Admin audit remediation: security hardening + repo cleanup (Phases 1-2)

.eslintrc.json

@@ -0,0 +1,44 @@
+{
+  "extends": ["next/core-web-vitals", "next/typescript"],
+  "rules": {
+    "@typescript-eslint/no-explicit-any": "warn",
+    "@typescript-eslint/no-unused-vars": "warn"
+  },
+  "overrides": [
+    {
+      "files": [
+        "app/admin/**",
+        "components/admin/**",
+        "shared/**",
+        "app/api/admin/**"
+      ],
+      "rules": {
+        "no-console": "warn",
+        "no-alert": "warn",
+        "no-restricted-globals": [
+          "warn",
+          {
+            "name": "localStorage",
+            "message": "Use session hooks from shared/auth instead of localStorage directly."
+          },
+          {
+            "name": "confirm",
+            "message": "Use MUI Dialog instead of window.confirm()."
+          },
+          {
+            "name": "alert",
+            "message": "Use toast/snackbar instead of window.alert()."
+          }
+        ],
+        "no-restricted-properties": [
+          "warn",
+          {
+            "object": "window",
+            "property": "location",
+            "message": "Use Next.js router instead of window.location."
+          }
+        ]
+      }
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+# Verification-only gate. Deployment stays on Vercel.
+# Runs on pull requests and direct pushes to main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+
+    env:
+      # Dummy secret for build-time evaluation only (Phase 1 made
+      # ADMIN_SESSION_SECRET required in all envs). Not a real credential.
+      ADMIN_SESSION_SECRET: ci-build-dummy-0123456789abcdef0123456789abcdef
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Test admin
+        run: pnpm test:admin

.gitignore

@@ -36,6 +36,7 @@ yarn-error.log*
 
 # vercel
 .vercel
+.omc/
 
 # typescript
 *.tsbuildinfo

.omc/state/idle-notif-cooldown.json

@@ -1,3 +1,3 @@
 {
-  "lastSentAt": "2026-03-14T06:57:54.122Z"
+  "lastSentAt": "2026-07-11T21:08:23.208Z"
 }

AGENTS.md

@@ -9,8 +9,8 @@ University student matching platform Admin Dashboard (Next.js 14 + AWS Backend)
 
 | Category | Technology |
 |----------|------------|
-| Framework | Next.js 14.1.3 (App Router) |
-| Language | TypeScript 4.9.5 |
+| Framework | Next.js 14.2.35 (App Router) |
+| Language | TypeScript 5.3.3 |
 | UI | Material-UI 6.4.8 + Tailwind CSS 3.4.17 + Shadcn/ui |
 | State | React Context + cookie-based admin session |
 | Backend | AWS (sometimes-api) via BFF proxy |
@@ -45,14 +45,13 @@ Browser → Next.js (Vercel)
 
 ```
 app/
-├── admin/           # 30+ admin pages (v2 only, no legacy)
+├── admin/           # ~97 admin pages (v2 only, no legacy)
 │   ├── dashboard/   # Admin home
 │   ├── users/       # User management
 │   ├── matching/    # Matching management
 │   └── ...
 ├── api/admin/       # BFF route handlers (auth, session, proxy)
-├── home/            # User pages
-├── services/admin/  # API service layer (9 domain modules)
+├── services/admin/  # API service layer (40+ domain modules)
 ├── types/           # TypeScript types
 ├── utils/           # Utilities
 └── components/      # Shared components
@@ -64,7 +63,7 @@ shared/
 ├── contexts/        # Admin session context
 └── providers/       # React Query provider
 
-contexts/            # React Context providers (Auth, Country)
+contexts/            # React Context providers (Country only)
 e2e/                 # Playwright E2E tests
 __tests__/           # Jest unit tests
 ```
@@ -75,11 +74,11 @@ __tests__/           # Jest unit tests
 
 | File | Purpose |
 |------|---------|
-| `app/services/admin/index.ts` | Admin API barrel export (9 domain modules) |
+| `app/services/admin/index.ts` | Admin API barrel export (40+ domain modules) |
 | `shared/auth/cookies.ts` | httpOnly cookie CRUD |
 | `shared/auth/session-config.ts` | iron-session config |
 | `shared/ui/admin/admin-shell.tsx` | Admin layout (session, sidebar, error boundary) |
-| `contexts/AuthContext.tsx` | User auth state + admin session bridging |
+| `shared/contexts/admin-session-context.tsx` | Admin session state (cookie-backed) |
 | `middleware.ts` | Route protection (cookie check) |
 | `shared/lib/admin-logger.ts` | Structured JSON logging for BFF |
 
@@ -149,6 +148,7 @@ pnpm test:e2e         # Run Playwright E2E tests
 
 # Quality
 pnpm quality:admin-v2 # typecheck → lint → test pipeline
+                      #   targets: app/admin, components/admin, shared, app/api/admin
 
 # Lint
 pnpm lint             # ESLint check
@@ -160,7 +160,7 @@ pnpm lint             # ESLint check
 
 ```env
 NEXT_PUBLIC_API_URL=           # Backend API URL (sometimes-api)
-ADMIN_SESSION_SECRET=          # iron-session encryption secret
+ADMIN_SESSION_SECRET=          # iron-session encryption secret — REQUIRED in all environments
 SLACK_WEBHOOK_URL=             # Slack error notifications
 EDGE_CONFIG=                   # Vercel Edge Config (feature flags)
 ```
@@ -180,7 +180,6 @@ EDGE_CONFIG=                   # Vercel Edge Config (feature flags)
 ### State Management
 
 - Admin Session → `AdminSessionContext` (cookie-based)
-- Auth → `AuthContext` (login flow)
 - Country → `CountryContext`
 - Server State → React Query (via `AdminQueryProvider`)
 - Local → `useState`

CLAUDE.md

@@ -9,8 +9,8 @@ University student matching platform Admin Dashboard (Next.js 14 + AWS Backend)
 
 | Category | Technology |
 |----------|------------|
-| Framework | Next.js 14.1.3 (App Router) |
-| Language | TypeScript 4.9.5 |
+| Framework | Next.js 14.2.35 (App Router) |
+| Language | TypeScript 5.3.3 |
 | UI | Material-UI 6.4.8 + Tailwind CSS 3.4.17 + Shadcn/ui |
 | State | React Context + cookie-based admin session |
 | Backend | AWS (sometimes-api) via BFF proxy |
@@ -45,14 +45,13 @@ Browser → Next.js (Vercel)
 
 ```
 app/
-├── admin/           # 30+ admin pages (v2 only, no legacy)
+├── admin/           # ~97 admin pages (v2 only, no legacy)
 │   ├── dashboard/   # Admin home
 │   ├── users/       # User management
 │   ├── matching/    # Matching management
 │   └── ...
 ├── api/admin/       # BFF route handlers (auth, session, proxy)
-├── home/            # User pages
-├── services/admin/  # API service layer (9 domain modules)
+├── services/admin/  # API service layer (40+ domain modules)
 ├── types/           # TypeScript types
 ├── utils/           # Utilities
 └── components/      # Shared components
@@ -64,7 +63,7 @@ shared/
 ├── contexts/        # Admin session context
 └── providers/       # React Query provider
 
-contexts/            # React Context providers (Auth, Country)
+contexts/            # React Context providers (Country only)
 e2e/                 # Playwright E2E tests
 __tests__/           # Jest unit tests
 ```
@@ -75,11 +74,11 @@ __tests__/           # Jest unit tests
 
 | File | Purpose |
 |------|---------|
-| `app/services/admin/index.ts` | Admin API barrel export (9 domain modules) |
+| `app/services/admin/index.ts` | Admin API barrel export (40+ domain modules) |
 | `shared/auth/cookies.ts` | httpOnly cookie CRUD |
 | `shared/auth/session-config.ts` | iron-session config |
 | `shared/ui/admin/admin-shell.tsx` | Admin layout (session, sidebar, error boundary) |
-| `contexts/AuthContext.tsx` | User auth state + admin session bridging |
+| `shared/contexts/admin-session-context.tsx` | Admin session state (cookie-backed) |
 | `middleware.ts` | Route protection (cookie check) |
 | `shared/lib/admin-logger.ts` | Structured JSON logging for BFF |
 
@@ -149,6 +148,7 @@ pnpm test:e2e         # Run Playwright E2E tests
 
 # Quality
 pnpm quality:admin-v2 # typecheck → lint → test pipeline
+                      #   targets: app/admin, components/admin, shared, app/api/admin
 
 # Lint
 pnpm lint             # ESLint check
@@ -160,7 +160,7 @@ pnpm lint             # ESLint check
 
 ```env
 NEXT_PUBLIC_API_URL=           # Backend API URL (sometimes-api)
-ADMIN_SESSION_SECRET=          # iron-session encryption secret
+ADMIN_SESSION_SECRET=          # iron-session encryption secret — REQUIRED in all environments
 SLACK_WEBHOOK_URL=             # Slack error notifications
 EDGE_CONFIG=                   # Vercel Edge Config (feature flags)
 ```
@@ -180,7 +180,6 @@ EDGE_CONFIG=                   # Vercel Edge Config (feature flags)
 ### State Management
 
 - Admin Session → `AdminSessionContext` (cookie-based)
-- Auth → `AuthContext` (login flow)
 - Country → `CountryContext`
 - Server State → React Query (via `AdminQueryProvider`)
 - Local → `useState`