumnDelegationMembers": "Delegationsmitglieder",
+	"cleanupNormalizeSchoolsColumnDelegations": "Delegationen",
+	"cleanupNormalizeSchoolsColumnSchool": "Schulname",
+	"cleanupNormalizeSchoolsColumnTotalParticipants": "Gesamt",
+	"cleanupNormalizeSchoolsDescription": "Da Menschen unterschiedliche Varianten ihres Schulnamens eintragen, ist es oft schwer zu überblicken, wie viele Personen von derselben Schule kommen. Mit der folgenden Tabelle kannst du Schulnamen zusammenführen und anpassen, um sie zu vereinheitlichen.",
+	"cleanupNormalizeSchoolsEnterNewName": "Bitte gib einen neuen Schulnamen ein",
+	"cleanupNormalizeSchoolsFailed": "Vereinheitlichen der Schulen fehlgeschlagen",
+	"cleanupNormalizeSchoolsNewName": "Neuer Schulname",
+	"cleanupNormalizeSchoolsNewNamePlaceholder": "Gib den vereinheitlichten Schulnamen ein",
+	"cleanupNormalizeSchoolsNoSchools": "Keine Schulen für diese Konferenz gefunden.",
+	"cleanupNormalizeSchoolsNormalizeMany": "Ausgewählte Schulen vereinheitlichen",
+	"cleanupNormalizeSchoolsRenameOne": "Ausgewählte Schule umbenennen",
+	"cleanupNormalizeSchoolsSelectAtLeastOne": "Bitte wähle mindestens 1 Schule aus",
+	"cleanupNormalizeSchoolsSuccess": "Erfolgreich {count} Schule(n) vereinheitlicht",
+	"cleanupNormalizeSchoolsTitle": "Schulnamen vereinheitlichen",
 	"cleanupSupervisors": "Betreuende aufräumen",
 	"cleanupSupervisorsButton": "Betreuende aufräumen",
 	"cleanupSupervisorsDescription": "Mit einem Klick auf den unteren Button werden alle Betreuende, die nicht mindestens eine Delegation mit einer zugewiesenen Rolle betreuen, aus der Konferenz entfernt.",
@@ -318,6 +334,7 @@
 	"end": "Ende",
 	"enterCode": "Code eingeben",
 	"enterDateOfdateReceipt": "Empfangsdatum eingeben",
+	"enterNewSchoolName": "Neuen Schulnamen eingeben",
 	"entryCode": "Eintrittscode",
 	"experience": "Erfahrung",
 	"exportFrom": "Export aus {appName}",

messages/en.json

@@ -168,6 +168,22 @@
 	"cleanupIndividualParticipantsButton": "Clean up single participants",
 	"cleanupIndividualParticipantsDescription": "By clicking on the button below, all single participants who do not have assigned roles will be removed from the conference.",
 	"cleanupIndividualParticipantsSuccess": "Single participants have been cleaned up successfully.",
+	"cleanupNormalizeSchoolsClearSelected": "Clear selected {count} school(s)",
+	"cleanupNormalizeSchoolsColumnDelegationMembers": "Delegation Members",
+	"cleanupNormalizeSchoolsColumnDelegations": "Delegations",
+	"cleanupNormalizeSchoolsColumnSchool": "School Name",
+	"cleanupNormalizeSchoolsColumnTotalParticipants": "Total Participants",
+	"cleanupNormalizeSchoolsDescription": "Because people enter varying versions of their school names, it can be hard to see how many people come from one school. Use the table below to merge and adapt school names to a unified, normalized name.",
+	"cleanupNormalizeSchoolsEnterNewName": "Please enter a new school name",
+	"cleanupNormalizeSchoolsFailed": "Failed to normalize schools",
+	"cleanupNormalizeSchoolsNewName": "New School Name",
+	"cleanupNormalizeSchoolsNewNamePlaceholder": "Enter the normalized school name",
+	"cleanupNormalizeSchoolsNoSchools": "No schools found for this conference.",
+	"cleanupNormalizeSchoolsNormalizeMany": "Normalize Selected Schools",
+	"cleanupNormalizeSchoolsRenameOne": "Rename Selected School",
+	"cleanupNormalizeSchoolsSelectAtLeastOne": "Please select at least 1 school",
+	"cleanupNormalizeSchoolsSuccess": "Successfully normalized {count} school(s)",
+	"cleanupNormalizeSchoolsTitle": "Normalize Schools",
 	"cleanupSupervisors": "Clean up Supervisors",
 	"cleanupSupervisorsButton": "Clean up supervisors",
 	"cleanupSupervisorsDescription": "By clicking on the button below, all supervisors who do not supervise at least one delegation with an assigned role will be removed from the conference.",

schema.graphql

@@ -320,6 +320,7 @@ type Conference {
   postalStreet: String
   postalZip: String
   registrationDeadlineGracePeriodMinutes: Int!
+  schools: [ConferenceSchools!]!
   singleParticipants: [SingleParticipant!]!
   startAssignment: DateTime!
   startConference: DateTime!
@@ -648,6 +649,14 @@ input ConferenceScalarRelationFilter {
   isNot: ConferenceWhereInput
 }
 
+type ConferenceSchools {
+  delegationCount: Int!
+  delegationMembers: Int!
+  school: String!
+  singleParticipants: Int!
+  sumParticipants: Int!
+}
+
 enum ConferenceState {
   ACTIVE
   PARTICIPANT_REGISTRATION
@@ -1974,6 +1983,7 @@ type Mutation {
   deleteOneTeamMember(where: TeamMemberWhereUniqueInput!): TeamMember
   deleteOneUser(where: UserWhereUniqueInput!): User
   deleteOneWaitingListEntry(where: WaitingListEntryWhereUniqueInput!): WaitingListEntry
+  normalizeSchoolsInConference(conferenceId: String!, newSchoolName: String!, schoolsToMerge: [String!]!): Conference
   rotateSupervisorConnectionCode(id: ID!): ConferenceSupervisor!
   seedNewConference(data: JSONObject!): SeedNewConferenceResult!
   sendAssignmentData(data: JSONObject!, where: ConferenceWhereUniqueInput!): SetAssignmentDataResult!