feat (secruity): prepare repo for public release

Author: daklay

LICENSE

@@ -0,0 +1,29 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+Copyright (c) 2025 ThinkAI Platform
+
+LICENSED UNDER THE APACHE LICENSE, VERSION 2.0 (THE "LICENSE");
+YOU MAY NOT USE THIS FILE EXCEPT IN COMPLIANCE WITH THE LICENSE.
+YOU MAY OBTAIN A COPY OF THE LICENSE AT
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING, SOFTWARE
+DISTRIBUTED UNDER THE LICENSE IS DISTRIBUTED ON AN "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+SEE THE LICENSE FOR THE SPECIFIC LANGUAGE GOVERNING PERMISSIONS AND
+LIMITATIONS UNDER THE LICENSE.
+
+-----------------------------------------------------------------------------
+
+ATTRIBUTION REQUIREMENT:
+
+When using or adapting ThinkAI Platform for hackathons, events, or other
+public uses, attribution must be provided in a visible manner, such as:
+
+"Powered by ThinkAI Platform - https://github.com/1337-Artificial-Intelligence/thinkai_main"
+
+This attribution must be visible in the user interface, documentation, and any
+promotional materials for the event or hackathon.

README.md

@@ -0,0 +1,104 @@
+# ThinkAI Platform
+
+ThinkAI is an AI learning and challenge platform designed to help students and teams collaborate on AI projects and challenges.
+
+## Features
+
+- User authentication and role-based access control (admin, mentor, team)
+- Challenge creation and management
+- Team collaboration tools
+- Project submission and validation
+
+## Project Structure
+
+The project is divided into two main parts:
+
+- **Backend**: Node.js API with Express and MongoDB
+- **Frontend**: React application with modern UI components
+
+## Setup and Installation
+
+### Prerequisites
+
+- Node.js (v14 or higher)
+- MongoDB
+- npm or yarn
+
+### Backend Setup
+
+1. Navigate to the backend directory:
+   ```bash
+   cd backend
+   ```
+
+2. Install dependencies:
+   ```bash
+   npm install
+   ```
+
+3. Create a `.env` file based on `.env.example`:
+   ```bash
+   cp .env.example .env
+   ```
+
+4. Update the `.env` file with your configuration values
+
+5. Start the development server:
+   ```bash
+   npm run dev
+   ```
+
+### Frontend Setup
+
+1. Navigate to the frontend directory:
+   ```bash
+   cd frontend
+   ```
+
+2. Install dependencies:
+   ```bash
+   npm install
+   ```
+
+3. Start the development server:
+   ```bash
+   npm start
+   ```
+
+## Scripts
+
+The repository contains several utility scripts in the `backend/src/scripts` directory:
+
+- `createAdmin.js`: Creates an admin user
+- `createMentor.js`: Creates mentor accounts from a CSV file
+- `createTeams.js`: Creates team accounts from a CSV file
+
+For security reasons, sensitive data files are not included in the repository. Template files are provided that show the required format.
+
+## Configuration
+
+All sensitive configuration is managed through environment variables. See `.env.example` for required variables.
+
+## Contributing
+
+Contributions are welcome! Please feel free to submit a Pull Request.
+
+1. Fork the repository
+2. Create your feature branch (`git checkout -b feature/amazing-feature`)
+3. Commit your changes (`git commit -m 'Add some amazing feature'`)
+4. Push to the branch (`git push origin feature/amazing-feature`)
+5. Open a Pull Request
+
+## License
+
+This project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.
+
+### Attribution Requirement
+
+When using ThinkAI Platform for hackathons, events, or other public uses, attribution must be provided:
+
+```
+Powered by ThinkAI Platform - https://github.com/1337-Artificial-Intelligence/thinkai_main
+```
+
+This attribution must be visible in the user interface, documentation, and any promotional materials for the event or hackathon.

backend/.env.example

@@ -2,4 +2,11 @@ PORT=5000
 MONGODB_URI=mongodb://localhost:27017/thinkai
 JWT_SECRET=your_jwt_secret_key_here
 JWT_EXPIRES_IN=24h
-NODE_ENV=development
+NODE_ENV=development
+
+# Admin credentials
+ADMIN_PASSWORD=your_secure_admin_password_here
+
+# CSV file paths (absolute paths or relative to script directory)
+MENTORS_CSV_PATH=./path/to/mentors.csv
+TEAMS_CSV_PATH=./path/to/teams.csv

backend/.gitignore

@@ -133,4 +133,10 @@ dist
 .yarn/unplugged
 .yarn/build-state.yml
 .yarn/install-state.gz
-.pnp.*
+.pnp.*
+
+# Sensitive data files
+/src/scripts/mentors.csv
+/src/scripts/teams.csv
+# Keep template files
+!/src/scripts/*.template.csv

backend/package-lock.json

@@ -2,6 +2,9 @@ require('dotenv').config();
 const mongoose = require('mongoose');
 const bcrypt = require('bcryptjs');
 
+// Default admin password for development only - should be overridden by environment variable
+const DEFAULT_ADMIN_PASSWORD = 'development_password_only';
+
 async function createAdmin() {
   try {
     // Connect to MongoDB
@@ -14,9 +17,12 @@ async function createAdmin() {
     await mongoose.connection.collection('teams').deleteOne({ teamName: 'admin' });
     console.log('Deleted existing admin if any');
 
+    // Get admin password from environment variable or use default (for development only)
+    const adminPassword = process.env.ADMIN_PASSWORD || DEFAULT_ADMIN_PASSWORD;
+    
     // Hash password
     const salt = await bcrypt.genSalt(10);
-    const hashedPassword = await bcrypt.hash('0m@L@APKpJmLT8', salt);
+    const hashedPassword = await bcrypt.hash(adminPassword, salt);
     console.log('Generated hashed password');
 
     // Create admin user directly in MongoDB to bypass any model validation

backend/src/scripts/createAdmin.js

@@ -3,6 +3,7 @@ const mongoose = require('mongoose');
 const bcrypt = require('bcryptjs');
 const fs = require('fs');
 const csv = require('csv-parser');
+const path = require('path');
 
 async function creatementorsFromCSV() {
   try {
@@ -15,8 +16,12 @@ async function creatementorsFromCSV() {
     // Read and parse CSV file
     const mentors = [];
 
+    // Get CSV path from environment variable or use default path
+    const csvPath = process.env.MENTORS_CSV_PATH || path.join(__dirname, 'mentors.csv');
+    console.log(`Reading mentors from: ${csvPath}`);
+    
     await new Promise((resolve, reject) => {
-      fs.createReadStream('mentors.csv')
+      fs.createReadStream(csvPath)
         .pipe(csv())
         .on('data', (row) => {
           // Extract mentor data from CSV row
@@ -36,48 +41,50 @@ async function creatementorsFromCSV() {
 
     console.log(`Found ${mentors.length} mentors in CSV file`);
 
-    // Clear existing mentors (optional - remove this if you want to keep existing mentors)
-    // await mongoose.connection.collection('mentors').deleteMany({});
-    // console.log('Cleared existing mentors');
+    // We are updating existing mentors with new passwords
+    console.log('Updating existing mentors with new passwords');
 
 
-    // Create mentors in database
-    const createdMentors = [];
+    // Update mentors in database
+    const updatedMentors = [];
 
     for (const mentor of mentors) {
       try {
-        // Generate a unique 5-character password for each mentor
+        // Generate a unique password hash for each mentor
         const salt = await bcrypt.genSalt(10);
         const hashedPassword = await bcrypt.hash(mentor.mentorPassword, salt);
 
-        const mentorDoc = {
-          teamName: mentor.mentorName,
-          password: hashedPassword,
-          role: 'mentor', // Default role for mentors
-          isActive: true,
-          createdAt: new Date(),
-          updatedAt: new Date()
-        };
-
-        const result = await mongoose.connection.collection('teams').insertOne(mentorDoc);
+        // Update existing mentor with new password
+        const result = await mongoose.connection.collection('teams').updateOne(
+          { teamName: mentor.mentorName },
+          { 
+            $set: {
+              password: hashedPassword,
+              updatedAt: new Date()
+            }
+          }
+        );
 
-        createdMentors.push({
-          id: result.insertedId,
-          mentorName: mentor.mentorName,
-          password: mentor.mentorPassword // Store the plain password for display
-        });
+        if (result.matchedCount > 0) {
+          updatedMentors.push({
+            mentorName: mentor.mentorName,
+            password: mentor.mentorPassword // Store the plain password for display
+          });
+        } else {
+          console.log(`No mentor found with username: ${mentor.mentorName}`);
+        }
       } catch (error) {
         console.error(`Error creating mentor ${mentor.mentorName}:`, error.message);
       }
     }
 
     console.log('\n=== SUMMARY ===');
-    console.log(`Successfully created ${createdMentors.length} mentors:`);
-    createdMentors.forEach(mentor => {
+    console.log(`Successfully updated ${updatedMentors.length} mentors:`);
+    updatedMentors.forEach(mentor => {
       console.log(`${mentor.mentorName},${mentor.password}`);
     });
 
-    console.log('\nIMPORTANT: Save these passwords! Each mentor has a unique 5-character password.');
+    console.log('\nIMPORTANT: Save these new passwords! Make sure to distribute them to the mentors.');
 
   } catch (error) {
     console.error('Error creating mentors from CSV:', error);