# Confexe — Conference Operating System

End-to-end conference management platform: create, promote, operate, and close physical / virtual / hybrid conferences from one place. See [ARCHITECTURE.md](./ARCHITECTURE.md) for system design, entity map, and build phases.

## Run

```bash
npm install
npx prisma db push     # create prisma/dev.db
npm run db:seed        # demo data (destructive reseed)
npm run dev            # http://localhost:3300
```

## Speaker photos & S3

Speaker photo uploads use an adapter (`src/lib/storage.ts`): with no config they land in `<repo>/uploads/` and are served via `/api/files/*`. To use S3, set in `.env`:

```
S3_BUCKET=your-bucket
S3_REGION=ap-south-1
AWS_ACCESS_KEY_ID=…
AWS_SECRET_ACCESS_KEY=…
# optional, e.g. CloudFront: S3_PUBLIC_URL=https://cdn.example.com
```

## Email (AWS SES)

Transactional emails (registration confirmations, volunteer welcomes, submission decisions, certificates, announcement blasts, reviewer assignments) send via SES. Configure in **Admin → System settings** (From address must be SES-verified; leave keys blank to use the EC2 IAM role with `ses:SendEmail` permission), or via env: `SES_FROM_EMAIL`, `SES_FROM_NAME`, `SES_REGION`. Unconfigured → sends are logged as SKIPPED in the admin email log and nothing breaks.

"Add speaker from LinkedIn" does a best-effort public-profile read (og tags / JSON-LD, photo download); when LinkedIn walls the request it still creates the speaker from the URL slug and opens the edit modal for review.

## Demo logins (password `demo1234`)

| Email | Role | See |
|---|---|---|
| `organizer@demo.test` | Organizer (Ananya Iyer, platform role ORGANIZER) | `/dashboard` — full TechBharat Summit 2026 workspace |
| `attendee@demo.test` | Attendee (Rohan Verma) | `/me` — ticket, submissions, certificate |
| `reviewer@demo.test` | Reviewer (Dr. Kavita Rao) | `/me/reviews` — review inbox |
| `volunteer@demo.test` | Volunteer (Sameer Khan) | check-in desk access only |
| `admin@demo.test` | Super admin | `/admin` — platform overview + audit log |

## Demo URLs

- Public conference site: `/c/techbharat-summit-2026` (schedule, speakers, sponsors, registration)
- Certificate verification: `/verify/CFX-CERT-DEMO2025`
- REST API: `GET /api/v1/conferences`, `POST /api/v1/checkin` (session-authed), `GET /api/v1/conferences/:id/registrations.csv`

## What's implemented (Phases 1–3 core)

- Auth (email+password, bcrypt, httpOnly sessions), org + per-conference RBAC across 10 roles. Platform roles: USER (attendee — participate only), ORGANIZER (can create conferences; chosen at signup), SUPER_ADMIN. Attendees are locked out of the organizer console server-side; team members (volunteer/reviewer…) reach only the workspaces their conference role permits
- Conference creation wizard → auto-generated branded public website (SEO metadata per page)
- Registration engine: 5+ ticket types, quantities/sale windows, coupons (percent/flat), duplicate guard, hybrid physical/virtual mode choice, mock Razorpay-shaped payment flow, QR digital tickets
- Agenda builder with tracks/rooms and room + speaker conflict detection; day-wise public schedule; attendee personal schedule (starred sessions)
- Check-in desk (scanner-friendly) + attendance stats; CSV exports
- Certificates: bulk idempotent generation, unique IDs, public verification page with printable A4 certificate + QR
- CFP: submissions → reviewer assignment → scored reviews → accept/revise/reject decisions with notifications
- Sponsors by tier, announcements with notification fan-out, audit logging throughout
- Organizer workspace + attendee portal + super-admin dashboard

Payments and email delivery are deliberate mocks; swap `mockPayAction` and add an SMTP adapter for production. Prisma is pinned to v6 (v7 breaks `url` in schema); SQLite means statuses are strings validated in code (`src/lib/constants.ts`).