feat: implement pairwise voting judging system with React client

Add Express API server alongside Discord bot with Discord OAuth2 authentication, pairwise comparison judging UI, and spectral ranking algorithm for game jam entries. Includes Vite + React frontend, database migration for comparisons, and jam:rankings CLI script. Supports local dev with auth bypass mode.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: kronosapiens

backend/.env.example

@@ -48,3 +48,8 @@ OPENAI_API_KEY=sk-your-openai-key
 # Typefully (for draft publishing)
 TYPEFULLY_API_KEY=your-typefully-api-key
 TYPEFULLY_SOCIAL_SET_ID=your-social-set-id
+
+# Game Jam Judging
+DISCORD_CLIENT_SECRET=your_discord_client_secret
+DISCORD_SESSION_SECRET=random-32-char-string-for-jwt-signing
+DEV_AUTH_BYPASS=false # true for local dev (skips OAuth)

backend/migrations/1769199745034_judging.cjs

@@ -0,0 +1,37 @@
+/**
+ * Game jam judging schema migration
+ * Creates table for pairwise comparisons
+ */
+
+/**
+ * @param {import('node-pg-migrate').MigrationBuilder} pgm
+ */
+exports.up = (pgm) => {
+  // Pairwise comparisons table
+  pgm.createTable('jam_comparisons', {
+    id: { type: 'text', primaryKey: true },
+    jam_slug: { type: 'text', notNull: true },
+    judge_id: { type: 'text', notNull: true },
+    entry_a_id: { type: 'text', notNull: true },
+    entry_b_id: { type: 'text', notNull: true },
+    score: { type: 'real' }, // NULL if skipped, 0.0-1.0 for preference
+    timestamp: { type: 'bigint', notNull: true },
+  });
+
+  // Unique constraint: one comparison per judge per pair per jam
+  pgm.addConstraint('jam_comparisons', 'jam_comparisons_unique_judge_pair', {
+    unique: ['jam_slug', 'judge_id', 'entry_a_id', 'entry_b_id'],
+  });
+
+  // Indexes for common queries
+  pgm.createIndex('jam_comparisons', 'jam_slug', { name: 'idx_jam_comparisons_jam' });
+  pgm.createIndex('jam_comparisons', 'judge_id', { name: 'idx_jam_comparisons_judge' });
+  pgm.createIndex('jam_comparisons', 'timestamp', { name: 'idx_jam_comparisons_timestamp' });
+};
+
+/**
+ * @param {import('node-pg-migrate').MigrationBuilder} pgm
+ */
+exports.down = (pgm) => {
+  pgm.dropTable('jam_comparisons');
+};

backend/package.json

@@ -6,6 +6,7 @@
   "type": "module",
   "scripts": {
     "dev": "tsx watch src/index.ts",
+    "dev:api": "tsx watch src/api-server.ts",
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit -p tsconfig.build.json",
     "start": "node dist/index.js",
@@ -22,7 +23,8 @@
     "test:coverage": "NODE_OPTIONS=--experimental-vm-modules jest --coverage",
     "migrate": "node-pg-migrate up",
     "migrate:down": "node-pg-migrate down",
-    "migrate:create": "node-pg-migrate create"
+    "migrate:create": "node-pg-migrate create",
+    "jam:rankings": "tsx src/scripts/jam-rankings.ts"
   },
   "lint-staged": {
     "*.{ts,js}": [
@@ -42,16 +44,26 @@
   "license": "MIT",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.71.2",
+    "cookie-parser": "^1.4.7",
+    "cors": "^2.8.6",
     "discord.js": "^14.25.1",
     "dotenv": "^17.2.3",
+    "express": "^5.2.1",
+    "js-yaml": "^4.1.1",
+    "jsonwebtoken": "^9.0.3",
     "node-cron": "^4.2.1",
     "node-pg-migrate": "^8.0.4",
     "openai": "^4.77.0",
     "postgres": "^3.4.8"
   },
   "devDependencies": {
     "@electric-sql/pglite": "^0.3.15",
+    "@types/cookie-parser": "^1.4.10",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
+    "@types/js-yaml": "^4.0.9",
+    "@types/jsonwebtoken": "^9.0.10",
     "@types/node": "^25.0.3",
     "@types/node-cron": "^3.0.11",
     "eslint": "^9.39.2",

backend/src/api-server.ts

@@ -0,0 +1,51 @@
+/**
+ * Standalone API server for local development.
+ * Runs Express without the Discord bot.
+ */
+import { config } from 'dotenv';
+import postgres from 'postgres';
+import { startApiServer } from './api/index.js';
+import { setSql } from './services/database.js';
+
+// Load environment variables
+config();
+
+async function main() {
+  const databaseUrl = process.env.DATABASE_URL;
+  if (!databaseUrl) {
+    console.error('DATABASE_URL environment variable is required');
+    process.exit(1);
+  }
+
+  // Initialize database connection
+  console.log('Connecting to database...');
+  const sql = postgres(databaseUrl);
+
+  // Verify connection
+  await sql`SELECT 1`;
+  console.log('Database connected');
+
+  // Set the SQL instance for the database module
+  setSql(sql);
+
+  // Start API server
+  startApiServer();
+
+  // Handle graceful shutdown
+  process.on('SIGINT', async () => {
+    console.log('\nShutting down...');
+    await sql.end();
+    process.exit(0);
+  });
+
+  process.on('SIGTERM', async () => {
+    console.log('\nShutting down...');
+    await sql.end();
+    process.exit(0);
+  });
+}
+
+main().catch((err) => {
+  console.error('Failed to start API server:', err);
+  process.exit(1);
+});

backend/src/api/index.ts

@@ -0,0 +1,59 @@
+import express, { Express } from 'express';
+import path from 'path';
+import { fileURLToPath } from 'url';
+import { existsSync } from 'fs';
+import cors from 'cors';
+import cookieParser from 'cookie-parser';
+import authRoutes from './routes/auth.js';
+import jamsRoutes from './routes/jams.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+export function createApiServer(): Express {
+  const app = express();
+
+  // Middleware
+  app.use(
+    cors({
+      origin: process.env.CORS_ORIGIN || 'http://localhost:5173',
+      credentials: true,
+    })
+  );
+  app.use(express.json());
+  app.use(cookieParser());
+
+  // Health check
+  app.get('/api/health', (_req, res) => {
+    res.json({ status: 'ok' });
+  });
+
+  // API routes
+  app.use('/api/auth', authRoutes);
+  app.use('/api/jams', jamsRoutes);
+
+  // Serve React SPA static files in production
+  const clientDist = path.resolve(__dirname, '../../../client/dist');
+  if (existsSync(clientDist)) {
+    app.use(express.static(clientDist));
+
+    // SPA catch-all: serve index.html for non-API routes
+    app.get('/{*splat}', (_req, res) => {
+      res.sendFile(path.join(clientDist, 'index.html'));
+    });
+
+    console.log(`Serving client from ${clientDist}`);
+  }
+
+  return app;
+}
+
+export function startApiServer(): Express {
+  const app = createApiServer();
+  const port = process.env.PORT || process.env.HTTP_PORT || 3000;
+
+  app.listen(port, () => {
+    console.log(`API server listening on port ${port}`);
+  });
+
+  return app;
+}

backend/src/api/middleware/auth.ts

@@ -0,0 +1,80 @@
+import { Request, Response, NextFunction } from 'express';
+import jwt from 'jsonwebtoken';
+
+export interface AuthUser {
+  id: string;
+  username: string;
+  avatar?: string;
+}
+
+declare global {
+  namespace Express {
+    interface Request {
+      user?: AuthUser;
+    }
+  }
+}
+
+// Dev bypass user for local testing
+const DEV_USER: AuthUser = {
+  id: 'dev-user-123',
+  username: 'DevSensei',
+  avatar: undefined,
+};
+
+function getSessionSecret(): string {
+  return process.env.DISCORD_SESSION_SECRET || 'dev-secret-change-in-production';
+}
+
+function isDevBypass(): boolean {
+  return process.env.DEV_AUTH_BYPASS === 'true';
+}
+
+export function authMiddleware(req: Request, res: Response, next: NextFunction) {
+  // Dev bypass mode - auto-authenticate as a mock user
+  if (isDevBypass()) {
+    req.user = DEV_USER;
+    return next();
+  }
+
+  // Check for session cookie
+  const token = req.cookies?.session;
+  if (!token) {
+    return res.status(401).json({ error: 'Not authenticated' });
+  }
+
+  try {
+    const decoded = jwt.verify(token, getSessionSecret()) as AuthUser;
+    req.user = decoded;
+    next();
+  } catch {
+    return res.status(401).json({ error: 'Invalid session' });
+  }
+}
+
+export function optionalAuthMiddleware(req: Request, res: Response, next: NextFunction) {
+  // Dev bypass mode - auto-authenticate as a mock user
+  if (isDevBypass()) {
+    req.user = DEV_USER;
+    return next();
+  }
+
+  // Check for session cookie (optional - don't fail if missing)
+  const token = req.cookies?.session;
+  if (!token) {
+    return next();
+  }
+
+  try {
+    const decoded = jwt.verify(token, getSessionSecret()) as AuthUser;
+    req.user = decoded;
+  } catch {
+    // Invalid token - treat as unauthenticated
+  }
+
+  next();
+}
+
+export function createSessionToken(user: AuthUser): string {
+  return jwt.sign(user, getSessionSecret(), { expiresIn: '7d' });
+}