update branch to match main

AGENTS.md

@@ -4,6 +4,8 @@ applyTo: "**"
 
 Keep your changes as low impact as possible. You do not need to give me a summary of changes. You do not need to test the changes. Try to reference other parts of the codebase to ensure your changes are consistent with the existing code style and practices. Keep your responses concise and focused.
 
+Never add "Co-Authored-By" lines to commits. PR descriptions should be a simple description of the changes — nothing more. No test plans, no checklists, no headings, no marketing copy. One short paragraph (or a couple of plain sentences) is enough. Do not push code or create PRs unless explicitly asked. Do not add co-authorship attribution of any kind.
+
 Read all context and instructions carefully before making changes. Code may be manually modified between messages. Do not suggest code that has been deleted or is no longer relevant.
 
 This project uses ruby 3.4.4, rails 8.1.2 with React 19 and tailwind 4.1.18 through inertia-rails. Make sure to only suggest changes that are applicable to those versions. When possible, prefer to use the cli to generate boilerplate rather than editing files manually. You can always modify boilerplate generated from the cli.
@@ -27,10 +29,11 @@ Do not add comments unless they are absolutely necessary for clarity. Your code
 Forge is a Hack Club program where teen builders (ages 13-18) get funded for hardware projects. Users pitch projects in Slack, admins review them, and approved builders document their progress via devlogs.
 
 ### Key Models
-- **User** — has roles (user/admin/reviewer), permissions array, ban status, slack_id for Slack integration
-- **Project** — belongs to user, has status enum (draft/pending/approved/returned/rejected), slack_channel_id/slack_message_ts for Slack thread tracking, pitch_text (cleaned user pitch), description (AI-generated admin summary)
+- **User** — has roles (user/admin/reviewer/support/fulfillment), permissions array, ban status, slack_id for Slack integration
+- **Project** — belongs to user, has status enum (draft/pending/approved/returned/rejected/pitch_pending/pitch_approved), slack_channel_id/slack_message_ts for Slack thread tracking, pitch_text (cleaned user pitch), description (AI-generated admin summary), hidden flag
 - **Ship** — belongs to project, represents a submission of work for review
 - **Devlog** — belongs to project, markdown entries documenting build progress (title, content, time_spent)
+- **SupportTicket** — tracks support questions from Slack with status (open/claimed/resolved), two-way thread sync between public and BTS channels
 - **FeatureFlag** — simple name/enabled toggle for app-wide feature flags
 - All models use `has_paper_trail` for audit logging
 
@@ -43,28 +46,38 @@ Forge is a Hack Club program where teen builders (ages 13-18) get funded for har
 6. Once approved, user can add devlogs on the project page or sync from JOURNAL.md in their GitHub repo
 
 ### Slack Integration
-- **Webhook endpoint:** `POST /slack/events` — receives Slack events, filters for messages in the forge channel
+- **Webhook endpoint:** `POST /slack/events` — receives Slack events, routes to pitch or support handlers
+- **Interactivity endpoint:** `POST /slack/interactivity` — handles Block Kit button clicks (support ticket claim/resolve)
 - **SlackPitchJob** — processes pitches, creates projects, replies in thread, adds :eyes: reaction
 - **SlackNotifyJob** — posts review decisions back to Slack threads
-- Bot ignores its own messages (`bot_id`), thread replies (`thread_ts`), and messages with subtypes
-- Required env vars: `SLACK_SIGNING_SECRET`, `SLACK_FORGE_CHANNEL_ID`, `SLACK_BOT_TOKEN`
-- Required Slack app scopes: `channels:history`, `groups:history`, `chat:write`, `reactions:write`
+- **SupportTicketJob** — processes support questions, auto-responds, posts to BTS channel with buttons
+- **SupportRelayJob** — relays BTS thread replies to public thread with staff name/avatar
+- **SupportForwardJob** — forwards public thread replies to BTS thread with user name/avatar
+- Bot ignores its own messages (`bot_id`) and messages with subtypes
+- Events controller routes by channel: forge channel → pitches, support channel → tickets, BTS channel threads → relay
+- Required env vars: `SLACK_SIGNING_SECRET`, `SLACK_FORGE_CHANNEL_ID`, `SLACK_BOT_TOKEN`, `SLACK_SUPPORT_CHANNEL_ID`, `SLACK_BTS_CHANNEL_ID`
+- Required Slack app scopes: `channels:history`, `groups:history`, `chat:write`, `chat:write.customize`, `reactions:write`
 - Event subscription: `message.channels` and `message.groups`
 
 ### Admin Panel
-- Dashboard at `/admin` with links to all sections
+- Dashboard at `/admin` with links filtered by user permissions
 - **Projects** (`/admin/projects`) — table view, status filters, review panel with approve/return/reject/draft actions
-- **Users** (`/admin/users`) — role management, permission toggles, ban/unban with reasons, soft/hard delete, restore
+- **Users** (`/admin/users`) — role management, permission toggles, ban/unban with reasons, soft/hard delete, restore, role filter
+- **Support** (`/admin/support`) — support ticket list with stats, leaderboard, status filters. Detail page with Slack thread view, reply from web, claim/resolve/delete
 - **Ships** (`/admin/reviews`) — review and manage ship submissions
 - **Feature Flags** (`/admin/feature_flags`) — create/toggle/delete feature flags, use `FeatureFlag.enabled?("name")` to check
 - **Audit Log** (`/admin/audit_log`) — PaperTrail versions with human-readable descriptions, filterable by type/event, clickable detail view
 - **Jobs** (`/admin/jobs`) — MissionControl::Jobs engine with dark theme override
-- Route constraints: `StaffConstraint` (admin or reviewer) for dashboard/ships, `AdminConstraint` (admin only) for everything else
+- **Database** (`/admin/database`) — raw SQL query/execute, admin-only
+- Route constraints: `StaffConstraint` for all admin routes, individual controllers enforce permissions
 
 ### Permissions System
-- **Roles** (array on User): `user`, `admin`, `reviewer`. Admin has all permissions by default.
-- **Permissions** (array on User): `pending_reviews`, `projects`, `users`, `ships`, `feature_flags`, `audit_log`, `jobs`, `third_party` — for fine-grained access control on non-admin staff
-- Check with `user.has_permission?("permission_name")` — returns true for admins automatically
+- **Roles** (array on User): `user`, `admin`, `reviewer`, `support`, `fulfillment`
+- **Permissions** (array on User): `pending_reviews`, `projects`, `users`, `ships`, `feature_flags`, `audit_log`, `jobs`, `third_party`, `support`
+- Permissions are explicit for all roles including admin — `has_permission?` checks the permissions array only
+- Assigning a role auto-grants default permissions (see `ROLE_DEFAULT_PERMISSIONS`), but individual permissions can be revoked afterwards
+- Default permissions: admin gets all, reviewer gets pending_reviews/projects/ships, support gets projects/users/support, fulfillment gets projects/ships
+- `staff?` returns true for admin, reviewer, support, or fulfillment roles
 
 ### AI Integration
 - Uses Hack Club AI (`https://ai.hackclub.com/proxy/v1/chat/completions`) with `qwen/qwen3-32b` model
@@ -87,6 +100,8 @@ Forge is a Hack Club program where teen builders (ages 13-18) get funded for har
 - `SLACK_SIGNING_SECRET` — Slack request verification
 - `SLACK_FORGE_CHANNEL_ID` — Channel ID for `#into-the-forge`
 - `HCA_CLIENT_ID` / `HCA_CLIENT_SECRET` — HCA OAuth credentials
+- `SLACK_SUPPORT_CHANNEL_ID` — Channel ID for support questions
+- `SLACK_BTS_CHANNEL_ID` — Channel ID for behind-the-scenes support staff
 - `APP_URL` — Base URL for links in Slack messages (defaults to `https://forge.hackclub.com`)
 
 ### Deployment

Gemfile.lock

@@ -75,7 +75,7 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     ahoy_matey (5.4.1)
       activesupport (>= 7.1)
@@ -312,7 +312,7 @@ GEM
     psych (5.3.1)
       date
       stringio
-    public_suffix (7.0.2)
+    public_suffix (7.0.5)
     puma (7.2.0)
       nio4r (~> 2.0)
     pundit (2.5.2)

app/assets/tailwind/application.css

@@ -2,10 +2,10 @@
 
 .markdown-content {
   max-width: 48rem;
-  margin: 2rem auto;
-  padding: 0 1rem;
+  margin: 0;
+  padding: 0;
   line-height: 1.75;
-  color: #1a202c;
+  color: #a8a29e;
 }
 
 .markdown-content h1 {
@@ -14,6 +14,7 @@
   margin-top: 0;
   margin-bottom: 1rem;
   line-height: 1.2;
+  color: #e5e2e1;
 }
 
 .markdown-content h2 {
@@ -22,35 +23,38 @@
   margin-top: 2rem;
   margin-bottom: 0.75rem;
   line-height: 1.3;
-  border-bottom: 1px solid #e2e8f0;
+  border-bottom: 1px solid rgba(168, 138, 126, 0.2);
   padding-bottom: 0.25rem;
+  color: #e5e2e1;
 }
 
 .markdown-content h3 {
   font-size: 1.25rem;
   font-weight: 600;
   margin-top: 1.5rem;
   margin-bottom: 0.5rem;
+  color: #e5e2e1;
 }
 
 .markdown-content h4 {
   font-size: 1.125rem;
   font-weight: 600;
   margin-top: 1.25rem;
   margin-bottom: 0.5rem;
+  color: #e5e2e1;
 }
 
 .markdown-content p {
   margin-bottom: 1rem;
 }
 
 .markdown-content a {
-  color: #2563eb;
+  color: #ffb595;
   text-decoration: underline;
 }
 
 .markdown-content a:hover {
-  color: #1d4ed8;
+  color: #ffd4be;
 }
 
 .markdown-content ul,
@@ -78,26 +82,27 @@
 }
 
 .markdown-content blockquote {
-  border-left: 4px solid #e2e8f0;
+  border-left: 4px solid rgba(238, 103, 28, 0.4);
   padding: 0.5rem 1rem;
   margin: 1rem 0;
-  color: #4a5568;
+  color: #d6d3d1;
+  background-color: rgba(42, 42, 42, 0.7);
 }
 
 .markdown-content code {
-  background-color: #f1f5f9;
+  background-color: #0e0e0e;
   padding: 0.125rem 0.375rem;
-  border-radius: 0.25rem;
   font-size: 0.875em;
+  color: #f5f5f4;
 }
 
 .markdown-content pre {
-  background-color: #1e293b;
-  color: #e2e8f0;
+  background-color: #0e0e0e;
+  color: #e7e5e4;
   padding: 1rem;
-  border-radius: 0.5rem;
   overflow-x: auto;
   margin-bottom: 1rem;
+  border: 1px solid rgba(168, 138, 126, 0.2);
 }
 
 .markdown-content pre code {
@@ -115,40 +120,39 @@
 }
 
 .markdown-content th {
-  background-color: #f8fafc;
-  border: 1px solid #e2e8f0;
+  background-color: #2a2a2a;
+  border: 1px solid rgba(168, 138, 126, 0.25);
   padding: 0.5rem 0.75rem;
   text-align: left;
   font-weight: 600;
+  color: #e7e5e4;
 }
 
 .markdown-content td {
-  border: 1px solid #e2e8f0;
+  border: 1px solid rgba(168, 138, 126, 0.2);
   padding: 0.5rem 0.75rem;
 }
 
 .markdown-content hr {
   border: none;
-  border-top: 1px solid #e2e8f0;
+  border-top: 1px solid rgba(168, 138, 126, 0.2);
   margin: 2rem 0;
 }
 
 .markdown-content img {
   max-width: 100%;
   height: auto;
-  border-radius: 0.5rem;
 }
 
 .markdown-content input[type="checkbox"] {
   margin-right: 0.5rem;
 }
 
 .markdown-content aside {
-  background-color: #eff6ff;
-  border-left: 4px solid #3b82f6;
+  background-color: rgba(42, 42, 42, 0.7);
+  border-left: 4px solid rgba(238, 103, 28, 0.5);
   padding: 1rem;
   margin: 1rem 0;
-  border-radius: 0 0.25rem 0.25rem 0;
 }
 
 .markdown-content sup {
@@ -158,6 +162,6 @@
 .markdown-content .footnotes {
   margin-top: 2rem;
   padding-top: 1rem;
-  border-top: 1px solid #e2e8f0;
+  border-top: 1px solid rgba(168, 138, 126, 0.2);
   font-size: 0.875rem;
 }

app/controllers/admin/airtable_queue_controller.rb

@@ -0,0 +1,85 @@
+class Admin::AirtableQueueController < Admin::ApplicationController
+  before_action :require_superadmin!
+
+  def index
+    scope = AirtableQueueItem.includes(:project, :enqueued_by, :sent_by).recent
+    scope = scope.where(status: params[:status_filter]) if params[:status_filter].present?
+    @pagy, @items = pagy(scope, limit: 50)
+
+    render inertia: "Admin/AirtableQueue/Index", props: {
+      items: @items.map { |i| serialize(i) },
+      pagy: pagy_props(@pagy),
+      filters: { status: params[:status_filter].to_s },
+      counts: {
+        pending: AirtableQueueItem.pending.count,
+        sent: AirtableQueueItem.sent.count,
+        failed: AirtableQueueItem.failed.count,
+        cancelled: AirtableQueueItem.cancelled.count
+      },
+      airtable_enabled: AirtableService.enabled?
+    }
+  end
+
+  def show
+    item = AirtableQueueItem.includes(:project, :enqueued_by, :sent_by).find(params[:id])
+
+    render inertia: "Admin/AirtableQueue/Show", props: {
+      item: serialize(item, full: true),
+      airtable_enabled: AirtableService.enabled?
+    }
+  end
+
+  def send_to_airtable
+    item = AirtableQueueItem.find(params[:id])
+
+    unless AirtableService.enabled?
+      redirect_to admin_airtable_queue_path(item), alert: "Airtable is not configured."
+      return
+    end
+
+    if item.send_to_airtable!(actor: current_user)
+      audit!("airtable.sent", target: item.project, metadata: { queue_item_id: item.id, airtable_record_id: item.airtable_record_id, table: item.table_name })
+      redirect_to admin_airtable_queue_path(item), notice: "Sent to Airtable."
+    else
+      redirect_to admin_airtable_queue_path(item), alert: "Airtable send failed: #{item.error}"
+    end
+  end
+
+  def cancel
+    item = AirtableQueueItem.find(params[:id])
+
+    unless item.pending?
+      redirect_to admin_airtable_queue_path(item), alert: "Only pending items can be cancelled."
+      return
+    end
+
+    item.update!(status: :cancelled)
+    audit!("airtable.cancelled", target: item.project, metadata: { queue_item_id: item.id })
+    redirect_to admin_airtable_queue_index_path, notice: "Item cancelled."
+  end
+
+  private
+
+  def require_superadmin!
+    raise ActionController::RoutingError, "Not Found" unless current_user&.superadmin?
+  end
+
+  def serialize(item, full: false)
+    data = {
+      id: item.id,
+      status: item.status,
+      table_name: item.table_name,
+      forge_id: item.forge_id,
+      project_id: item.project_id,
+      project_name: item.project&.name,
+      enqueued_by: item.enqueued_by&.display_name,
+      sent_by: item.sent_by&.display_name,
+      sent_at: item.sent_at&.strftime("%b %d, %Y %H:%M"),
+      airtable_record_id: item.airtable_record_id,
+      error: item.error,
+      created_at: item.created_at.strftime("%b %d, %Y %H:%M")
+    }
+    data[:payload] = item.payload if full
+    data
+  end
+end

app/controllers/admin/application_controller.rb

@@ -10,4 +10,8 @@ def require_staff!
   def require_admin!
     raise ActionController::RoutingError, "Not Found" unless current_user&.admin?
   end
+
+  def require_permission!(perm)
+    raise ActionController::RoutingError, "Not Found" unless current_user&.has_permission?(perm)
+  end
 end