Team - VenueForge - Phase1 MVP

.gitignore

@@ -0,0 +1,3 @@
+.claude
+PlanAndProgressFiles
+.mcp.json

backend/.gitignore

@@ -0,0 +1,2 @@
+node_modules
+.env

backend/config/config.js

@@ -0,0 +1,20 @@
+module.exports = {
+   mongodbConnectionUrl: process.env.MONGODB_CONNECTION_URL,
+
+   // Google OAuth — the Web client ID from Google Cloud Console.
+   // Used to verify that an incoming Google ID token was issued for THIS app.
+   googleClientId: process.env.GOOGLE_CLIENT_ID,
+
+   jwtSecret: process.env.JWT_SECRET,
+   // Token lifetime per role. Customers stay logged in longer for convenience;
+   // venue owners get a shorter session since their account manages listings.
+   jwtExpiresIn: {
+      customer: "7d",
+      venueOwner: "1d",
+      admin: "2h"
+   },
+
+   // Comma-separated list of frontend origins allowed by CORS.
+   // Defaults to the Vite dev server.
+   corsOrigin: process.env.CORS_ORIGIN || "http://localhost:5173",
+};

backend/config/database.js

@@ -0,0 +1,6 @@
+const mongoose = require("mongoose");
+const { mongodbConnectionUrl } = require("./config");
+
+module.exports.connectDB = async () => {
+   await mongoose.connect(mongodbConnectionUrl);
+}

backend/constants/user.js

@@ -0,0 +1,9 @@
+const USER_ROLES = Object.freeze({
+   CUSTOMER: "customer", // customer books venues
+   VENUE_OWNER: "venueOwner", // lists and manages venues
+   ADMIN: "admin", // platform administration
+});
+
+const USER_ROLE_VALUES = Object.values(USER_ROLES);
+
+module.exports = { USER_ROLES, USER_ROLE_VALUES };

backend/constants/venue.js

@@ -0,0 +1,65 @@
+// Venue domain constants — shared across model, controllers, and seed.
+// Centralized here so there are no magic strings scattered through the codebase.
+
+// Listing lifecycle. Only APPROVED venues are publicly searchable
+const VENUE_STATUSES = {
+   DRAFT: "DRAFT",           // Venue owner just created the venue; fields can be filled anytime. Not visible to admin or public.
+   PENDING: "PENDING",       // Venue owner submitted the venue; waiting for admin approval. Not yet public.
+   APPROVED: "APPROVED",     // Admin approved the venue; visible to the public (if isActive is true).
+   REJECTED: "REJECTED", // REJECTED means admin declined (+rejectionReason); not terminal — venue owner can fix & resubmit (REJECTED → change back to "DRAFT"/"EDIT_DRAFT" → submit → PENDING)
+   EDIT_DRAFT: "EDIT_DRAFT", // EDIT_DRAFT is an in-progress edit copy of a live (APPROVED) venue (editOf field set in db); venue owner keeps editing until they submit it (EDIT_DRAFT → submit → CHANGES_PENDING).
+   CHANGES_PENDING: "CHANGES_PENDING", // CHANGES_PENDING is a submitted edit copy waiting for admin re-approval; on approve it merges into the original.
+};
+
+// Venue owner-initiated submit → review queue.
+//   DRAFT  → PENDING          (a new/own venue enters the queue)
+//   EDIT_DRAFT        → CHANGES_PENDING  (a drafted edit copy enters the queue)
+const SUBMITTABLE_STATUSES = Object.freeze([
+   VENUE_STATUSES.DRAFT,
+   VENUE_STATUSES.EDIT_DRAFT,
+]);
+
+// Venue owner-initiated hard delete. Only never-submitted/in-progress copies are
+// deletable:
+//   DRAFT       → a new venue that was never submitted; safe to drop entirely
+//   EDIT_DRAFT  → an edit copy of a live APPROVED venue; deleting it discards the
+//                 in-progress edits without touching the original APPROVED doc
+const DELETABLE_STATUSES = Object.freeze([
+   VENUE_STATUSES.DRAFT,
+   VENUE_STATUSES.EDIT_DRAFT,
+]);
+
+// Statuses an edit applies in place (the doc isn't live). Covers a new venue's
+// own draft states AND a not-yet-submitted edit copy. APPROVED is absent — editing
+// an APPROVED venue spawns a new EDIT_DRAFT copy instead. AND PENDING, CHANGES_PENDING are submitted versions
+const IN_PLACE_EDIT_STATUSES = Object.freeze([
+   VENUE_STATUSES.DRAFT,
+   VENUE_STATUSES.EDIT_DRAFT,
+]);
+
+// Statuses awaiting an admin decision — the admin review queue.
+//   PENDING          → a brand-new venue submitted for first approval
+//   CHANGES_PENDING  → a submitted edit copy awaiting re-approval
+const REVIEW_STATUSES = Object.freeze([
+   VENUE_STATUSES.PENDING,
+   VENUE_STATUSES.CHANGES_PENDING,
+]);
+
+// Admin decisions recorded in a venue's editHistory. Deliberately distinct from
+// the APPROVED/REJECTED status strings so a history entry (the noun for the
+// decision) isn't confused with the venue's lifecycle state.
+const HISTORY_ACTIONS = Object.freeze({
+   APPROVAL: "APPROVAL",
+   REJECTION: "REJECTION",
+});
+
+module.exports = {
+   VENUE_STATUSES,
+   VENUE_STATUS_VALUES: Object.values(VENUE_STATUSES),
+   SUBMITTABLE_STATUSES,
+   DELETABLE_STATUSES,
+   IN_PLACE_EDIT_STATUSES,
+   REVIEW_STATUSES,
+   HISTORY_ACTIONS,
+   HISTORY_ACTION_VALUES: Object.values(HISTORY_ACTIONS),
+};

backend/controllers/admin/adminGetVenueById.js

@@ -0,0 +1,47 @@
+const mongoose = require("mongoose");
+const Venues = require("../../models/venue");
+const { REVIEW_STATUSES } = require("../../constants/venue");
+const { VENUE_POPULATE } = require("../venue/shared");
+
+// Owner fields surfaced to the review page — enough to identify/contact the owner.
+const OWNER_POPULATE = { path: "venueOwner", select: "name email" };
+
+// Fields excluded from the review detail. version/editHistory are the admin audit
+// trail (not shown on the review page yet); deletedAt/__v are internal.
+const DETAIL_HIDDEN_FIELDS = "-version -editHistory -deletedAt -__v";
+
+// GET /admin/venues/:id
+// Returns a single venue awaiting review (PENDING or CHANGES_PENDING) for the
+// admin review page. Non-review statuses are treated as not found — this endpoint
+// only serves the approval queue. For a CHANGES_PENDING edit copy the response
+// carries `editOf` (the original APPROVED venue's id) so the UI can link to the
+// live listing.
+async function adminGetVenueById(req, res) {
+   try {
+      const { id } = req.params;
+
+      if (!mongoose.Types.ObjectId.isValid(id)) {
+         return res.status(400).json({ message: "Invalid venue id" });
+      }
+
+      const venue = await Venues.findOne({
+         _id: id,
+         status: { $in: REVIEW_STATUSES },
+         deletedAt: null,
+      })
+         .select(DETAIL_HIDDEN_FIELDS)
+         .populate(VENUE_POPULATE)
+         .populate(OWNER_POPULATE)
+         .lean();
+
+      if (!venue) {
+         return res.status(404).json({ message: "Venue not found" });
+      }
+
+      return res.status(200).json({ data: venue });
+   } catch (err) {
+      return res.status(500).json({ error: err.message, message: "Failed to fetch venue" });
+   }
+}
+
+module.exports = adminGetVenueById;

backend/controllers/admin/adminListVenues.js

@@ -0,0 +1,80 @@
+const Venues = require("../../models/venue");
+const { REVIEW_STATUSES } = require("../../constants/venue");
+const {
+   DEFAULT_PAGE,
+   DEFAULT_LIMIT,
+   CATEGORY_POPULATE,
+   parsePageParam,
+} = require("../venue/shared");
+
+// Owner fields surfaced to the admin queue — enough to identify/contact the owner.
+const OWNER_POPULATE = { path: "venueOwner", select: "name email" };
+
+// Lean projection for the review table. Full venue data comes from the detail
+// endpoint; the queue only needs what the table renders.
+const LIST_FIELDS = "name city district venueCategory venueOwner status createdAt updatedAt";
+
+// The queue is always sorted by submission time (updatedAt); only the direction
+// is client-controlled. Map the two allowed sortOrder values to Mongo sort ints.
+const SORT_DIRECTIONS = { asc: 1, desc: -1 };
+const DEFAULT_SORT_ORDER = "desc";
+
+// GET /admin/venues?status=<PENDING|CHANGES_PENDING>&sortOrder=<asc|desc>
+// Paginated admin review queue. `status` is required and must be exactly one
+// review status (the UI's two tabs each fetch one). PENDING = new venues awaiting
+// first approval; CHANGES_PENDING = submitted edit copies awaiting re-approval.
+// Results are sorted by submission time (updatedAt); sortOrder defaults to desc.
+//   countOnly "true" — returns { data: { total } } with no venue docs (used to
+//                       populate both tab count badges without fetching rows).
+async function adminListVenues(req, res) {
+   try {
+      const { status } = req.query;
+      if (!status) {
+         return res.status(400).json({ message: "status query parameter is required" });
+      }
+      if (!REVIEW_STATUSES.includes(status)) {
+         return res.status(400).json({
+            message: `status must be one of: ${REVIEW_STATUSES.join(", ")}`,
+         });
+      }
+
+      const filter = { status, deletedAt: null };
+
+      if (req.query.countOnly === "true") {
+         const total = await Venues.countDocuments(filter);
+         return res.status(200).json({ data: { total } });
+      }
+
+      const sortOrder = req.query.sortOrder || DEFAULT_SORT_ORDER;
+      if (!Object.hasOwn(SORT_DIRECTIONS, sortOrder)) {
+         return res.status(400).json({
+            message: `sortOrder must be one of: ${Object.keys(SORT_DIRECTIONS).join(", ")}`,
+         });
+      }
+
+      const page = parsePageParam(req.query.page, DEFAULT_PAGE);
+      const limit = parsePageParam(req.query.limit, DEFAULT_LIMIT);
+      const skip = (page - 1) * limit;
+
+      const [venues, total] = await Promise.all([
+         Venues.find(filter)
+            .select(LIST_FIELDS)
+            .populate(CATEGORY_POPULATE)
+            .populate(OWNER_POPULATE)
+            .sort({ updatedAt: SORT_DIRECTIONS[sortOrder] })
+            .skip(skip)
+            .limit(limit)
+            .lean(),
+         Venues.countDocuments(filter),
+      ]);
+
+      return res.status(200).json({
+         data: venues,
+         pagination: { page, limit, total, totalPages: Math.ceil(total / limit) },
+      });
+   } catch (err) {
+      return res.status(500).json({ error: err.message, message: "Failed to fetch venues" });
+   }
+}
+
+module.exports = adminListVenues;

backend/controllers/amenity/adminListAmenities.js

@@ -0,0 +1,22 @@
+const Amenities = require("../../models/amenity");
+
+// GET /admin/amenities
+// Full management list for the admin UI: includes inactive/soft-deleted-excluded
+// rows (deletedAt: null) regardless of isActive, so admins can see and
+// reactivate a retired amenity, not just the ones live on the public site.
+async function adminListAmenities(req, res) {
+   try {
+      const amenities = await Amenities.find({ deletedAt: null })
+         .select("name isActive")
+         .sort({ name: 1 })
+         .lean();
+
+      return res.status(200).json({ data: amenities });
+   } catch (err) {
+      return res
+         .status(500)
+         .json({ error: err.message, message: "Failed to fetch amenities" });
+   }
+}
+
+module.exports = adminListAmenities;

backend/controllers/amenity/createAmenity.js

@@ -0,0 +1,37 @@
+const Amenities = require("../../models/amenity");
+const slugify = require("../../utils/slugify");
+
+// POST /admin/amenities   body: { name }
+// identifier is derived from name and never exposed for manual editing —
+// venues reference amenities by identifier, so keeping it machine-generated
+// avoids typo'd/duplicate slugs.
+async function createAmenity(req, res) {
+   try {
+      const { name } = req.body;
+      if (!name || !name.trim()) {
+         return res.status(400).json({ message: "name is required" });
+      }
+
+      const identifier = slugify(name);
+      if (!identifier) {
+         return res.status(400).json({ message: "name must contain at least one letter or number" });
+      }
+
+      const existing = await Amenities.findOne({ identifier });
+      if (existing) {
+         return res.status(409).json({ message: "An amenity with this name already exists" });
+      }
+
+      const amenity = await Amenities.create({ identifier, name: name.trim() });
+      return res.status(201).json({ data: amenity });
+   } catch (err) {
+      if (err.code === 11000) {
+         return res.status(409).json({ message: "An amenity with this name already exists" });
+      }
+      return res
+         .status(500)
+         .json({ error: err.message, message: "Failed to create amenity" });
+   }
+}
+
+module.exports = createAmenity;

backend/controllers/amenity/deleteAmenity.js

@@ -0,0 +1,28 @@
+const Amenities = require("../../models/amenity");
+
+// DELETE /admin/amenities/:id
+// Soft delete: marks deletedAt + isActive false rather than removing the doc,
+// so venues that already reference this amenity's identifier don't break.
+async function deleteAmenity(req, res) {
+   try {
+      const { id } = req.params;
+
+      const amenity = await Amenities.findOneAndUpdate(
+         { _id: id, deletedAt: null },
+         { deletedAt: new Date(), isActive: false },
+         { new: true }
+      );
+
+      if (!amenity) {
+         return res.status(404).json({ message: "Amenity not found" });
+      }
+
+      return res.status(200).json({ data: amenity });
+   } catch (err) {
+      return res
+         .status(500)
+         .json({ error: err.message, message: "Failed to delete amenity" });
+   }
+}
+
+module.exports = deleteAmenity;

backend/controllers/amenity/listAmenities.js

@@ -0,0 +1,21 @@
+const Amenities = require("../../models/amenity");
+
+const PUBLIC_FIELDS = "identifier name";
+
+// multiselect dropdown and for resolving amenity labels
+async function listAmenities(req, res) {
+   try {
+      const amenities = await Amenities.find({ isActive: true, deletedAt: null })
+         .select(PUBLIC_FIELDS)
+         .sort({ name: 1 })
+         .lean();
+
+      return res.status(200).json({ data: amenities });
+   } catch (err) {
+      return res
+         .status(500)
+         .json({ error: err.message, message: "Failed to fetch amenities" });
+   }
+}
+
+module.exports = listAmenities;