================================================================
DIASPORA AIR — PROJECT STATUS REPORT
For: GitHub Copilot / engineering handoff
Generated: 2026-06-29
Live: https://diasporaair.lovable.app
================================================================

1. STACK
--------
- Framework: TanStack Start v1 (React 19, Vite 7), deployed on Cloudflare
  Workers (nodejs_compat).
- Styling: Tailwind v4 via src/styles.css (semantic tokens, .btn-gold,
  .text-3d, .text-cycle, .neon-tile animations).
- Backend: Lovable Cloud (Supabase) — Postgres + Auth + Storage + Realtime.
- Server logic: createServerFn from @tanstack/react-start. Server routes
  under src/routes/api/ for raw HTTP (donate webhook target, invites).
- Integrations: Brevo (email/SMS/WhatsApp invites), Google Translate widget,
  YouTube embed, NovaCast iframe, "TNV Gateway" stub for payments.

2. ROUTE MAP
------------
  /                       Home (hero, banner slider, stats, campaigns, videos)
  /campaigns              List + search by 15 categories
  /campaigns/new          Auth-gated create form w/ cover upload
  /campaigns/$slug        Detail + donate + vote + share
  /community              Country room directory
  /community/$country     Country room
  /admin                  Staff dashboard (Stats, Invite, Templates,
                          Leads, Campaigns approval)
  /login                  Email/password + Google
  /legal                  Disclaimer, Terms, Privacy, Risk
  /api/donate             POST — creates pending donation, calls TNV gw
  /api/send-invite        POST — Brevo email/sms/whatsapp

================================================================
3. ✅ WORKING / VERIFIED
================================================================
[UI]
- Hero "Owned by Diaspora" letter-drop + slide-in animation.
- Hero banner image (src/assets/hero-banner.png) with navy gradient overlay.
- Four-CTA button row (Support, World Cup Tee, Spirit Workers, Join).
- Theme toggle (light/dark) persisted in localStorage.
- Google Translate dropdown with 15 diaspora languages.
- Banner slider (10 images, auto-rotate, manual + dots).
- VideoModal autoplay "Watch Our Story".
- NovaCast iframe embed (awards 1 TNVCoin on >50% view).
- Neon-cycle crowdfunding platform tiles.
- Footer with thenuvision.com + legal links + logo.

[Data / DB]
- profiles, user_roles, site_stats, invites, invite_templates, leads,
  campaigns, donations, campaign_updates, tnv_wallet_mirror, votes,
  referrals, tnvcoin_transactions, country_groups, group_members,
  affiliate_assignments.
- has_role() + has_any_staff_role() SECURITY DEFINER functions.
- live_impact view aggregating raised_cents, supporters, countries.
- Realtime subscriptions on donations + campaigns drive homepage stats.
- handle_new_user() trigger creates a profile row on signup.

[Features]
- Auth: email/password sign-up + sign-in (useAuth hook).
- _authenticated layout gate (ssr:false) for protected routes.
- Admin tabs functional: edit stats, send invite (Email path), list
  invites with Resend, edit templates, view leads, approve/reject/
  pause/freeze campaigns (stamps approved_by).
- Campaign creation: validation, image upload to private bucket
  "campaign-covers", 10-yr signed URL stored in cover_image_url.
- Campaign detail renders cover, progress, share panel, vote button.
- /api/donate inserts pending donation, awards TNVCoin math
  (1 USD = 1 TNVCoin), calls TNV Gateway stub, fires CRM event.
- Vote toggle (one per user/campaign).
- Share panel logs to referrals table by channel.
- Affiliate IP rotation: round-robin PXCH + NovaCast links, persisted
  per IP in affiliate_assignments.
- Legal page (Disclaimer, Terms, Privacy, Risk).
- Lead form on homepage writes to leads table.
- Spirit Resources CTA → https://afacwa.org/spirit_resources/.
- World Cup Tee CTA → https://thenuvision.com/shop.

================================================================
4. ⚠️ PARTIAL / STUBBED
================================================================
- TNV Gateway (src/lib/tnv-gateway.server.ts) returns a fake checkout_url
  and { stubbed: true }. No real Stripe / PayPal / Square / NowPayments
  API call is made.
- Donation rows stay status='pending' forever — no webhook flips them to
  'succeeded', so live_impact totals from real donations never grow.
  (The homepage takes MAX(live, manual override), so the manual admin
  numbers mask this in the UI.)
- CRM sync (src/lib/crm-sync.server.ts) is a no-op until secrets
  THENUVISION_CRM_WEBHOOK_URL and THENUVISION_CRM_API_KEY are set.
- TNVCoin: rows insert into tnvcoin_transactions but no wallet UI,
  no withdrawal flow, no balance display, no on-chain mirror sync.
- NovaCast view reward: fires once per session via IntersectionObserver,
  no rate-limit or anti-abuse server-side.
- Google OAuth: button is present; Supabase Google provider configuration
  has NOT been verified in this project.
- Brevo invites: Email path tested. SMS / WhatsApp depend on the Brevo
  account having those channels enabled; untested end-to-end.
- Community country rooms: routes exist, minimal moderation tooling.
- Two of four video tiles in FundraisingVideos.tsx use placeholder
  YouTube ID "dQw4w9WgXcQ" (Rickroll) — need real spotlight videos.
- Translate dropdown can overflow on screens narrower than ~380px.

================================================================
5. ❌ MISSING / NOT BUILT
================================================================
- No real payment provider enabled (no Stripe/Paddle integration).
- No public webhook endpoint at /api/public/webhooks/* to confirm payments
  and update donations.status + campaigns.raised_cents.
- No campaign content moderation (image scan, profanity filter).
- No password-reset route (/forgot-password).
- No email confirmation flow customization.
- No analytics dashboard charts — Admin Stats tab shows raw numbers only.
- No referral payout / commission ledger.
- No SEO og:image on /campaigns/$slug (only text meta).
- No /sitemap.xml or /robots.txt.
- No rate limiting on /api/donate or /api/send-invite.
- No CSV export of leads or donations from admin.
- No unit/integration tests.

================================================================
6. 🔐 SECURITY & CONFIG CHECKLIST
================================================================
- [ ] Verify RLS enabled on ALL public tables (currently enabled on most;
      run: select tablename, rowsecurity from pg_tables where schemaname='public').
- [ ] Audit GRANTs — every public table must grant to service_role and
      to authenticated (and only to anon when policy explicitly permits).
- [ ] Add secrets:
        THENUVISION_CRM_WEBHOOK_URL
        THENUVISION_CRM_API_KEY
        STRIPE_SECRET_KEY (when payments go live)
        STRIPE_WEBHOOK_SECRET
- [ ] Configure Google provider in Supabase Auth dashboard.
- [ ] Add CORS allow-list to /api/donate (currently open).
- [ ] Add HMAC signature verification on any future inbound webhook.
- [ ] Review storage policies on "campaign-covers" bucket (private,
      per-user folder, signed-URL reads — confirm uploads are user-scoped).

================================================================
7. 📋 SUGGESTED FIX ORDER FOR COPILOT
================================================================
P0 — Money flow:
  1. Enable Stripe (or Paddle) in the project.
  2. Replace tnv-gateway.server.ts stub with a real Stripe Checkout
     Session create call, return session.url as checkout_url.
  3. Add /api/public/webhooks/stripe route, verify signature with
     timingSafeEqual, on checkout.session.completed:
       - update donations.status='succeeded'
       - increment campaigns.raised_cents
       - insert tnvcoin_transactions row
       - emit syncToCrm('donation.succeeded', ...).
  4. Remove the "MAX(live, manual)" mask once real donations flow.

P1 — Trust + auth:
  5. Configure Google OAuth provider; verify redirect_uri.
  6. Add /forgot-password route using supabase.auth.resetPasswordForEmail.
  7. Add rate limiting on /api/donate and /api/send-invite (per IP, 10/min).

P2 — Growth:
  8. Replace placeholder YouTube IDs in FundraisingVideos.tsx.
  9. Add og:image on /campaigns/$slug from cover_image_url.
  10. Add sitemap.xml + robots.txt routes.
  11. Add CSV export buttons in Admin → Leads and Admin → Campaigns.
  12. Build TNVCoin wallet UI on /account.

P3 — Polish:
  13. Fix translate dropdown overflow on <380px.
  14. Add analytics charts to Admin Stats tab (recharts already installed).
  15. Add e2e tests for donate + create-campaign flow.

================================================================
8. KEY FILES (read these first)
================================================================
src/routes/__root.tsx
src/routes/index.tsx
src/routes/admin.tsx
src/routes/campaigns.tsx
src/routes/campaigns.new.tsx
src/routes/campaigns.$slug.tsx
src/routes/api/donate.ts
src/routes/api/send-invite.ts
src/lib/tnv-gateway.server.ts        <-- replace stub
src/lib/crm-sync.server.ts           <-- needs secrets
src/lib/rotation.functions.ts
src/lib/voting.functions.ts
src/components/FundraisingVideos.tsx <-- placeholder video IDs
src/components/DonateDialog.tsx
src/components/NovaCastEmbed.tsx
src/components/SharePanel.tsx
src/components/VoteButton.tsx
src/hooks/useAuth.ts
src/integrations/supabase/client.ts          (auto-generated, DO NOT EDIT)
src/integrations/supabase/client.server.ts   (auto-generated, DO NOT EDIT)
src/integrations/supabase/auth-middleware.ts (auto-generated, DO NOT EDIT)
src/styles.css
supabase/config.toml

================================================================
END OF REPORT
================================================================