Merge pull request #114 from matanp/feat/srs-implementation

Feat/srs implementation

Author: matanp

.cursorrules

@@ -54,6 +54,12 @@ Senior full-stack 10x developer: balances speed, clarity, and maintainability.
 - **Stale closures**: For callbacks/effects, use `useRef` when a dependency has unstable identity (e.g. `toastRef.current = toast`). `useApiMutation.mutate` is now stable; no `mutateRef` needed.
 - **Enums**: Use `PrivilegeLevel.Admin` not `"Admin"`
 - **Prisma models**: Never use `(prisma as unknown as {...})` casts. Add the model to [apps/frontend/prisma/schema.prisma](apps/frontend/prisma/schema.prisma), run migrations, then use `prisma.modelName` directly. The schema is the single source of truth.
+- **Client-safe shared packages**: Packages imported by client components (e.g. `shared-validators`) must NOT re-export runtime code from `shared-prisma` or any package that pulls in Prisma Client. Prisma uses Node.js built-ins (`async_hooks`) and will break browser/Vercel builds. Server-only helpers (e.g. `runBoeEligibilityFlagging`) belong in `shared-prisma`; import them directly in API routes and server code.
+
+## Tests
+
+- Use typed matcher utilities from `__tests__/utils/testUtils.ts` instead of raw `expect.objectContaining` when asserting Prisma mock calls (e.g. `expectMembershipCreate`, `expectMembershipUpdate`). Avoids `@typescript-eslint/no-unsafe-assignment` and keeps assertions type-safe.
+- If no domain-specific matcher exists, add one to testUtils (e.g. `expectXCreate`) rather than using raw `expect.objectContaining`, which Jest types as `any`.
 
 ## File Locations
 
@@ -78,3 +84,9 @@ Senior full-stack 10x developer: balances speed, clarity, and maintainability.
 ## Plan Documents
 
 When creating a plan document, put it in the `docs/` folder (or `AI_PLAN_DOCS/` subfolder if gitignored planning material).
+
+## Authentication and privilege changes
+
+Before changing or reviewing authentication, authorization, privileges, or role-gated UI, read `skills/auth-check-patterns/SKILL.md`.
+
+Before adding or extending report types, read `skills/adding-reports/SKILL.md`.

.gitignore

@@ -9,6 +9,7 @@ terraform.tfstate*
 **/dist/
 **/coverage/
 .vercel
+.pnpm-store/
 
 **/.DS_Store
 
@@ -18,5 +19,12 @@ terraform.tfstate*
 
 AI_PLAN_DOCS/
 
+# Architecture review manifests and cited-files lists (local, not for version control)
+.review/
+
+# Local planning/review docs (not for version control)
+docs/ADMIN_USER_MANAGEMENT_REVIEW.md
+docs/AUDIT_TRAIL_PREVIOUS_SEAT_OCCUPANT.md
+
 *.tsbuildinfo
 .test-results/

AGENTS.md

@@ -0,0 +1,16 @@
+# Agent Guidance
+
+Before changing or reviewing authentication, authorization, privileges, or role-gated UI, read [skills/auth-check-patterns/SKILL.md](skills/auth-check-patterns/SKILL.md).
+
+Before adding or extending report types (API schema, scoped pages, grid cards, report-server handlers), read [skills/adding-reports/SKILL.md](skills/adding-reports/SKILL.md).
+
+Before adding or materially changing tests, read [skills/test-type-safety/SKILL.md](skills/test-type-safety/SKILL.md).
+
+Before merging API, auth, role-gated UI, report, upload, invite, committee membership, or audit-log changes, run the illegible-bug checklist:
+
+- Trust boundary: every route is `withPrivilege`, `withBackendCheck`, or `withPublic`.
+- Negative auth: tests cover unauthenticated, insufficient privilege, and cross-user/cross-scope access.
+- State race: find-then-write flows use transactions, unique constraints, conditional updates, or P2002 handling.
+- Validation: request bodies and query params use Zod/shared validators, not TypeScript casts.
+- Data scope: list/file/report/PII responses prove owner, jurisdiction, or privilege scope.
+- Audit/state invariants: privileged mutations preserve audit and domain invariants.

CLAUDE.md

@@ -0,0 +1,5 @@
+# Agent Guidance
+
+Before changing or reviewing authentication, authorization, privileges, or role-gated UI, read [skills/auth-check-patterns/SKILL.md](skills/auth-check-patterns/SKILL.md).
+
+Before adding or extending report types, read [skills/adding-reports/SKILL.md](skills/adding-reports/SKILL.md).

README.md

@@ -27,6 +27,18 @@ packages/
 - **Local development** → [docs/LOCAL_DEVELOPMENT.md](docs/LOCAL_DEVELOPMENT.md)
 - **Deployment** → [DEPLOYMENT_GUIDE.md](DEPLOYMENT_GUIDE.md), [infrastructure/DEPLOYMENT_SETUP.md](infrastructure/DEPLOYMENT_SETUP.md)
 - **Shared Prisma** → [docs/SHARED_PRISMA_ARCHITECTURE.md](docs/SHARED_PRISMA_ARCHITECTURE.md)
+- **SRS implementation roadmap** → [docs/SRS/SRS_IMPLEMENTATION_ROADMAP.md](docs/SRS/SRS_IMPLEMENTATION_ROADMAP.md)
+- **SRS ticket index / status** → [docs/SRS/tickets/README.md](docs/SRS/tickets/README.md)
+
+## Current Phase 1 Follow-Up Tickets (SRS)
+
+- [1.R.1 Leader Privilege Escalation](docs/SRS/tickets/1.R.1-leader-privilege-escalation.md) (P0)
+- [1.R.2 requestAdd Resubmission for Non-Active Memberships](docs/SRS/tickets/1.R.2-requestAdd-resubmission-non-active.md) (P1)
+- [1.R.3 Replacement Flow Not Implemented in handleRequest](docs/SRS/tickets/1.R.3-replacement-flow-not-implemented.md) (P1)
+- [1.R.4 Bulk Import Incompatible with Phase 1 Schema](docs/SRS/tickets/1.R.4-bulk-import-phase1-incompatible.md) (P1)
+- [1.R.5 Source-of-Truth Split](docs/SRS/tickets/1.R.5-source-of-truth-split.md) (P1)
+- [1.R.6 Audit Tests Fail](docs/SRS/tickets/1.R.6-audit-tests-fail.md) (P2)
+- [1.R.7 Capacity + Seat Assignment Non-Atomic](docs/SRS/tickets/1.R.7-capacity-seat-assignment-non-atomic.md) (P2)
 
 ## Contributing
 

apps/frontend/.eslintrc.cjs

@@ -25,6 +25,7 @@ const config = {
       "warn",
       {
         argsIgnorePattern: "^_",
+        varsIgnorePattern: "^_",
       },
     ],
     "@typescript-eslint/require-await": "off",
@@ -43,6 +44,9 @@ const config = {
       env: { jest: true },
       rules: {
         "@typescript-eslint/unbound-method": "off",
+        "@typescript-eslint/no-unsafe-assignment": "warn",
+        "@typescript-eslint/no-unsafe-member-access": "warn",
+        "@typescript-eslint/non-nullable-type-assertion-style": "warn",
       },
     },
     {