Freebites Mobile App

.github/workflows/README.md

@@ -0,0 +1,29 @@
+# CI Workflows
+
+This project uses **GitHub Actions** for continuous integration.
+
+## Workflows Included
+
+- **Mobile Lint**  
+  Runs ESLint in the `mobile/` app directory to enforce code quality and catch errors early.
+
+- **Backend RBAC E2E**  
+  Runs Jest end-to-end tests in `backend/` to verify secure role-based access control.
+
+## How They Run
+
+| Workflow | Trigger |
+|---------|---------|
+| Mobile Lint | Push to `main` / `dev` + all pull requests |
+| Backend RBAC E2E | Push to `main` / `dev` or manual trigger |
+
+## Challenges
+
+- Ensuring proper working directories for monorepo structure (Fixed using `defaults.run.working-directory`)
+- Performance during installs (Fixed by caching Node dependency installs)
+
+## In the Future
+
+As we add more testing suites, we will expand our CI pipeline accordingly.  
+
+We plan to include full mobile end-to-end testing using [Detox](https://wix.github.io/Detox/) to ensure the entire app behaves correctly on real devices (soon!).

.github/workflows/add_collaborators.yml

@@ -1,7 +1,7 @@
-# Author: Rishab 
+# Author: Rishab
 name: Add Collaborators v1.1
 
-on: 
+on:
   push:
     branches:
       - master
@@ -48,4 +48,3 @@ jobs:
 
               }
             });
-

.github/workflows/backend-rbac-e2e.yml

@@ -0,0 +1,36 @@
+name: Backend RBAC E2E
+
+on:
+  push:
+    branches: [main, dev, feat/ci-and-tests]
+  workflow_dispatch:
+
+jobs:
+  rbac-e2e:
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: backend
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run RBAC E2E Jest tests
+        env:
+          BASE: ${{ secrets.BASE }}
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          STUDENT_ID: ${{ secrets.STUDENT_ID }}
+          ADMIN_ID: ${{ secrets.ADMIN_ID }}
+        run: npm test

.github/workflows/mobile-lint.yml

@@ -0,0 +1,31 @@
+name: Mobile Lint
+
+on:
+  push:
+    branches: [main, dev]
+  pull_request:
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    defaults:
+      run:
+        working-directory: mobile
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: mobile/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint with ESLint (Expo)
+        run: npm run lint

.github/workflows/release_archive.yml

@@ -1,12 +1,12 @@
 name: Archive Repository into Release v1.0
-on: 
+on:
   push:
     tags:
-      - "spark-archive-*"
+      - 'spark-archive-*'
 jobs:
   tagged-release:
-    name: "Tagged Release"
-    runs-on: "ubuntu-latest"
+    name: 'Tagged Release'
+    runs-on: 'ubuntu-latest'
     steps:
       - name: Checkout
         uses: actions/checkout@v2

.gitignore

@@ -1,11 +1,13 @@
-
+*.log
+.firebase-data/
 
 
 # Jetbrains Products
 # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
 # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 
 # User-specific stuff
+.idea/
 .idea/**/workspace.xml
 .idea/**/tasks.xml
 .idea/**/usage.statistics.xml
@@ -206,3 +208,7 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 node_modules
+
+
+
+.expo/

.npmrc

@@ -0,0 +1 @@
+legacy-peer-deps=true

DATABASE.md

@@ -0,0 +1,93 @@
+# Firestore Data Model
+
+This project stores application data in Google Cloud Firestore using a document-oriented (NoSQL) schema. The collections listed below are derived from the application's forms, utilities, and data-fetching logic and describe the shape of the documents the frontend expects.
+
+## Collections and Documents
+
+### `Users`
+
+Each document is stored at `Users/{uid}` where the document ID matches the Firebase Authentication user ID. User documents are created on first sign-in and updated through the account settings and terms & conditions flows.
+
+| Field           | Type                | Description                                                                                 |
+| --------------- | ------------------- | ------------------------------------------------------------------------------------------- |
+| `uid`           | `string`            | Firebase Authentication UID; also used as the document ID.                                  |
+| `email`         | `string`            | User email address sourced from authentication or edited later.                             |
+| `name`          | `string`            | Display name captured at sign-up and editable in account settings.                          |
+| `role`          | `"User" \| "Admin"` | Determines access to admin-only event management screens.                                   |
+| `events`        | `string[]`          | Event IDs created by the user; maintained when publishing, copying, or deleting events.     |
+| `reviews`       | `string[]`          | Event IDs the user has reviewed; updated after submitting feedback.                         |
+| `locPref`       | `string[]`          | Preferred campus sections used to filter event notifications (e.g., `"East"`, `"Central"`). |
+| `timePref`      | `string[]`          | Reserved for notification time preferences (currently stored but unused).                   |
+| `foodPref`      | `string[]`          | Reserved for dietary preferences (currently stored but unused).                             |
+| `agreedToTerms` | `boolean`           | Tracks whether the user accepted the program terms; required before accessing events.       |
+
+### `Events`
+
+Event documents live at `Events/{eventId}` where `eventId` is generated by Firestore. Documents are created via the admin event form and updated through the event management actions.
+
+| Field             | Type                                         | Description                                                                                                       |
+| ----------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
+| `id`              | `string`                                     | Stored copy of the Firestore document ID for convenient lookups and client-side routing.                          |
+| `host`            | `string`                                     | Hosting department or organization name.                                                                          |
+| `name`            | `string`                                     | Event title displayed across listings and detail views.                                                           |
+| `Location`        | `object`                                     | Structured location with map metadata; see [Location object](#location-object).                                   |
+| `locationDetails` | `string`                                     | Additional pickup instructions shown on the event page.                                                           |
+| `notes`           | `string`                                     | Extra comments about the food or logistics.                                                                       |
+| `duration`        | `number` (minutes)                           | Pickup window length derived from the time picker (stored as minutes even though the type is declared as string). |
+| `foodArrived`     | `Timestamp`                                  | When food first became available; controls validation limits for pickup timing.                                   |
+| `foodAvailable`   | `Timestamp`                                  | Pickup start time displayed in event cards and previews.                                                          |
+| `foods`           | `FoodItem[]`                                 | Array of food entries including quantity, unit, and item name.                                                    |
+| `status`          | `"drafted" \| "saved" \| "open" \| "closed"` | Workflow state toggled by publishing and ending events.                                                           |
+| `images`          | `string[]`                                   | Up to three Firebase Storage download URLs representing event photos.                                             |
+| `reviewedBy`      | `string[]`                                   | User IDs that already submitted feedback; prevents duplicate reviews.                                             |
+
+Events reference the creating admin via the `Users/{uid}.events` array and are filtered client-side to show only `status === "open"` when listing public events.
+
+#### Location object
+
+The `Location` embedded object standardizes site-wide geocoding details used in filters and maps.
+
+| Field                | Type      | Notes                                                                        |
+| -------------------- | --------- | ---------------------------------------------------------------------------- |
+| `name`               | `string`  | Human-readable location name (defaults to "BU Campus").                      |
+| `address`            | `string`  | Full address displayed to users and in map popups.                           |
+| `abbreviation`       | `string`  | Short label shown alongside `locationDetails`.                               |
+| `lat` / `lon`        | `string`  | Latitude and longitude stored as strings, parsed when rendering maps.        |
+| `campus_section`     | `string`  | Campus region used for filtering and preference chips (e.g., East, Central). |
+| `abbreviatedAddress` | `string?` | Optional shortened label when provided.                                      |
+
+### `Reviews/{eventId}/Reviews`
+
+Feedback is organized under a top-level `Reviews` collection where each event ID has its own document containing a nested `Reviews` subcollection. Submissions append documents to `Reviews/{eventId}/Reviews/{reviewId}` with the following fields.
+
+| Field          | Type        | Description                                                                         |
+| -------------- | ----------- | ----------------------------------------------------------------------------------- |
+| `id`           | `string`    | Stored review document ID for client rendering.                                     |
+| `comment`      | `string`    | Participant feedback message (required).                                            |
+| `date`         | `Timestamp` | Submission timestamp used for ordering newest-first.                                |
+| `images`       | `string[]`  | Optional Firebase Storage download URLs; limited to three via the upload component. |
+| `shareContact` | `boolean`   | Indicates whether contact information can be shared with admins.                    |
+| `name`         | `string`    | Reviewer name collected only when `shareContact` is true.                           |
+| `email`        | `string`    | Reviewer email collected only when `shareContact` is true.                          |
+
+Submitting feedback also updates `Users/{uid}.reviews` and `Events/{eventId}.reviewedBy` arrays to reflect participation.
+
+## Media Storage
+
+Event and review images are uploaded to Firebase Storage under `events/images/` or `reviews/images/`. Download URLs are stored directly in `images` arrays, and users can manage up to three images per record.
+
+## Query & Index Considerations
+
+The frontend issues several Firestore queries that influence indexing strategy:
+
+- Event listings order by `foodAvailable` descending and filter client-side by `status === "open"`. Ensure a single-field index on `foodAvailable` exists (Firestore creates it automatically).
+- Admin dashboards query events with `where("id", "in", user.events)` combined with `orderBy("foodAvailable", "desc")`; this requires a composite index on `(id asc, foodAvailable desc)` for best performance.
+- Reviews are ordered by `date` within each `Reviews/{eventId}/Reviews` subcollection to show recent feedback first.
+
+## Relationships Summary
+
+- Users own events through the `events` array and must have `role === "Admin"` to create or manage them.
+- Participants mark event attendance by submitting feedback, which updates both the user's `reviews` list and the event's `reviewedBy` list to prevent duplicate submissions.
+- Access to event listings is gated by the `agreedToTerms` flag; users are redirected to accept terms before seeing live events.
+
+This document should serve as a reference when adding new fields or updating Firestore security rules so that the client and backend remain in sync.

README.md

@@ -1,7 +1,9 @@
 [![Netlify Status](https://api.netlify.com/api/v1/badges/589b5f54-8e95-4ceb-950f-262659a1bc4c/deploy-status)](https://app.netlify.com/sites/bu-sustainability-leftovers/deploys)
+
 # BU Sustainability Catering Leftovers
 
 ## Overview
+
 The BU Leftover Catering application is a solution aimed at reducing food waste on campus by facilitating the redistribution of leftover food from catering events within the specified time constraints.
 
 ## Core Features
@@ -12,6 +14,7 @@ The BU Leftover Catering application is a solution aimed at reducing food waste
 4. Tracking and Analytics: Tracks metrics such as reduced waste volume, types of food claimed, number of people engaged, speed of food pick-ups, and remaining food.
 
 ## Getting Started
+
 ```bash
 git clone https://github.com/yourgithubusername/se-bu-catering-leftovers.git (or download the entire project to your desktop by pressing the green "code" button and selecting "Download ZIP")
 cd se-bu-catering-leftovers
@@ -28,24 +31,27 @@ Sensitive keys and tokens are not stored wihtin the repository for security reas
 This project was done on React with Next.js. MUI Materials is the main UI framework, and Google Cloud Firestore and Storage systems were utilized. Further, openStreetMaps for the mapping feature was empoyed.
 
 ### Tech Stack
+
 The frontend of this project is built using React alongside Next.js. The primary UI framework utilized is MUI Materials. For additional styling, Styled-components and MUI Material Styles are implemented.
 
 On the backend, Firebase Firestore serves as the database and Firebase Storage is used for storage. User authentication is managed through Firebase Auth, which includes integration with Google OAuth for user login processes. Custom API routes are handled within the Next.js framework and are detailed in the `src/pages/api/` directory.
 
 For third-party services and APIs Google Cloud's Firestore and Storage are used for backend data management and file storage, and OpenStreetMaps is utilized for geographic mapping for locating events on campus.
 
 ## Known issues
-* Google Auth issues on the deployed version if popups are blocked on browser.
-* A more secure way of registering admins is suggested, particularly a changing, potentially one-time use, token, or any other better-suited alternative.
-* Google Cloud Storage rules should be modified accordingly to only allow authenticated members its use.
-* Swipeable images component on the event preview is optimized for phone use and is hard to maneuver on PC.
-
+
+- Google Auth issues on the deployed version if popups are blocked on browser.
+- A more secure way of registering admins is suggested, particularly a changing, potentially one-time use, token, or any other better-suited alternative.
+- Google Cloud Storage rules should be modified accordingly to only allow authenticated members its use.
+- Swipeable images component on the event preview is optimized for phone use and is hard to maneuver on PC.
+
 ## Future Improvements
-* Managing storage: A function that automatically deletes events/images after a certain amount of time could be implemented to save storage.
-* Events can't currently be deleted within the app, only closed. 
-* A notifications page to view new feedback could be implemented for a better user experience on the admin side.
-* Email notifications: The component was created but it couldn't be tested as an official email wasn't provided and the security of sendGrid didn't allow the use of any email for testing purposes.
-  
+
+- Managing storage: A function that automatically deletes events/images after a certain amount of time could be implemented to save storage.
+- Events can't currently be deleted within the app, only closed.
+- A notifications page to view new feedback could be implemented for a better user experience on the admin side.
+- Email notifications: The component was created but it couldn't be tested as an official email wasn't provided and the security of sendGrid didn't allow the use of any email for testing purposes.
 
 ## Deployment
+
 To view our project deployed checkout: [https://bu-sustainability-leftovers.netlify.app/](https://testing--bu-sustainability-leftovers.netlify.app/)

backend/.env.example

@@ -0,0 +1,7 @@
+# Clerk Config
+CLERK_SECRET_KEY=sk_test_xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+# API Base URL
+BASE=https://your-project.vercel.app
+# Test User IDs (from Clerk Dashboard)
+STUDENT_ID=user_xxxxxxxxxxxxxxxxxxxxx
+ADMIN_ID=user_xxxxxxxxxxxxxxxxxxxxx

backend/.gitignore

@@ -0,0 +1,6 @@
+node_modules
+.vercel
+.env
+.env.local
+dist
+*.log