From 8a4b896064c5fbb01643b015e710be5505a8a0ff Mon Sep 17 00:00:00 2001
From: Krishna-Das20 <krishnadas2806@gmail.com>
Date: Fri, 31 Jul 2026 11:18:13 +0530
Subject: [PATCH 1/3] Fix the redirect after sign-in (#3)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A correct login showed "Login successful" and then sat on /Login forever.

App.jsx never navigated from inside Login.jsx — it called authCtx.login(...)
and let the route table react:

  <Route path="/Login" element={authCtx.isLoggedIn ? <LoginRedirect /> : <Login />} />

App Router routes are files, so nothing observes isLoggedIn, and proxy.ts only
runs on a server request, which a client-side sign-in never makes.

The redirect belongs in the components rather than in a layout wrapper. A guard
in app/(auth)/layout.jsx reacting to isLoggedIn was tried first and is wrong:
SignUp and CompleteProfile sign the user in and then navigate themselves to
"/", and a layout guard cancels that in-flight router.push before it commits.
Measured on the signup flow, the push never reached history at all and a new
account landed on /profile instead of "/". No delay fixes that reliably, since
the push only commits once its RSC payload arrives.

Login.jsx, GoogleLogin.jsx and GoogleSignup.jsx already carry the
shouldNavigate/navigatePath state and the effect that acts on it — dead in the
original precisely because the route table did the job. Setting
setShouldNavigate(true) after authCtx.login(...) brings it to life, with no
cross-component race. SendOtp.jsx already did this and is unchanged.

postAuthRedirect() resolves the destination the way LoginRedirect did, plus the
?next= proxy.ts appends. That value comes off the query string and is therefore
attacker-supplied, so anything that is not a plain internal path is discarded.

Verified in the browser by driving the real forms with the API stubbed:

  Login   /Login                            -> /profile
  Login   /Login?next=/Events               -> /Events
  Login   /Login?next=//example.com/phish   -> /profile, origin preserved
  Login   blocked page -> login             -> back to it, prevPage cleared
  Signup  /SignUp                           -> /, matching the original
  Login   stale localStorage, no cookie     -> login form, one bounce, no loop

Also verified every auth route against the running server, signed out and
signed in: all five auth pages, all seven /profile pages, the lowercase casing
redirects, a tampered cookie (rejected and cleared), and the seven auth
endpoints on an empty body.

Two pre-existing gaps are documented in MIGRATION.md rather than silently
changed: /ForgotPassword submits natively (identical in the original), and
/profile/members and /profile/BlogForm are not access-gated in the UI.

typecheck clean, eslint 0 errors, build 68 routes.
---
 MIGRATION.md                               | 91 ++++++++++++++++++++++
 app/(auth)/layout.jsx                      | 10 +++
 src/authentication/Login/GoogleLogin.jsx   | 10 ++-
 src/authentication/Login/Login.jsx         | 12 ++-
 src/authentication/SignUp/GoogleSignup.jsx | 12 ++-
 src/utils/postAuthRedirect.js              | 34 ++++++++
 6 files changed, 163 insertions(+), 6 deletions(-)
 create mode 100644 src/utils/postAuthRedirect.js

diff --git a/MIGRATION.md b/MIGRATION.md
index 4af73cd..697b516 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -74,6 +74,58 @@ These redirects live in `proxy.ts`, not `next.config.ts`: Next matches a
 redirect `source` case-insensitively, so a rule from `/Events` to `/events` also
 matches `/events` and loops forever.
 
+## Route guards — the redirect after sign-in
+
+The original never navigated from inside `Login.jsx`. It called
+`authCtx.login(...)` and let the **route table** react:
+
+```jsx
+<Route path="/Login" element={authCtx.isLoggedIn ? <LoginRedirect /> : <Login />} />
+```
+
+App Router routes are files, so nothing observes `isLoggedIn`, and `proxy.ts`
+only runs on a server request — which a client-side sign-in never makes. The
+first cut of this port dropped the behaviour: a correct login showed "Login
+successful" and then sat on `/Login` forever.
+
+**The redirect belongs in the components, not in a layout wrapper.** A guard in
+`app/(auth)/layout.jsx` reacting to `isLoggedIn` was tried first and is wrong:
+`SignUP.jsx` and `CompleteProfile.jsx` sign the user in and then navigate
+themselves to `/`, and a layout guard cancels that in-flight `router.push`
+before it commits. Measured on the signup flow — the push never reached
+`history` at all, and a new account landed on `/profile` instead of `/`:
+
+```
+20494ms  resolve /api/auth/register
+21025ms  history.replaceState(/Login?next=%2Fprofile)   <- guard won
+         (no history.pushState(/) — SignUp's own push was discarded)
+```
+
+No delay fixes that reliably, because the push only commits once its RSC
+payload arrives. So each component owns its own navigation, which is how the
+ported source was already written: `Login.jsx`, `GoogleLogin.jsx` and
+`GoogleSignup.jsx` all carry `shouldNavigate` / `navigatePath` state and an
+effect that acts on it — dead code in the original precisely *because* the route
+table did the job. Setting `setShouldNavigate(true)` after `authCtx.login(...)`
+brings it to life. `SendOtp.jsx` already did exactly this and needed no change.
+
+`src/utils/postAuthRedirect.js` resolves the destination the way `LoginRedirect`
+did, plus the `?next=` the proxy appends. Because that value now comes off the
+query string it is attacker-supplied, so anything that is not a plain internal
+path is discarded — `//evil.com` included.
+
+Verified in the browser by driving the real forms with the API stubbed at the
+XHR layer:
+
+| Flow | Start | Lands on |
+|---|---|---|
+| Login | `/Login` | **`/profile`** |
+| Login | `/Login?next=/Events` | **`/Events`** |
+| Login | `/Login?next=//example.com/phish` | **`/profile`** — origin preserved |
+| Login | blocked page → login | **back to the blocked page**, `prevPage` cleared |
+| Signup | `/SignUp` | **`/`** — matches the original |
+| Login | stale localStorage, no cookie | **login form, one bounce, no loop** |
+
 ---
 
 ## What was ported
@@ -265,8 +317,47 @@ Two further problems surfaced while verifying, both inherited from the original
 length. The Express controller checked only for presence, so `email: "bad"` was
 accepted and wrote unreplyable rows into `contactus`.
 
+## Auth routes — verified
+
+Every auth route was exercised against the running server, signed out and
+signed in. `proxy.ts` is the gate; the numbers below are what it returned.
+
+| Route | Signed out | Signed in |
+|---|---|---|
+| `/Login` `/SignUp` `/ForgotPassword` `/completeProfile` `/otp` | 200 | **307 → `/profile`** |
+| `/profile` and all six sub-pages | **307 → `/Login?next=…`** | 200 |
+| `/login` `/signup` `/forgotpassword` `/completeprofile` | 308 → canonical casing | — |
+
+A forged or expired token is treated as no token, and the bad cookie is cleared
+on the way out:
+
+```
+GET /profile   Cookie: token=<tampered>
+307 → /Login?next=%2Fprofile
+set-cookie: token=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
+```
+
+The seven auth endpoints reject malformed input rather than failing open —
+`login`, `register`, `verifyEmail`, `forgotPassword` and `googleAuth` all
+answer 400 on an empty body, and `logout` is idempotent. `changePassword` is
+the reset step and is gated on a single-use OTP, rate limited, and returns the
+same message whether or not the account exists.
+
 ## Known issues
 
+- **`/ForgotPassword` reloads instead of submitting.** Its `<form>` has no
+  `onSubmit` and `Button` renders an untyped `<button>`, so "Send OTP" submits
+  natively and the page navigates to `?email=…` before the 1.5s handler can run.
+  Reproduced identically in the original — inherited, not a port defect. Left
+  alone because fixing it changes behaviour rather than restoring it.
+- **`/profile/members` and `/profile/BlogForm` are not access-gated in the UI.**
+  App.jsx only registered those routes for `ADMIN` (and `SENIOR_EXECUTIVE_CREATIVE`
+  for the blog form), so a non-admin hitting the URL fell through to the error
+  page; here they render for any signed-in user. Every mutation behind them is
+  still enforced server-side — `createBlog` checks `canManageBlogs`, `addMember`
+  and `editDetails` return 403 — so the exposure is the admin screen itself, not
+  the ability to use it. The data it lists comes from `fetchTeam`, which is
+  public either way (see below).
 - `/api/user/fetchTeam` returns members' email addresses to anonymous callers.
   Preserved deliberately: trimming the projection changes the response bytes and
   the Team page's sort order. Worth fixing, but it is a behaviour change, not a
diff --git a/app/(auth)/layout.jsx b/app/(auth)/layout.jsx
index 06460f2..12527d4 100644
--- a/app/(auth)/layout.jsx
+++ b/app/(auth)/layout.jsx
@@ -2,6 +2,16 @@
  * Auth layout — the `AuthLayout` component from App.jsx.
  * No navbar, no footer, just the `.authpage` wrapper.
  *
+ * App.jsx also guarded these five routes with
+ * `authCtx.isLoggedIn ? <Navigate /> : <Page />`. That is deliberately *not*
+ * reproduced as a wrapper here. Two of the pages sign the user in and then
+ * navigate themselves (SignUp and CompleteProfile both go to "/"), and a
+ * layout-level guard reacting to `isLoggedIn` cancels their in-flight
+ * `router.push` before it commits — measured: the push never reached
+ * `history`. The redirect therefore lives in each component that needs it,
+ * using the `shouldNavigate` state they already carried, and `proxy.ts` covers
+ * a signed-in visitor arriving at one of these URLs.
+ *
  * No Suspense boundary here: wrapping children made prerendered pages emit
  * their markup twice (once inside the streamed boundary, once outside). Pages
  * that read search params declare their own boundary.
diff --git a/src/authentication/Login/GoogleLogin.jsx b/src/authentication/Login/GoogleLogin.jsx
index ede493c..aace2dc 100644
--- a/src/authentication/Login/GoogleLogin.jsx
+++ b/src/authentication/Login/GoogleLogin.jsx
@@ -11,6 +11,7 @@ import google from "../../assets/images/google.png";
 import { Alert, MicroLoading } from "../../microInteraction";
 import { api } from "../../services";
 import { useRouter } from "next/navigation";
+import postAuthRedirect from "../../utils/postAuthRedirect";
 
 export default function GoogleLogin() {
   const [alert, setAlert] = useState(null);
@@ -40,9 +41,10 @@ export default function GoogleLogin() {
     }
   }, [alert]);
 
+  // `replace`, not `push`: App.jsx redirected with <Navigate replace />.
   useEffect(() => {
     if (shouldNavigate) {
-      router.push(navigatePath);
+      router.replace(navigatePath);
       setShouldNavigate(false);
     }
   }, [shouldNavigate, navigatePath, router]);
@@ -67,7 +69,7 @@ export default function GoogleLogin() {
             duration: 2800,
           });
 
-          setNavigatePath(sessionStorage.getItem("prevPage") || "/");
+          setNavigatePath(postAuthRedirect());
 
           setTimeout(() => {
             localStorage.setItem("token", response.data.token);
@@ -90,6 +92,10 @@ export default function GoogleLogin() {
               response.data.token,
               9600000
             );
+            // App.jsx re-rendered /Login as <LoginRedirect /> once isLoggedIn
+            // flipped; nothing watches that flag under the App Router, so the
+            // navigation this component was already wired for is triggered here.
+            setShouldNavigate(true);
           }, 800);
 
         } else {
diff --git a/src/authentication/Login/Login.jsx b/src/authentication/Login/Login.jsx
index ee73677..b6f2bbd 100644
--- a/src/authentication/Login/Login.jsx
+++ b/src/authentication/Login/Login.jsx
@@ -17,6 +17,7 @@ import ArrowBackIcon from "@mui/icons-material/ArrowBack";
 import { Alert, MicroLoading } from "../../microInteraction";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
+import postAuthRedirect from "../../utils/postAuthRedirect";
 
 const Login = () => {
   const router = useRouter();
@@ -40,9 +41,11 @@ const Login = () => {
     }
   }, [alert]);
 
+  // `replace`, not `push`: App.jsx redirected with <Navigate replace />, so the
+  // login page must not sit in the history stack behind the destination.
   useEffect(() => {
     if (shouldNavigate) {
-      router.push(navigatePath);
+      router.replace(navigatePath);
       setShouldNavigate(false);
     }
   }, [shouldNavigate, navigatePath, router]);
@@ -81,7 +84,7 @@ const Login = () => {
           duration: 2800,
         });
 
-        setNavigatePath(sessionStorage.getItem("prevPage") || "/");
+        setNavigatePath(postAuthRedirect());
 
         setTimeout(() => {
           localStorage.setItem("token", response.data.token);
@@ -104,6 +107,11 @@ const Login = () => {
             response.data.token,
             9600000
           );
+          // App.jsx re-rendered /Login as <LoginRedirect /> the moment
+          // isLoggedIn flipped. App Router routes are files and nothing watches
+          // that flag, so the navigation this component was already wired for
+          // has to be triggered explicitly.
+          setShouldNavigate(true);
         }, 800);
         // console.log(authCtx);
 
diff --git a/src/authentication/SignUp/GoogleSignup.jsx b/src/authentication/SignUp/GoogleSignup.jsx
index 0018866..3f72a04 100644
--- a/src/authentication/SignUp/GoogleSignup.jsx
+++ b/src/authentication/SignUp/GoogleSignup.jsx
@@ -12,6 +12,7 @@ import users from "../../data/user.json";
 import { Alert, MicroLoading } from "../../microInteraction";
 import { api } from "../../services";
 import { useRouter } from "next/navigation";
+import postAuthRedirect from "../../utils/postAuthRedirect";
 
 export default function GoogleSignup({ setAlert }) {
   // const [alert, setAlert] = useState(null);
@@ -35,9 +36,10 @@ export default function GoogleSignup({ setAlert }) {
 
 
 
+  // `replace`, not `push`: App.jsx redirected with <Navigate replace />.
   useEffect(() => {
     if (shouldNavigate) {
-      router.push(navigatePath);
+      router.replace(navigatePath);
       setShouldNavigate(false); // Reset state after navigation
     }
   }, [shouldNavigate, navigatePath, router]);
@@ -64,8 +66,10 @@ export default function GoogleSignup({ setAlert }) {
             position: "bottom-right",
             duration: 3000,
           });
-          setNavigatePath("/");
           sessionStorage.removeItem("prevPage"); // Clean up
+          // Order matters: App.jsx cleared prevPage here and only then rendered
+          // <LoginRedirect />, which therefore fell through to /profile.
+          setNavigatePath(postAuthRedirect());
 
           setTimeout(() => {
             localStorage.setItem("token",response.data.token);
@@ -88,6 +92,10 @@ export default function GoogleSignup({ setAlert }) {
               response.data.token,
               9600000
             );
+            // App.jsx re-rendered /SignUp as <LoginRedirect /> once isLoggedIn
+            // flipped; nothing watches that flag under the App Router, so the
+            // navigation this component was already wired for is triggered here.
+            setShouldNavigate(true);
           }, 800);
         } else {
           // Handle unexpected response status
diff --git a/src/utils/postAuthRedirect.js b/src/utils/postAuthRedirect.js
new file mode 100644
index 0000000..ffbe02e
--- /dev/null
+++ b/src/utils/postAuthRedirect.js
@@ -0,0 +1,34 @@
+/**
+ * Where to send someone straight after they sign in.
+ *
+ * Reproduces `LoginRedirect` from FED-Frontend/src/App.jsx:
+ *
+ *   const redirectTo = sessionStorage.getItem("prevPage") || "/profile";
+ *   sessionStorage.removeItem("prevPage");
+ *   return <Navigate to={redirectTo} replace />;
+ *
+ * `?next=` is new: `proxy.ts` appends it when it turns an anonymous request for
+ * a protected route away, which is the server-side equivalent of the
+ * `prevPage` that the original's `ProtectedRoute` stashed. Both mean the same
+ * thing — the page the visitor was actually trying to reach — so either is
+ * accepted, the proxy's first because it is the more recent intent.
+ *
+ * The return path is read from the URL, so unlike the original it is
+ * attacker-supplied: anything that is not a plain internal path is discarded,
+ * the same rule `proxy.ts` applies to the value on its way out.
+ */
+
+const isSafeInternalPath = (path) =>
+  typeof path === "string" && path.startsWith("/") && !path.startsWith("//");
+
+export default function postAuthRedirect() {
+  if (typeof window === "undefined") return "/profile";
+
+  const next = new URLSearchParams(window.location.search).get("next");
+  const prevPage = sessionStorage.getItem("prevPage");
+  sessionStorage.removeItem("prevPage");
+
+  if (isSafeInternalPath(next)) return next;
+  if (isSafeInternalPath(prevPage)) return prevPage;
+  return "/profile";
+}

From 35172e0563af9b9357af27f0b1d7bea907ad9af7 Mon Sep 17 00:00:00 2001
From: Krishna-Das20 <krishnadas2806@gmail.com>
Date: Wed, 5 Aug 2026 10:51:19 +0530
Subject: [PATCH 2/3] Team management, Google sign-in, and a round of migration
 fixes (#8)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fix the redirect after sign-in

A correct login showed "Login successful" and then sat on /Login forever.

App.jsx never navigated from inside Login.jsx — it called authCtx.login(...)
and let the route table react:

  <Route path="/Login" element={authCtx.isLoggedIn ? <LoginRedirect /> : <Login />} />

App Router routes are files, so nothing observes isLoggedIn, and proxy.ts only
runs on a server request, which a client-side sign-in never makes.

The redirect belongs in the components rather than in a layout wrapper. A guard
in app/(auth)/layout.jsx reacting to isLoggedIn was tried first and is wrong:
SignUp and CompleteProfile sign the user in and then navigate themselves to
"/", and a layout guard cancels that in-flight router.push before it commits.
Measured on the signup flow, the push never reached history at all and a new
account landed on /profile instead of "/". No delay fixes that reliably, since
the push only commits once its RSC payload arrives.

Login.jsx, GoogleLogin.jsx and GoogleSignup.jsx already carry the
shouldNavigate/navigatePath state and the effect that acts on it — dead in the
original precisely because the route table did the job. Setting
setShouldNavigate(true) after authCtx.login(...) brings it to life, with no
cross-component race. SendOtp.jsx already did this and is unchanged.

postAuthRedirect() resolves the destination the way LoginRedirect did, plus the
?next= proxy.ts appends. That value comes off the query string and is therefore
attacker-supplied, so anything that is not a plain internal path is discarded.

Verified in the browser by driving the real forms with the API stubbed:

  Login   /Login                            -> /profile
  Login   /Login?next=/Events               -> /Events
  Login   /Login?next=//example.com/phish   -> /profile, origin preserved
  Login   blocked page -> login             -> back to it, prevPage cleared
  Signup  /SignUp                           -> /, matching the original
  Login   stale localStorage, no cookie     -> login form, one bounce, no loop

Also verified every auth route against the running server, signed out and
signed in: all five auth pages, all seven /profile pages, the lowercase casing
redirects, a tampered cookie (rejected and cleared), and the seven auth
endpoints on an empty body.

Two pre-existing gaps are documented in MIGRATION.md rather than silently
changed: /ForgotPassword submits natively (identical in the original), and
/profile/members and /profile/BlogForm are not access-gated in the UI.

typecheck clean, eslint 0 errors, build 68 routes.

* Fix the redirect after sign-in (#3) (#4)

A correct login showed "Login successful" and then sat on /Login forever.

App.jsx never navigated from inside Login.jsx — it called authCtx.login(...)
and let the route table react:

  <Route path="/Login" element={authCtx.isLoggedIn ? <LoginRedirect /> : <Login />} />

App Router routes are files, so nothing observes isLoggedIn, and proxy.ts only
runs on a server request, which a client-side sign-in never makes.

The redirect belongs in the components rather than in a layout wrapper. A guard
in app/(auth)/layout.jsx reacting to isLoggedIn was tried first and is wrong:
SignUp and CompleteProfile sign the user in and then navigate themselves to
"/", and a layout guard cancels that in-flight router.push before it commits.
Measured on the signup flow, the push never reached history at all and a new
account landed on /profile instead of "/". No delay fixes that reliably, since
the push only commits once its RSC payload arrives.

Login.jsx, GoogleLogin.jsx and GoogleSignup.jsx already carry the
shouldNavigate/navigatePath state and the effect that acts on it — dead in the
original precisely because the route table did the job. Setting
setShouldNavigate(true) after authCtx.login(...) brings it to life, with no
cross-component race. SendOtp.jsx already did this and is unchanged.

postAuthRedirect() resolves the destination the way LoginRedirect did, plus the
?next= proxy.ts appends. That value comes off the query string and is therefore
attacker-supplied, so anything that is not a plain internal path is discarded.

Verified in the browser by driving the real forms with the API stubbed:

  Login   /Login                            -> /profile
  Login   /Login?next=/Events               -> /Events
  Login   /Login?next=//example.com/phish   -> /profile, origin preserved
  Login   blocked page -> login             -> back to it, prevPage cleared
  Signup  /SignUp                           -> /, matching the original
  Login   stale localStorage, no cookie     -> login form, one bounce, no loop

Also verified every auth route against the running server, signed out and
signed in: all five auth pages, all seven /profile pages, the lowercase casing
redirects, a tampered cookie (rejected and cleared), and the seven auth
endpoints on an empty body.

Two pre-existing gaps are documented in MIGRATION.md rather than silently
changed: /ForgotPassword submits natively (identical in the original), and
/profile/members and /profile/BlogForm are not access-gated in the UI.

typecheck clean, eslint 0 errors, build 68 routes.

Co-authored-by: Krishna-Das20 <krishnadas2806@gmail.com>

* Halve the client bundle and fix the SSR hydration errors

The landing page shipped 2.3 MB of JavaScript. Home.jsx imported its four
sections from the `sections` barrel, which also re-exports `sections/Profile` —
the whole admin panel. All of them are client components, so the bundler pulled
that entire graph onto the landing page: certificate tooling, admin tables, the
avatar editor, event analytics. The `features` barrel did the same for
LiveEventPopup. Under Vite this cost nothing noticeable; under Next, where each
route gets its own bundle, a barrel import silently undoes the code splitting.

Importing those four components directly, leaving the barrels in place for
other call sites:

  /        2317 KB -> 1082 KB
  /Events  2063 KB -> 1082 KB
  /Team    2014 KB -> 1082 KB
  /Login   1248 KB ->  920 KB

Over the wire the landing page is now 327 KB of JS; locally TTFB 38ms,
DOMContentLoaded 135ms, load 536ms.

EventCard wrapped its meta row in a <p> containing div.price, which contained
another <p>. Client-rendered that was invisible, because React builds the DOM
node by node and nothing reparents it. Server-rendered it is real markup, so
the parser closed the <p> early and div.price came out a sibling instead of a
child — a different layout, reported as a hydration mismatch on every card. The
wrapper is a <div className={style.meta}> and the two `.eventname p` rules list
`.eventname .meta` alongside, so computed styles are unchanged: verified in the
browser at font-size 14.4px, display flex, align-items center, margin-top 1.6px
with div.price a real child, console clean across 580 cards.

Also: darken() -> color.adjust() in VerifyCertificate.module.scss, confirmed
identical by compiling both and diffing (rgb(80%, 43.2941176471%, 0%) either
way), which clears the Dart Sass deprecation warnings; and <html> now carries
data-scroll-behavior="smooth" to acknowledge the globals.scss rule.

The <Fit /> warnings are left alone — react-fit is a transitive dependency of
react-date-picker and uses the `warning` package, a no-op in production.

typecheck clean, eslint 0 errors, build 68 routes, all pages 200, auth route
matrix unchanged.

* Fix the remaining SSR hydration errors, and add an audit that finds them

Four components wrapped block-level content in a <p>: EventCard and EventModal
(<p> -> div.price -> <p>), Hero (<p> -> <span> -> <h3>) and Social (<p> ->
div.fed). Client-rendered under Vite none of it mattered, because React builds
the DOM node by node and nothing reparents an existing tree. Server-rendered it
is real markup, so the parser closes the <p> at the first block child and the
content lands as a sibling — a different layout, reported as a hydration
mismatch. EventCard was fixed in 9a1073e; this covers the other three.

Each wrapper is a <div> carrying a class listed alongside the original `p`
selector, so computed styles are unchanged. Verified in the browser:

  EventModal .meta   14.4px / flex / center / 1.6px / #fff
  Hero .tagline      39.2px / 700 / #fff
  Social .content    40px / 600 / #fff / center

Hero keeps its <h3> rather than downgrading it to a span — the wrapper changed
instead, so the heading still counts as a heading. Social's `styles.content`
had no rule in the stylesheet at all, so the className resolved to undefined
and the element was styled purely by `.text p`; `.content` now exists and
carries those declarations.

Fixing Social surfaced a second, unrelated mismatch on that page:
react-social-media-embed mints a fresh UUID per render into both `id` and
`className`, and the embed sizes come from useDimensions(), which measures 0 on
the server. Both embeds now load via next/dynamic with ssr: false — nothing is
lost, since the visible post is drawn by Instagram's and LinkedIn's own scripts
after mount. Same four embeds, same 1674px page height, console clean.

npm run audit:nesting keeps this from recurring. It walks a tag stack through
every JSX file and reports anything the HTML parser would reparent, skipping
comments and string/regex literals — without that a comment mentioning <p>, or
`.replace(/<a\s[^>]*>/gi, '')`, is read as markup. It was validated against the
pre-fix files: it reports all four real cases and nothing for the two files that
produced false positives. Current tree: 153 files, zero findings.

typecheck clean, eslint 0 errors, build 68 routes, no Sass deprecations.

* Fix the admin calendar, and restore Express parity for forms and events

The calendar on the admin form page had no styling at all. The original
index.scss imported three vendor stylesheets and only one was carried over, so
react-date-picker's popup — which it draws with react-calendar — came out as an
unstyled column of numbers. Confirmed by grepping the emitted CSS: zero
.react-calendar rules shipped, now 50. In the browser the popup measures
350x248 with a #a0a096 border, react-calendar's own defaults.

Re-reading every form/event controller against its port turned up more:

getFormAnalytics returned the wrong shape entirely. EventStats.jsx reads
response.data.form.formAnalytics, .form.info and .yearCounts; the port returned
{ success, message, data }, so response.data.form was undefined and the admin
analytics panel threw. It now returns { message, form, yearCounts }, rebuilds
the yearCounts histogram, and restores the 404 for a form nobody has registered
to. Access is the controller's own allowlist (ADMIN/PRESIDENT/VICEPRESIDENT/
DIRECTOR_*) plus the srex@fedkiit.com escape hatch, answering 401 "Access
Denied", not the isMember test the port had invented.

The attendance flow did not work. The QR carries a signed JWT: attendanceCode
must return { message, attendanceToken } with a 20-minute expiry, and
markAttendance takes { formId, token } and verifies it. The port returned the
raw record id under a different key, so QRCodeModal generated no QR, and
markAttendance rejected the scanned JWT for not being a 24-character id. Both
now match, including the formId binding that stops one event's QR checking
someone in at another, and the ?teamCode= branch. Verified both directions: a
token minted by the original's jsonwebtoken call verifies with jose here, and
vice versa; tampered tokens are rejected.

Access levels corrected both ways: export-attendance is ADMIN again (was any
club member, which handed every executive the full attendee list), while
markAttendance drops to signed-in, matching the Express route whose checkAccess
is commented out — the door volunteer signs in as a plain USER, so requiring
member access locked the door staff out.

Cloudinary dimensions were wrong: addForm/editForm resize FormImages at
h350.67 x w196.37 and QR media at h400 x w150 and h150 x w400 respectively, not
the 1000x1000 / 500x500 the port used. The two QR rows are transposed against
each other in the original and are reproduced per call site rather than
reconciled. addForm also returns 200 "Form created successfully" and editForm
"Form info and sections updated successfully".

One divergence kept deliberately: Express's addForm computes
Boolean(isPublic) || false over a multipart field, and Boolean("false") is
true, so every event created through the admin form was public,
registration-closed and past regardless of the toggles. editForm already used
=== "true". The port uses editForm's form in both so the switches work;
restoring byte-parity would re-break them. Documented in MIGRATION.md along
with checkAccess("USER") being stricter in Express than here.

typecheck clean, eslint 0 errors, build 68 routes, nesting audit clean.

* Send 4-digit OTPs again, so they fit the four boxes on screen

The password-reset email carried a 6-digit code while every OTP screen renders
four boxes, so the code could not be entered at all. The reset flow and signup
share components/OtpInput, so both were affected.

The UI was not at fault — it is four boxes in the original too, character for
character. This port had raised OTP_LENGTH from 4 to 6 as hardening, without a
consumer that could accept six.

Reverted to 4, matching generateOtp(4, false, false, false). The argument for 6
does not hold here: 10,000 combinations are brute-forceable against the Express
backend, which had no throttling at all, but RATE_LIMITS.passwordReset allows 6
attempts per 15 minutes and a code expires after 15, so an attacker gets at most
6 guesses out of 10,000 before the code stops existing. The rest of the OTP
hardening is untouched: SHA-256 digest at rest, constant-time comparison,
single-use, and expiry derived from createdAt rather than a setTimeout that
never fires on a serverless host.

Codes issued before this change are 6 digits and cannot be entered; they expire
on their own within 15 minutes.

typecheck clean, eslint 0 errors, build 68 routes.

* Restore the global button reset, and put the Chatbot back on every route

The disabled "Resend OTP" button rendered with a grey box. Measured against the
original running side by side, it had background-color rgba(19,1,1,0.3) and a
2px outset border where the original has rgba(0,0,0,0) and 0px none — the
user-agent's disabled-button chrome showing through.

The cause is structural, not a mistranslation. TeamCard.module.scss has a
top-level bare `button { }` rule; Vite does not hash element selectors in CSS
Modules and bundles every module into one stylesheet for the SPA, so that rule
was live on every page of the original. Next code-splits CSS per route, so once
ported it only loaded where TeamCard did — /Team and /profile/members — and
buttons everywhere else lost their reset.

Declared in app/globals.scss, which reproduces the original cascade. At
specificity 0-0-1 every component's own class rules still win: verified by
diffing all three buttons on /Login between the two apps, identical background,
font-size, margins and box sizes, and the resend button on /otp now matches the
original on every property (transparent, 0px none, 14.4px, 16px margin-top,
126x19).

Ten other top-level :global(...) rules sit in the same trap and are listed in
MIGRATION.md. They are left alone deliberately — three are :global(*) and would
move layout on every page, so they want reviewing one at a time rather than
hoisting wholesale.

Separately, App.jsx renders <Chatbot /> above <Routes>, so it is on every route.
The port mounted it in the (main) layout, hiding it on /Login, /SignUp, /otp,
/ForgotPassword and /completeProfile. Moved to the root layout, inside Providers
since it reads AuthContext. Confirmed in the server-rendered HTML for all six
routes, and the toggle measures 72x72 on /Login in both apps.

typecheck clean, eslint 0 errors, build 68 routes.

* Fix the password reset, and two more request-body contract breaks

/otp rejected a correct code with "Email, otp and password are required".
OtpInput.jsx posts { newPassword, confirmPassword, otp, email }, matching
Express; this handler destructured `password`, so the check failed before the
code was ever looked at.

Restored the rest of that controller's contract too, which had been simplified
away: 400 "Missing fields." when any of the four is absent, 409 on a
confirm-password mismatch, 404 "User not found!" (Express's checkAccess looks
the account up by the body's email, which is also why the endpoint works without
a session), 400 when the new password equals the old one, and
200 { status: "OK", message: "Password has been changed successfully !!" }.

This was the third contract break found by report rather than by testing, so
npm run audit:contracts now walks every api.*() call in the components, resolves
it to its Route Handler and flags payload keys the handler never reads. It found
two more live ones:

  renameTeam        UI sends newTeamName,        handler read teamName
  sendJoinRequest   UI sends teamRegistrationId, handler read teamCode

Every rename failed on an empty name and every join request was rejected. Both
now match Express, including sendJoinRequest identifying the target by
registration row id — the value searchTeams already returns to the UI as
teamRegistrationId — with the explicit team.formId !== formId check that a
global row id makes necessary.

The audit also surfaced that the admin certificate tooling calls five endpoints
that do not exist here (getEvent, getEventByFormId, createOrganisationEvent,
sendBatchMails, sendCertViaEmail), out of eleven missing overall. That is a gap
rather than a regression — it was never built — and is documented in
MIGRATION.md rather than fixed in passing, since the certificate flow already
carries a deliberate architectural deviation.

typecheck clean, eslint 0 errors, build 68 routes.

* Fix useSearchParams destructuring, which crashed two pages

React Router returns [params, setParams]; Next returns the params object itself.
Two components outside the team feature kept the array destructuring:

  EventForm.jsx          crashed opening the event registration form
  VerifyCertificate.jsx  crashed opening certificate verification

ReadonlyURLSearchParams is iterable, so destructuring it as an array does not
throw — it quietly yields the first [key, value] entry, or undefined when the
URL has no query string. The next .get() then fails with "Cannot read
properties of undefined (reading 'get')".

EventForm is the one that hid: it reads searchParams.get("teamCode") during
render, but ProtectedRoute redirects signed-out visitors first, so an anonymous
smoke test returns 200 and only a signed-in user reaches the crash.

Swept the tree for the rest of the React Router surface (useNavigate,
useLocation, Outlet, Navigate, to=): only comments remain.

TeamManagement.jsx has the same bug and is fixed on feature/team-member-fix,
where the rest of the team work lives.

* Add a health endpoint for production monitoring

GET|HEAD /api/health returns 200 when every dependency answers and 503 when one
does not. There was no equivalent in the Express backend, so uptime monitors had
to be pointed at a real endpoint like /api/form/getAllForms — which reads the
whole forms collection on every poll and still answers 200 when the database is
unreachable but the response is cached.

The database check uses MongoDB's `ping`, the cheapest command the driver
exposes: it touches no collection and reads no documents, so polling costs
nothing.

It is bounded at 3s. A hung TCP connection to Atlas does not reject — it waits
for the driver's own much longer timeout — and a probe that hangs reads to a
monitor as a timeout rather than a clean 503.

The endpoint is unauthenticated (proxy.ts already excludes /api/), so the error
body carries only "unreachable" or the timeout message. Driver errors can embed
the connection string, which holds the Atlas password; the detail goes to the
server log instead.

HEAD is exported explicitly because Next does not derive it from GET for route
handlers, and a monitor configured for HEAD would otherwise get 405 and report
the site as down.

force-dynamic + no-store: a health check answering from build output or a cache
would report "ok" for a process that is not actually serving.

Verified both paths against the real database: 200 with a 36ms ping, and 503 in
3.03s with DATABASE_URL pointed at an unreachable host (HEAD likewise 503).

* Rebuild team management against the Express controllers

The five components were already ported line for line; the backend behind them
was not. It had been written against a different data model, so most of the page
did not work.

The model: a team is one formRegistration row holding every member's address in
regTeamMemEmails and every member's answers in value, with userId as the leader.
Leaving or being removed lifts a person's entries out of that row into their own
UNAFFILIATED row, so they stay registered and can join or start another team.
The port assumed a row per member sharing a teamCode, earliest row as leader.

That assumption produced most of the faults:

  teamDetails   looked up by userId, so only the leader could load the page.
                Confirmed on live data: the ownership query returns NULL for a
                real member of team "ABC"; the membership query finds it.
  teamDetails   returned registrationId/regTeamMemEmails/isLeader, while the UI
                reads eventTitle, leaderEmail, max/minTeamSize,
                isRegistrationClosed, isEventPast and data.isTeamless — and
                members lacked college and year.
  teamDetails   had no UNAFFILIATED branch, so TeamlessState — the entire
                create/join flow — could never render.
  searchTeams   returned a flat array of {teamName,teamCode,size,maxSize,isFull}
                and read ?q=, where the picker reads data.data.teams with
                teamRegistrationId/teamSize/maxTeamSize/leaderName/
                spotsRemaining/hasPendingRequest and sends ?search=. The list
                rendered empty and the search box filtered nothing.
  leaveTeam     keyed on userId with no leader/member distinction: a member
                could not leave, answers were not carried across, and the
                tracker's regTeamNames was never released.
  removeTeamMember  assumed row-per-member, so removal failed and no email went
                out.

Also restored: leaveTeam blocks a leader who still has members; the
closed-registration guard compares the flags as the strings "true"/"false" the
data actually stores; joinTeam returns eventId (falling back to formId when
relatedEvent is absent or the literal "null"); joinRequestUpdates returns
pendingCount; the removed-member email is sent, following
emailTemplates/removedMember.html. Every success message matches the original,
since the components put response.data.message straight into a toast.

Verified against the live database, read paths only: teamDetails as leader and
as member return identical full payloads, the teamless branch returns
isTeamless with the event's limits, searchTeams returns data.teams with every
field the picker needs and ?search= filters correctly, inviteLink and
joinRequestUpdates match.

The mutations are deliberately not exercised: this database holds real
registrations and running them would rewrite other people's teams. They are
matched to the controllers line by line and typecheck clean, but want a
run-through on a scratch database before release.

typecheck clean, eslint 0 errors, build 68 routes, audit:contracts clean for
every team endpoint.

* Fix the useSearchParams destructuring that crashed the team page

TeamManagement.jsx carried React Router's [params, setParams] destructuring.
Next returns the params object itself, so opening any team page failed with
"Cannot read properties of undefined (reading 'get')".

ReadonlyURLSearchParams is iterable, so destructuring it as an array does not
throw — it quietly yields the first [key, value] entry, or undefined when the
URL has no query string. The next .get() is what fails.

TeamManagement also cleaned the URL after an email-redirect toast by mutating
the params and calling the setter. Next's object is read-only with no setter,
so that is now a copy plus router.replace(..., { scroll: false }) — the toast
still does not re-fire on refresh and no history entry is added.

EventForm.jsx and VerifyCertificate.jsx had the same bug from the base
migration; they are fixed on auth-redirect-fix since neither is team work.

Verified in the browser against live data: the team page renders in full for a
non-leader member (team, code, 2/3 members with year and college, "You" marker,
Leave Team) and for the leader (invite panel, share link, per-member remove);
?toast=joined&name=... is consumed and stripped from the URL; console clean on
both.

* Only build invite links from a trusted origin

inviteLink is built from the request rather than hardcoded, so production
traffic already produced production URLs — the localhost in a dev screenshot is
dev's own origin. But the origin was taken verbatim, and these URLs go into
email: the team invitation, and the accept/reject buttons sent to a team leader.

Origin and Host are set by the caller. Reflected unchecked, anyone able to
create a team could have FED KIIT send a message, from its own address,
containing a link to a domain they chose. Measured before the change, a request
carrying `Origin: https://evil.example` came back with
`https://evil.example/Events/.../Form?teamCode=...`.

An origin is now trusted when it matches NEXT_PUBLIC_SITE_URL, or is localhost
so a developer's copied link still works locally; anything else falls back to
NEXT_PUBLIC_SITE_URL. After the change:

  Origin: https://www.fedkiit.com  -> https://www.fedkiit.com/Events/...
  Origin: http://localhost:3999    -> http://localhost:3999/Events/...
  Origin: https://evil.example     -> falls back to the real host
  Host:   evil.example             -> https://www.fedkiit.com/Events/...

The Express controller reflected these headers
(req.headers.origin || process.env.FRONTEND_URL || "https://fedkiit.com"), so
this is a deliberate deviation, noted in MIGRATION.md.

typecheck clean, eslint 0 errors, build 68 routes.

* Carry team invite links through sign-in and sign-up

Clicking an invite while signed out sent you to the login page and then dropped
you on the team-finding page instead of joining the team.

The auto-join was never the problem — it was ported and works. The destination
was thrown away during authentication, in four places:

  Login.jsx "Sign Up" link  overwrote prevPage with /Login, discarding the
                            invite ProtectedRoute had just saved
  SignUP.jsx                router.push("/") after signing up
  GoogleSignup.jsx          cleared prevPage, then resolved to /profile
  CompleteProfile.jsx       router.push("/")

So the very case an invite exists for — someone without an account — lost it
before signing up. All four now resolve through postAuthRedirect(), which takes
a fallback argument so the signup screens still default to "/" as before.

Measured through the real UI with the login and join calls stubbed, so nothing
was written to the database:

  open invite signed out -> /Login, prevPage = /Events/<id>/Form?teamCode=...
  click "Sign Up"        -> prevPage unchanged (previously became "/Login")
  sign in                -> POST /api/auth/login
                            POST /api/form/joinTeam {formId, teamCode}
                         -> /Events/<id>/team

Email and WhatsApp links carry the same ?teamCode=, so both behave identically.

A brand-new account still fills in the event's registration form first: team
membership is a formRegistration row, so there is nothing to move onto a team
until the person has registered, and that form is where required details and
payment are collected. The invite is carried through it — EventForm passes the
code to PreviewForm, which joins the team as soon as registration succeeds.

typecheck clean, eslint 0 errors, build 68 routes.

* Tell people when an invite link's auto-join fails

PreviewForm joins the invited team the moment registration succeeds. When that
join was rejected it only logged to the console and fell through to
router.push("/Events") — the person ended up on the events listing, registered
but teamless, with nothing on screen explaining that the invite had not been
honoured.

Two paths were silent, not one. Besides the catch, a 200 carrying
success: false also fell through untouched. Both now redirect to

  /Events/<formId>/team?toast=join_failed&reason=<api message>

The team page is the right destination: they are registered by then, just
unaffiliated, so TeamManagement renders TeamlessState — the team search. They
land on the screen that lets them recover instead of the events listing.

The reason is forwarded rather than hard-coded, because the same path catches
four different rejections from joinTeam: "This team is full", "Invalid team
code", "Registration is closed for this event" and "You are already in a team".
TeamManagement appends "You can join another team below." and strips reason from
the URL alongside toast and name, so the toast does not re-fire on refresh.

Also dropped a dead `const eventId` in the success branch — it was computed and
never read; the redirect uses form.id directly.

The same silent fall-through is in FED-Frontend PreviewForm.jsx:191-194, so the
behaviour is inherited, not a port defect.

Not exercised against the database: joinTeam is a mutation and the configured
Atlas instance holds real registrations. eslint 0 errors, build clean.

* Fix four team-mutation defects found by running them

The mutations had only ever been matched to the controllers by eye. Running them
end to end against the database with two real accounts found four defects.

joinTeam failed outright with a 500. formRegistration carries
@@unique([formId, teamCode]): the model is one row per TEAM, holding the whole
roster in regTeamMemEmails, not one row per member. The port stamped the team's
code onto the joiner's own row, colliding with the team row on that constraint,
so every join died with a Prisma P2002. Joining is a merge — the joiner's email
and value entry move onto the team row and their solo row is deleted. This is
what the entire invite-link flow depends on, so that flow could not have worked.

respondJoinRequest failed the same way for the same reason, so a leader
accepting from their email got the generic error page and the request stayed
PENDING for ever. It also now handles the requester having joined elsewhere in
the meantime, and a team that filled up, as expiries rather than errors.

renameTeam had no leader check at all — any member could rename the team. The
controller looks the row up by membership and compares its owner to the caller;
this loaded the caller's own row and compared nothing. Also missing: the
registration-closed check, the "name unchanged" no-op, and the tracker's name
swap, so a rename left the old name reserved for ever.

Team codes were built from a slug of the team name (CLAUDETE-7130) instead of
the controller's <2-letter event code>-<3-digit index>-<4 digits> (AR-003-8793).
Every code already in the database uses the latter and people share them by
hand, so the wrong shape makes a valid code look fake.

Two messages were wrong with them: createTeam used a commented-out v1 string
from addRegistration.js rather than the live one, and renameTeam invented its
own. Both now match the controllers.

One deliberate deviation kept: the controller lets a teamless registrant rename
their own UNAFFILIATED placeholder, producing a named "team" with a SOLO- code
and absent from the tracker. Guarded here.

Verified on the "Team Test" event with two accounts belonging to the repo owner,
restored to their original state afterwards; no team containing anyone else was
touched. 20/20 asserted steps pass across createTeam, duplicate name,
searchTeams, joinTeam (valid/invalid/already-joined), renameTeam
(leader/non-leader/unchanged), inviteTeamMember, removeTeamMember, leaveTeam
(member and leader-last), sendJoinRequest and respondJoinRequest (accept and
replay). Both accounts end TEAMLESS with no leftover PENDING requests.

typecheck clean, eslint 0 errors, build 68 routes.

* Distinguish renaming a team from replacing one

A pending join request survived the dissolution of the team it pointed at, and
came back to life the moment that leader created their next team. A leader could
disband "ABC", create "BCD", and the person who asked to join ABC would be pulled
into BCD without ever agreeing to it.

teamRegistrationId cannot tell the two apart: the registration row is reused, so
its id survives a rename and a disband alike. Confirmed against the database
rather than assumed — after a disband and a fresh createTeam, the request's
teamRegistrationId still equals the new team's row id.

teamCode is the discriminator. A rename leaves it untouched; disbanding resets it
to a SOLO- code and the next createTeam mints a fresh one. teamJoinRequest now
pins the code at the time of asking, and acceptance compares it:

  renames ABC -> BCD          code unchanged   request accepted, link works
  disbands ABC, creates BCD   code new         request auto-expired, link 404

The invite-link path already had the right semantics, since those links carry
?teamCode=, but it was verified rather than taken on trust.

The field is optional: rows written before it existed carry no code, and a
request that cannot be verified is treated as stale. There were 45 requests in
the database and none pending when this shipped, so nothing was grandfathered.
MongoDB needs no migration for an optional scalar with no index — prisma
generate is enough, no db push against production.

Verified on the live database, 9/9 assertions across all three cases, plus the
14-step lifecycle re-run to confirm nothing regressed. Both test accounts end
TEAMLESS with no leftover PENDING requests. typecheck clean, eslint 0 errors,
build 68 routes.

* Regenerate the Prisma client automatically when the schema changes

The generated client lives in node_modules/.prisma/client, which is gitignored,
so it never travels with a commit. @prisma/client has its own postinstall hook,
but npm only fires that during an install — and a schema change on its own does
not touch package.json, so nobody has a reason to reinstall.

That combination is the trap: pulling a branch that changed schema.prisma leaves
a client that no longer matches it, the app starts perfectly, and the mismatch
only surfaces as "Unknown argument" on whichever request happens to touch the new
field. npm run build and npm run typecheck do fail loudly, but npm run dev does
not type-check up front, so the usual workflow hides it. The teamCode field added
for the rename-vs-disband fix is the first change with this hazard.

scripts/ensure-prisma.mjs runs the check where it cannot be skipped: with-env.mjs
calls it, and dev, build and start all go through that.

It regenerates only when the schema actually changed, comparing a SHA-256 of
schema.prisma against a stamp written beside the generated client. Generating
unconditionally would add seconds to every dev start; hashing one file is
imperceptible, so the common case is free. The stamp sits inside the client
directory deliberately — deleting node_modules takes it along, so a wiped install
cannot look up to date — and is written only after a successful generate, so a
failure retries instead of marking a client that was never produced as current.

postinstall runs the same script with --optional, which tolerates a missing CLI:
prisma is a devDependency, so npm install --omit=dev on a deploy host
legitimately has none and failing there would break the install. A dev server
without one is not legitimate, so that path leaves the flag off and fails.
npm run prisma:generate is the manual escape hatch.

package-lock records hasInstallScript for the new hook, and npm re-resolved the
Prisma engines from dev to devOptional.

Verified all three paths: no stamp generates; unchanged schema is silent with no
generate spawned; a changed schema is detected and regenerated, both standalone
and through a real npm run dev, which then served /api/health 200. npm install
still exits 0. eslint clean, typecheck clean, build 68 routes.

* Fix Google sign-in, which rejected every request

Two defects stacked, both introduced by this port.

The body field never matched. GoogleLogin.jsx and GoogleSignup.jsx post
{ access_token }, as they always did against Express. The route read
credential || token || tokenId, matched none of them, and returned 400 "Google
credential is required" before Google was contacted at all. Google sign-in and
sign-up therefore failed for everyone, every time.

The token type was wrong underneath. The route handed the value to
OAuth2Client.verifyIdToken, which expects an ID token (a JWT). Neither component
produces one: both call useGoogleLogin with no flow option, which is the implicit
flow, and its response carries an opaque access token. Verifying it locally is
not possible — it is not a JWT and carries no claims. Handing it back to Google
is what establishes whose it is, which is what the controller does, via
oauth2/v3/userinfo.

Matched now, with one deliberate difference: the token goes in an Authorization
Bearer header rather than the query string. Same endpoint and response, but a
credential in a URL ends up in proxy and server logs.

Also restored from the controller and previously missing: the display name is
built from given_name + family_name before falling back to name, and an
hd === "kiit.ac.in" account gets college, rollNumber, year and school derived
from the roll number. That derivation was checked against the controller's
inline version across six roll numbers spanning 1st year to Passout — identical
on all six.

Error mapping: Google answering 401/403 becomes a 401, since a bad token is the
caller's problem and not a server fault; any other non-OK becomes 502; a
transport failure becomes 503. Previously an unhandled throw would have surfaced
as a 500.

Status codes follow the controller: 201 when the account was just created, 200
otherwise, message "LOGGED IN" in both cases. getEnv and the google-auth-library
import are dropped — the access-token flow needs no client id server-side.

Verified against the live Google endpoint: empty body gives 400 "Missing fields:
access_token"; an invalid access_token gives 401, proving the request now
reaches Google instead of being turned away at the door. A full popup sign-in
needs a browser and was not automated.

typecheck clean, eslint 0 errors, build 68 routes.

* Fixed all the comments above namely, image dimensions in one file, role centralization, form analytics access, otp length and validity, trusted origins, Preview Form.

---------

Co-authored-by: Ansh Raj <146376691+AnshRaj112@users.noreply.github.com>
---
 .env.example                                  |  24 +
 MIGRATION.md                                  | 760 ++++++++++++++++++
 app/(main)/layout.jsx                         |   9 +-
 app/api/auth/changePassword/route.ts          |  51 +-
 app/api/auth/googleAuth/route.ts              |  40 +-
 app/api/auth/register/route.ts                |  12 +-
 app/api/blog/createBlog/route.ts              |   2 +-
 app/api/blog/updateBlog/[id]/route.ts         |   2 +-
 app/api/form/addForm/route.ts                 |  38 +-
 app/api/form/attendanceCode/[id]/route.ts     |  16 +-
 app/api/form/createTeam/route.ts              |  19 +-
 app/api/form/editForm/[id]/route.ts           |   6 +-
 app/api/form/export-attendance/[id]/route.ts  |  10 +-
 app/api/form/getFormAnalytics/[id]/route.ts   |  80 +-
 app/api/form/inviteTeamMember/route.ts        |  16 +-
 app/api/form/joinTeam/route.ts                |  18 +-
 app/api/form/leaveTeam/route.ts               |  15 +-
 app/api/form/markAttendance/route.ts          |  21 +-
 app/api/form/removeTeamMember/route.ts        |  21 +-
 app/api/form/renameTeam/route.ts              |  26 +-
 app/api/form/searchTeams/[formId]/route.ts    |  14 +-
 app/api/form/sendJoinRequest/route.ts         |  23 +-
 app/api/form/teamDetails/[formId]/route.ts    | 101 ++-
 app/api/health/route.ts                       | 122 +++
 app/api/user/editDetails/route.ts             |   7 +-
 app/api/user/editProfileImage/route.ts        |   5 +-
 app/globals.scss                              |  34 +
 app/layout.tsx                                |  19 +-
 lib/academic.ts                               |  93 +++
 lib/auth/permissions.ts                       |  45 ++
 lib/config/images.ts                          |  49 ++
 lib/email/templates.ts                        |  35 +
 lib/env.ts                                    |  46 ++
 lib/services/attendance.ts                    | 151 ++--
 lib/services/auth.ts                          | 104 ++-
 lib/services/otp.ts                           |  32 +-
 lib/services/team-invites.ts                  | 200 ++++-
 lib/services/teams.ts                         | 529 +++++++++---
 lib/services/upload.ts                        |  17 +-
 package-lock.json                             |  72 +-
 package.json                                  |   6 +-
 prisma/schema.prisma                          |   7 +
 scripts/audit-api-contracts.mjs               | Bin 0 -> 3979 bytes
 scripts/audit-nesting.mjs                     | 114 +++
 scripts/ensure-prisma.mjs                     | 123 +++
 scripts/with-env.mjs                          |   9 +
 src/authentication/Login/Login.jsx            |  15 +-
 src/authentication/SignUp/CompleteProfile.jsx |  20 +-
 src/authentication/SignUp/GoogleSignup.jsx    |   8 +-
 src/authentication/SignUp/SignUP.jsx          |  21 +-
 src/components/EventCard/EventCard.jsx        |  14 +-
 .../EventCard/styles/EventCard.module.scss    |   8 +-
 src/components/OtpInput/OtpInput.jsx          |  12 +-
 src/components/SocialEmbed/SocialEmbed.jsx    |  25 +-
 src/data/yearOptions.js                       |  24 +
 .../Modals/EditProfile/EditProfile.jsx        |  15 +-
 .../Modals/Event/EventModal/EventModal.jsx    |  10 +-
 .../EventModal/styles/EventModal.module.scss  |   7 +-
 .../Modals/Profile/Admin/PreviewForm.jsx      |  86 +-
 src/sections/Home/Contact/Contact.jsx         |   2 +-
 src/sections/Home/Hero/Hero.jsx               |  14 +-
 .../Home/Hero/styles/Hero.module.scss         |   9 +-
 .../VerifyCertificate/VerifyCertificate.jsx   |   4 +-
 .../styles/VerifyCertificate.module.scss      |   5 +-
 src/utils/postAuthRedirect.js                 |  11 +-
 src/views/Event/EventForm.jsx                 |   4 +-
 src/views/Home/Home.jsx                       |  10 +-
 src/views/Social/Social.jsx                   |  10 +-
 src/views/Social/styles/Social.module.scss    |  18 +-
 src/views/TeamManagement/TeamManagement.jsx   |  39 +-
 70 files changed, 2988 insertions(+), 546 deletions(-)
 create mode 100644 app/api/health/route.ts
 create mode 100644 lib/academic.ts
 create mode 100644 lib/auth/permissions.ts
 create mode 100644 lib/config/images.ts
 create mode 100644 scripts/audit-api-contracts.mjs
 create mode 100644 scripts/audit-nesting.mjs
 create mode 100644 scripts/ensure-prisma.mjs
 create mode 100644 src/data/yearOptions.js

diff --git a/.env.example b/.env.example
index 66c1eef..c40fddd 100644
--- a/.env.example
+++ b/.env.example
@@ -82,5 +82,29 @@ PORT=3000
 # which would have published a sitemap full of localhost URLs.
 NEXT_PUBLIC_SITE_URL=https://www.fedkiit.com
 
+# --- Tunables ---------------------------------------------------------------
+# All optional. Every default below reproduces the previous hardcoded value, so
+# leaving them unset changes nothing.
+
+# One-time passwords. NEXT_PUBLIC so OtpInput draws exactly this many boxes —
+# one variable for both sides means the code length and the UI cannot desync.
+NEXT_PUBLIC_OTP_LENGTH=4
+OTP_VALIDITY_MINUTES=15
+
+# Extra hosts allowed to appear in an Origin header when building an emailed
+# invite link. Comma-separated. The canonical site host, localhost and 127.0.0.1
+# are always trusted; this is for staging and preview deployments.
+# e.g. TRUSTED_ORIGIN_HOSTS=staging.fedkiit.com,fed-frontend.vercel.app
+TRUSTED_ORIGIN_HOSTS=
+
+# Addresses that may read form analytics regardless of role. Comma-separated.
+# Previously the literal srex@fedkiit.com in the route.
+FORM_ANALYTICS_ALLOWED_EMAILS=srex@fedkiit.com
+
+# Calendar month (1-12) the academic year rolls over in. Used to derive the year
+# of study from a KIIT roll number, so a 2022 intake stays 4th Year until July
+# 2026 rather than being promoted every 1 January.
+ACADEMIC_YEAR_START_MONTH=7
+
 LOG_REQ=false
 DEBUG=false
diff --git a/MIGRATION.md b/MIGRATION.md
index 697b516..7344ade 100644
--- a/MIGRATION.md
+++ b/MIGRATION.md
@@ -343,6 +343,757 @@ answer 400 on an empty body, and `logout` is idempotent. `changePassword` is
 the reset step and is gated on a single-use OTP, rate limited, and returns the
 same message whether or not the account exists.
 
+## Load time — the barrel files were the problem
+
+The landing page was shipping **2.3 MB of JavaScript**. The cause is visible in
+any dev-server warning trace:
+
+```
+./src/sections/Profile/Admin/View/VerifyCertificate/VerifyCertificate.jsx
+./src/sections/Profile/index.jsx
+./src/sections/index.jsx          <- re-exports Home *and* Profile
+./src/views/Home/Home.jsx
+./app/(main)/page.jsx
+```
+
+`Home.jsx` imported `{ Hero, About, Sponser, Feedback, Contact }` from the
+`sections` barrel, which also re-exports `sections/Profile` — the entire admin
+panel. Every one of those is a client component, so the bundler pulled the whole
+graph into the landing page: certificate tooling, admin tables, the avatar
+editor, event analytics. A visitor who only wanted the hero image downloaded the
+admin panel. The `features` barrel did the same thing for `LiveEventPopup`.
+
+Under Vite this cost nothing noticeable, because the dev server serves ES modules
+untouched and the SPA loaded one bundle for every route anyway. Under Next each
+route gets its own bundle, so a barrel import silently undoes the code splitting.
+
+Fixed by importing the four components directly instead of through a barrel. The
+barrels are untouched — other call sites still use them.
+
+| Page | Before | After |
+|---|---|---|
+| `/` | 2317 KB | **1082 KB** |
+| `/Events` | 2063 KB | **1082 KB** |
+| `/Team` | 2014 KB | **1082 KB** |
+| `/Login` | 1248 KB | **920 KB** |
+
+Uncompressed. Over the wire the landing page is **327 KB** of JS and 55 KB of
+HTML, and locally serves in TTFB 38 ms / DOMContentLoaded 135 ms / load 536 ms.
+
+**Dev-server slowness is separate and expected.** `next dev` compiles each route
+on first request, so a cold page can take seconds while production serves the
+same page in 5–30 ms. Measure `npm run build && npm start`, never `npm run dev`.
+
+## Invalid HTML nesting that only mattered under SSR — all of it
+
+Four components wrapped block-level content in a `<p>`:
+
+| Component | The nesting |
+|---|---|
+| `EventCard` | `<p>` → `div.price` → `<p>` |
+| `EventModal` | `<p>` → `div.price` → `<p>` |
+| `Hero` | `<p>` → `<span>` → `<h3>` |
+| `Social` | `<p>` → `div.fed` → `<div>` |
+
+Client-rendered under Vite none of this mattered: React builds the DOM node by
+node, and nothing reparents a tree that already exists. Server-rendered it is
+real markup, so the parser closes the `<p>` at the first block child and the
+content lands as a *sibling* — a different layout, which React then reports as a
+hydration mismatch.
+
+Each wrapper is now a `<div>` carrying a class listed alongside the original
+`p` selector, so the computed styles are unchanged. Verified in the browser:
+
+| | Was styled by | Now computes to |
+|---|---|---|
+| `EventCard .meta` | `.eventname p` | 14.4px / flex / center / 1.6px |
+| `EventModal .meta` | `.eventname p` | 14.4px / flex / center / 1.6px / #fff |
+| `Hero .tagline` | `.largeContent p` | 39.2px / 700 / #fff |
+| `Social .content` | `.text p` | 40px / 600 / #fff / center |
+
+Hero keeps its `<h3>` rather than downgrading it to a `<span>` — the wrapper
+changed instead, so the heading still counts as a heading.
+
+`Social`'s wrapper is worth a note: `styles.content` had **no rule in the
+stylesheet**, so the className resolved to `undefined` and did nothing — the
+element was styled purely by `.text p`. `.content` now exists and carries those
+declarations. (`EventCardModal.price` is undefined in the same way; both are
+inherited from the original and left as they are.)
+
+**`npm run audit:nesting` keeps it that way.** `scripts/audit-nesting.mjs`
+walks a tag stack through every JSX file and reports any element the HTML parser
+would reparent. It skips comments, string and regex literals — without that, a
+comment mentioning `<p>` or a `.replace(/<a\s[^>]*>/gi, '')` gets read as markup,
+which produced three separate rounds of false positives while writing it. The
+scanner was validated by running it against the pre-fix files: it reports all
+four real cases and nothing for the two false-positive files.
+
+## Social embeds do not survive hydration
+
+Fixing `Social`'s nesting uncovered a second, unrelated mismatch on the same
+page: `react-social-media-embed` mints a fresh UUID per render and writes it
+into both `id` and `className`, so the server's markup can never match the
+client's. The embed sizes compound it — they come from `useDimensions()`, which
+reads `window` and therefore measures 0 on the server.
+
+`InstagramEmbed` and `LinkedInEmbed` are now loaded through `next/dynamic` with
+`ssr: false`. Nothing is lost: the visible post is drawn by Instagram's and
+LinkedIn's own scripts after mount, so the server-rendered markup was an
+invisible placeholder either way. `/Social` renders the same four embeds at the
+same 1674px page height, with the console clean.
+
+`{ ssr: false }` is written out at both call sites because `next/dynamic` is a
+compile-time transform and rejects a shared options variable —
+*"next/dynamic options must be an object literal."*
+
+## Smaller fixes from the same dev-server log
+
+- `darken($accent-color, 10%)` in `VerifyCertificate.module.scss` is deprecated
+  in Dart Sass. Replaced with `color.adjust($accent-color, $lightness: -10%)`,
+  its documented equivalent — confirmed by compiling both and diffing the output
+  (`rgb(80%, 43.2941176471%, 0%)` either way). The build no longer emits
+  deprecation warnings.
+- `<html>` carries `data-scroll-behavior="smooth"`, acknowledging the
+  `scroll-behavior: smooth` that `globals.scss` sets, so Next stops warning and
+  keeps the original's smooth scrolling.
+
+Not fixed, deliberately: the `<Fit />` "height decreased" messages come from
+`react-fit`, a transitive dependency of `react-date-picker`, when the calendar
+popup is repositioned to fit the viewport. It uses the `warning` package, which
+compiles to a no-op in production, so this is dev-only third-party noise.
+
+## Admin forms & events — re-verified against the Express controllers
+
+The calendar on the admin form page had **no styling at all**. The original
+`index.scss` pulled in three vendor stylesheets; only one was carried over:
+
+```scss
+@import "react-date-picker/dist/DatePicker.css";   // was missing
+@import "react-calendar/dist/Calendar.css";        // was missing
+@import "react-datepicker/dist/react-datepicker.css";
+```
+
+`react-date-picker` draws its popup with `react-calendar`, so with `Calendar.css`
+absent the picker opened as an unstyled column of numbers. Confirmed by grepping
+the emitted CSS — **zero** `.react-calendar` rules shipped, now 50. In the
+browser the popup measures 350×248 with a `#a0a096` border, which is
+react-calendar's own default and therefore exactly what the original rendered.
+
+Re-reading every form/event controller alongside its port turned up more:
+
+**`getFormAnalytics` returned the wrong shape entirely.** `EventStats.jsx` reads
+`response.data.form.formAnalytics`, `response.data.form.info` and
+`response.data.yearCounts`; the port returned `{ success, message, data }`, so
+`response.data.form` was `undefined` and the admin analytics panel threw. It now
+returns `{ message, form, yearCounts }`, including the `yearCounts` histogram
+built from registrants' `year` field, and the 404 for a form nobody has
+registered to. Its access check is the controller's own allowlist
+(ADMIN / PRESIDENT / VICEPRESIDENT / DIRECTOR_*) plus the `srex@fedkiit.com`
+escape hatch, answering 401 "Access Denied" — not the `isMember` test the port
+had invented.
+
+**The attendance flow did not work.** The QR code carries a *signed JWT*:
+
+| | Express | Port (before) |
+|---|---|---|
+| `attendanceCode` returns | `{ message, attendanceToken }`, a JWT expiring in 20 min | `{ success, data }` with the raw record id |
+| `markAttendance` accepts | `{ formId, token }`, verifies the JWT | a bare ObjectId |
+
+`QRCodeModal` reads `response.data.attendanceToken` — absent, so no QR was
+generated — and `AttendancePage` posts the scanned JWT, which the port rejected
+as not being a 24-character id. Both sides now match the original, including the
+`formId` binding that stops one event's QR checking someone in at another, and
+the `?teamCode=` branch. Verified by minting a token with the original's
+`jsonwebtoken` call and verifying it with the port's `jose` code, and the
+reverse:
+
+```
+Express-minted QR verifies in the port : true
+Port-minted QR verifies in Express     : true
+  lifetime (minutes)                   : 20
+Tampered QR rejected                   : true
+```
+
+**Access levels corrected in both directions:**
+
+| Endpoint | Express | Port (before) | Now |
+|---|---|---|---|
+| `export-attendance/:id` | `checkAccess("ADMIN")` | any club member | ADMIN |
+| `markAttendance` | signed-in (its `checkAccess` is commented out) | any club member | signed-in |
+| `getFormAnalytics/:id` | controller allowlist | any club member | allowlist |
+
+`markAttendance` reads as the loosest of the three but is not: the door
+volunteer signs in as a plain USER, so requiring member access locked the door
+staff out, and the 20-minute signed QR is the actual control.
+
+**Image dimensions were wrong.** Both controllers resize through Cloudinary at
+fixed sizes; the port used 1000×1000 and 500×500 instead:
+
+| | Express | Port (before) | Now |
+|---|---|---|---|
+| `addForm` FormImages | h 350.67 × w 196.37 | 1000 × 1000 | h 350.67 × w 196.37 |
+| `addForm` QRMediaImages | h 400 × w 150 | 500 × 500 | h 400 × w 150 |
+| `editForm` FormImages | h 350.67 × w 196.37 | 1000 × 1000 | h 350.67 × w 196.37 |
+| `editForm` QRMediaImages | h 150 × w 400 | 500 × 500 | h 150 × w 400 |
+
+The two QR rows are transposed relative to each other because `addForm` passes
+`(QrImageWidth, QrImageHeight)` and `editForm` passes `(QrImageHeight, QrImageWidth)`
+into the same `(height, width)` parameters. Each call site is reproduced as
+written rather than reconciled. Note also that Express's helper is
+`uploadImage(path, folder, height, width)` while this project's is
+`(file, folder, width, height)`, so the arguments read transposed in the source
+while sending identical values.
+
+`addForm` also returns 200 with "Form created successfully", and `editForm`
+"Form info and sections updated successfully", matching the originals.
+
+**One divergence kept on purpose.** `addForm` in Express computes
+`isPublic: Boolean(isPublic) || false` over a multipart field, and
+`Boolean("false")` is `true` — so every event created through the admin form was
+public, registration-closed and past regardless of the toggles. `editForm`
+already used `isPublic === "true"`. The port uses the `editForm` form in both, so
+the three switches actually work. Restoring byte-parity here would re-break them.
+
+## OTP length — a hardening change that broke the screen
+
+The password-reset email carried a **6-digit** code while every OTP screen in the
+app renders **4 boxes**, so the code could not be typed in at all. Both the
+reset flow and signup share `components/OtpInput`, and both were affected.
+
+The UI was not at fault — it is 4 boxes in the original too, character for
+character. The mismatch came from this port raising `OTP_LENGTH` from 4 to 6 as
+a hardening measure, without a consumer that could accept six.
+
+Reverted to 4, matching `generateOtp(4, false, false, false)`. The reasoning
+behind 6 does not survive contact with the rest of this codebase: 10,000
+combinations really are brute-forceable against the Express backend, which had
+no throttling whatsoever, but `RATE_LIMITS.passwordReset` allows 6 attempts per
+15 minutes and a code expires after 15 — so an attacker gets at most 6 guesses
+out of 10,000 before the code they are hunting stops existing. The other OTP
+hardening stays: codes are stored as a SHA-256 digest, compared in constant
+time, single-use, and expiry is derived from `createdAt` rather than a
+`setTimeout` that never fires on a serverless host.
+
+One caveat carried over from `lib/api/rate-limit.ts`: the limiter is
+in-process, so a horizontally scaled deploy multiplies the effective limit by
+the instance count. A shared store is the follow-up if the app is scaled out.
+
+Codes already issued before this change are 6 digits and cannot be entered;
+they expire on their own within 15 minutes.
+
+## Vite bundles all CSS; Next splits it per route
+
+The disabled "Resend OTP" button on `/otp` rendered with a grey box around it.
+Measured against the original running side by side:
+
+| | Original (Vite) | Port (before) |
+|---|---|---|
+| `background-color` | `rgba(0, 0, 0, 0)` | `rgba(19, 1, 1, 0.3)` |
+| `border` | `0px none` | `2px outset rgba(195,195,195,0.3)` |
+
+That is the user-agent's disabled-button chrome showing through. The cause is
+structural rather than a mistranslation. `TeamCard.module.scss` contains a
+**top-level bare `button { }`** rule — Vite does not hash element selectors in
+CSS Modules, and it bundles every module into one stylesheet for the SPA, so
+that rule was live on every page of the original site. Next code-splits CSS per
+route, so once ported it only loaded where `TeamCard` did: `/Team` and
+`/profile/members`. Everywhere else, buttons lost their reset.
+
+The rule is now declared in `app/globals.scss`, which reproduces the original
+cascade. At specificity 0-0-1 every component's own class rules still win, so
+nothing else moves — verified by diffing all three buttons on `/Login` between
+the two apps: identical background, font-size, margins and box sizes.
+
+**The same trap applies to ten other rules.** These are top-level `:global(...)`
+selectors inside CSS Modules — app-wide under Vite, route-scoped here:
+
+```
+src/views/Event/styles/Event.module.scss:1                :global(*)
+src/views/Event/styles/PastEvent.module.scss:1            :global(*)
+src/views/TermsAndConditions/styles/T&C.module.scss:2     :global(*)
+src/components/EventCard/styles/EventCard.module.scss:261 :global(a)
+src/layouts/Blog/TabBar/styles/TabBar.module.scss:24      :global(ul)
+src/sections/Home/Feedback/styles/Feedback.module.scss:15 :global(::-webkit-scrollbar)
+src/sections/LiveEvents/Omega/Attend/styles/Attend.module.scss:77 :global(img)
+src/components/Core/styles/Core.module.scss:103-104       :global(input[type="number"]::-webkit-*-spin-button)
+src/authentication/Login/ForgotPassword/styles/forgotPassword.module.scss:1 :global(:root)
+```
+
+Only the `button` one is fixed here, because it had a visible, reported symptom
+and a verified before/after. The `:global(*)` rules in particular would change
+layout on every page and need reviewing one at a time rather than hoisting
+wholesale. The `:root` entry is already harmless — it only defines `--primary`,
+which `globals.scss` also defines.
+
+## The Chatbot was missing from every auth screen
+
+App.jsx renders `<Chatbot />` above `<Routes>`, so it appears on every route.
+The port mounted it in the `(main)` layout, which hid it on `/Login`, `/SignUp`,
+`/otp`, `/ForgotPassword` and `/completeProfile`. Moved to the root layout,
+inside `Providers` since it reads `AuthContext`. Confirmed present in the
+server-rendered HTML for all six routes checked, and the toggle now measures
+`72x72` on `/Login` in both apps.
+
+## Request-body field names — audited
+
+`/otp` rejected a correct code with "Email, otp and password are required".
+`OtpInput.jsx` posts `{ newPassword, confirmPassword, otp, email }`, matching
+Express; this port's handler destructured `password`, so the check failed before
+the code was ever looked at. Fixed, along with the rest of that controller's
+contract, which had also been simplified away:
+
+- 400 `"Missing fields."` when any of the four is absent
+- 409 `"Conflict : New Password and confirm Password did not match!!"`
+- 404 `"User not found!"` — Express's `checkAccess` looks the account up by the
+  body's `email`, which is also why the endpoint works without a session
+- 400 `"New password cannot be same as the old password ! Instead try login"`
+- 200 `{ status: "OK", message: "Password has been changed successfully !!" }`
+
+This was the third contract break found by report rather than by testing, so
+`npm run audit:contracts` now walks every `api.*()` call in the components,
+resolves it to its Route Handler, and flags payload keys the handler never
+reads. It found two more live ones:
+
+| Endpoint | UI sends | Handler read | Effect |
+|---|---|---|---|
+| `renameTeam` | `newTeamName` | `teamName` | every rename failed on an empty name |
+| `sendJoinRequest` | `teamRegistrationId` | `teamCode` | every join request rejected |
+
+Both now match Express, including `sendJoinRequest` identifying the target by
+registration row id — the value `searchTeams` already returns to the UI as
+`teamRegistrationId` — rather than by team code, with the explicit
+`team.formId !== formId` check that a global row id makes necessary.
+
+## Certificate endpoints are largely unimplemented
+
+The audit also showed the admin certificate tooling calling endpoints that do
+not exist here. Express exposes **15** certificate routes; this port has 5, and
+one of those (`addCertificateTemplate`) has no counterpart upstream at all.
+
+Five of the missing ones are called by
+`CertificatesForm/tools/certificateTools.js` and so are reachable from the admin
+panel today: `getEvent`, `getEventByFormId`, `createOrganisationEvent`,
+`sendBatchMails`, `sendCertViaEmail`. The remainder — `getCertificateTest`,
+`getOrganisationEvents`, `addAttendee`, `createEvent`, `getCertificate`,
+`testNamePosition` — are unreferenced by the UI.
+
+This is a gap, not a regression: it was never built. It is called out here
+rather than fixed in passing because the certificate flow already carries a
+deliberate architectural deviation (images composite client-side instead of
+through `canvas`/`puppeteer`), so completing it is a design decision rather than
+a translation.
+
+## `useSearchParams` has a different shape in Next
+
+React Router returns `[params, setParams]`; Next returns the params object
+itself. Components that kept the array destructuring crash:
+
+```jsx
+const [searchParams] = useSearchParams();   // wrong under Next
+const searchParams = useSearchParams();     // correct
+```
+
+`ReadonlyURLSearchParams` is iterable, so destructuring it as an array does not
+throw — it quietly yields the first `[key, value]` entry, or `undefined` when the
+URL has no query string. The next `.get()` then fails with "Cannot read
+properties of undefined (reading 'get')".
+
+Fixed here in `EventForm.jsx` (the event registration form) and
+`VerifyCertificate.jsx` (certificate verification).
+
+`EventForm` is the one that hid. It reads `searchParams.get("teamCode")` during
+render, but `ProtectedRoute` redirects signed-out visitors first, so an anonymous
+smoke test returns 200 and only a signed-in user ever reaches the crash.
+
+Swept the tree for the rest of the React Router surface (`useNavigate`,
+`useLocation`, `Outlet`, `Navigate`, `to=`): only comments remain.
+
+## Team management — rebuilt against the Express controllers
+
+The five components (`TeamManagement`, `MemberCard`, `InviteSection`,
+`TeamlessState`, `ConfirmDialog`) were already ported line for line. The backend
+behind them was not: it had been written against a **different data model**, so
+most of the page did not work.
+
+**The model.** A team is one `formRegistration` row. It holds every member's
+address in `regTeamMemEmails` and every member's form answers in `value`, and its
+`userId` is the leader. Leaving or being removed means lifting a person's entries
+out of that row and giving them their own `UNAFFILIATED` row, so they stay
+registered for the event and can join or start another team. The port had assumed
+a row per member sharing a `teamCode`, with the earliest row treated as leader.
+
+That single wrong assumption produced most of the faults:
+
+| Endpoint | Fault | Effect |
+|---|---|---|
+| `teamDetails/:formId` | looked the registration up by `userId` | **only the leader could load the page** — every other member got "no registration found". Confirmed against live data: the ownership query returns `NULL` for a real member of team "ABC", the membership query finds the team |
+| `teamDetails/:formId` | returned `registrationId, regTeamMemEmails, isLeader` | the UI reads `eventTitle`, `leaderEmail`, `maxTeamSize`, `minTeamSize`, `isRegistrationClosed`, `isEventPast` and `data.isTeamless`, none of which existed, and members lacked `college` and `year` |
+| `teamDetails/:formId` | no `UNAFFILIATED` branch | `TeamlessState` — the whole create/join flow — could never render |
+| `searchTeams/:formId` | returned a flat array of `{teamName, teamCode, size, maxSize, isFull}`, read `?q=` | the picker reads `data.data.teams` with `teamRegistrationId`, `teamSize`, `maxTeamSize`, `leaderName`, `spotsRemaining`, `hasPendingRequest`, and sends `?search=`. The list rendered empty and the search box filtered nothing |
+| `leaveTeam` | keyed on `userId`; no leader/member distinction | a member could not leave; nobody's answers were carried across; the tracker's `regTeamNames` was never released |
+| `removeTeamMember` | assumed row-per-member | removal did not work, and the removed member got no email |
+| `renameTeam` | read `teamName` | UI sends `newTeamName` — every rename failed |
+| `sendJoinRequest` | read `teamCode` | UI sends `teamRegistrationId` — every request rejected |
+
+Also restored: `leaveTeam` blocks a leader who still has members
+("You must remove all team members before leaving…"), the closed-registration
+guard compares the flags as the **strings** `"true"`/`"false"` the data actually
+stores, `joinTeam` returns `eventId` (falling back to `formId` when
+`relatedEvent` is absent or the literal string `"null"`),
+`joinRequestUpdates` returns `pendingCount`, and the removed-member email is
+sent, following `emailTemplates/removedMember.html`.
+
+Every success message now matches the original, because the components put
+`response.data.message` straight into a toast — `Team "X" created successfully!`,
+`Successfully joined team "X"!`,
+`Successfully dissolved|left the team "X". You can now create or join another team.`,
+`Successfully removed a@b.com from the team & informed through a@b.com`,
+`Invitation sent to a@b.com`.
+
+**Verified against the live database**, read paths only:
+
+```
+teamDetails as leader  -> team ABC, size 2, max/min 3/1, eventTitle,
+                          leaderEmail, members with year + college
+teamDetails as member  -> identical payload (previously: nothing)
+teamDetails teamless   -> isTeamless true, eventTitle, max/min 5/3
+searchTeams            -> data.teams[] with teamRegistrationId, leaderName,
+                          spotsRemaining, hasPendingRequest
+searchTeams?search=AB  -> filters to "ABC"
+inviteLink             -> inviteLink, teamCode, teamName, shareText
+joinRequestUpdates     -> { updates: [], pendingCount: 0 }
+```
+
+The mutations (`createTeam`, `joinTeam`, `leaveTeam`, `removeTeamMember`,
+`renameTeam`, `inviteTeamMember`, `sendJoinRequest`) are **not** exercised here:
+this database holds real registrations, and running them would rewrite other
+people's teams. They are matched to the controllers line by line and typecheck
+clean, but they want a run-through on a scratch database before release.
+
+## The team page hit the same `useSearchParams` bug
+
+`TeamManagement.jsx` carried the React Router destructuring described above, so
+opening any team page crashed with *"Cannot read properties of undefined
+(reading 'get')"*.
+
+It also cleaned the URL after showing an email-redirect toast by mutating the
+params and calling the setter. Next's object is read-only and has no setter, so
+that is now a copy plus `router.replace(..., { scroll: false })` — same outcome:
+the toast does not re-fire on refresh and no history entry is added.
+
+Verified in the browser against live data: the team page renders in full for a
+non-leader member (team, code, 2/3 members with year and college, "You" marker,
+Leave Team) and for the leader (invite panel, share link, per-member remove),
+`?toast=joined&name=…` is consumed and stripped from the URL, and the console is
+clean on both.
+
+## Invite links resolve to the deployed domain
+
+`inviteLink` is built from the request, not hardcoded, so a browser on
+production produces a production URL. The localhost you see in development is
+development's own origin.
+
+The origin is now checked against an allowlist before being used. `Origin` and
+`Host` are set by the caller, and these URLs go into **email** — the team
+invitation, and the accept/reject buttons sent to a team leader. Reflected
+unchecked, anyone able to create a team could have FED KIIT send a message, from
+its own address, containing a link to a domain of their choosing. The Express
+controller did reflect them
+(`req.headers.origin || process.env.FRONTEND_URL || "https://fedkiit.com"`);
+this is the one place the port deliberately does not follow it.
+
+An origin is trusted when it matches `NEXT_PUBLIC_SITE_URL`, or is localhost so
+a developer's copied link works on their machine. Anything else falls back to
+`NEXT_PUBLIC_SITE_URL`. Measured:
+
+| Request | Link produced |
+|---|---|
+| `Origin: https://www.fedkiit.com` | `https://www.fedkiit.com/Events/…` |
+| `Origin: http://localhost:3999` | `http://localhost:3999/Events/…` |
+| `Origin: https://evil.example` | falls back to the real host — attacker domain dropped |
+| `Host: evil.example` | `https://www.fedkiit.com/Events/…` |
+
+**`NEXT_PUBLIC_SITE_URL` must be set correctly in the production environment**;
+it is what every fallback resolves to.
+
+## Team invite links now survive signing in
+
+Clicking an invite while signed out sent you to the login page and then, after
+signing in, dropped you on the team-finding page instead of joining the team.
+
+The auto-join itself was never the problem — it was ported and works. The
+destination was being thrown away during authentication, in four places:
+
+| Where | What it did |
+|---|---|
+| `Login.jsx` — the "Sign Up" link | overwrote `prevPage` with `/Login`, discarding the invite `ProtectedRoute` had just saved |
+| `SignUP.jsx` | `router.push("/")` after signing up |
+| `GoogleSignup.jsx` | cleared `prevPage`, then resolved to `/profile` |
+| `CompleteProfile.jsx` | `router.push("/")` |
+
+So the very case an invite is for — someone without an account — lost it before
+signing up. All four now resolve through `postAuthRedirect()`, which takes a
+fallback so the signup screens still default to `/` as they always did.
+
+Measured through the real UI, with the login and join calls stubbed so nothing
+was written:
+
+```
+open invite signed out -> /Login
+                          prevPage = /Events/<id>/Form?teamCode=40-002-7161
+click "Sign Up"        -> prevPage unchanged   (previously: "/Login")
+sign in                -> POST /api/auth/login
+                          POST /api/form/joinTeam {formId, teamCode:"40-002-7161"}
+                       -> /Events/<id>/team
+```
+
+Both the email and WhatsApp links carry the same `?teamCode=`, so both behave
+identically.
+
+**A new account still has to fill in the event's registration form.** Team
+membership is a `formRegistration` row: there is nothing to move onto a team
+until the person has registered for the event, and that form is where required
+details and any payment are collected. The invite is carried through it —
+`EventForm` passes the code to `PreviewForm`, which joins the team the moment
+registration succeeds. Someone who is *already* registered skips all of that and
+joins on the spot, which is the flow shown above.
+
+## A failed auto-join no longer fails silently
+
+`PreviewForm` joins the invited team as soon as registration succeeds. When that
+join was rejected it did nothing but `console.error`, then fell through to
+`router.push("/Events")` — the person landed on the events listing, registered
+but teamless, with no indication that the invite had not been honoured. The same
+silent fall-through is in `FED-Frontend/src/features/Modals/Profile/Admin/
+PreviewForm.jsx:191-194`, so this is inherited rather than a port defect, but it
+is reachable in ordinary use: invite links get shared in group chats, and the
+last person to act on one finds the team full.
+
+Two paths were silent, not one. Besides the `catch`, a `200` carrying
+`success: false` also fell through untouched. Both now redirect to
+`/Events/<formId>/team?toast=join_failed&reason=<api message>`.
+
+That destination is deliberate. The person *is* registered at that point, just
+unaffiliated, so `TeamManagement` renders `TeamlessState` — the team search. They
+arrive on the screen that lets them fix the situation instead of the events
+listing.
+
+The reason is forwarded rather than hard-coded because the same path catches
+four different rejections from `joinTeam`:
+
+| API message | What happened |
+| --- | --- |
+| `This team is full` | filled up while they were registering |
+| `Invalid team code` | team disbanded or the link is stale |
+| `Registration is closed for this event` | deadline passed mid-flow |
+| `You are already in a team` | duplicate submit |
+
+`TeamManagement` appends "You can join another team below." and strips `reason`
+from the URL alongside `toast` and `name`, so the toast does not re-fire on
+refresh.
+
+Not exercised against the database: `joinTeam` is a mutation and the configured
+Atlas instance holds real registrations. The redirect and the toast are verified
+by build and by reading the path; the full-team rejection itself wants a scratch
+database.
+
+## Team mutations — exercised against the database, and four defects found
+
+Previously only the read paths were verified; the mutations were matched to the
+controllers by eye and explicitly flagged as unrun. Running them end to end with
+two real accounts on the "Team Test" event found four defects that reading had
+missed.
+
+**1. `joinTeam` failed outright (500).** `formRegistration` carries
+`@@unique([formId, teamCode])` — the model is **one row per team**, with the
+whole roster in `regTeamMemEmails`, not one row per member. The port stamped the
+team's code onto the joiner's own row, which collides with the team row on that
+constraint. Every join died with a Prisma P2002 surfaced as a 500. Joining is a
+*merge*: the joiner's email and their `value` entry move onto the team row and
+their solo row is deleted.
+
+This is the mutation the entire invite-link flow depends on, so the flow could
+not have worked in production.
+
+**2. `respondJoinRequest` failed the same way**, for the same reason, so a leader
+accepting from their email got the generic error page and the request stayed
+PENDING for ever.
+
+**3. `renameTeam` had no leader check at all.** Any member could rename the team.
+The controller looks the row up by membership and compares its owner to the
+caller; the port loaded the caller's own row and compared nothing. It was also
+missing the registration-closed check, the "name unchanged" no-op, and the
+tracker's name swap — so a rename left the old name reserved for ever.
+
+**4. Team codes were generated in the wrong shape.** The controller builds
+`<2-letter event code>-<3-digit index>-<4 digits>` (`AR-003-8793`); the port
+built a slug of the *team* name (`CLAUDETE-7130`). Every code already in the
+database uses the first shape, and people share these by hand — a second shape
+makes a valid code look fake.
+
+Two message mismatches went with them: `createTeam` used a **commented-out v1
+string** from `addRegistration.js` rather than the live one, and `renameTeam`
+invented its own.
+
+One deliberate deviation was kept. The controller lets a teamless registrant
+rename their own `UNAFFILIATED` placeholder, which produces a named "team"
+carrying a `SOLO-<userId>-<n>` code and absent from the tracker — a row nothing
+else expects. That is guarded here.
+
+### What was run
+
+Event "Team Test", two accounts belonging to the repo owner, restored to their
+original state afterwards. No team containing anyone else was touched — every
+event both accounts share has a third party in one of their teams, so account A
+was registered for "Team Test" to get two free accounts in one event.
+
+```
+createTeam · duplicate name · searchTeams · joinTeam (valid, invalid code,
+already-on-a-team) · renameTeam (leader, non-leader 403, unchanged no-op) ·
+inviteTeamMember · removeTeamMember (leader, non-leader) · leaveTeam (member,
+leader-last) · sendJoinRequest (new, duplicate) · respondJoinRequest (accept,
+replay) · teamDetails after every step
+```
+
+20/20 asserted steps pass; both accounts end `TEAMLESS` with no leftover PENDING
+requests.
+
+`checkJoinRequestUpdates` filtering on `requesterEmail` is **correct**, not a
+bug: it is the requester's view of their own requests. Leaders are notified by
+email only, so a leader legitimately sees `pendingCount: 0`.
+
+### Renaming a team and replacing one are different things
+
+A pending request used to survive the dissolution of the team it pointed at, and
+became live again the moment that leader created their next team. A leader could
+disband "ABC", create "BCD", and the person who had asked to join ABC would be
+pulled into BCD without ever agreeing to it.
+
+`teamRegistrationId` cannot tell the two apart — the registration row is reused,
+so its id survives a rename *and* a disband. Verified rather than assumed: after
+a disband and a fresh createTeam, the request's `teamRegistrationId` still equals
+the new team's row id.
+
+**`teamCode` is the discriminator.** A rename leaves it untouched; disbanding
+resets it to a `SOLO-…` code and the next `createTeam` mints a fresh one. So
+`teamJoinRequest` now pins the code at the time of asking, and acceptance
+compares it:
+
+| Leader does | Team code | Pending request | Invite link |
+| --- | --- | --- | --- |
+| renames ABC → BCD | unchanged | **still accepted** | **still works** |
+| disbands ABC, creates BCD | new | **auto-expired** | **404** |
+
+The invite-link path already behaved correctly — those links carry
+`?teamCode=`, so a rename keeps them valid and a disband invalidates them — but
+it was confirmed against the database rather than taken on trust.
+
+`teamCode` on `teamJoinRequest` is optional: rows written before it existed do
+not carry one, and a request that cannot be verified is treated as stale. There
+were 45 requests in the database when this shipped and **none** of them pending,
+so nothing was grandfathered. MongoDB needs no migration for an optional scalar
+with no index — `prisma generate` is enough, no `db push` against production.
+
+Proven end to end on the live database, 9/9 assertions: rename keeps the code and
+the request is accepted into the renamed team; disband-and-recreate changes the
+code, the row id is demonstrably reused, the requester is *not* pulled in, and
+the request lands in `AUTO_EXPIRED`; the invite link survives the rename and dies
+on the disband.
+
+## Pulling a schema change does not break anyone
+
+The generated Prisma client lives in `node_modules/.prisma/client`, which is
+gitignored, so it never travels with a commit. `@prisma/client` has its own
+postinstall hook, but npm only fires that during an install — and a schema change
+on its own does not touch `package.json`, so nobody has a reason to reinstall.
+
+That combination is the trap: pulling a branch that changed `schema.prisma`
+leaves a client that no longer matches it, the app starts perfectly, and the
+mismatch only surfaces as `Unknown argument …` on whichever request happens to
+touch the new field. `npm run build` and `npm run typecheck` do fail loudly, but
+`npm run dev` does not type-check up front, so the usual workflow hides it.
+
+`scripts/ensure-prisma.mjs` runs the check where it cannot be skipped —
+`with-env.mjs` calls it, and `dev`, `build` and `start` all go through that.
+
+It regenerates **only when the schema has actually changed**, comparing a
+SHA-256 of `schema.prisma` against a stamp written beside the generated client.
+Generating unconditionally would add seconds to every dev start; hashing one file
+is imperceptible, so the common case is free. The stamp lives inside the client
+directory deliberately: deleting `node_modules` takes it along, so a wiped
+install can never look up to date. It is written only after a successful
+generate, so a failure retries rather than marking a client that was never
+produced as current.
+
+`postinstall` runs the same script with `--optional`, which tolerates a missing
+CLI: `prisma` is a devDependency, so `npm install --omit=dev` on a deploy host
+legitimately has none, and failing there would break the install. Running a dev
+server without one is not legitimate, so that path leaves the flag off and fails.
+
+`npm run prisma:generate` is the manual escape hatch.
+
+Verified: no stamp → generates; unchanged schema → silent, no `prisma generate`
+spawned; changed schema → detected and regenerated, both standalone and through
+a real `npm run dev`, which then served `/api/health` 200. `npm install` still
+exits 0 with the new hook.
+
+## Google sign-in was rejecting every request
+
+Two defects stacked on top of each other, both introduced by this port.
+
+**The body field never matched.** `GoogleLogin.jsx` and `GoogleSignup.jsx` post
+`{ access_token }`, as they always did against Express. The route read
+`credential || token || tokenId`, matched none of them, and returned
+400 *"Google credential is required"* — before Google was contacted at all. So
+Google sign-in and sign-up failed for everyone, every time.
+
+**The token type was wrong underneath.** The route then handed the value to
+`OAuth2Client.verifyIdToken`, which expects an ID token (a JWT). Neither
+component ever produces one: both use `useGoogleLogin` without a `flow` option,
+which is the implicit flow, and its response carries an opaque **access token**.
+Verifying it locally is not possible — it is not a JWT and carries no claims.
+Handing it back to Google is what establishes whose it is, which is exactly what
+the controller does:
+
+```js
+`https://www.googleapis.com/oauth2/v3/userinfo?access_token=${access_token}`
+```
+
+Now matched, with one deliberate difference: the token goes in an
+`Authorization: Bearer` header instead of the query string. Same endpoint, same
+response, but a credential in a URL ends up in proxy and server logs.
+
+Also restored from the controller and previously missing: the display name is
+built from `given_name` + `family_name` before falling back to `name`, and a
+`hd === "kiit.ac.in"` account gets `college`, `rollNumber`, `year` and `school`
+derived from the roll number. That derivation was checked against the
+controller's inline version across six roll numbers spanning 1st year to
+Passout — identical output on all six.
+
+Error mapping: Google answering 401/403 becomes a 401 (the caller's token is
+bad, not a server fault), any other non-OK becomes 502, and a transport failure
+becomes 503 — where an unhandled throw would otherwise have surfaced as a 500.
+
+Status codes now follow the controller: 201 when the account was just created,
+200 otherwise, with the message `"LOGGED IN"` in both cases.
+
+Verified against the live Google endpoint: an empty body gives
+400 *"Missing fields: access_token"*; an invalid `access_token` gives **401**,
+proving the request now reaches Google instead of being turned away at the door.
+A full popup sign-in needs a browser and was not automated.
+
+### Google Cloud console
+
+The implicit flow validates **Authorized JavaScript origins**, not Authorized
+redirect URIs — those apply to the server-side auth-code flow, which no app on
+this client id uses (checked across FED-Backend, FED-Frontend and this repo: no
+`redirect_uri`, no auth-code flow, no OAuth callback route).
+
+So local development needs `http://localhost:3111` as a JavaScript **origin**
+— scheme, host and port, no path. `https://fedkiit.com` is not needed alongside
+`https://www.fedkiit.com`: the apex 308-redirects to `www`, so the browser is
+never on the apex origin.
+
 ## Known issues
 
 - **`/ForgotPassword` reloads instead of submitting.** Its `<form>` has no
@@ -358,6 +1109,15 @@ same message whether or not the account exists.
   and `editDetails` return 403 — so the exposure is the admin screen itself, not
   the ability to use it. The data it lists comes from `fetchTeam`, which is
   public either way (see below).
+- **`checkAccess("USER")` is stricter in Express than here.** It passes only when
+  `access === "USER"` (or ADMIN), so club executives could not register for an
+  event, create or join a team, or fetch their attendance code — they got a 403.
+  The ported routes require a signed-in user instead, which lets staff use those
+  features. Worth a decision rather than a silent change: matching Express
+  exactly would start returning 403 to every executive account.
+- `GET /api/form/allJoinRequestUpdates` answers `{ updates: [] }` to anonymous
+  callers where Express returned 401. App.jsx polls it on load, so a 401 logged
+  an error on every signed-out page view.
 - `/api/user/fetchTeam` returns members' email addresses to anonymous callers.
   Preserved deliberately: trimming the projection changes the response bytes and
   the Team page's sort order. Worth fixing, but it is a behaviour change, not a
diff --git a/app/(main)/layout.jsx b/app/(main)/layout.jsx
index 8ff7059..a2b4a6a 100644
--- a/app/(main)/layout.jsx
+++ b/app/(main)/layout.jsx
@@ -4,14 +4,16 @@ import { usePathname } from "next/navigation";
 
 import Navbar from "@/src/layouts/Navbar/Navbar";
 import Footer from "@/src/layouts/Footer/Footer";
-import Chatbot from "@/src/components/Chatbot/Chatbot";
 
 /**
  * Main site layout — the `MainLayout` component from App.jsx.
  *
  * Same structure: Navbar, a `.page` wrapper that gains `.omega-page` on the
- * Omega route, then Footer. The global Chatbot sits alongside it, as it did at
- * the top of `App()`.
+ * Omega route, then Footer.
+ *
+ * The Chatbot is *not* here. App.jsx renders it above `<Routes>`, so it appears
+ * on every route including Login, SignUp and the OTP screens; mounting it in
+ * this layout hid it on all of those. It now lives in the root layout.
  *
  * Deliberately no Suspense boundary here. Wrapping `{children}` made every
  * prerendered page ship its content twice — once inside the streamed boundary
@@ -25,7 +27,6 @@ export default function MainLayout({ children }) {
 
   return (
     <div>
-      <Chatbot />
       <Navbar />
       <div className={`page ${isOmegaPage ? "omega-page" : ""}`}>
         {children}
diff --git a/app/api/auth/changePassword/route.ts b/app/api/auth/changePassword/route.ts
index e963b23..8f72dde 100644
--- a/app/api/auth/changePassword/route.ts
+++ b/app/api/auth/changePassword/route.ts
@@ -1,36 +1,53 @@
 import { prisma } from "@/lib/db";
 import { body, expressError, handle, json } from "@/lib/api/express";
 import { enforceRateLimit, RATE_LIMITS } from "@/lib/api/rate-limit";
-import { hashPassword } from "@/lib/auth/password";
+import { hashPassword, verifyPassword } from "@/lib/auth/password";
 import { verifyOtp } from "@/lib/services/otp";
 
 /**
  * POST /api/auth/changePassword
  * Port of controllers/auth/changePassword.js — completes the reset flow.
+ *
+ * Body is `{ newPassword, confirmPassword, otp, email }`, which is what
+ * `OtpInput.jsx` posts. An earlier version of this route read `password`
+ * instead of `newPassword`, so a correct code was rejected with
+ * "Email, otp and password are required" before it was ever checked.
+ *
+ * Public, as in Express: the route's `checkAccess('USER','MEMBER','ADMIN')` runs
+ * with no `verifyToken` ahead of it, so the middleware takes its `email` from
+ * the body and looks the account up itself. Knowing the address is the entry
+ * requirement; the OTP is what actually authorises the change.
  */
 export async function POST(request: Request) {
   return handle(async () => {
-    const { email, otp, password } = await body<{
-      email?: string;
+    const { newPassword, confirmPassword, otp, email } = await body<{
+      newPassword?: string;
+      confirmPassword?: string;
       otp?: string;
-      password?: string;
+      email?: string;
     }>(request);
 
-    if (!email || !otp || !password) {
-      return expressError(400, "Email, otp and password are required");
+    if (!newPassword || !confirmPassword || !otp || !email) {
+      return expressError(400, "Missing fields.");
+    }
+
+    if (newPassword !== confirmPassword) {
+      return expressError(
+        409,
+        "Conflict : New Password and confirm Password did not match!!",
+      );
     }
 
     const address = email.trim().toLowerCase();
 
     await enforceRateLimit({ ...RATE_LIMITS.passwordReset, subject: address });
 
+    // `checkAccess` answered 404 here when the address was unknown.
     const user = await prisma.user.findUnique({
       where: { email: address },
-      select: { id: true },
+      select: { id: true, password: true },
     });
-
-    // Same message whether or not the account exists.
-    if (!user) return expressError(400, "That code is not correct");
+    if (!user) return expressError(404, "User not found!");
 
     await verifyOtp({
       email: address,
@@ -39,11 +56,21 @@ export async function POST(request: Request) {
       consume: true,
     });
 
+    if (await verifyPassword(newPassword, user.password)) {
+      return expressError(
+        400,
+        "New password cannot be same as the old password ! Instead try login",
+      );
+    }
+
     await prisma.user.update({
       where: { id: user.id },
-      data: { password: await hashPassword(password) },
+      data: { password: await hashPassword(newPassword) },
     });
 
-    return json({ message: "Password changed successfully" }, 200);
+    return json({
+      status: "OK",
+      message: "Password has been changed successfully !!",
+    });
   });
 }
diff --git a/app/api/auth/googleAuth/route.ts b/app/api/auth/googleAuth/route.ts
index 4847d9b..cc29e38 100644
--- a/app/api/auth/googleAuth/route.ts
+++ b/app/api/auth/googleAuth/route.ts
@@ -6,30 +6,46 @@ import { googleAuth } from "@/lib/services/auth";
  * POST /api/auth/googleAuth
  * Port of controllers/auth/google/googleAuthentication.js.
  *
- * Accepts either `credential` or `token` — GoogleLogin.jsx and GoogleSignup.jsx
- * each send a different key.
+ * The body is `{ access_token }`. `GoogleLogin.jsx` and `GoogleSignup.jsx` both
+ * use `useGoogleLogin`'s implicit flow and post that key — as they did against
+ * Express. This route previously looked for `credential` / `token` / `tokenId`
+ * and matched none of them, so every Google sign-in was rejected with a 400
+ * before Google was ever contacted.
+ *
+ * `token` and `credential` stay accepted as aliases so a caller that already
+ * adopted either keeps working.
  */
 export async function POST(request: Request) {
   return handle(async () => {
     const payload = await body<{
+      access_token?: string;
       credential?: string;
       token?: string;
       tokenId?: string;
     }>(request);
 
-    const credential = payload.credential || payload.token || payload.tokenId;
-    if (!credential) return expressError(400, "Google credential is required");
+    const accessToken =
+      payload.access_token || payload.token || payload.credential || payload.tokenId;
+    if (!accessToken) {
+      return expressError(400, "Missing fields: access_token");
+    }
 
     await enforceRateLimit(RATE_LIMITS.login);
 
-    const result = await googleAuth(credential);
+    const result = await googleAuth(accessToken);
 
-    return json({
-      message: result.isNewUser ? "User created successfully" : "LOGGED IN",
-      user: result.user,
-      token: result.token,
-      isNewUser: result.isNewUser,
-      needsProfile: result.needsProfile,
-    });
+    // 201 when the account was just created, 200 otherwise; the message is
+    // "LOGGED IN" either way, matching the controller. GoogleSignup.jsx keys its
+    // toast off the status, not the message.
+    return json(
+      {
+        message: "LOGGED IN",
+        user: result.user,
+        token: result.token,
+        isNewUser: result.isNewUser,
+        needsProfile: result.needsProfile,
+      },
+      result.isNewUser ? 201 : 200,
+    );
   });
 }
diff --git a/app/api/auth/register/route.ts b/app/api/auth/register/route.ts
index 5aeefed..47c63b4 100644
--- a/app/api/auth/register/route.ts
+++ b/app/api/auth/register/route.ts
@@ -7,6 +7,7 @@ import { createSessionToken, setSessionCookie } from "@/lib/auth/session";
 import { consumeOtp, verifyOtp } from "@/lib/services/otp";
 import { sendMail } from "@/lib/email/mailer";
 import { welcomeEmail } from "@/lib/email/templates";
+import { normalizeYear } from "@/lib/academic";
 
 /**
  * POST /api/auth/register
@@ -59,7 +60,16 @@ export async function POST(request: Request) {
         rollNumber: data.rollNumber || null,
         school: data.school || null,
         college: data.college || null,
-        year: data.year || null,
+        // Exactly what the user selected — never inferred. Anyone can sign up
+        // with a personal address, so the roll number beside this field is not
+        // guaranteed to be a KIIT one, and guessing from it would quietly stamp
+        // a wrong year on the account. Lateral entry breaks the inference even
+        // when the roll number *is* real: a 2025 LE student sits in 2nd year
+        // with the 2024 batch.
+        //
+        // `normalizeYear` only folds spelling ("3rd Year" -> "3rd"); it never
+        // invents a value.
+        year: normalizeYear(data.year),
         contactNo: data.contactNo || null,
         whatsappNo: data.whatsappNo || null,
         img: data.img || null,
diff --git a/app/api/blog/createBlog/route.ts b/app/api/blog/createBlog/route.ts
index 13dd821..26c8e00 100644
--- a/app/api/blog/createBlog/route.ts
+++ b/app/api/blog/createBlog/route.ts
@@ -35,7 +35,7 @@ export async function POST(request: Request) {
     let image = text("image");
     const file = form.get("image");
     if (file instanceof File && file.size > 0) {
-      const result = await uploadImage(file, "BlogImages", 1200, 800);
+      const result = await uploadImage(file, "BlogImages");
       image = result?.secure_url ?? image;
     }
 
diff --git a/app/api/blog/updateBlog/[id]/route.ts b/app/api/blog/updateBlog/[id]/route.ts
index bcfc8cb..106508b 100644
--- a/app/api/blog/updateBlog/[id]/route.ts
+++ b/app/api/blog/updateBlog/[id]/route.ts
@@ -60,7 +60,7 @@ export async function PUT(
 
     const file = form.get("image");
     if (file instanceof File && file.size > 0) {
-      const result = await uploadImage(file, "BlogImages", 1200, 800);
+      const result = await uploadImage(file, "BlogImages");
       if (result) data.image = result.secure_url;
     } else {
       const imageUrl = text("image");
diff --git a/app/api/form/addForm/route.ts b/app/api/form/addForm/route.ts
index 6fbd2a9..c042917 100644
--- a/app/api/form/addForm/route.ts
+++ b/app/api/form/addForm/route.ts
@@ -14,10 +14,16 @@ import { uploadImage } from "@/lib/services/upload";
  * fields, and assembles the same `info` blob the original wrote, so existing
  * documents and new ones stay structurally identical.
  */
-const FORM_IMAGE_W = 1000;
-const FORM_IMAGE_H = 1000;
-const QR_IMAGE_W = 500;
-const QR_IMAGE_H = 500;
+/**
+ * Upload dimensions come from `lib/config/images.ts`.
+ *
+ * They were literals here and in `editForm`, and the two had drifted: Express
+ * declares `QrImageWidth = 400, QrImageHeight = 150` in both controllers, but
+ * `addForm` passed them into `uploadimage(path, folder, height, width)` in the
+ * wrong order, so it uploaded QR media at 150x400 while `editForm` used
+ * 400x150. Centralising picks the declared intent, which is what `editForm`
+ * already did — so this call changes, deliberately, to match.
+ */
 
 export async function POST(request: Request) {
   return handle(async () => {
@@ -55,23 +61,13 @@ export async function POST(request: Request) {
 
     const eventImg = form.get("eventImg");
     if (eventImg instanceof File && eventImg.size > 0) {
-      const result = await uploadImage(
-        eventImg,
-        "FormImages",
-        FORM_IMAGE_W,
-        FORM_IMAGE_H,
-      );
+      const result = await uploadImage(eventImg, "FormImages");
       info.eventImg = result?.secure_url ?? null;
     }
 
     const media = form.get("media");
     if (media instanceof File && media.size > 0) {
-      const result = await uploadImage(
-        media,
-        "QRMediaImages",
-        QR_IMAGE_W,
-        QR_IMAGE_H,
-      );
+      const result = await uploadImage(media, "QRMediaImages");
       (info.receiverDetails as { media: string | null }).media =
         result?.secure_url ?? null;
     }
@@ -96,9 +92,11 @@ export async function POST(request: Request) {
     // Drop the cached listing so the new event shows up immediately.
     revalidatePath("/Events");
 
-    return json(
-      { success: true, message: "Form added successfully", form: created },
-      201,
-    );
+    // 200 and this wording are what the Express controller returned.
+    return json({
+      success: true,
+      message: "Form created successfully",
+      form: created,
+    });
   });
 }
diff --git a/app/api/form/attendanceCode/[id]/route.ts b/app/api/form/attendanceCode/[id]/route.ts
index f7e2659..04f3359 100644
--- a/app/api/form/attendanceCode/[id]/route.ts
+++ b/app/api/form/attendanceCode/[id]/route.ts
@@ -3,12 +3,16 @@ import { expressError, handle, json } from "@/lib/api/express";
 import { getCurrentUser } from "@/lib/auth/access";
 
 /**
- * GET /api/form/attendanceCode/:id
- * Port of controllers/registration/getAttendanceCode — the value the
- * attendee's QR code encodes.
+ * GET /api/form/attendanceCode/:id?teamCode=
+ * Port of controllers/registration/getAttendanceCode.
+ *
+ * Responds `{ message, attendanceToken }` at the top level: QRCodeModal reads
+ * `response.data.attendanceToken` and encodes it straight into the QR image.
+ * `attendanceToken` is a signed JWT expiring in 20 minutes, not the attendance
+ * record's id.
  */
 export async function GET(
-  _request: Request,
+  request: Request,
   ctx: RouteContext<"/api/form/attendanceCode/[id]">,
 ) {
   return handle(async () => {
@@ -16,8 +20,8 @@ export async function GET(
     if (!user) return expressError(401, "Token is required");
 
     const { id } = await ctx.params;
-    const data = await getAttendanceCode(id, user);
+    const teamCode = new URL(request.url).searchParams.get("teamCode");
 
-    return json({ success: true, data });
+    return json(await getAttendanceCode(id, user, teamCode));
   });
 }
diff --git a/app/api/form/createTeam/route.ts b/app/api/form/createTeam/route.ts
index 1361c9c..e5131c9 100644
--- a/app/api/form/createTeam/route.ts
+++ b/app/api/form/createTeam/route.ts
@@ -11,9 +11,22 @@ export async function POST(request: Request) {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await createTeam({ user, formId: b.formId ?? b._id, teamName: b.teamName ?? '' });
+    const b = await body<{ formId?: string; teamName?: string }>(request);
+    if (!b.formId || !b.teamName) {
+      return expressError(400, "Form ID and team name are required");
+    }
 
-    return json({ success: true, message: "Team created successfully", data });
+    const data = await createTeam({
+      user,
+      formId: b.formId,
+      teamName: b.teamName,
+    });
+
+    // TeamlessState.jsx shows this verbatim, so it names the team as before.
+    return json({
+      success: true,
+      message: `Team "${data.teamName}" created successfully!`,
+      data,
+    });
   });
 }
diff --git a/app/api/form/editForm/[id]/route.ts b/app/api/form/editForm/[id]/route.ts
index a2859b4..36fc189 100644
--- a/app/api/form/editForm/[id]/route.ts
+++ b/app/api/form/editForm/[id]/route.ts
@@ -76,13 +76,13 @@ export async function PUT(
 
     const eventImg = form.get("eventImg");
     if (eventImg instanceof File && eventImg.size > 0) {
-      const result = await uploadImage(eventImg, "FormImages", 1000, 1000);
+      const result = await uploadImage(eventImg, "FormImages");
       if (result) info.eventImg = result.secure_url;
     }
 
     const media = form.get("media");
     if (media instanceof File && media.size > 0) {
-      const result = await uploadImage(media, "QRMediaImages", 500, 500);
+      const result = await uploadImage(media, "QRMediaImages");
       if (result) {
         info.receiverDetails = {
           ...(info.receiverDetails ?? {}),
@@ -110,7 +110,7 @@ export async function PUT(
 
     return json({
       success: true,
-      message: "Form updated successfully",
+      message: "Form info and sections updated successfully",
       form: updated,
     });
   });
diff --git a/app/api/form/export-attendance/[id]/route.ts b/app/api/form/export-attendance/[id]/route.ts
index 3ad6542..3e2d4dc 100644
--- a/app/api/form/export-attendance/[id]/route.ts
+++ b/app/api/form/export-attendance/[id]/route.ts
@@ -1,10 +1,14 @@
 import { exportAttendance } from "@/lib/services/attendance";
 import { expressError, handle } from "@/lib/api/express";
-import { getCurrentUser, isMember } from "@/lib/auth/access";
+import { getCurrentUser, isAdmin } from "@/lib/auth/access";
 
 /**
  * GET /api/form/export-attendance/:id
- * Port of controllers/registration/exportAttendance — club members only.
+ * Port of controllers/registration/exportAttendance.
+ *
+ * Admin only, matching the route's `checkAccess("ADMIN")`. This previously
+ * accepted any club member, which handed the full attendee list of any event to
+ * every executive rather than to admins alone.
  */
 export async function GET(
   _request: Request,
@@ -13,7 +17,7 @@ export async function GET(
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
-    if (!isMember(user)) return expressError(403, "Unauthorized");
+    if (!isAdmin(user)) return expressError(403, "Unauthorized");
 
     const { id } = await ctx.params;
     const { filename, csv } = await exportAttendance(id);
diff --git a/app/api/form/getFormAnalytics/[id]/route.ts b/app/api/form/getFormAnalytics/[id]/route.ts
index fa2f5be..f54c5e5 100644
--- a/app/api/form/getFormAnalytics/[id]/route.ts
+++ b/app/api/form/getFormAnalytics/[id]/route.ts
@@ -1,14 +1,18 @@
 import { prisma } from "@/lib/db";
 import { expressError, handle, json } from "@/lib/api/express";
-import { getCurrentUser, isMember } from "@/lib/auth/access";
+import { getCurrentUser } from "@/lib/auth/access";
+import { can } from "@/lib/auth/permissions";
+import { envList, getEnv } from "@/lib/env";
 
 /**
  * GET /api/form/getFormAnalytics/:id
  * Port of controllers/forms/analytics.js.
  *
- * Requires a club member: the original was mounted without any access check, so
- * the full registrant email list of any event was readable by anyone signed in.
+ * Response is `{ message, form, yearCounts }` at the top level, because
+ * EventStats.jsx reads `response.data.form.formAnalytics`,
+ * `response.data.form.info` and `response.data.yearCounts` directly.
  */
+
 export async function GET(
   _request: Request,
   ctx: RouteContext<"/api/form/getFormAnalytics/[id]">,
@@ -16,33 +20,65 @@ export async function GET(
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
-    if (!isMember(user)) return expressError(403, "Unauthorized");
+
+    // Role list lives in `lib/auth/permissions.ts`; the address allowlist that
+    // sits beside it is `FORM_ANALYTICS_ALLOWED_EMAILS` in the environment,
+    // both previously hardcoded here.
+    const allowedEmails = envList(getEnv().FORM_ANALYTICS_ALLOWED_EMAILS).map(
+      (entry) => entry.toLowerCase(),
+    );
+
+    // 401 rather than 403, matching `ApiError(status.UNAUTHORIZED, ...)`.
+    if (
+      !can(user, "FORM_ANALYTICS_VIEW") &&
+      !allowedEmails.includes(user.email.toLowerCase())
+    ) {
+      return expressError(401, "Access Denied");
+    }
 
     const { id } = await ctx.params;
+    // The original passed the id straight to Prisma; a non-ObjectId throws
+    // there and surfaces as a 500. Screened here so it reads as "not found".
     if (!/^[a-f\d]{24}$/i.test(id)) return expressError(404, "Form not found");
 
+    // The original wrote `include: { formAnalytics: true, sections: false }`.
+    // `sections` is a scalar JSON column, not a relation, so listing it in
+    // `include` never excluded anything — scalars come back regardless unless a
+    // `select` says otherwise. Dropping it returns exactly the same row.
     const form = await prisma.form.findUnique({
       where: { id },
-      include: { formAnalytics: true, userReg: true },
+      include: { formAnalytics: true },
     });
     if (!form) return expressError(404, "Form not found");
 
-    const tracker = form.formAnalytics[0] ?? null;
-
-    return json({
-      success: true,
-      message: "Analytics fetched successfully",
-      data: {
-        formId: id,
-        info: form.info,
-        totalRegistrationCount:
-          tracker?.totalRegistrationCount ?? form.userReg.length,
-        totalClickCount: tracker?.totalClickCount ?? 0,
-        regUserEmails: tracker?.regUserEmails ?? [],
-        regTeamNames: tracker?.regTeamNames ?? [],
-        faildAttemptCount: tracker?.faildAttemptCount ?? 0,
-        registrations: form.userReg,
-      },
-    });
+    if (form.formAnalytics.length === 0) {
+      return expressError(404, "No users have registered to this form yet");
+    }
+
+    const formAnalytics = form.formAnalytics[0];
+
+    // Registrant counts bucketed by the first word of `year` ("2nd Year" -> "2nd").
+    // A user with no year lands under the key "null", exactly as before: the
+    // original initialised `year` to null and used it as the object key.
+    let yearCounts: Record<string, number> | undefined;
+    try {
+      const users = await prisma.user.findMany({
+        where: { email: { in: formAnalytics.regUserEmails } },
+      });
+
+      yearCounts = users.reduce<Record<string, number>>((acc, obj) => {
+        let year: string | null = null;
+        if (obj.year) year = obj.year.split(" ")[0];
+
+        acc[year as string] = (acc[year as string] || 0) + 1;
+        return acc;
+      }, {});
+    } catch (error) {
+      // Matches the original: the failure is logged and the response still goes
+      // out, with `yearCounts` undefined.
+      console.error("Error fetching all the users form the array list", error);
+    }
+
+    return json({ message: "success", form, yearCounts });
   });
 }
diff --git a/app/api/form/inviteTeamMember/route.ts b/app/api/form/inviteTeamMember/route.ts
index 7bd51f8..1ca2adc 100644
--- a/app/api/form/inviteTeamMember/route.ts
+++ b/app/api/form/inviteTeamMember/route.ts
@@ -17,13 +17,21 @@ export async function POST(request: Request) {
 
     await enforceRateLimit({ ...RATE_LIMITS.otpRequest, subject: user.id });
 
-    const b = await body<Record<string, string>>(request);
+    const b = await body<{ formId?: string; inviteeEmail?: string }>(request);
+    if (!b.formId || !b.inviteeEmail) {
+      return expressError(400, "Form ID and invitee email are required");
+    }
+
     const data = await inviteTeamMember({
       user,
-      formId: b.formId ?? b._id ?? "",
-      inviteeEmail: b.inviteeEmail ?? b.email ?? "",
+      formId: b.formId,
+      inviteeEmail: b.inviteeEmail,
     });
 
-    return json({ success: true, message: "Invitation sent", data });
+    return json({
+      success: true,
+      message: `Invitation sent to ${b.inviteeEmail.trim().toLowerCase()}`,
+      data,
+    });
   });
 }
diff --git a/app/api/form/joinTeam/route.ts b/app/api/form/joinTeam/route.ts
index 187be42..f030193 100644
--- a/app/api/form/joinTeam/route.ts
+++ b/app/api/form/joinTeam/route.ts
@@ -11,9 +11,21 @@ export async function POST(request: Request) {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await joinTeam({ user, formId: b.formId ?? b._id, teamCode: b.teamCode ?? '' });
+    const b = await body<{ formId?: string; teamCode?: string }>(request);
+    if (!b.formId || !b.teamCode) {
+      return expressError(400, "Form ID and team code are required");
+    }
 
-    return json({ success: true, message: "Joined the team successfully", data });
+    const data = await joinTeam({
+      user,
+      formId: b.formId,
+      teamCode: b.teamCode,
+    });
+
+    return json({
+      success: true,
+      message: `Successfully joined team "${data.teamName}"!`,
+      data,
+    });
   });
 }
diff --git a/app/api/form/leaveTeam/route.ts b/app/api/form/leaveTeam/route.ts
index 57aea02..55f3372 100644
--- a/app/api/form/leaveTeam/route.ts
+++ b/app/api/form/leaveTeam/route.ts
@@ -5,15 +5,24 @@ import { getCurrentUser } from "@/lib/auth/access";
 /**
  * POST /api/form/leaveTeam
  * Port of controllers/registration/leaveTeam.js.
+ *
+ * The message is built from the outcome because TeamManagement.jsx puts
+ * `response.data.message` straight into the toast, and the original distinguishes
+ * a leader dissolving a team from a member leaving one.
  */
 export async function POST(request: Request) {
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await leaveTeam({ user, formId: b.formId ?? b._id });
+    const b = await body<{ formId?: string }>(request);
+    if (!b.formId) return expressError(400, "Form ID is required");
 
-    return json({ success: true, message: "Left the team successfully", data });
+    const { action, oldTeamName } = await leaveTeam({ user, formId: b.formId });
+
+    return json({
+      success: true,
+      message: `Successfully ${action} the team "${oldTeamName}". You can now create or join another team.`,
+    });
   });
 }
diff --git a/app/api/form/markAttendance/route.ts b/app/api/form/markAttendance/route.ts
index 736b26f..73dcfe9 100644
--- a/app/api/form/markAttendance/route.ts
+++ b/app/api/form/markAttendance/route.ts
@@ -1,25 +1,28 @@
 import { markAttendance } from "@/lib/services/attendance";
 import { body, expressError, handle, json } from "@/lib/api/express";
-import { getCurrentUser, isMember } from "@/lib/auth/access";
+import { getCurrentUser } from "@/lib/auth/access";
 
 /**
  * POST /api/form/markAttendance
  * Port of controllers/registration/markAttendance.js.
  *
- * Requires a club member. The Express route had its `checkAccess` call
- * commented out, so any signed-in user could mark any attendee present.
+ * Signed-in callers only, with no access-level check — matching the Express
+ * route, which has its `checkAccess` call commented out. That is deliberate on
+ * their side: the volunteer scanning at the door signs in as a plain USER, so
+ * requiring club-member access locks the door staff out. The real control is
+ * the signed, 20-minute QR token, which `markAttendance` verifies.
+ *
+ * Responds `{ message, attendance }` at the top level, which is the shape
+ * AttendancePage reads.
  */
 export async function POST(request: Request) {
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
-    if (!isMember(user)) return expressError(403, "Unauthorized");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await markAttendance({
-      attendanceId: b.attendanceId ?? b.token ?? b.id ?? "",
-    });
+    const b = await body<{ formId?: string; token?: string }>(request);
+    const result = await markAttendance({ formId: b.formId, token: b.token });
 
-    return json({ success: true, message: data.message, data });
+    return json(result);
   });
 }
diff --git a/app/api/form/removeTeamMember/route.ts b/app/api/form/removeTeamMember/route.ts
index 17b4f19..32f6975 100644
--- a/app/api/form/removeTeamMember/route.ts
+++ b/app/api/form/removeTeamMember/route.ts
@@ -5,15 +5,30 @@ import { getCurrentUser } from "@/lib/auth/access";
 /**
  * POST /api/form/removeTeamMember
  * Port of controllers/registration/removeTeamMember.js.
+ *
+ * Body is `{ formId, memberEmail }`. The message names both the address as
+ * typed and the normalised one the notification went to, as the original did —
+ * TeamManagement.jsx shows it verbatim in a toast.
  */
 export async function POST(request: Request) {
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await removeTeamMember({ user, formId: b.formId ?? b._id, email: b.email ?? b.memberEmail ?? '' });
+    const b = await body<{ formId?: string; memberEmail?: string }>(request);
+    if (!b.formId || !b.memberEmail) {
+      return expressError(400, "Form ID and member email are required");
+    }
 
-    return json({ success: true, message: "Member removed successfully", data });
+    const { memberEmail, normalizedEmail } = await removeTeamMember({
+      user,
+      formId: b.formId,
+      memberEmail: b.memberEmail,
+    });
+
+    return json({
+      success: true,
+      message: `Successfully removed ${memberEmail} from the team & informed through ${normalizedEmail}`,
+    });
   });
 }
diff --git a/app/api/form/renameTeam/route.ts b/app/api/form/renameTeam/route.ts
index 43772cd..5fb4008 100644
--- a/app/api/form/renameTeam/route.ts
+++ b/app/api/form/renameTeam/route.ts
@@ -5,15 +5,35 @@ import { getCurrentUser } from "@/lib/auth/access";
 /**
  * PATCH /api/form/renameTeam
  * Port of controllers/registration/renameTeam.js.
+ *
+ * Body is `{ formId, newTeamName }`. This route previously read `teamName`,
+ * which TeamManagement.jsx never sends, so every rename failed on an empty
+ * name. The success message echoes the new name because the UI surfaces it.
  */
 export async function PATCH(request: Request) {
   return handle(async () => {
     const user = await getCurrentUser();
     if (!user) return expressError(401, "Token is required");
 
-    const b = await body<Record<string, string>>(request);
-    const data = await renameTeam({ user, formId: b.formId ?? b._id, teamName: b.teamName ?? '' });
+    const b = await body<{ formId?: string; newTeamName?: string }>(request);
+    if (!b.formId || !b.newTeamName) {
+      return expressError(400, "Form ID and new team name are required");
+    }
 
-    return json({ success: true, message: "Team renamed successfully", data });
+    const data = await renameTeam({
+      user,
+      formId: b.formId,
+      teamName: b.newTeamName,
+    });
+
+    // The controller answers 200 "Team name unchanged" when the submitted name
+    // matches the current one, rather than treating it as a duplicate.
+    return json({
+      success: true,
+      message: data.unchanged
+        ? "Team name unchanged"
+        : `Team renamed to "${data.teamName}"`,
+      data: { teamName: data.teamName },
+    });
   });
 }
diff --git a/app/api/form/searchTeams/[formId]/route.ts b/app/api/form/searchTeams/[formId]/route.ts
index 6db9f41..b35f224 100644
--- a/app/api/form/searchTeams/[formId]/route.ts
+++ b/app/api/form/searchTeams/[formId]/route.ts
@@ -3,8 +3,13 @@ import { expressError, handle, json } from "@/lib/api/express";
 import { getCurrentUser } from "@/lib/auth/access";
 
 /**
- * GET /api/form/searchTeams/:formId?q=
+ * GET /api/form/searchTeams/:formId?search=
  * Port of controllers/registration/searchTeams.js — teams with room left.
+ *
+ * Two details the UI depends on: the query parameter is `search` (this route
+ * read `q`, which `TeamlessState.jsx` never sends, so typing in the box filtered
+ * nothing), and the list is nested as `data.teams` — the component reads
+ * `response.data.data.teams`.
  */
 export async function GET(
   request: Request,
@@ -15,10 +20,11 @@ export async function GET(
     if (!user) return expressError(401, "Token is required");
 
     const { formId } = await ctx.params;
-    const query = new URL(request.url).searchParams.get("q") ?? "";
+    if (!formId) return expressError(400, "Form ID is required");
 
-    const teams = await searchTeams(formId, query);
+    const search = new URL(request.url).searchParams.get("search") ?? "";
+    const teams = await searchTeams(formId, search, user.email);
 
-    return json({ success: true, message: "Teams fetched successfully", data: teams });
+    return json({ success: true, data: { teams } });
   });
 }
diff --git a/app/api/form/sendJoinRequest/route.ts b/app/api/form/sendJoinRequest/route.ts
index 937e1e2..ed4a299 100644
--- a/app/api/form/sendJoinRequest/route.ts
+++ b/app/api/form/sendJoinRequest/route.ts
@@ -6,6 +6,10 @@ import { getCurrentUser } from "@/lib/auth/access";
 /**
  * POST /api/form/sendJoinRequest
  * Port of controllers/registration/sendJoinRequest.js.
+ *
+ * Body is `{ formId, teamRegistrationId }` — the id `searchTeams` returns for
+ * each team. This route previously looked for `teamCode`, which the UI never
+ * sends, so every join request was rejected.
  */
 export async function POST(request: Request) {
   return handle(async () => {
@@ -14,13 +18,24 @@ export async function POST(request: Request) {
 
     await enforceRateLimit({ ...RATE_LIMITS.registration, subject: user.id });
 
-    const b = await body<Record<string, string>>(request);
+    const b = await body<{ formId?: string; teamRegistrationId?: string }>(
+      request,
+    );
+    if (!b.formId || !b.teamRegistrationId) {
+      return expressError(400, "Form ID and team registration ID are required");
+    }
+
     const data = await sendJoinRequest({
       user,
-      formId: b.formId ?? b._id ?? "",
-      teamCode: b.teamCode ?? "",
+      formId: b.formId,
+      teamRegistrationId: b.teamRegistrationId,
     });
 
-    return json({ success: true, message: "Join request sent", data });
+    return json({
+      success: true,
+      message:
+        "Join request sent to the team leader. They will receive an email with your request.",
+      data,
+    });
   });
 }
diff --git a/app/api/form/teamDetails/[formId]/route.ts b/app/api/form/teamDetails/[formId]/route.ts
index 1675ff1..b857ece 100644
--- a/app/api/form/teamDetails/[formId]/route.ts
+++ b/app/api/form/teamDetails/[formId]/route.ts
@@ -1,14 +1,21 @@
 import { prisma } from "@/lib/db";
 import { expressError, handle, json } from "@/lib/api/express";
 import { getCurrentUser } from "@/lib/auth/access";
+import type { EventInfo } from "@/lib/types/event";
 
 /**
  * GET /api/form/teamDetails/:formId
  * Port of controllers/registration/getTeamDetails.js.
  *
- * Returns only the caller's own registration for the form — the original looked
- * the record up by form alone in places, which exposed other teams' member
- * lists.
+ * Drives the whole team management page, so the payload has to match field for
+ * field: `TeamManagement.jsx` reads `data.isTeamless`, `teamData.eventTitle`,
+ * `.leaderEmail`, `.maxTeamSize`, `.minTeamSize`, `.teamSize`, `.teamCode`,
+ * `.teamName`, `.members`, `.isRegistrationClosed` and `.isEventPast`, and
+ * `MemberCard.jsx` reads `member.name/email/img/college/year`.
+ *
+ * The registration is looked up by **membership**, not ownership. An earlier
+ * version matched on `userId`, which is only ever the team leader's id — so
+ * every other member of a team got "no registration found" and an empty page.
  */
 export async function GET(
   _request: Request,
@@ -19,48 +26,88 @@ export async function GET(
     if (!user) return expressError(401, "Token is required");
 
     const { formId } = await ctx.params;
+    if (!formId) return expressError(400, "Form ID is required");
+    // A malformed id makes Prisma throw; answer as "not found" instead.
     if (!/^[a-f\d]{24}$/i.test(formId)) {
-      return expressError(404, "Form not found");
+      return expressError(
+        404,
+        "No team registration found for this user in the specified form",
+      );
     }
 
-    const registration = await prisma.formRegistration.findFirst({
-      where: { formId, userId: user.id },
+    const teamRegistration = await prisma.formRegistration.findFirst({
+      where: { formId, regTeamMemEmails: { has: user.email } },
+      include: { form: { select: { info: true } } },
     });
 
-    if (!registration) {
+    if (!teamRegistration) {
+      return expressError(
+        404,
+        "No team registration found for this user in the specified form",
+      );
+    }
+
+    const info = (teamRegistration.form.info ?? {}) as EventInfo;
+
+    if (info.participationType !== "Team") {
+      return expressError(400, "This is not a team event");
+    }
+
+    const maxTeamSize = Number.parseInt(String(info.maxTeamSize ?? ""), 10) || 1;
+    const minTeamSize = Number.parseInt(String(info.minTeamSize ?? ""), 10) || 1;
+
+    // Registered for the event but not yet on a team — the UI swaps in
+    // TeamlessState, which needs the event's limits to offer team creation.
+    if (teamRegistration.teamName === "UNAFFILIATED") {
       return json({
         success: true,
-        message: "No registration found",
-        data: null,
+        message: "User is registered but not yet on a team",
+        data: {
+          isTeamless: true,
+          eventTitle: info.eventTitle,
+          maxTeamSize,
+          minTeamSize,
+          isRegistrationClosed: info.isRegistrationClosed || false,
+          isEventPast: info.isEventPast || false,
+          formId: teamRegistration.formId,
+        },
       });
     }
 
-    // Everyone on the same team code, so the UI can list teammates.
-    const teammates = await prisma.formRegistration.findMany({
-      where: { formId, teamCode: registration.teamCode },
-      select: { regTeamMemEmails: true, teamSize: true },
+    const members = await prisma.user.findMany({
+      where: { email: { in: teamRegistration.regTeamMemEmails } },
+      select: {
+        name: true,
+        email: true,
+        img: true,
+        rollNumber: true,
+        college: true,
+        year: true,
+      },
     });
 
-    const memberEmails = [
-      ...new Set(teammates.flatMap((t) => t.regTeamMemEmails)),
-    ];
-
-    const members = await prisma.user.findMany({
-      where: { email: { in: memberEmails } },
-      select: { name: true, email: true, img: true },
+    // `userId` on the registration is the leader; the UI compares this against
+    // the signed-in user to decide who may rename, invite and remove.
+    const leaderUser = await prisma.user.findUnique({
+      where: { id: teamRegistration.userId },
+      select: { email: true },
     });
 
     return json({
       success: true,
-      message: "Team details fetched successfully",
+      message: "Team details retrieved successfully",
       data: {
-        registrationId: registration.id,
-        teamName: registration.teamName,
-        teamCode: registration.teamCode,
-        teamSize: registration.teamSize,
-        regTeamMemEmails: registration.regTeamMemEmails,
+        teamName: teamRegistration.teamName,
+        teamCode: teamRegistration.teamCode,
+        teamSize: teamRegistration.teamSize,
+        maxTeamSize,
+        minTeamSize,
         members,
-        isLeader: registration.userId === user.id,
+        eventTitle: info.eventTitle,
+        leaderEmail: leaderUser?.email || null,
+        isRegistrationClosed: info.isRegistrationClosed || false,
+        isEventPast: info.isEventPast || false,
+        formId: teamRegistration.formId,
       },
     });
   });
diff --git a/app/api/health/route.ts b/app/api/health/route.ts
new file mode 100644
index 0000000..43c99fe
--- /dev/null
+++ b/app/api/health/route.ts
@@ -0,0 +1,122 @@
+import { NextResponse } from "next/server";
+
+import { prisma } from "@/lib/db";
+
+/**
+ * GET|HEAD /api/health
+ *
+ * Liveness/readiness probe for uptime monitors and container orchestrators.
+ * There was no equivalent in the Express backend — monitors were pointed at
+ * `/api/form/getAllForms`, which reads the whole forms collection on every
+ * poll and returns 200 even when the database is unreachable but cached.
+ *
+ *   200  { status: "ok" }        every dependency answered
+ *   503  { status: "unhealthy" } at least one did not
+ *
+ * A monitor only needs the status code; the body is for a human reading it
+ * after an alert fires.
+ */
+
+// Never prerendered or cached: a health check answering from the build output
+// would report "ok" for a process that is not actually serving.
+export const dynamic = "force-dynamic";
+export const revalidate = 0;
+
+/**
+ * A hung TCP connection to Atlas does not reject — it hangs until the driver's
+ * own (much longer) timeout. A probe that hangs reads as a timeout to the
+ * monitor rather than a clean 503, so the check is bounded here.
+ */
+const DB_TIMEOUT_MS = 3000;
+
+type CheckResult = {
+  status: "ok" | "error";
+  latencyMs: number;
+  error?: string;
+};
+
+async function checkDatabase(): Promise<CheckResult> {
+  const startedAt = Date.now();
+  let timer: NodeJS.Timeout | undefined;
+
+  try {
+    // `ping` is the cheapest command the MongoDB driver exposes: it touches no
+    // collection and reads no documents, so polling it every few seconds costs
+    // nothing. A `findFirst` against a real collection would also exercise the
+    // schema, but it puts load on a production database on every poll.
+    await Promise.race([
+      prisma.$runCommandRaw({ ping: 1 }),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new Error(`timed out after ${DB_TIMEOUT_MS}ms`)),
+          DB_TIMEOUT_MS,
+        );
+      }),
+    ]);
+
+    return { status: "ok", latencyMs: Date.now() - startedAt };
+  } catch (error) {
+    // The message can carry the connection string, which holds the Atlas
+    // password. `/api/health` is unauthenticated, so only the error's class and
+    // a fixed message are exposed; the detail goes to the server log.
+    console.error("[health] database check failed:", error);
+
+    const message =
+      error instanceof Error && error.message.startsWith("timed out")
+        ? error.message
+        : "unreachable";
+
+    return { status: "error", latencyMs: Date.now() - startedAt, error: message };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function runChecks() {
+  const database = await checkDatabase();
+  const healthy = database.status === "ok";
+
+  return {
+    healthy,
+    body: {
+      status: healthy ? ("ok" as const) : ("unhealthy" as const),
+      timestamp: new Date().toISOString(),
+      // Seconds this Node process has been up. On serverless this resets with
+      // every cold start and is expected to be small — it is a signal about the
+      // instance answering, not about the deployment's age.
+      uptime: Math.round(process.uptime()),
+      // Set by Vercel; absent elsewhere. A commit SHA is not a secret and makes
+      // "which build is actually live" answerable from the probe itself.
+      version: process.env.VERCEL_GIT_COMMIT_SHA?.slice(0, 7) ?? null,
+      environment: process.env.NODE_ENV,
+      checks: { database },
+    },
+  };
+}
+
+const NO_STORE = {
+  "Cache-Control": "no-store, no-cache, must-revalidate",
+} as const;
+
+export async function GET() {
+  const { healthy, body } = await runChecks();
+
+  return NextResponse.json(body, {
+    status: healthy ? 200 : 503,
+    headers: NO_STORE,
+  });
+}
+
+/**
+ * Uptime monitors commonly poll with HEAD to avoid transferring a body. Next
+ * does not derive HEAD from GET for route handlers, so without this a monitor
+ * configured for HEAD gets 405 and reports the site as down.
+ */
+export async function HEAD() {
+  const { healthy } = await runChecks();
+
+  return new Response(null, {
+    status: healthy ? 200 : 503,
+    headers: NO_STORE,
+  });
+}
diff --git a/app/api/user/editDetails/route.ts b/app/api/user/editDetails/route.ts
index a2e1844..3f02663 100644
--- a/app/api/user/editDetails/route.ts
+++ b/app/api/user/editDetails/route.ts
@@ -1,6 +1,7 @@
 import { prisma } from "@/lib/db";
 import { body, expressError, handle, json } from "@/lib/api/express";
 import { getCurrentUser, isAdmin, toSafeUser } from "@/lib/auth/access";
+import { normalizeYear } from "@/lib/academic";
 
 /**
  * PUT /api/user/editDetails
@@ -54,7 +55,11 @@ export async function PUT(request: Request) {
         college: data.college ?? target.college,
         contactNo: data.contactNo ?? target.contactNo,
         whatsappNo: data.whatsappNo ?? target.whatsappNo,
-        year: data.year ?? target.year,
+        // Editable, and never recomputed behind the user's back: a
+        // lateral-entry student sets a year their roll number does not imply,
+        // and re-deriving on save would silently undo it every time. Only
+        // normalised, so the stored spelling stays consistent.
+        year: normalizeYear(data.year) ?? target.year,
         img: data.img ?? target.img,
         extra,
         // Access is never taken from the request body unless an admin sets it.
diff --git a/app/api/user/editProfileImage/route.ts b/app/api/user/editProfileImage/route.ts
index c2bdd40..b21e60a 100644
--- a/app/api/user/editProfileImage/route.ts
+++ b/app/api/user/editProfileImage/route.ts
@@ -4,9 +4,8 @@ import { enforceRateLimit, RATE_LIMITS } from "@/lib/api/rate-limit";
 import { getCurrentUser } from "@/lib/auth/access";
 import { uploadImage } from "@/lib/services/upload";
 
-/** Cloudinary caps and the square avatar the profile UI renders. */
+/** Upload size cap. The avatar's pixel bounds live in `lib/config/images.ts`. */
 const MAX_BYTES = 5 * 1024 * 1024;
-const AVATAR = 512;
 
 /**
  * POST /api/user/editProfileImage
@@ -40,7 +39,7 @@ export async function POST(request: Request) {
       return expressError(415, "That file is not an image");
     }
 
-    const result = await uploadImage(file, "ProfileImages", AVATAR, AVATAR);
+    const result = await uploadImage(file, "ProfileImages");
     if (!result) {
       return expressError(502, "Could not upload the image. Please try again.");
     }
diff --git a/app/globals.scss b/app/globals.scss
index c4e5eac..04b15ee 100644
--- a/app/globals.scss
+++ b/app/globals.scss
@@ -16,6 +16,14 @@
 // text silently fell back to a system sans-serif and every line box was ~2px
 // shorter than the original.
 
+// All three vendor stylesheets the original index.scss pulled in. Only the
+// react-datepicker one was carried over at first, which left the <DatePicker>
+// on the admin form with no styling at all: react-date-picker renders its popup
+// with react-calendar, and with Calendar.css missing the calendar opened as an
+// unstyled column of numbers. Verified by grepping the emitted CSS — zero
+// `.react-calendar` rules shipped.
+@import "react-date-picker/dist/DatePicker.css";
+@import "react-calendar/dist/Calendar.css";
 @import "react-datepicker/dist/react-datepicker.css";
 
 // The brand gradient. Lived in Global.scss on the original site; it moved here
@@ -40,6 +48,32 @@
   border: none !important;
 }
 
+/**
+ * Lifted out of TeamCard.module.scss, where it sits as a top-level bare
+ * `button { }` rule.
+ *
+ * Vite emits every CSS Module into one stylesheet for the whole SPA, and it does
+ * not hash element selectors — so that rule was live on every page of the
+ * original site. Next code-splits CSS per route, so once ported it only loaded
+ * where TeamCard did (/Team, /profile/members). Everywhere else buttons fell
+ * back to the user-agent appearance: measured on /otp, the disabled "Resend OTP"
+ * button rendered with `background-color: rgba(19, 1, 1, 0.3)` and a
+ * `2px outset` border against the original's transparent / `0px none`.
+ *
+ * Declared here so the cascade matches the original app. It is only specificity
+ * 0-0-1, so every component's own class rules still win, exactly as before.
+ */
+button {
+  color: #ff8a00;
+  background-color: transparent;
+  border: none;
+  cursor: pointer;
+  margin-top: 10px;
+  font-size: 1.2em;
+  font-weight: 500;
+  margin-bottom: 15px;
+}
+
 html {
   scroll-behavior: smooth;
 }
diff --git a/app/layout.tsx b/app/layout.tsx
index a6a8af9..23caba4 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -2,6 +2,7 @@ import type { Metadata, Viewport } from "next";
 import Script from "next/script";
 
 import Providers from "@/src/context/Providers";
+import Chatbot from "@/src/components/Chatbot/Chatbot";
 import { JsonLd } from "@/components/seo/JsonLd";
 import { SITE } from "@/lib/site";
 import { SITE_URL } from "@/lib/seo/metadata";
@@ -59,7 +60,11 @@ export default function RootLayout({
   children,
 }: Readonly<{ children: React.ReactNode }>) {
   return (
-    <html lang="en" suppressHydrationWarning>
+    // `data-scroll-behavior="smooth"` acknowledges the `scroll-behavior: smooth`
+    // that globals.scss sets on <html>. Without it Next warns, because it has to
+    // decide whether a route change should animate the scroll to the top — with
+    // the attribute present it keeps the smooth scroll the original had.
+    <html lang="en" data-scroll-behavior="smooth" suppressHydrationWarning>
       <head>
         {/*
           The exact font families and weights the original SCSS pulled in.
@@ -80,7 +85,17 @@ export default function RootLayout({
       </head>
       <body>
         <JsonLd schema={[organizationSchema(), websiteSchema()]} />
-        <Providers>{children}</Providers>
+        <Providers>
+          {/*
+            App.jsx renders <Chatbot /> above <Routes>, so it is present on
+            every route — the auth screens included. Mounting it in the (main)
+            layout instead hid it on /Login, /SignUp, /otp, /ForgotPassword and
+            /completeProfile. It sits inside Providers because it reads
+            AuthContext to attach the signed-in user to a conversation.
+          */}
+          <Chatbot />
+          {children}
+        </Providers>
 
         {/* Razorpay checkout, loaded in index.html on the original site. */}
         <Script
diff --git a/lib/academic.ts b/lib/academic.ts
new file mode 100644
index 0000000..40d9ca8
--- /dev/null
+++ b/lib/academic.ts
@@ -0,0 +1,93 @@
+import "server-only";
+
+import { getEnv } from "@/lib/env";
+
+/**
+ * Year of study.
+ *
+ * **The user picks it.** A KIIT roll number encodes the intake year
+ * (`22052xxx` started in 2022), but intake year does not determine year of
+ * study: a lateral-entry student admitted in 2025 joins the 2024 batch directly
+ * in 2nd year. Deriving it would put every LE student in the wrong year with no
+ * way to correct it, so the dropdown stays and what someone selects is kept.
+ *
+ * Derivation survives only as a *fallback*, for the one path with no form to
+ * fill in — Google sign-up, where the profile is built from the token alone.
+ *
+ * `normalizeYear` is the part worth keeping regardless. Six spellings of the
+ * same thing were in the database ("3rd", "3rd Year", "3rd year", …) because
+ * each screen shipped its own option list, and that split one cohort across
+ * three buckets in the EventStats year counts.
+ */
+
+/** The stored form. Bare ordinals, which is what 115 of 135 rows already used. */
+const LABELS = ["1st", "2nd", "3rd", "4th", "5th"] as const;
+export const PASSOUT = "Passout";
+
+/**
+ * Folds any spelling onto the canonical one: "3rd Year", "3rd year", " 3RD " all
+ * become "3rd". Returns `null` for an empty or unrecognisable value so callers
+ * can leave the stored value alone rather than overwrite it with rubbish.
+ */
+export function normalizeYear(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+
+  if (/^passout$/i.test(trimmed)) return PASSOUT;
+
+  // Leading ordinal is the only meaningful part; " Year" is decoration.
+  const match = /^([1-5])(?:st|nd|rd|th)?\b/i.exec(trimmed);
+  if (match) return LABELS[Number(match[1]) - 1]!;
+
+  return null;
+}
+
+/**
+ * The academic year turns over in July, not on 1 January — so a 2022 intake is
+ * in their 4th year until July 2026, not from January. `ACADEMIC_YEAR_START_MONTH`
+ * moves that boundary without a code change.
+ */
+export function currentAcademicYear(now: Date = new Date()): number {
+  const startMonth = getEnv().ACADEMIC_YEAR_START_MONTH;
+  return now.getMonth() + 1 >= startMonth ? now.getFullYear() : now.getFullYear() - 1;
+}
+
+/**
+ * `22052001` -> "4th" (as of the 2025-26 session). Returns `null` when the roll
+ * number is not in the expected shape, so callers can leave the field alone
+ * rather than storing a wrong guess.
+ *
+ * A **fallback only** — see the note at the top. It cannot know about lateral
+ * entry, so it must never override a year the user selected.
+ */
+export function yearFromRollNumber(
+  rollNumber: string | null | undefined,
+  now: Date = new Date(),
+): string | null {
+  if (!rollNumber) return null;
+
+  const digits = String(rollNumber).trim();
+  if (!/^\d{2}/.test(digits)) return null;
+
+  const startYear = Number.parseInt(`20${digits.substring(0, 2)}`, 10);
+  if (!Number.isFinite(startYear)) return null;
+
+  const yearOfStudy = currentAcademicYear(now) - startYear + 1;
+  // Anything past the 5th year, or a roll number from the future, is not a
+  // current student.
+  if (yearOfStudy < 1 || yearOfStudy > LABELS.length) return PASSOUT;
+
+  return LABELS[yearOfStudy - 1]!;
+}
+
+/** School, from the two digits after the intake year. */
+export function schoolFromRollNumber(
+  rollNumber: string | null | undefined,
+): string | null {
+  if (!rollNumber) return null;
+  return String(rollNumber).substring(2, 4) === "05"
+    ? "Computer Science and Engineering"
+    : null;
+}
diff --git a/lib/auth/permissions.ts b/lib/auth/permissions.ts
new file mode 100644
index 0000000..da7f91e
--- /dev/null
+++ b/lib/auth/permissions.ts
@@ -0,0 +1,45 @@
+import "server-only";
+
+import type { SafeUser } from "@/lib/auth/access";
+
+/**
+ * Who may do what, declared once.
+ *
+ * Role lists used to be written out inside the route that needed them, so
+ * adding a role meant hunting down every endpoint that mentioned it. A
+ * permission is named for the capability, not the screen, so the same set can
+ * back several routes.
+ *
+ * ADMIN is not listed in each set — `can()` grants it everything, matching the
+ * Express `checkAccess`, where ADMIN always passed.
+ */
+export const PERMISSIONS = {
+  /** Read a form's registration analytics (EventStats). */
+  FORM_ANALYTICS_VIEW: new Set<string>([
+    "PRESIDENT",
+    "VICEPRESIDENT",
+    "DIRECTOR_CREATIVE",
+    "DIRECTOR_TECHNICAL",
+    "DIRECTOR_MARKETING",
+    "DIRECTOR_OPERATIONS",
+    // Not a member of the AccessTypes enum, so it can never match. Carried over
+    // from the Express controller, where it was equally dead; kept so the list
+    // stays a faithful copy rather than a silent narrowing.
+    "DIRECTOR_SPONSORSHIP",
+  ]),
+} satisfies Record<string, ReadonlySet<string>>;
+
+export type Permission = keyof typeof PERMISSIONS;
+
+/**
+ * `user.access` is this project's role field — the Express `user.role` in the
+ * review comment does not exist on this schema.
+ */
+export function can(
+  user: Pick<SafeUser, "access"> | null | undefined,
+  permission: Permission,
+): boolean {
+  if (!user) return false;
+  if (user.access === "ADMIN") return true;
+  return PERMISSIONS[permission].has(user.access);
+}
diff --git a/lib/config/images.ts b/lib/config/images.ts
new file mode 100644
index 0000000..7ccc947
--- /dev/null
+++ b/lib/config/images.ts
@@ -0,0 +1,49 @@
+/**
+ * Every Cloudinary upload dimension, in one place, keyed by folder.
+ *
+ * These used to be literals at each call site, which is how `addForm` and
+ * `editForm` drifted apart: Express declares `QrImageWidth = 400,
+ * QrImageHeight = 150` in both controllers, but `addForm` passed them into
+ * `uploadimage(path, folder, height, width)` in the wrong order. The two routes
+ * uploaded the same kind of image to the same folder at transposed sizes and
+ * nobody noticed, because nothing broke visibly — see the note below on why.
+ *
+ * `uploadImage` reads this table itself and takes no width/height arguments, so
+ * a call site cannot pass the wrong pair, or the right pair the wrong way round.
+ * Adding a folder here is the only way to give it a size.
+ *
+ * ## These are bounds, not target sizes
+ *
+ * The transformation is `crop: "limit"`: Cloudinary scales the image down to fit
+ * *inside* the box, preserving aspect ratio, and never upscales. So a 1000x1000
+ * QR code lands at 150x150 under either `400x150` or `150x400` — the smaller
+ * side governs, which is why the transposed `addForm` produced identical output
+ * for square sources and the bug stayed invisible.
+ *
+ * It matters that this is `limit` and not `fill`: `fill` would crop to the exact
+ * ratio, and a cropped QR code does not scan.
+ */
+export const IMAGE_SIZES = {
+  /** Event cover art on the form/event card. */
+  FormImages: {
+    width: 196.37,
+    height: 350.67,
+  },
+  /** Payment QR shown on the registration form. */
+  QRMediaImages: {
+    width: 400,
+    height: 150,
+  },
+  /** Blog hero image. */
+  BlogImages: {
+    width: 1200,
+    height: 800,
+  },
+  /** Member avatar — square. */
+  ProfileImages: {
+    width: 512,
+    height: 512,
+  },
+} as const satisfies Record<string, { width: number; height: number }>;
+
+export type ImageFolder = keyof typeof IMAGE_SIZES;
diff --git a/lib/email/templates.ts b/lib/email/templates.ts
index 4b71c25..a023876 100644
--- a/lib/email/templates.ts
+++ b/lib/email/templates.ts
@@ -258,3 +258,38 @@ export function contactNotificationEmail(input: {
     }),
   };
 }
+
+/**
+ * Sent to someone a team leader has removed.
+ *
+ * Copy follows emailTemplates/removedMember.html: the point is to make clear the
+ * person is still registered for the event and can join or start another team.
+ */
+export function removedMemberEmail(input: {
+  teamName: string;
+  eventName: string;
+}): string {
+  const body = `
+    <p style="${P}">Hi there,</p>
+    <p style="${P}">
+      You have been removed from the team <strong>${escapeHtml(input.teamName)}</strong>
+      for <strong>${escapeHtml(input.eventName)}</strong>.
+    </p>
+    <p style="${P}">
+      But don't worry — your registration for the event is still active. You can:
+    </p>
+    <p style="${P}">
+      • Browse and join other available teams<br />
+      • Create your own brand new team
+    </p>
+    <p style="${P}">
+      Head over to the Team Management page to explore your options and get back
+      in the action.
+    </p>`;
+
+  return shell({
+    heading: "Team Membership Update",
+    body,
+    preheader: `You have been removed from ${input.teamName}.`,
+  });
+}
diff --git a/lib/env.ts b/lib/env.ts
index 5eea925..cead718 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -38,6 +38,43 @@ const schema = z.object({
   CERT_ORG: z.string().optional(),
 
   NEXT_PUBLIC_SITE_URL: z.string().url().default("https://www.fedkiit.com"),
+
+  // --- Tunables that used to be literals in the code ------------------------
+  // Defaults reproduce the previous hardcoded behaviour exactly, so setting
+  // none of these changes nothing.
+
+  /**
+   * Digits in a one-time password.
+   *
+   * `NEXT_PUBLIC_` because `OtpInput` has to draw exactly this many boxes. One
+   * variable read by both sides makes them impossible to desync — a
+   * server-only setting here would recreate the bug where six digits were
+   * emailed to a screen with four boxes.
+   */
+  NEXT_PUBLIC_OTP_LENGTH: z.coerce.number().int().min(4).max(10).default(4),
+  /** How long an OTP stays valid, in minutes. */
+  OTP_VALIDITY_MINUTES: z.coerce.number().int().min(1).max(120).default(15),
+
+  /**
+   * Extra hosts that may appear in an `Origin` header and still be used to
+   * build an emailed invite link. Comma-separated. The canonical site host is
+   * always trusted and does not need listing; this is for staging and preview
+   * deployments.
+   */
+  TRUSTED_ORIGIN_HOSTS: z.string().optional(),
+
+  /**
+   * Addresses allowed to read form analytics regardless of role.
+   * Comma-separated. Previously the literal `srex@fedkiit.com`.
+   */
+  FORM_ANALYTICS_ALLOWED_EMAILS: z.string().optional(),
+
+  /**
+   * Calendar month the academic year rolls over in, 1-12. July by default:
+   * a student admitted in 2022 is in their 4th year until July 2026, not until
+   * January 2026.
+   */
+  ACADEMIC_YEAR_START_MONTH: z.coerce.number().int().min(1).max(12).default(7),
   DEBUG: z
     .string()
     .optional()
@@ -75,3 +112,12 @@ export function getEnv(): Env {
 export function siteUrl(): string {
   return getEnv().NEXT_PUBLIC_SITE_URL.replace(/\/$/, "");
 }
+
+/** Splits a comma-separated env value, dropping blanks and surrounding space. */
+export function envList(value: string | undefined): string[] {
+  if (!value) return [];
+  return value
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
diff --git a/lib/services/attendance.ts b/lib/services/attendance.ts
index 25a4821..2d33cd4 100644
--- a/lib/services/attendance.ts
+++ b/lib/services/attendance.ts
@@ -1,10 +1,28 @@
 import "server-only";
 
+import { SignJWT, jwtVerify } from "jose";
+
 import { prisma } from "@/lib/db";
 import { ApiError } from "@/lib/api/errors";
+import { getEnv } from "@/lib/env";
 import type { SafeUser } from "@/lib/auth/access";
 import type { EventInfo } from "@/lib/types/event";
 
+/**
+ * QR tokens are signed with the same secret and 20-minute lifetime the Express
+ * controller used (`jwt.sign({ attendanceToken }, JWT_SECRET, { expiresIn: "20m" })`),
+ * so a code minted by either implementation verifies against the other.
+ */
+const secret = () => new TextEncoder().encode(getEnv().JWT_SECRET);
+
+async function signAttendanceToken(attendanceId: string): Promise<string> {
+  return new SignJWT({ attendanceToken: attendanceId })
+    .setProtectedHeader({ alg: "HS256" })
+    .setIssuedAt()
+    .setExpirationTime("20m")
+    .sign(secret());
+}
+
 /**
  * Attendance and registration export.
  *
@@ -36,17 +54,60 @@ export function toCsv(rows: Array<Record<string, unknown>>): string {
   return "" + lines.join("\r\n");
 }
 
-/** The caller's attendance token for an event — encoded into their QR code. */
-export async function getAttendanceCode(formId: string, user: SafeUser) {
+/**
+ * The caller's attendance token for an event — encoded into their QR code.
+ *
+ * Returns a **signed JWT that expires in 20 minutes**, not the record id. That
+ * signature is the security control for the whole flow: it is why the Express
+ * route left its `checkAccess` commented out, and why a scanned code cannot be
+ * forged or replayed a day later. An earlier version of this port handed back
+ * the raw `attendance.id`, which was both unauthenticated and permanent — and
+ * did not match what `QRCodeModal` reads (`response.data.attendanceToken`).
+ */
+export async function getAttendanceCode(
+  formId: string,
+  user: SafeUser,
+  teamCode?: string | null,
+) {
   if (!/^[a-f\d]{24}$/i.test(formId)) throw new ApiError(404, "Form not found");
 
-  const registration = await prisma.formRegistration.findFirst({
-    where: { formId, userId: user.id },
-  });
-  if (!registration) {
-    throw new ApiError(404, "You are not registered for this event");
+  // With a teamCode the original looked the team up directly; without one it
+  // scanned every registration for the form and picked the row containing this
+  // user. Both branches are preserved, including their distinct 404 messages.
+  let registration = null;
+  if (teamCode && teamCode.trim() !== "") {
+    registration = await prisma.formRegistration.findFirst({
+      where: { formId, teamCode },
+    });
+    if (!registration) {
+      throw new ApiError(404, "Form registration not found.");
+    }
+  } else {
+    const all = await prisma.formRegistration.findMany({ where: { formId } });
+    registration =
+      all.find((reg) =>
+        (reg.value as Array<{ user_id?: string }>).some(
+          (v) => v?.user_id === user.id,
+        ),
+      ) ?? null;
+    if (!registration) {
+      throw new ApiError(404, "Form registration not found for the user.");
+    }
   }
 
+  const info =
+    (registration.value as Array<{ user_id?: string }>).find(
+      (v) => v?.user_id === user.id,
+    ) ?? undefined;
+
+  const attendanceData = {
+    formId,
+    userId: user.id,
+    teamName: registration.teamName,
+    teamCode: registration.teamCode,
+    info,
+  };
+
   const record = await prisma.attendance.upsert({
     where: {
       formId_userId_teamCode: {
@@ -55,29 +116,13 @@ export async function getAttendanceCode(formId: string, user: SafeUser) {
         teamCode: registration.teamCode,
       },
     },
-    create: {
-      formId,
-      userId: user.id,
-      teamName: registration.teamName,
-      teamCode: registration.teamCode,
-      isPresent: false,
-      isPaymentVerified: false,
-      info: {
-        name: user.name,
-        email: user.email,
-        rollNumber: user.rollNumber,
-      },
-    },
-    update: {},
+    create: attendanceData as never,
+    update: attendanceData as never,
   });
 
-  return {
-    attendanceId: record.id,
-    token: record.id,
-    teamCode: record.teamCode,
-    teamName: record.teamName,
-    isPresent: record.isPresent,
-  };
+  const token = await signAttendanceToken(record.id);
+
+  return { message: "Validation id generated successfully.", attendanceToken: token };
 }
 
 /**
@@ -86,33 +131,47 @@ export async function getAttendanceCode(formId: string, user: SafeUser) {
  * Requires a club member — the original mounted this with its access check
  * commented out, so any signed-in user could mark anyone present.
  */
-export async function markAttendance(input: { attendanceId: string }) {
-  const id = input.attendanceId?.trim();
-  if (!id || !/^[a-f\d]{24}$/i.test(id)) {
-    throw new ApiError(400, "A valid attendance token is required");
+export async function markAttendance(input: {
+  formId?: string;
+  token?: string;
+}) {
+  const token = input.token?.trim();
+  if (!token) throw new ApiError(400, "Attendance token is required.");
+
+  // The scanned value is the signed QR token, not a record id. Verifying it is
+  // what stops a stale or hand-crafted QR from marking anyone present.
+  let attendanceId: string | undefined;
+  try {
+    const { payload } = await jwtVerify(token, secret(), {
+      algorithms: ["HS256"],
+    });
+    attendanceId = payload.attendanceToken as string | undefined;
+  } catch {
+    throw new ApiError(401, "Invalid or expired QR.");
+  }
+
+  if (!attendanceId) {
+    throw new ApiError(400, "Attendance ID is missing in the token.");
   }
 
-  const record = await prisma.attendance.findUnique({ where: { id } });
-  if (!record) throw new ApiError(404, "Attendance record not found");
+  const record = await prisma.attendance.findUnique({
+    where: { id: attendanceId },
+  });
+  if (!record) throw new ApiError(404, "Attendance record not found.");
 
-  if (record.isPresent) {
-    return {
-      alreadyMarked: true,
-      attendance: record,
-      message: "Attendance was already marked",
-    };
+  // A QR for one event must not check someone in at another.
+  if (record.formId !== input.formId) {
+    throw new ApiError(400, "QR does not belong to the specified form.");
   }
 
+  if (record.isPresent) throw new ApiError(400, "Attendance already marked.");
+
   const updated = await prisma.attendance.update({
-    where: { id },
+    where: { id: attendanceId },
     data: { isPresent: true, markedAt: new Date() },
   });
 
-  return {
-    alreadyMarked: false,
-    attendance: updated,
-    message: "Attendance marked",
-  };
+  return { message: "Attendance marked successfully.", attendance: updated };
 }
 
 /** Flattens a registration's stored submission into spreadsheet columns. */
diff --git a/lib/services/auth.ts b/lib/services/auth.ts
index a232cce..d09877c 100644
--- a/lib/services/auth.ts
+++ b/lib/services/auth.ts
@@ -1,9 +1,7 @@
 import "server-only";
 
-import { OAuth2Client } from "google-auth-library";
-
 import { prisma } from "@/lib/db";
-import { getEnv } from "@/lib/env";
+import { yearFromRollNumber, schoolFromRollNumber } from "@/lib/academic";
 import { ApiError } from "@/lib/api/errors";
 import { toSafeUser, type SafeUser } from "@/lib/auth/access";
 import {
@@ -171,37 +169,81 @@ export async function logout(): Promise<void> {
   await clearSessionCookie();
 }
 
+type GoogleUserInfo = {
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  hd?: string;
+};
+
+/**
+ * A KIIT roll number encodes the intake year and the school, so a
+ * @kiit.ac.in sign-up can be pre-filled instead of asking for it again.
+ * The derivation itself lives in `lib/academic.ts`, shared with registration
+ * and profile edits so all three agree.
+ */
+function kiitProfileFrom(email: string) {
+  const rollNumber = email.split("@")[0] ?? "";
+
+  return {
+    college: "Kalinga Institute of Industrial Technology",
+    rollNumber,
+    year: yearFromRollNumber(rollNumber),
+    school: schoolFromRollNumber(rollNumber),
+  };
+}
+
 /**
  * Google sign-in.
  *
- * Verifies the ID token against Google's certs and the configured client id —
- * the token is attacker-controlled input, so decoding it without verification
- * would let anyone sign in as anyone.
+ * Takes the **access token** that `useGoogleLogin`'s implicit flow hands the
+ * browser, and exchanges it at Google's UserInfo endpoint — which is what the
+ * Express controller does, and what `GoogleLogin.jsx` / `GoogleSignup.jsx` have
+ * always posted as `access_token`.
+ *
+ * An earlier version of this port expected an ID token and called
+ * `OAuth2Client.verifyIdToken`. Nothing ever sends one: the components use the
+ * implicit flow, whose response carries an opaque access token, so sign-in
+ * failed for everyone. Verifying it locally is not an option either — an access
+ * token is not a JWT and carries no claims to verify. Handing it back to Google
+ * is what establishes who it belongs to.
  */
-let oauthClient: OAuth2Client | null = null;
-
-export async function googleAuth(credential: string): Promise<{
+export async function googleAuth(accessToken: string): Promise<{
   user: SafeUser;
   token: string;
   isNewUser: boolean;
   needsProfile: boolean;
 }> {
-  const clientId = getEnv().GOOGLE_CLIENT_ID;
-  if (!clientId) {
-    throw new ApiError(503, "Google sign-in is not configured");
-  }
-
-  oauthClient ??= new OAuth2Client(clientId);
-
-  let payload;
+  let payload: GoogleUserInfo;
   try {
-    const ticket = await oauthClient.verifyIdToken({
-      idToken: credential,
-      audience: clientId,
-    });
-    payload = ticket.getPayload();
-  } catch {
-    throw new ApiError(401, "Could not verify your Google sign-in");
+    // Sent as a Bearer header rather than the `?access_token=` query string the
+    // original used. Same endpoint and same response, but a credential in a URL
+    // ends up in proxy and server logs.
+    const response = await fetch(
+      "https://www.googleapis.com/oauth2/v3/userinfo",
+      {
+        headers: { Authorization: `Bearer ${accessToken}` },
+        cache: "no-store",
+      },
+    );
+
+    if (!response.ok) {
+      // 401 from Google means the token is bad or expired — the caller's
+      // problem, not a server fault, so it must not surface as a 500.
+      throw new ApiError(
+        response.status === 401 || response.status === 403 ? 401 : 502,
+        "Could not verify your Google sign-in",
+      );
+    }
+
+    payload = (await response.json()) as GoogleUserInfo;
+  } catch (error) {
+    if (error instanceof ApiError) throw error;
+    // fetch only rejects on a transport failure.
+    throw new ApiError(503, "No response from Google");
   }
 
   if (!payload?.email) {
@@ -234,17 +276,29 @@ export async function googleAuth(credential: string): Promise<{
     };
   }
 
+  // Built from the given/family parts first, exactly as the controller does,
+  // falling back to the display name when Google sends neither.
+  const composed = [payload.given_name, payload.family_name]
+    .filter(Boolean)
+    .join(" ");
+  const name = composed || payload.name || email.split("@")[0];
+
+  // `hd` is the Google Workspace domain, so this only fires for a real
+  // @kiit.ac.in account, not for anyone who types the address in.
+  const kiit = payload.hd === "kiit.ac.in" ? kiitProfileFrom(email) : null;
+
   // Google-only accounts have no password. Store an unusable placeholder rather
   // than an empty string so `bcrypt.compare` can never succeed against it.
   const created = await prisma.user.create({
     data: {
       email,
-      name: payload.name ?? email.split("@")[0],
+      name,
       img: payload.picture ?? null,
       password: `google-oauth:${crypto.randomUUID()}`,
       access: "USER",
       editProfileCount: 5,
       regForm: [],
+      ...(kiit ?? {}),
     },
   });
 
diff --git a/lib/services/otp.ts b/lib/services/otp.ts
index 8b29350..e9c6684 100644
--- a/lib/services/otp.ts
+++ b/lib/services/otp.ts
@@ -7,6 +7,7 @@ import { prisma } from "@/lib/db";
 import { ApiError } from "@/lib/api/errors";
 import { sendMail } from "@/lib/email/mailer";
 import { otpEmail } from "@/lib/email/templates";
+import { getEnv } from "@/lib/env";
 
 /**
  * One-time passcodes for email verification and password reset.
@@ -20,17 +21,34 @@ import { otpEmail } from "@/lib/email/templates";
  *  - Expiry is enforced purely by reading `createdAt + age`. The old code also
  *    scheduled a `setTimeout` to delete the row, which never fires reliably on a
  *    serverless host and silently leaked rows.
- *  - Codes are 6 digits rather than 4. A 4-digit numeric code is 10,000
- *    possibilities, which is brute-forceable against an endpoint with no
- *    attempt limit.
+ *
+ * Length stays at 4, matching `generateOtp(4, false, false, false)` in the
+ * original. It was briefly raised to 6 on the grounds that 10,000 combinations
+ * are brute-forceable — true of the Express backend, which had no throttling at
+ * all, but not of this one. `RATE_LIMITS.passwordReset` allows 6 attempts per
+ * 15 minutes and a code expires after 15, so an attacker gets at most 6 guesses
+ * out of 10,000 before the code they are hunting no longer exists. The extra
+ * digits bought very little and cost a great deal: every OTP screen in the app
+ * renders exactly four boxes, so a 6-digit code could not be typed in at all.
+ *
+ * (One caveat on that reasoning: the limiter is in-process, so a horizontally
+ * scaled deploy multiplies the effective limit by the instance count. Moving it
+ * to a shared store is the follow-up noted in `lib/api/rate-limit.ts`.)
  */
 
-const DEFAULT_VALIDITY_MINUTES = 15;
-const OTP_LENGTH = 6;
+/**
+ * Both of these are `OTP_VALIDITY_MINUTES` / `OTP_LENGTH` in the environment,
+ * defaulting to the values the Express backend used (15 minutes, 4 digits).
+ * Read per call rather than at module load so a deployment can change them
+ * without a rebuild — and so `OTPInput` stays in step, since the number of
+ * boxes it renders has to match the number of digits sent.
+ */
+const validityMinutes = () => getEnv().OTP_VALIDITY_MINUTES;
 
 function generateCode(): string {
+  const length = getEnv().NEXT_PUBLIC_OTP_LENGTH;
   let code = "";
-  for (let i = 0; i < OTP_LENGTH; i++) code += randomInt(0, 10).toString();
+  for (let i = 0; i < length; i++) code += randomInt(0, 10).toString();
   return code;
 }
 
@@ -64,7 +82,7 @@ export async function issueOtp(input: {
   allowRetry?: boolean;
 }): Promise<{ delivered: boolean }> {
   const email = input.email.trim().toLowerCase();
-  const validity = input.validityMinutes ?? DEFAULT_VALIDITY_MINUTES;
+  const validity = input.validityMinutes ?? validityMinutes();
   const allowRetry = input.allowRetry ?? true;
 
   const existing = await prisma.otp.findUnique({
diff --git a/lib/services/team-invites.ts b/lib/services/team-invites.ts
index 41da65b..a625772 100644
--- a/lib/services/team-invites.ts
+++ b/lib/services/team-invites.ts
@@ -6,7 +6,7 @@ import { prisma } from "@/lib/db";
 import { ApiError } from "@/lib/api/errors";
 import type { SafeUser } from "@/lib/auth/access";
 import { sendMail } from "@/lib/email/mailer";
-import { siteUrl } from "@/lib/env";
+import { envList, getEnv, siteUrl } from "@/lib/env";
 import type { EventInfo } from "@/lib/types/event";
 import { UNAFFILIATED } from "@/lib/services/teams";
 
@@ -49,16 +49,57 @@ function assertOpen(info: EventInfo) {
   }
 }
 
+/**
+ * Is this a request origin we are willing to put inside a link?
+ *
+ * `Origin` and `Host` are set by the caller, and the URLs built from them go
+ * into **email** — the team invitation, and the accept/reject buttons sent to a
+ * team leader. Reflecting them unchecked lets anyone who can create a team have
+ * FED KIIT send a message, from its own address, containing a link to a domain
+ * they chose. The Express controller did exactly that
+ * (`req.headers.origin || process.env.FRONTEND_URL || "https://fedkiit.com"`);
+ * this is the one place the port deliberately does not follow it.
+ *
+ * Localhost stays allowed so a developer copying an invite link gets a link
+ * that works on their machine.
+ */
+function trustedHosts(): Set<string> {
+  return new Set([
+    // The canonical site is always trusted and never needs listing.
+    new URL(siteUrl()).host,
+    "localhost",
+    "127.0.0.1",
+    // Staging, preview deployments and any future domain, added in the
+    // environment rather than in this file.
+    ...envList(getEnv().TRUSTED_ORIGIN_HOSTS),
+  ]);
+}
+
+function isTrustedOrigin(candidate: string): boolean {
+  try {
+    const { host, hostname } = new URL(candidate);
+    const trusted = trustedHosts();
+    // `host` carries the port, `hostname` does not — checking both means an
+    // entry can pin a port ("localhost:3111") or allow any ("localhost").
+    return trusted.has(host) || trusted.has(hostname);
+  } catch {
+    return false;
+  }
+}
+
 /** Origin of the current request, falling back to the configured site URL. */
 async function originUrl(): Promise<string> {
   try {
     const h = await headers();
+
     const origin = h.get("origin");
-    if (origin) return origin.replace(/\/$/, "");
+    if (origin && isTrustedOrigin(origin)) return origin.replace(/\/$/, "");
+
     const host = h.get("host");
     if (host) {
       const proto = h.get("x-forwarded-proto") ?? "https";
-      return `${proto}://${host}`;
+      const candidate = `${proto}://${host}`;
+      if (isTrustedOrigin(candidate)) return candidate;
     }
   } catch {
     // headers() is unavailable outside a request scope.
@@ -164,27 +205,42 @@ function escapeHtml(value: string): string {
 }
 
 /** POST /api/form/sendJoinRequest — asks a team's leader for admission. */
+/**
+ * Identifies the target team by the **registration row id**, not a team code —
+ * `teamRegistrationId` is what `searchTeams` hands the UI and what
+ * `TeamlessState.jsx` posts back. This took a `teamCode` at first, which the UI
+ * never sends, so every join request failed with "Team code is required".
+ */
 export async function sendJoinRequest(input: {
   user: SafeUser;
   formId: string;
-  teamCode: string;
+  teamRegistrationId: string;
 }) {
-  const code = input.teamCode.trim();
-  if (!code) throw new ApiError(400, "Team code is required");
+  const targetId = input.teamRegistrationId.trim();
+  if (!targetId) {
+    throw new ApiError(400, "Form ID and team registration ID are required");
+  }
 
   const mine = await prisma.formRegistration.findFirst({
     where: { formId: input.formId, userId: input.user.id },
   });
   if (!mine) throw new ApiError(400, "You are not registered for this event");
   if (mine.teamName !== UNAFFILIATED) {
-    throw new ApiError(400, "You are already in a team");
+    throw new ApiError(400, "You are already on a team.");
   }
 
-  const team = await prisma.formRegistration.findFirst({
-    where: { formId: input.formId, teamCode: code },
+  const team = await prisma.formRegistration.findUnique({
+    where: { id: targetId },
     include: { form: { select: { info: true } } },
   });
-  if (!team) throw new ApiError(404, "Invalid team code");
+  if (!team) throw new ApiError(404, "Team not found");
+  // A row id is global, so the form has to be checked explicitly.
+  if (team.formId !== input.formId) {
+    throw new ApiError(400, "Team does not belong to this form");
+  }
+  if (team.teamName === UNAFFILIATED) {
+    throw new ApiError(400, "Cannot request to join a teamless registration");
+  }
 
   const info = (team.form.info ?? {}) as EventInfo;
   assertOpen(info);
@@ -219,6 +275,8 @@ export async function sendJoinRequest(input: {
       requesterName: input.user.name ?? input.user.email,
       teamRegistrationId: team.id,
       teamName: team.teamName,
+      // Pinned so acceptance can tell a rename from a disband-and-recreate.
+      teamCode: team.teamCode,
       leaderEmail: leader?.email ?? "",
       status: "PENDING",
       seenByRequester: false,
@@ -281,6 +339,12 @@ export async function checkJoinRequestUpdates(formId: string, user: SafeUser) {
     orderBy: { respondedAt: "desc" },
   });
 
+  // How many of this user's requests for the event are still outstanding —
+  // counted before the updates below are marked seen, as in the original.
+  const pendingCount = await prisma.teamJoinRequest.count({
+    where: { formId, requesterEmail: user.email, status: "PENDING" },
+  });
+
   if (updates.length > 0) {
     await prisma.teamJoinRequest.updateMany({
       where: { id: { in: updates.map((u) => u.id) } },
@@ -288,7 +352,7 @@ export async function checkJoinRequestUpdates(formId: string, user: SafeUser) {
     });
   }
 
-  return { updates };
+  return { updates, pendingCount };
 }
 
 /** GET /api/form/allJoinRequestUpdates — unseen outcomes across every event. */
@@ -362,55 +426,107 @@ export async function respondJoinRequest(input: {
     return { status: "REJECTED", message: "Request declined." };
   }
 
-  // Accept: move the requester onto the team, re-checking capacity first.
+  // Accept. Same merge-and-delete shape as `joinTeam`: `formRegistration` is one
+  // row per *team*, under `@@unique([formId, teamCode])`. An earlier version
+  // stamped the team's code onto the requester's own row, which collides with
+  // the team row on that constraint — accepting always failed with a P2002 and
+  // the leader saw only the generic error page.
+
+  // The requester may have joined elsewhere between asking and the leader
+  // clicking; that makes this request moot rather than an error.
+  const userRegistration = await prisma.formRegistration.findFirst({
+    where: {
+      formId: request.formId,
+      regTeamMemEmails: { has: request.requesterEmail },
+    },
+  });
+
+  if (!userRegistration || userRegistration.teamName !== UNAFFILIATED) {
+    await prisma.teamJoinRequest.update({
+      where: { id: request.id },
+      data: { status: "AUTO_EXPIRED", respondedAt: new Date() },
+    });
+    return {
+      status: "AUTO_EXPIRED",
+      message: "That person has already joined another team.",
+    };
+  }
+
   const team = await prisma.formRegistration.findUnique({
     where: { id: request.teamRegistrationId },
     include: { form: { select: { info: true } } },
   });
   if (!team) throw new ApiError(404, "That team no longer exists");
 
-  const info = (team.form.info ?? {}) as EventInfo;
-  const max = Number.parseInt(String(info.maxTeamSize ?? ""), 10);
+  // Renaming a team and disbanding one to start another are different things,
+  // and `teamRegistrationId` cannot tell them apart — the registration row is
+  // reused, so its id survives both. Without this check, a leader who disbanded
+  // "ABC" and created "BCD" would find the old request still live, and the
+  // requester would land in a team they never asked to join.
+  //
+  // The code is the discriminator: a rename leaves it alone, while disbanding
+  // resets it to a SOLO- code and the next createTeam mints a fresh one. So a
+  // pending request survives a rename and dies with a disband, which is the
+  // intended behaviour in both directions.
+  //
+  // A request without a pinned code predates this field and cannot be verified;
+  // there were no pending ones when it shipped, so treating that as stale costs
+  // nothing and fails closed.
+  if (request.teamCode !== team.teamCode) {
+    await prisma.teamJoinRequest.update({
+      where: { id: request.id },
+      data: { status: "AUTO_EXPIRED", respondedAt: new Date() },
+    });
+    return {
+      status: "AUTO_EXPIRED",
+      message:
+        "That team was disbanded after this request was sent, so it can no longer be accepted. Ask them to request again.",
+    };
+  }
 
-  const requester = await prisma.user.findUnique({
-    where: { email: request.requesterEmail },
-    select: { id: true },
-  });
-  if (!requester) throw new ApiError(404, "That user no longer exists");
+  const info = (team.form.info ?? {}) as EventInfo;
+  const max = Number.parseInt(String(info.maxTeamSize ?? ""), 10) || 1;
 
-  await prisma.$transaction(async (tx) => {
-    const members = await tx.formRegistration.findMany({
-      where: { formId: request.formId, teamCode: team.teamCode },
+  if (team.teamSize >= max) {
+    await prisma.teamJoinRequest.update({
+      where: { id: request.id },
+      data: { status: "AUTO_EXPIRED", respondedAt: new Date() },
     });
+    return { status: "TEAM_FULL", message: "This team is now full." };
+  }
 
-    if (Number.isFinite(max) && max > 0 && members.length >= max) {
-      throw new ApiError(400, "This team is now full");
-    }
-
-    const emails = [
-      ...new Set([
-        ...members.flatMap((m) => m.regTeamMemEmails),
-        request.requesterEmail,
-      ]),
-    ];
+  const userValue = userRegistration.value?.[0] ?? null;
 
-    await tx.formRegistration.updateMany({
-      where: { formId: request.formId, userId: requester.id },
+  await prisma.$transaction(async (tx) => {
+    await tx.formRegistration.update({
+      where: { id: team.id },
       data: {
-        teamCode: team.teamCode,
-        teamName: team.teamName,
-        regTeamMemEmails: emails,
+        regTeamMemEmails: { push: request.requesterEmail },
+        teamSize: { increment: 1 },
+        ...(userValue ? { value: { push: userValue } } : {}),
       },
     });
 
-    await tx.formRegistration.updateMany({
-      where: { formId: request.formId, teamCode: team.teamCode },
-      data: { regTeamMemEmails: emails, teamSize: emails.length },
-    });
+    await tx.formRegistration.delete({ where: { id: userRegistration.id } });
 
     await tx.teamJoinRequest.update({
       where: { id: request.id },
-      data: { status: "ACCEPTED", respondedAt: new Date(), seenByRequester: false },
+      data: {
+        status: "ACCEPTED",
+        respondedAt: new Date(),
+        seenByRequester: false,
+      },
+    });
+
+    // Any other team they asked to join is moot now.
+    await tx.teamJoinRequest.updateMany({
+      where: {
+        formId: request.formId,
+        requesterEmail: request.requesterEmail,
+        status: "PENDING",
+        id: { not: request.id },
+      },
+      data: { status: "AUTO_EXPIRED", respondedAt: new Date() },
     });
   });
 
diff --git a/lib/services/teams.ts b/lib/services/teams.ts
index b3717b4..ef06818 100644
--- a/lib/services/teams.ts
+++ b/lib/services/teams.ts
@@ -4,6 +4,8 @@ import { randomInt } from "node:crypto";
 
 import { prisma } from "@/lib/db";
 import { ApiError } from "@/lib/api/errors";
+import { sendMail } from "@/lib/email/mailer";
+import { removedMemberEmail } from "@/lib/email/templates";
 import type { SafeUser } from "@/lib/auth/access";
 import type { EventInfo } from "@/lib/types/event";
 
@@ -20,9 +22,18 @@ import type { EventInfo } from "@/lib/types/event";
 
 export const UNAFFILIATED = "UNAFFILIATED";
 
-function newTeamCode(name: string): string {
-  const slug = name.replace(/[^A-Za-z0-9]/g, "").toUpperCase().slice(0, 8);
-  return `${slug || "TEAM"}-${randomInt(1000, 10000)}`;
+/**
+ * `<2-letter event code>-<3-digit team index>-<4 digits>`, e.g. `AR-003-8793`.
+ *
+ * Derived from the *event*, not the team name. An earlier version of this port
+ * built the code from a slug of the team name (`CLAUDETE-7130`), which every
+ * code already in the database contradicts — teams share their code by hand and
+ * a second shape makes a valid code look fake.
+ */
+function newTeamCode(eventTitle: string, teamCount: number): string {
+  const eventCode = (eventTitle || "EV").slice(0, 2).toUpperCase();
+  const index = String(teamCount).padStart(3, "0");
+  return `${eventCode}-${index}-${randomInt(1000, 10000)}`;
 }
 
 async function loadRegistration(formId: string, userId: string) {
@@ -38,6 +49,53 @@ async function loadRegistration(formId: string, userId: string) {
   return registration;
 }
 
+/**
+ * Finds the row the caller *belongs to*, which is not the same as the row they
+ * own: `userId` on a team registration is the leader's, so looking a member up
+ * by ownership finds nothing and locks them out of their own team.
+ */
+async function loadMembership(
+  formId: string,
+  email: string,
+  opts?: { notFound?: string },
+) {
+  const notFound =
+    opts?.notFound ?? "No team registration found for this user";
+  if (!/^[a-f\d]{24}$/i.test(formId)) {
+    throw new ApiError(404, notFound);
+  }
+  const registration = await prisma.formRegistration.findFirst({
+    where: { formId, regTeamMemEmails: { has: email } },
+    include: { form: { select: { info: true } } },
+  });
+  if (!registration) {
+    throw new ApiError(404, notFound);
+  }
+  return registration;
+}
+
+/**
+ * The event's flags are stored as the *strings* "true"/"false", and Express
+ * compares them as such. Matching that exactly matters: a loose truthiness check
+ * would treat "false" as closed and block every team change.
+ */
+function assertRegistrationOpen(info: EventInfo): void {
+  if (
+    String(info.isRegistrationClosed) === "true" ||
+    String(info.isEventPast) === "true"
+  ) {
+    throw new ApiError(
+      400,
+      "Registration is closed. Team changes are no longer allowed.",
+    );
+  }
+}
+
+/** `SOLO-<userId>-<4 digits>`, the shape the original generated. */
+function soloTeamCode(userId: string): string {
+  return `SOLO-${userId}-${randomInt(1000, 10000)}`;
+}
+
 async function teamLimits(formId: string) {
   const form = await prisma.form.findUnique({
     where: { id: formId },
@@ -50,6 +108,11 @@ async function teamLimits(formId: string) {
     max: Number.isFinite(max) && max > 0 ? max : 1,
     min: Number.isFinite(min) && min > 0 ? min : 1,
     title: info.eventTitle ?? "the event",
+    // Unsubstituted, for the team code. `title` carries a prose fallback that
+    // would make the code read "TH-…".
+    rawTitle: info.eventTitle ?? "",
+    isRegistrationClosed: info.isRegistrationClosed,
+    isEventPast: info.isEventPast,
   };
 }
 
@@ -68,18 +131,22 @@ export async function createTeam(input: {
     throw new ApiError(400, "You are already in a team");
   }
 
-  const clash = await prisma.formRegistration.findFirst({
-    where: { formId: input.formId, teamName: name },
-    select: { id: true },
+  // Checked against the tracker's `regTeamNames`, which is what the controller
+  // consults and what `leaveTeam` maintains. An earlier version queried
+  // `formRegistration` by `teamName` instead, so a name freed by the last member
+  // leaving stayed unusable.
+  const tracker = await prisma.registrationTracker.findUnique({
+    where: { formId: input.formId },
   });
-  if (clash) {
+  if (tracker?.regTeamNames.includes(name)) {
     throw new ApiError(
       400,
-      "! This team name already taken !\n Please choose a different one.",
+      "This team name is already taken. Please choose a different one.",
     );
   }
 
-  const teamCode = newTeamCode(name);
+  const { rawTitle } = await teamLimits(input.formId);
+  const teamCode = newTeamCode(rawTitle, tracker?.regTeamNames.length ?? 0);
 
   await prisma.$transaction([
     prisma.formRegistration.update({
@@ -95,7 +162,19 @@ export async function createTeam(input: {
   return { teamName: name, teamCode };
 }
 
-/** Joins an existing team by its code. */
+/**
+ * Joins an existing team by its code — the invite-link path and the
+ * accepted-request path both land here.
+ *
+ * There is **one row per team**, not one per member: `formRegistration` carries
+ * `@@unique([formId, teamCode])`, and the row holds the whole roster in
+ * `regTeamMemEmails`. An earlier version of this port stamped the team's code
+ * onto the joiner's own row, which collides with the leader's row on that
+ * constraint — every join failed with a P2002 and surfaced as a 500.
+ *
+ * So joining *merges*: the joiner's email and their `value` entry move onto the
+ * team row and their solo row is deleted.
+ */
 export async function joinTeam(input: {
   user: SafeUser;
   formId: string;
@@ -104,82 +183,161 @@ export async function joinTeam(input: {
   const code = input.teamCode.trim();
   if (!code) throw new ApiError(400, "Team code is required");
 
-  const registration = await loadRegistration(input.formId, input.user.id);
+  const registration = await loadMembership(input.formId, input.user.email, {
+    notFound: "You are not registered for this event. Please register first.",
+  });
+
   if (registration.teamName !== UNAFFILIATED) {
-    throw new ApiError(400, "You are already in a team");
+    throw new ApiError(
+      400,
+      "You are already on a team. Leave your current team first.",
+    );
   }
 
-  const { max } = await teamLimits(input.formId);
+  const targetTeam = await prisma.formRegistration.findUnique({
+    where: { formId_teamCode: { formId: input.formId, teamCode: code } },
+    include: { form: { select: { info: true } } },
+  });
 
-  return prisma.$transaction(async (tx) => {
-    const members = await tx.formRegistration.findMany({
-      where: { formId: input.formId, teamCode: code },
-    });
+  if (!targetTeam) {
+    throw new ApiError(404, "Team not found. The team code may be invalid.");
+  }
+  if (targetTeam.teamName === UNAFFILIATED) {
+    throw new ApiError(400, "Cannot join a teamless registration");
+  }
 
-    if (members.length === 0) throw new ApiError(404, "Invalid team code");
-    if (members.length >= max) throw new ApiError(400, "This team is full");
+  const info = (targetTeam.form?.info ?? {}) as EventInfo;
+  assertRegistrationOpen(info);
 
-    const teamName = members[0]!.teamName;
-    const emails = [
-      ...new Set([
-        ...members.flatMap((m) => m.regTeamMemEmails),
-        input.user.email,
-      ]),
-    ];
+  const maxSize = Number.parseInt(String(info.maxTeamSize ?? ""), 10) || 1;
+  if (targetTeam.teamSize >= maxSize) {
+    throw new ApiError(
+      400,
+      `Team is full (${targetTeam.teamSize}/${maxSize} members).`,
+    );
+  }
 
+  // The registrant's own form answers, carried over so the team row keeps a
+  // `value` entry per member.
+  const userValue = registration.value?.[0] ?? null;
+
+  await prisma.$transaction(async (tx) => {
     await tx.formRegistration.update({
-      where: { id: registration.id },
-      data: { teamCode: code, teamName, regTeamMemEmails: emails },
+      where: { id: targetTeam.id },
+      data: {
+        regTeamMemEmails: { push: input.user.email },
+        teamSize: { increment: 1 },
+        ...(userValue ? { value: { push: userValue } } : {}),
+      },
     });
 
-    // Keep every row in the team consistent about its membership list.
-    await tx.formRegistration.updateMany({
-      where: { formId: input.formId, teamCode: code },
-      data: { regTeamMemEmails: emails, teamSize: emails.length },
-    });
+    await tx.formRegistration.delete({ where: { id: registration.id } });
 
-    return { teamName, teamCode: code, teamSize: emails.length };
+    // Any other team they had asked to join is moot now.
+    await tx.teamJoinRequest.updateMany({
+      where: {
+        formId: input.formId,
+        requesterEmail: input.user.email,
+        status: "PENDING",
+      },
+      data: { status: "AUTO_EXPIRED", respondedAt: new Date() },
+    });
   });
+
+  const relatedEvent = info.relatedEvent;
+  return {
+    teamName: targetTeam.teamName,
+    teamCode: targetTeam.teamCode,
+    // An event created from another one carries `relatedEvent`; the string
+    // "null" is a real value in this data, not an absent one.
+    eventId:
+      relatedEvent && relatedEvent !== "null" ? relatedEvent : input.formId,
+  };
 }
 
 /** Leaves the current team, returning to an unaffiliated solo registration. */
 export async function leaveTeam(input: { user: SafeUser; formId: string }) {
-  const registration = await loadRegistration(input.formId, input.user.id);
+  const { email, id: userId } = input.user;
+  const teamRegistration = await loadMembership(input.formId, email);
 
-  if (registration.teamName === UNAFFILIATED) {
-    throw new ApiError(400, "You are not in a team");
+  if (teamRegistration.teamName === UNAFFILIATED) {
+    throw new ApiError(400, "You are not currently on a team.");
   }
 
-  const code = registration.teamCode;
+  const info = (teamRegistration.form.info ?? {}) as EventInfo;
+  assertRegistrationOpen(info);
 
-  return prisma.$transaction(async (tx) => {
-    const remaining = await tx.formRegistration.findMany({
-      where: { formId: input.formId, teamCode: code, id: { not: registration.id } },
-    });
+  const isLeader = teamRegistration.userId === userId;
 
-    const emails = remaining.flatMap((m) => m.regTeamMemEmails)
-      .filter((e) => e !== input.user.email);
-    const unique = [...new Set(emails)];
+  // The leader cannot walk away from a populated team and orphan it; they have
+  // to remove everyone first, at which point leaving dissolves the team.
+  if (isLeader && teamRegistration.teamSize > 1) {
+    throw new ApiError(
+      400,
+      "You must remove all team members before leaving. As the leader, you cannot leave while other members are on the team.",
+    );
+  }
 
-    await tx.formRegistration.update({
-      where: { id: registration.id },
-      data: {
-        teamCode: `SOLO-${input.user.id}-${randomInt(1000, 10000)}`,
-        teamName: UNAFFILIATED,
-        regTeamMemEmails: [input.user.email],
-        teamSize: 1,
-      },
-    });
+  const entries = (teamRegistration.value ?? []) as Array<{
+    user_email?: string;
+  }>;
+  const userValue = entries.filter((entry) => entry.user_email === email);
+  const code = soloTeamCode(userId);
+  const oldTeamName = teamRegistration.teamName;
 
-    if (remaining.length > 0) {
-      await tx.formRegistration.updateMany({
-        where: { formId: input.formId, teamCode: code },
-        data: { regTeamMemEmails: unique, teamSize: unique.length },
+  const tracker = await prisma.registrationTracker.findUnique({
+    where: { formId: input.formId },
+  });
+  if (!tracker) throw new ApiError(500, "Registration tracker not found");
+
+  await prisma.$transaction(async (tx) => {
+    if (isLeader && teamRegistration.teamSize === 1) {
+      // Sole member: the existing row becomes their unaffiliated registration,
+      // and the team's name is released for reuse.
+      await tx.formRegistration.update({
+        where: { id: teamRegistration.id },
+        data: { teamName: UNAFFILIATED, teamCode: code },
       });
-    }
 
-    return { left: true };
+      await tx.registrationTracker.update({
+        where: { formId: input.formId },
+        data: {
+          regTeamNames: {
+            set: tracker.regTeamNames.filter((name) => name !== oldTeamName),
+          },
+        },
+      });
+    } else {
+      // A member leaving keeps their answers: they are lifted out of the team
+      // row and carried into a fresh solo registration, so the person stays
+      // registered for the event and can join another team.
+      await tx.formRegistration.update({
+        where: { id: teamRegistration.id },
+        data: {
+          value: { set: entries.filter((e) => e.user_email !== email) },
+          regTeamMemEmails: {
+            set: teamRegistration.regTeamMemEmails.filter((e) => e !== email),
+          },
+          teamSize: { decrement: 1 },
+        },
+      });
+
+      await tx.formRegistration.create({
+        data: {
+          formId: input.formId,
+          userId,
+          teamName: UNAFFILIATED,
+          teamCode: code,
+          teamSize: 1,
+          regTeamMemEmails: [email],
+          value: userValue,
+        },
+      });
+      // The tracker is untouched: the person is still registered.
+    }
   });
+
+  return { action: isLeader ? "dissolved" : "left", oldTeamName };
 }
 
 /** Renames the caller's team. */
@@ -191,113 +349,236 @@ export async function renameTeam(input: {
   const name = input.teamName.trim().toUpperCase();
   if (!name) throw new ApiError(400, "Team name is required");
 
-  const registration = await loadRegistration(input.formId, input.user.id);
+  // `loadMembership`, not `loadRegistration`: the controller looks the team up by
+  // membership and then compares the row's owner to the caller. An earlier
+  // version here loaded the caller's own row and never compared anything, so
+  // *any* member could rename the team.
+  const registration = await loadMembership(input.formId, input.user.email);
+
+  // Deliberate deviation: the controller has no such guard, so a teamless
+  // registrant could rename their own UNAFFILIATED placeholder. That produces a
+  // named "team" carrying a SOLO-<userId>-<n> code and absent from the tracker's
+  // regTeamNames — a row no other code path expects. Creating a team is what
+  // createTeam is for.
   if (registration.teamName === UNAFFILIATED) {
     throw new ApiError(400, "You are not in a team");
   }
 
-  const clash = await prisma.formRegistration.findFirst({
-    where: {
-      formId: input.formId,
-      teamName: name,
-      teamCode: { not: registration.teamCode },
-    },
-    select: { id: true },
+  if (registration.userId !== input.user.id) {
+    throw new ApiError(403, "Only the team leader can rename the team");
+  }
+
+  assertRegistrationOpen((registration.form?.info ?? {}) as EventInfo);
+
+  // Must precede the duplicate check: the team's current name is in
+  // `regTeamNames`, so renaming a team to what it is already called would
+  // otherwise be rejected as taken.
+  if (name === registration.teamName) {
+    return { teamName: name, unchanged: true };
+  }
+
+  const tracker = await prisma.registrationTracker.findUnique({
+    where: { formId: input.formId },
   });
-  if (clash) throw new ApiError(400, "That team name is already taken");
+  if (tracker?.regTeamNames.includes(name)) {
+    throw new ApiError(
+      400,
+      "This team name is already taken. Please choose a different one.",
+    );
+  }
+
+  await prisma.$transaction(async (tx) => {
+    await tx.formRegistration.updateMany({
+      where: { formId: input.formId, teamCode: registration.teamCode },
+      data: { teamName: name },
+    });
 
-  await prisma.formRegistration.updateMany({
-    where: { formId: input.formId, teamCode: registration.teamCode },
-    data: { teamName: name },
+    // Swap the old name for the new one rather than pushing, or the old name
+    // stays reserved forever and the list grows on every rename.
+    if (tracker) {
+      await tx.registrationTracker.update({
+        where: { formId: input.formId },
+        data: {
+          regTeamNames: {
+            set: tracker.regTeamNames.map((n) =>
+              n === registration.teamName ? name : n,
+            ),
+          },
+        },
+      });
+    }
   });
 
-  return { teamName: name };
+  return { teamName: name, unchanged: false };
 }
 
-/** Removes a member from the caller's team. Only the team leader may do this. */
+/**
+ * Removes a member from the caller's team. Only the team leader may do this.
+ *
+ * A team is a *single* `formRegistration` row: it carries every member's email
+ * in `regTeamMemEmails` and every member's form answers in `value`, and its
+ * `userId` is the leader. Removing someone therefore means lifting their entries
+ * out of the team row and giving them their own UNAFFILIATED row, so they stay
+ * registered for the event and can join or create another team.
+ *
+ * An earlier version assumed a row per member sharing a `teamCode` and treated
+ * the earliest row as leader, which does not match the data this app reads.
+ */
 export async function removeTeamMember(input: {
   user: SafeUser;
   formId: string;
-  email: string;
+  memberEmail: string;
 }) {
-  const registration = await loadRegistration(input.formId, input.user.id);
-  const target = input.email.trim().toLowerCase();
+  const { email, id: userId } = input.user;
+  const { memberEmail } = input;
+  const normalizedEmail = memberEmail.trim().toLowerCase();
 
-  if (target === input.user.email) {
-    throw new ApiError(400, "Use leave team to remove yourself");
+  if (!/^[a-f\d]{24}$/i.test(input.formId)) {
+    throw new ApiError(404, "You are not the leader of any team for this form");
   }
 
-  const members = await prisma.formRegistration.findMany({
-    where: { formId: input.formId, teamCode: registration.teamCode },
-    orderBy: { id: "asc" },
+  // Matching on `userId` is the leader check: only their row comes back.
+  const teamRegistration = await prisma.formRegistration.findFirst({
+    where: { formId: input.formId, userId },
+    include: { form: { select: { info: true } } },
   });
+  if (!teamRegistration) {
+    throw new ApiError(404, "You are not the leader of any team for this form");
+  }
 
-  // The leader is whoever created the team — the earliest row on the code.
-  if (members[0]?.userId !== input.user.id) {
-    throw new ApiError(403, "Only the team leader can remove members");
+  const info = (teamRegistration.form.info ?? {}) as EventInfo;
+  assertRegistrationOpen(info);
+
+  if (memberEmail === email) {
+    throw new ApiError(
+      400,
+      "You cannot remove yourself. Use the Leave/Dissolve Team option.",
+    );
   }
 
+  if (!teamRegistration.regTeamMemEmails.includes(memberEmail)) {
+    throw new ApiError(404, "The specified completed user is not in your team.");
+  }
+
+  const entries = (teamRegistration.value ?? []) as Array<{
+    user_email?: string;
+  }>;
+  const userValue = entries.filter((e) => e.user_email === memberEmail);
+
   const targetUser = await prisma.user.findUnique({
-    where: { email: target },
+    where: { email: memberEmail },
     select: { id: true },
   });
-  if (!targetUser) throw new ApiError(404, "That member was not found");
+  if (!targetUser) {
+    throw new ApiError(404, "Target user not found in the system.");
+  }
 
-  const targetReg = members.find((m) => m.userId === targetUser.id);
-  if (!targetReg) throw new ApiError(404, "That member is not in your team");
+  const code = soloTeamCode(targetUser.id);
 
-  const emails = members
-    .flatMap((m) => m.regTeamMemEmails)
-    .filter((e) => e !== target);
-  const unique = [...new Set(emails)];
+  await prisma.$transaction(async (tx) => {
+    await tx.formRegistration.update({
+      where: { id: teamRegistration.id },
+      data: {
+        value: { set: entries.filter((e) => e.user_email !== memberEmail) },
+        regTeamMemEmails: {
+          set: teamRegistration.regTeamMemEmails.filter(
+            (e) => e !== memberEmail,
+          ),
+        },
+        teamSize: { decrement: 1 },
+      },
+    });
 
-  await prisma.$transaction([
-    prisma.formRegistration.update({
-      where: { id: targetReg.id },
+    await tx.formRegistration.create({
       data: {
-        teamCode: `SOLO-${targetUser.id}-${randomInt(1000, 10000)}`,
+        formId: input.formId,
+        userId: targetUser.id,
         teamName: UNAFFILIATED,
-        regTeamMemEmails: [target],
+        teamCode: code,
         teamSize: 1,
+        regTeamMemEmails: [memberEmail],
+        value: userValue,
       },
+    });
+    // The tracker is untouched: the person is still registered for the event.
+  });
+
+  const eventTitle = info.eventTitle || "an event";
+  await sendMail({
+    to: normalizedEmail,
+    subject: `You're removed from "${teamRegistration.teamName}" from ${eventTitle}`,
+    html: removedMemberEmail({
+      teamName: teamRegistration.teamName,
+      eventName: info.eventTitle || "Event",
     }),
-    prisma.formRegistration.updateMany({
-      where: { formId: input.formId, teamCode: registration.teamCode },
-      data: { regTeamMemEmails: unique, teamSize: unique.length },
-    }),
-  ]);
+  });
 
-  return { removed: target };
+  return { memberEmail, normalizedEmail };
 }
 
-/** Teams with room left, for the join picker. */
-export async function searchTeams(formId: string, query: string) {
+/**
+ * Teams with room left, for the join picker.
+ *
+ * Each entry carries `teamRegistrationId` — the row id — because that is what
+ * `TeamlessState.jsx` keys the list on and posts back to `sendJoinRequest`. An
+ * earlier version grouped by `teamCode` and returned `{size, maxSize, isFull}`,
+ * none of which the component reads, so the picker rendered an empty list and
+ * the join button had no id to send.
+ */
+export async function searchTeams(
+  formId: string,
+  query: string,
+  requesterEmail: string,
+) {
   if (!/^[a-f\d]{24}$/i.test(formId)) throw new ApiError(404, "Form not found");
 
-  const { max } = await teamLimits(formId);
+  const form = await prisma.form.findUnique({
+    where: { id: formId },
+    select: { info: true },
+  });
+  if (!form) throw new ApiError(404, "Form not found");
 
-  const rows = await prisma.formRegistration.findMany({
+  const info = (form.info ?? {}) as EventInfo;
+  const maxTeamSize = Number.parseInt(String(info.maxTeamSize ?? ""), 10) || 1;
+
+  // One row per team, so "not full" is a plain comparison on teamSize.
+  const teamRegistrations = await prisma.formRegistration.findMany({
     where: {
       formId,
       teamName: { not: UNAFFILIATED },
-      ...(query ? { teamName: { contains: query, mode: "insensitive" } } : {}),
+      teamSize: { lt: maxTeamSize },
     },
-    select: { teamName: true, teamCode: true, regTeamMemEmails: true },
+    select: { id: true, teamName: true, teamSize: true, userId: true },
   });
 
-  const byCode = new Map<string, { teamName: string; teamCode: string; size: number }>();
-  for (const row of rows) {
-    const entry = byCode.get(row.teamCode);
-    if (entry) entry.size = Math.max(entry.size, row.regTeamMemEmails.length);
-    else
-      byCode.set(row.teamCode, {
-        teamName: row.teamName,
-        teamCode: row.teamCode,
-        size: row.regTeamMemEmails.length,
-      });
-  }
+  const search = query.trim().toLowerCase();
+  const filteredTeams = search
+    ? teamRegistrations.filter((t) => t.teamName.toLowerCase().includes(search))
+    : teamRegistrations;
+
+  const leaders = await prisma.user.findMany({
+    where: { id: { in: [...new Set(filteredTeams.map((t) => t.userId))] } },
+    select: { id: true, name: true },
+  });
+  const leaderMap = new Map(leaders.map((l) => [l.id, l.name]));
 
-  return [...byCode.values()]
-    .map((t) => ({ ...t, maxSize: max, isFull: t.size >= max }))
-    .filter((t) => !t.isFull);
+  // Teams this person has already asked to join, so the UI can show "Requested"
+  // instead of offering the button again.
+  const pendingRequests = await prisma.teamJoinRequest.findMany({
+    where: { formId, requesterEmail, status: "PENDING" },
+    select: { teamRegistrationId: true },
+  });
+  const pendingTeamIds = new Set(
+    pendingRequests.map((r) => r.teamRegistrationId),
+  );
+
+  return filteredTeams.map((team) => ({
+    teamRegistrationId: team.id,
+    teamName: team.teamName,
+    teamSize: team.teamSize,
+    maxTeamSize,
+    leaderName: leaderMap.get(team.userId) || "Unknown",
+    spotsRemaining: maxTeamSize - team.teamSize,
+    hasPendingRequest: pendingTeamIds.has(team.id),
+  }));
 }
diff --git a/lib/services/upload.ts b/lib/services/upload.ts
index 1cbce77..9ae09d7 100644
--- a/lib/services/upload.ts
+++ b/lib/services/upload.ts
@@ -3,6 +3,7 @@ import "server-only";
 import { v2 as cloudinary } from "cloudinary";
 
 import { getEnv } from "@/lib/env";
+import { IMAGE_SIZES, type ImageFolder } from "@/lib/config/images";
 
 /**
  * Cloudinary uploads — port of utils/image/uploadImage.js.
@@ -37,16 +38,24 @@ function configure(): boolean {
 export type UploadResult = { secure_url: string; public_id: string } | null;
 
 /**
- * Uploads a file to a Cloudinary folder, optionally resizing.
+ * Uploads a file to a Cloudinary folder, resized to the bounds that folder
+ * declares in `lib/config/images.ts`.
+ *
+ * Dimensions are deliberately *not* parameters. They used to be, and the two
+ * form routes passed the same pair in opposite orders — `addForm` uploading QR
+ * media at 150x400 while `editForm` used 400x150. Looking them up from the
+ * folder removes the argument entirely, so there is nothing left to get
+ * backwards, and `ImageFolder` makes an unknown folder a compile error.
+ *
  * Returns null when Cloudinary is not configured or the upload fails, matching
  * the original's tolerance for a missing image.
  */
 export async function uploadImage(
   file: File,
-  folder: string,
-  width?: number,
-  height?: number,
+  folder: ImageFolder,
 ): Promise<UploadResult> {
+  const { width, height } = IMAGE_SIZES[folder];
+
   if (!configure()) {
     console.error("[upload] Cloudinary is not configured");
     return null;
diff --git a/package-lock.json b/package-lock.json
index f95a11c..133e274 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -7,6 +7,7 @@
     "": {
       "name": "fedkiit",
       "version": "0.1.0",
+      "hasInstallScript": true,
       "dependencies": {
         "@emotion/react": "^11.14.0",
         "@emotion/styled": "^11.14.1",
@@ -2109,7 +2110,7 @@
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/@prisma/config/-/config-6.19.3.tgz",
       "integrity": "sha512-CBPT44BjlQxEt8kiMEauji2WHTDoVBOKl7UlewXmUgBPnr/oPRZC3psci5chJnYmH0ivEIog2OU9PGWoki3DLQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "c12": "3.1.0",
@@ -2122,14 +2123,14 @@
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-6.19.3.tgz",
       "integrity": "sha512-ljkJ+SgpXNktLG0Q/n4JGYCkKf0f8oYLyjImS2I8e2q2WCfdRRtWER062ZV/ixaNP2M2VKlWXVJiGzZaUgbKZw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/engines": {
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-6.19.3.tgz",
       "integrity": "sha512-RSYxtlYFl5pJ8ZePgMv0lZ9IzVCOdTPOegrs2qcbAEFrBI1G33h6wyC9kjQvo0DnYEhEVY0X4LsuFHXLKQk88g==",
-      "dev": true,
+      "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2143,14 +2144,14 @@
       "version": "7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7",
       "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.1.1-3.c2990dca591cba766e3b7ef5d9e8a84796e47ab7.tgz",
       "integrity": "sha512-03bgb1VD5gvuumNf+7fVGBzfpJPjmqV423l/WxsWk2cNQ42JD0/SsFBPhN6z8iAvdHs07/7ei77SKu7aZfq8bA==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@prisma/fetch-engine": {
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-6.19.3.tgz",
       "integrity": "sha512-tKtl/qco9Nt7LU5iKhpultD8O4vMCZcU2CHjNTnRrL1QvSUr5W/GcyFPjNL87GtRrwBc7ubXXD9xy4EvLvt8JA==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "6.19.3",
@@ -2162,7 +2163,7 @@
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-6.19.3.tgz",
       "integrity": "sha512-xFj1VcJ1N3MKooOQAGO0W5tsd0W2QzIvW7DD7c/8H14Zmp4jseeWAITm+w2LLoLrlhoHdPPh0NMZ8mfL6puoHA==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@prisma/debug": "6.19.3"
@@ -2195,7 +2196,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
       "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@swc/helpers": {
@@ -2584,7 +2585,6 @@
       "version": "19.2.17",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
       "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.2"
@@ -3797,7 +3797,7 @@
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/c12/-/c12-3.1.0.tgz",
       "integrity": "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "chokidar": "^4.0.3",
@@ -3980,7 +3980,7 @@
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
       "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "readdirp": "^4.0.1"
@@ -3996,7 +3996,7 @@
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz",
       "integrity": "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "consola": "^3.2.3"
@@ -4094,14 +4094,14 @@
       "version": "0.2.4",
       "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
       "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/consola": {
       "version": "3.4.2",
       "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.2.tgz",
       "integrity": "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": "^14.18.0 || >=16.10.0"
@@ -4301,7 +4301,7 @@
       "version": "7.1.5",
       "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
       "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=16.0.0"
@@ -4347,7 +4347,7 @@
       "version": "6.1.7",
       "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
       "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/delayed-stream": {
@@ -4372,7 +4372,7 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
       "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/detect-element-overflow": {
@@ -4443,7 +4443,7 @@
       "version": "16.6.1",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
       "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -4479,7 +4479,7 @@
       "version": "3.21.0",
       "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.0.tgz",
       "integrity": "sha512-PPN80qRokCd1f015IANNhrwOnLO7GrrMQfk4/lnZRE/8j7UPWrNNjPV0uBrZutI/nHzernbW+J0hdqQysHiSnQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
@@ -4504,7 +4504,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz",
       "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14"
@@ -5170,7 +5170,7 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.1.tgz",
       "integrity": "sha512-9U/jZUgjnSGyntRr6y5Muu1MJcwFl6kPu7k8qLF0IMNfLqvw0NZ4nnVDq0RVoZ0RvCyumib4Ez3KYrVfilrw+g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/extend": {
@@ -5183,7 +5183,7 @@
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
       "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
-      "dev": true,
+      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -5627,7 +5627,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
       "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "citty": "^0.1.6",
@@ -6528,7 +6528,7 @@
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
       "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
@@ -8014,7 +8014,7 @@
       "version": "1.6.7",
       "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
       "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/node-releases": {
@@ -8031,7 +8031,7 @@
       "version": "0.6.9",
       "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.9.tgz",
       "integrity": "sha512-zxlE2yvSWZWmHcNdT3+5zV2lrCogeE9YOklHrR3dFjqutq5wO7GFDYLFDRXLsYnJzwvy/im9fYoxePvS0VTW0w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "citty": "^0.2.2",
@@ -8049,7 +8049,7 @@
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
       "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/object-assign": {
@@ -8178,7 +8178,7 @@
       "version": "2.0.11",
       "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
       "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/optionator": {
@@ -8344,14 +8344,14 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/perfect-debounce": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
       "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/picocolors": {
@@ -8377,7 +8377,7 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
       "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "confbox": "^0.2.4",
@@ -8467,7 +8467,7 @@
       "version": "6.19.3",
       "resolved": "https://registry.npmjs.org/prisma/-/prisma-6.19.3.tgz",
       "integrity": "sha512-++ZJ0ijLrDJF6hNB4t4uxg2br3fC4H9Yc9tcbjr2fcNFP3rh/SBNrAgjhsqBU4Ght8JPrVofG/ZkXfnSfnYsFg==",
-      "dev": true,
+      "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -8533,7 +8533,7 @@
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
       "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
-      "dev": true,
+      "devOptional": true,
       "funding": [
         {
           "type": "individual",
@@ -8580,7 +8580,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz",
       "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "defu": "^6.1.4",
@@ -8990,7 +8990,7 @@
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
       "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">= 14.18.0"
@@ -9928,7 +9928,7 @@
       "version": "1.2.4",
       "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
       "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -10155,7 +10155,7 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
diff --git a/package.json b/package.json
index ec78d72..ea9115c 100644
--- a/package.json
+++ b/package.json
@@ -7,7 +7,11 @@
     "build": "node scripts/with-env.mjs build",
     "start": "node scripts/with-env.mjs start",
     "lint": "eslint",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "audit:nesting": "node scripts/audit-nesting.mjs",
+    "audit:contracts": "node scripts/audit-api-contracts.mjs",
+    "postinstall": "node scripts/ensure-prisma.mjs --optional",
+    "prisma:generate": "node scripts/ensure-prisma.mjs"
   },
   "dependencies": {
     "@emotion/react": "^11.14.0",
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index a402e17..fef3bb8 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -167,6 +167,13 @@ model teamJoinRequest {
   requesterName      String
   teamRegistrationId String    @db.ObjectId
   teamName           String?
+  // The team's code at the moment the request was made. `teamRegistrationId`
+  // alone cannot tell a rename from a disband-and-recreate: the registration row
+  // is reused, so its id survives both. `teamCode` does distinguish them —
+  // renaming leaves it untouched, while dissolving a team resets it to a SOLO-
+  // code and creating the next one mints a fresh code. Optional because rows
+  // written before this field existed do not carry it.
+  teamCode           String?
   leaderEmail        String
   status             String    @default("PENDING")
   seenByRequester    Boolean   @default(false)
diff --git a/scripts/audit-api-contracts.mjs b/scripts/audit-api-contracts.mjs
new file mode 100644
index 0000000000000000000000000000000000000000..a2d5befdff7155b14c3ec4ed4097085c048ab79d
GIT binary patch
literal 3979
zcmaJ^+iu%N5bd+SVoV4PDNCf&r^1dBBn5&L1==EcC{Rj?C~_&$rbw2%tnJDK`VsxY
zeo4>Fk`xsi4Pa!sJ3Bjb=FCOGbb3Zp`k~xcQLX517a1};MO9fFmC#2O#fD;>mW3*e
zCasEuOi2ONDoQA=%RND6N7%2*tT3!C+D2KS%~9LOvN4K2L`9OTnxL|Y^85jdSXEGp
zeW)`{U1%ToS;Ys{)R{I}JfosC6p?wT6vaCg->UkGGJ^|jqox?Qvm`P~vt8;zZJ>K5
zIx`&KlpEHU$*FGYG>VmY80V4JRHn3Pwy;#e`-svgGrP2baq|v=!FNESjb>fzLf!p}
z%Xej+tO<ZcwCh|mj9;R(sT(+1!=`oBOR{UhSq3O;LkGd{eU__F4+Wf5_wZKpnp%sh
zQ<RCiO0{!+yrb?_{8T31WqI<Ys>@hu7C(ziMn8peO$(^Dm)sXyz?SQ|J#cg#2h(XV
z^>6gOL*q~9#f%PTgqX%<k`>!4avGC<@666x&o_0pcRgQMd1hQ^SvZ~#g+|rxyRytx
zRCureifJ80RTiXWy$@89nfJVy9I~Wc)BH6>RrSnym?f*AX14f<9pFlvA~soBkZdwu
z(Bn3B?umug)0m%yr`YyEiyR?#gXLs-2tT*0>9P&BGjhIxp~K<lWpEK-(}A%>SxWA?
zDDkz4K&s!s0@q>l9nb5iNd;)Z()LZH3oKkvcg>;!@uy()H%3HVP`Em(x{LB#XmT^K
zHjX`7ycXZAT^TJF3zFCTToqfhgXbgC`&FZNF7Ej^NI%zMi?2JAuc?K-R*z^1vz4f0
zFuFI05Fv6qr#K%%hoj&Cosfg~W4Bg+q5$y6$|JVe&FF$&&M5SKAJ5OIS_zm00;^o3
zmOLxOu)z!~+cF3ucL_yyZ)8r)<{V+`P44Io$kxoF$sukB&a7FZ_4t@lZhDMj$^s0F
zEjV3NTT9uW)Ps}+u7GJ)BZ<n*jY0(k*Hs<m6xG{i4;&~;u_1MYNq53jlt{yhTqM{`
za(T>Eoo6UO3&No<YnN-Nm197^ySx+_t&?S?nAjrdXGNm!e@R{EaHOpj07K?4>G6@|
z^EGQ3Xlt34E3QkG*+Cny<|@v27z_cN&p|a&aE;Zg?oCTM>|9**@N>3^K?9p$k5ztg
zVd0nfKb32lbyjjdhfYpAF^adXN!c}R&{=LlU5OG$isj@~-2BS14yVn{0Fy;kkPw36
zsvsH!Xb{yr2a$8Sl}H!)1N2)JvePG~z{OAv09m0tD-@Fwv=~>w9vUmO$3+(O_mPQr
zZt!`jr*8Om{(Ch4>&s*nF7GC*sfW$0pvxHc5CMUIm-OwowD-h5o7(&EWuI8%)Y!2Z
z{0d{o_nkxNI^am0H)ud^yaVSG1jHtzNVF^Oi3A6NK^~<9BXNC(l(6ok;2oL(7dz(C
z*~kj+By5Lt6bpjA19n54M+7d}+_GGjK~0fHGGaK|?t-`zEPZ#Y%p-T%$Ev{}gZG#y
zghF{s7jT8^7tYEJKl6VVo_qyc4iHCc&x<>BLPf625vY~VosY8+NSp&(F5st;3TL!e
zW>+RN?j5L&R*j|HIcN5Orz7181V()1<hf1(=S@~L%4UIuVrX1!6L&U7<h^ZTC+!B6
zo8GV;gnk=1C<a)M2y#B$=8*SMu_WPdh8H(xn00icpra^B7>MB6mqo~-77b#s6oChD
zeG<qM0^TTc!@DQp>#uORW8efw+g%Vx2d;!Gcyd||_qK?^w|#iI>KhtJ#U>y@xo%2T
z?FXupSqkVe+qgQ{>W>Cv7H!Jp0fW`x0Dr&B%a|Lg*xe^#bcfMS#9xI=z5KMAzInZL
zJ2gwM&qSt@9ZNC&_SL}hVNl(3s7GLA<M662La4OEE$g}0+p|1?$p?%l-m(R^7x<g>
zM%ed8YQ3>dqkWWyz6{MUdhDahb+rr-`l~tZ%JCR*JG?zRq}UQ5QFxCDdK1OBSG4id
zl81ePnU{=>)(Uel{&7(`@6qamIm{LP0mFzHVHAzGd5-yPvq8!~DT~3@TUkf$#gY4C
z`8#3i9xP{Kqd9_r{nX{&%BBA4&L+v(VQ)xj$Z|4U!-n0pGdbM0&ieU7pAXj<u?7G-
zL!P+*KM6WYs4iF6a3aw(IrQ4>Fo%TmTKf0ze}*3zNr{=Be-UwQUC+dM85_~t!C0iW
z7-lOv0Fw|6rt||OS0>EreqL@}=jT$YLCwGP@Vt}^Jd&18k@!4mNH;$~@A%q!a`;Lu
zez(|80SaC%i?x_CZWgvv*k;n_(1}U{0I81}2853#v^R9kl#?HvBE|)8kYhJfOEE65
z-l?g4Q81T_1Ny`5uZ*x}NMr^P`v6nz8Qr|S2-$XCwW}dp?PkxscJ-WF;%SR^`yUJ`
B<*EPx

literal 0
HcmV?d00001

diff --git a/scripts/audit-nesting.mjs b/scripts/audit-nesting.mjs
new file mode 100644
index 0000000..daec1cf
--- /dev/null
+++ b/scripts/audit-nesting.mjs
@@ -0,0 +1,114 @@
+/**
+ * Find HTML nesting that the parser rewrites, which is what turns into a
+ * hydration mismatch once the markup is server-rendered.
+ *
+ * Only literal lowercase tags are tracked. Uppercase names are components —
+ * what they render is unknowable from here, so they are skipped rather than
+ * guessed at.
+ */
+import { readFileSync } from "node:fs";
+import { globSync } from "node:fs";
+import { execSync } from "node:child_process";
+
+// Elements that force an open <p> closed when the parser meets them.
+const CLOSES_P = new Set([
+  "address", "article", "aside", "blockquote", "details", "div", "dl",
+  "fieldset", "figcaption", "figure", "footer", "form", "h1", "h2", "h3",
+  "h4", "h5", "h6", "header", "hgroup", "hr", "main", "menu", "nav", "ol",
+  "p", "pre", "section", "table", "ul",
+]);
+
+// Elements that may never contain another of themselves.
+const NO_SELF_NEST = new Set(["a", "button", "form", "p"]);
+
+const VOID = new Set([
+  "area", "base", "br", "col", "embed", "hr", "img", "input", "link",
+  "meta", "param", "source", "track", "wbr",
+]);
+
+const files = process.argv.length > 2
+  ? process.argv.slice(2)
+  : execSync(
+      'git ls-files "src/**/*.jsx" "src/**/*.tsx" "app/**/*.jsx" "app/**/*.tsx"',
+      { encoding: "utf8" },
+    ).trim().split("\n").filter(Boolean);
+
+const findings = [];
+
+/**
+ * Blank out comments, keeping newlines so reported line numbers stay true.
+ * Without this a comment that merely *mentions* `<p>` is scanned as markup.
+ */
+const blank = (m) => m.replace(/[^\n]/g, " ");
+
+const stripComments = (s) =>
+  s
+    .replace(/\{\s*\/\*[\s\S]*?\*\/\s*\}/g, blank)
+    .replace(/\/\*[\s\S]*?\*\//g, blank)
+    .replace(/(^|[^:])\/\/[^\n]*/g, (m, p) => p + " ".repeat(m.length - p.length));
+
+/**
+ * Blank out regex literals and quoted strings too. `.replace(/<a\s[^>]*>/gi,'')`
+ * is not markup, and reading it as markup reports a nested <a> that is not there.
+ * The regex heuristic keys off the token before the slash: a regex may only
+ * start where an operand is expected.
+ */
+const stripLiterals = (s) =>
+  s
+    // `<` and `>` are deliberately absent: with them, the `/` of a closing tag
+    // like `</span>` reads as the start of a regex and eats the tags after it.
+    .replace(/(^|[=(,:[!&|?{};\n])(\s*)\/(?![/*])((?:\\.|\[(?:\\.|[^\]])*\]|[^/\\\n])+)\/[gimsuyv]*/g,
+      (m, pre, ws, body) => pre + ws + blank("/" + body + "/"))
+    .replace(/'(?:\\.|[^'\\\n])*'/g, blank)
+    .replace(/`(?:\\.|[^`\\])*`/g, blank);
+
+for (const file of files) {
+  const src = stripLiterals(stripComments(readFileSync(file, "utf8")));
+  const stack = [];
+  // Matches <tag, </tag and the closing bracket of a tag.
+  const re = /<\/?([a-zA-Z][\w.-]*)((?:[^<>'"]|'[^']*'|"[^"]*")*?)(\/?)>/g;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    const [full, rawName, , selfSlash] = m;
+    const name = rawName;
+    if (name[0] === name[0].toUpperCase()) continue; // component
+    const closing = full.startsWith("</");
+    const line = src.slice(0, m.index).split("\n").length;
+
+    if (closing) {
+      for (let i = stack.length - 1; i >= 0; i--) {
+        if (stack[i].name === name) { stack.length = i; break; }
+      }
+      continue;
+    }
+    if (selfSlash || VOID.has(name)) continue;
+
+    const openP = stack.find((e) => e.name === "p");
+    if (openP && CLOSES_P.has(name)) {
+      findings.push({
+        file, line, kind: `<${name}> inside <p>`,
+        detail: `<p> opened at line ${openP.line}; the parser closes it before this <${name}>`,
+      });
+    }
+    if (NO_SELF_NEST.has(name)) {
+      const same = stack.find((e) => e.name === name);
+      if (same && name !== "p") {
+        findings.push({
+          file, line, kind: `<${name}> inside <${name}>`,
+          detail: `outer <${name}> opened at line ${same.line}`,
+        });
+      }
+    }
+    stack.push({ name, line });
+  }
+}
+
+if (!findings.length) {
+  console.log(`${files.length} files scanned — no parser-rewriting nesting found.`);
+} else {
+  console.log(`${files.length} files scanned — ${findings.length} finding(s):\n`);
+  for (const f of findings) {
+    console.log(`  ${f.file}:${f.line}`);
+    console.log(`    ${f.kind} — ${f.detail}`);
+  }
+}
diff --git a/scripts/ensure-prisma.mjs b/scripts/ensure-prisma.mjs
new file mode 100644
index 0000000..c6f133e
--- /dev/null
+++ b/scripts/ensure-prisma.mjs
@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+/**
+ * Regenerates the Prisma client when, and only when, the schema has changed.
+ *
+ * Why this exists: the generated client lives in `node_modules/.prisma/client`,
+ * which is gitignored, so it never travels with a commit. Pulling a branch that
+ * changed `schema.prisma` leaves everyone with a client that does not match it.
+ * `@prisma/client` has its own postinstall hook, but npm only fires that during
+ * an install — and a schema change on its own does not touch `package.json`, so
+ * nobody has a reason to reinstall. The result is a pull that looks fine and
+ * then throws `Unknown argument` at runtime, on whichever request happens to
+ * touch the new field.
+ *
+ * So the check runs where it cannot be skipped: `npm run dev`, `build` and
+ * `start` all go through `with-env.mjs`, which calls this first.
+ *
+ * "Only when changed" matters. Generating unconditionally would add seconds to
+ * every dev start; hashing one file costs about a millisecond, so the common
+ * case — schema untouched — is free.
+ *
+ * The stamp lives inside the generated client directory on purpose: deleting
+ * `node_modules` takes the stamp with it, so a wiped install can never look
+ * up to date.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = resolve(here, "..");
+
+const SCHEMA = resolve(root, "prisma", "schema.prisma");
+const CLIENT_DIR = resolve(root, "node_modules", ".prisma", "client");
+// index.d.ts is what the type checker reads, so its absence is the honest test
+// of "no usable client", rather than merely an empty directory.
+const CLIENT_MARKER = resolve(CLIENT_DIR, "index.d.ts");
+const STAMP = resolve(CLIENT_DIR, ".schema-hash");
+const PRISMA_CLI = resolve(root, "node_modules", "prisma", "build", "index.js");
+
+function schemaHash() {
+  return createHash("sha256").update(readFileSync(SCHEMA)).digest("hex");
+}
+
+function readStamp() {
+  try {
+    return readFileSync(STAMP, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {NodeJS.ProcessEnv} env Environment to hand the Prisma CLI. `generate`
+ *   does not open a connection, but the schema interpolates env("DATABASE_URL")
+ *   and Prisma reads it while parsing.
+ * @param {{ optional?: boolean }} [opts] `optional` tolerates a missing CLI
+ *   instead of failing. Set from the postinstall hook: `prisma` is a
+ *   devDependency, so `npm install --omit=dev` on a deploy host legitimately has
+ *   no CLI, and failing there would break the install. Running a dev server
+ *   without one is not legitimate, so that path leaves it off.
+ * @returns {boolean} true when the client is usable and current.
+ */
+export function ensurePrismaClient(env = process.env, opts = {}) {
+  if (!existsSync(SCHEMA)) {
+    console.error(`[prisma] schema not found at ${SCHEMA}`);
+    return false;
+  }
+
+  if (!existsSync(PRISMA_CLI)) {
+    if (opts.optional) {
+      console.log("[prisma] CLI not installed (production install) — skipping.");
+      return true;
+    }
+    console.error("[prisma] CLI not installed — run `npm install` first.");
+    return false;
+  }
+
+  const hash = schemaHash();
+  const haveClient = existsSync(CLIENT_MARKER);
+
+  if (haveClient && readStamp() === hash) return true;
+
+  console.log(
+    haveClient
+      ? "[prisma] schema.prisma changed since the client was generated — regenerating…"
+      : "[prisma] no generated client found — generating…",
+  );
+
+  const result = spawnSync(process.execPath, [PRISMA_CLI, "generate"], {
+    cwd: root,
+    env,
+    stdio: "inherit",
+  });
+
+  if (result.status !== 0) {
+    console.error(
+      "\n[prisma] `prisma generate` failed.\n" +
+        "         If this is EPERM/EBUSY on Windows, a dev server is probably\n" +
+        "         still running and holding the query engine — stop it and retry.",
+    );
+    return false;
+  }
+
+  // Written only after a success, so a failed run retries next time instead of
+  // marking a client that was never produced as current.
+  try {
+    writeFileSync(STAMP, hash);
+  } catch (error) {
+    // A missing stamp only costs a redundant generate next time.
+    console.warn(`[prisma] could not write ${STAMP}: ${error.message}`);
+  }
+
+  return true;
+}
+
+// Also usable on its own: `node scripts/ensure-prisma.mjs [--optional]`.
+// The postinstall hook passes --optional; see the note on `opts.optional`.
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const optional = process.argv.includes("--optional");
+  process.exit(ensurePrismaClient(process.env, { optional }) ? 0 : 1);
+}
diff --git a/scripts/with-env.mjs b/scripts/with-env.mjs
index 49e1699..3516712 100644
--- a/scripts/with-env.mjs
+++ b/scripts/with-env.mjs
@@ -25,6 +25,8 @@ import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { ensurePrismaClient } from "./ensure-prisma.mjs";
+
 const here = dirname(fileURLToPath(import.meta.url));
 const root = resolve(here, "..");
 
@@ -72,6 +74,13 @@ if (args.length === 0) {
   process.exit(1);
 }
 
+// Before Next starts, not after: the generated Prisma client is gitignored, so
+// pulling a branch that changed schema.prisma otherwise leaves a client that no
+// longer matches it — and the mismatch only shows up as a runtime error on
+// whichever request touches the new field. Costs a file hash when the schema is
+// unchanged, which is almost always.
+if (!ensurePrismaClient(env)) process.exit(1);
+
 const nextBin = resolve(root, "node_modules", "next", "dist", "bin", "next");
 
 const child = spawn(process.execPath, [nextBin, ...args], {
diff --git a/src/authentication/Login/Login.jsx b/src/authentication/Login/Login.jsx
index b6f2bbd..3d784e7 100644
--- a/src/authentication/Login/Login.jsx
+++ b/src/authentication/Login/Login.jsx
@@ -254,8 +254,19 @@ const Login = () => {
               Don't have an account?{" "}
               <Link
                 href="/signup"
-                onClick={(e) => {
-                  sessionStorage.setItem("prevPage", window.location.pathname);
+                onClick={() => {
+                  // Only remember this page if nothing is already pending.
+                  // Overwriting unconditionally — as the original did — threw
+                  // away the destination `ProtectedRoute` had just stored, so
+                  // someone arriving on a team invite link and choosing "Sign
+                  // Up" lost the invite before signing up. `/Login` is never a
+                  // useful place to return to anyway.
+                  if (!sessionStorage.getItem("prevPage")) {
+                    sessionStorage.setItem(
+                      "prevPage",
+                      window.location.pathname,
+                    );
+                  }
                 }}
                 style={{
                   background: "var(--primary)",
diff --git a/src/authentication/SignUp/CompleteProfile.jsx b/src/authentication/SignUp/CompleteProfile.jsx
index 1be70ba..c29cf57 100644
--- a/src/authentication/SignUp/CompleteProfile.jsx
+++ b/src/authentication/SignUp/CompleteProfile.jsx
@@ -12,6 +12,8 @@ import AuthContext from "../../context/AuthContext";
 import { Alert, MicroLoading } from "../../microInteraction";
 import { api } from "../../services";
 import { useRouter, usePathname } from "next/navigation";
+import postAuthRedirect from "../../utils/postAuthRedirect";
+import { YEAR_OPTIONS } from "../../data/yearOptions";
 
 function CompleteProfile() {
   const [loadingEffect, setLoad] = useState(false);
@@ -27,7 +29,6 @@ function CompleteProfile() {
     college: "",
     contactNo: "",
     img: "",
-    year: "",
   });
   const [errors, setErrors] = useState({});
 
@@ -49,15 +50,6 @@ function CompleteProfile() {
     return Object.keys(newErrors).length === 0;
   };
 
-  const options = [
-    { value: "1st", text: "1st year" },
-    { value: "2nd", text: "2nd year" },
-    { value: "3rd", text: "3rd year" },
-    { value: "4th", text: "4th year" },
-    { value: "5th", text: "5th year" },
-    { value: "Passout", text: "Passout" },
-  ];
-
   useEffect(() => {
     setAlert({
       type: "info",
@@ -125,7 +117,9 @@ function CompleteProfile() {
             "someToken",
             7200000
           );
-          router.push("/");
+          // Honours a pending destination — a team invite link, typically —
+          // falling back to "/" as the original always did.
+          router.push(postAuthRedirect("/"));
         }, 3000);
 
         
@@ -187,12 +181,14 @@ function CompleteProfile() {
               error={errors.rollNumber}
             />
 
+            {/* Chosen, not derived from the roll number: a lateral-entry
+                student admitted in 2025 is in 2nd year with the 2024 batch. */}
             <Input
               type="select"
               placeholder="Select Year"
               label="Year"
               name="year"
-              options={options.map(option => ({ label: option.text, value: option.value }))}
+              options={YEAR_OPTIONS}
               value={year}
               onChange={(value) => setYear(value)}
               required
diff --git a/src/authentication/SignUp/GoogleSignup.jsx b/src/authentication/SignUp/GoogleSignup.jsx
index 3f72a04..5d9c609 100644
--- a/src/authentication/SignUp/GoogleSignup.jsx
+++ b/src/authentication/SignUp/GoogleSignup.jsx
@@ -66,10 +66,10 @@ export default function GoogleSignup({ setAlert }) {
             position: "bottom-right",
             duration: 3000,
           });
-          sessionStorage.removeItem("prevPage"); // Clean up
-          // Order matters: App.jsx cleared prevPage here and only then rendered
-          // <LoginRedirect />, which therefore fell through to /profile.
-          setNavigatePath(postAuthRedirect());
+          // `prevPage` is deliberately *not* cleared first. The original wiped
+          // it here, so a Google sign-up begun from a team invite link lost the
+          // invite and landed on the profile page instead of joining.
+          setNavigatePath(postAuthRedirect("/"));
 
           setTimeout(() => {
             localStorage.setItem("token",response.data.token);
diff --git a/src/authentication/SignUp/SignUP.jsx b/src/authentication/SignUp/SignUP.jsx
index 4c91ea2..5c87a08 100644
--- a/src/authentication/SignUp/SignUP.jsx
+++ b/src/authentication/SignUp/SignUP.jsx
@@ -18,6 +18,8 @@ import { api } from "../../services";
 import AuthContext from "../../context/AuthContext";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
+import postAuthRedirect from "../../utils/postAuthRedirect";
+import { YEAR_OPTIONS } from "../../data/yearOptions";
 // import { validateData } from "../../utils/hooks/validation/validateSignupData";
 
 const SignUp = () => {
@@ -42,8 +44,8 @@ const SignUp = () => {
     rollNumber: "",
     school: "",
     college: "",
-    contactNo: "+91",
     year: "",
+    contactNo: "+91",
   });
 
   useEffect(() => {
@@ -255,7 +257,10 @@ const SignUp = () => {
             10800000
           );
           // console.log(authCtx);
-          router.push("/");
+          // Return to whatever sent them here — a team invite link, typically —
+          // instead of always landing on the home page. Falls back to "/" when
+          // nothing is pending, which is where the original always went.
+          router.push(postAuthRedirect("/"));
         }
       } catch (error) {
         setAlert({
@@ -427,19 +432,15 @@ const SignUp = () => {
                 }}
               >
                 <div style={{ width: "46%" }}>
+                  {/* Chosen, not derived from the roll number: a lateral-entry
+                      student admitted in 2025 is in 2nd year with the 2024
+                      batch. */}
                   <Input
                     type="select"
                     placeholder="Select year"
                     label="Year"
                     name="year"
-                    options={[
-                      { value: "1st", label: "1st year" },
-                      { value: "2nd", label: "2nd year" },
-                      { value: "3rd", label: "3rd year" },
-                      { value: "4th", label: "4th year" },
-                      { value: "5th", label: "5th year" },
-                      { value: "Passout", label: "Passout" },
-                    ]}
+                    options={YEAR_OPTIONS}
                     value={showUser.year}
                     onChange={(value) => DataInp("year", value)}
                     required
diff --git a/src/components/EventCard/EventCard.jsx b/src/components/EventCard/EventCard.jsx
index 98e4d89..f2476b4 100644
--- a/src/components/EventCard/EventCard.jsx
+++ b/src/components/EventCard/EventCard.jsx
@@ -441,8 +441,18 @@ const EventCard = (props) => {
                 : info.eventTitle || "No title available"}
             </span>
 
+            {/*
+              A <div>, not the <p> the original used. This element contains
+              `div.price`, which itself contains a <p> — nesting the HTML parser
+              rejects. Client-rendered under Vite that was invisible, because
+              React builds the DOM node by node and nothing reparents it. Server
+              -rendered it is real markup, so the parser closed the <p> early and
+              `div.price` came out a sibling instead of a child, which React then
+              flagged as a hydration mismatch. `.meta` carries the styling the
+              `.eventname p` rules gave it, so the result is unchanged.
+            */}
             {type === "ongoing" && (
-              <p>
+              <div className={style.meta}>
                 {info.participationType === "Team" ? (
                   <>
                     <MdGroups color="#f97507" size={25} />
@@ -484,7 +494,7 @@ const EventCard = (props) => {
                     <p style={{ color: "white", marginTop: "-1px" }}>Free</p>
                   )}
                 </div>
-              </p>
+              </div>
             )}
           </div>
           {type === "ongoing" && showRegisterButton && (
diff --git a/src/components/EventCard/styles/EventCard.module.scss b/src/components/EventCard/styles/EventCard.module.scss
index 6484135..37ac725 100644
--- a/src/components/EventCard/styles/EventCard.module.scss
+++ b/src/components/EventCard/styles/EventCard.module.scss
@@ -188,7 +188,10 @@
   text-overflow:ellipsis;
 }
 
-.eventname p {
+// `.meta` is the wrapper that used to be a <p> — see EventCard.jsx. It is
+// listed alongside so the computed styles are exactly what they were.
+.eventname p,
+.eventname .meta {
   font-size: 0.9rem;
   width: auto;
   display: flex;
@@ -309,7 +312,8 @@
     background-clip: text;
   }
 
-  .eventname p {
+  .eventname p,
+  .eventname .meta {
     font-size: 0.7rem;
     display: flex;
     align-items: center;
diff --git a/src/components/OtpInput/OtpInput.jsx b/src/components/OtpInput/OtpInput.jsx
index 746a8e3..9a77255 100644
--- a/src/components/OtpInput/OtpInput.jsx
+++ b/src/components/OtpInput/OtpInput.jsx
@@ -12,10 +12,20 @@ import { api } from "../../services";
 import { Alert, MicroLoading } from "../../microInteraction";
 import { useRouter } from "next/navigation";
 
+// `NEXT_PUBLIC_OTP_LENGTH` is the same variable `lib/services/otp.ts` generates
+// codes from. Next inlines it at build time, so it must be referenced by its
+// full literal name rather than looked up dynamically.
+const OTP_LENGTH = Number(process.env.NEXT_PUBLIC_OTP_LENGTH) || 4;
+
 const OtpInput = (props) => {
   const { email } = useContext(RecoveryContext);
   const [timerCount, setTimer] = useState(60);
-  const [OTPinput, setOTPinput] = useState(["", "", "", ""]);
+  // Driven by the same variable the server generates codes from, so the number
+  // of boxes always matches the number of digits emailed. Hardcoding four here
+  // is what let a six-digit code arrive at a four-box screen.
+  const [OTPinput, setOTPinput] = useState(() =>
+    Array(OTP_LENGTH).fill(""),
+  );
   const [disable, setDisable] = useState(true);
   const inputRefs = useRef([]);
   const router = useRouter();
diff --git a/src/components/SocialEmbed/SocialEmbed.jsx b/src/components/SocialEmbed/SocialEmbed.jsx
index a2b5fe1..529b0a3 100644
--- a/src/components/SocialEmbed/SocialEmbed.jsx
+++ b/src/components/SocialEmbed/SocialEmbed.jsx
@@ -1,11 +1,34 @@
 "use client";
 
 import PropTypes from 'prop-types';
-import { InstagramEmbed, LinkedInEmbed } from 'react-social-media-embed';
+import dynamic from 'next/dynamic';
 import useDimensions from '../../utils/hooks/useDimensions';
 import AnimatedBox from '../../assets/animations/socialPageAnimation';
 import socialLinks from '../../data/SocialLink.json';
 
+/**
+ * Client-only, because these cannot survive hydration.
+ *
+ * `react-social-media-embed` mints a fresh UUID per render and writes it into
+ * both `id` and `className`, so the server's markup never matches the client's.
+ * The sizes are the second half of the problem: they come from `useDimensions()`,
+ * which reads `window` and so measures 0 on the server.
+ *
+ * Nothing is lost by skipping SSR — the visible post is drawn by Instagram's and
+ * LinkedIn's own scripts after mount, so the server-rendered markup was only ever
+ * an invisible placeholder.
+ */
+// `{ ssr: false }` is written out at both call sites on purpose: next/dynamic is
+// a compile-time transform and rejects a shared options variable.
+const InstagramEmbed = dynamic(
+  () => import('react-social-media-embed').then((m) => m.InstagramEmbed),
+  { ssr: false },
+);
+const LinkedInEmbed = dynamic(
+  () => import('react-social-media-embed').then((m) => m.LinkedInEmbed),
+  { ssr: false },
+);
+
 const SocialEmbed = ({ type }) => {
   const {
     calculateInstagramWidth,
diff --git a/src/data/yearOptions.js b/src/data/yearOptions.js
new file mode 100644
index 0000000..da3652e
--- /dev/null
+++ b/src/data/yearOptions.js
@@ -0,0 +1,24 @@
+/**
+ * The Year dropdown, in one place.
+ *
+ * Three screens each carried their own copy — sign-up, complete-profile and
+ * edit-profile — with different values ("1st" vs "1st Year") and different
+ * casing. That is how six spellings of the same year ended up in the database,
+ * splitting one cohort across three buckets in the EventStats year counts.
+ *
+ * Values here are the canonical stored form; `normalizeYear` in
+ * `lib/academic.ts` folds anything older onto the same set on write.
+ *
+ * The year is chosen, not derived: a lateral-entry student admitted in 2025
+ * joins the 2024 batch directly in 2nd year, which no roll number implies.
+ */
+export const YEAR_OPTIONS = [
+  { value: "1st", label: "1st Year" },
+  { value: "2nd", label: "2nd Year" },
+  { value: "3rd", label: "3rd Year" },
+  { value: "4th", label: "4th Year" },
+  { value: "5th", label: "5th Year" },
+  { value: "Passout", label: "Passout" },
+];
+
+export default YEAR_OPTIONS;
diff --git a/src/features/Modals/EditProfile/EditProfile.jsx b/src/features/Modals/EditProfile/EditProfile.jsx
index 2c4aacb..9d041e4 100644
--- a/src/features/Modals/EditProfile/EditProfile.jsx
+++ b/src/features/Modals/EditProfile/EditProfile.jsx
@@ -9,6 +9,7 @@ import AOS from "aos";
 import "aos/dist/aos.css";
 import { Alert, MicroLoading } from "../../../microInteraction";
 import { api } from "../../../services";
+import { YEAR_OPTIONS } from "../../../data/yearOptions";
 
 const EditProfile = ({ handleModalClose }) => {
   const authCtx = useContext(AuthContext);
@@ -222,6 +223,9 @@ const EditProfile = ({ handleModalClose }) => {
                           }
                         />
                       </div>
+                      {/* Editable, and never recomputed on save: a lateral-entry
+                          student's year does not follow from their roll number,
+                          and anyone repeating a year can correct it here. */}
                       <div className={styles.table}>
                         <h6 className={styles.dets}>Year</h6>
                         <Input
@@ -231,16 +235,9 @@ const EditProfile = ({ handleModalClose }) => {
                             fontSize: "15px",
                           }}
                           type="select"
-                          name={data.year}
+                          name="year"
                           className={styles.vals}
-                          options={[
-                            { label: "1st Year", value: "1st" },
-                            { label: "2nd Year", value: "2nd" },
-                            { label: "3rd Year", value: "3rd" },
-                            { label: "4th Year", value: "4th" },
-                            { label: "5th Year", value: "5th" },
-                            { label: "Passout", value: "Passout" },
-                          ]}
+                          options={YEAR_OPTIONS}
                           value={data.year}
                           onChange={(value) =>
                             setData({ ...data, year: value })
diff --git a/src/features/Modals/Event/EventModal/EventModal.jsx b/src/features/Modals/Event/EventModal/EventModal.jsx
index a867496..26a171b 100644
--- a/src/features/Modals/Event/EventModal/EventModal.jsx
+++ b/src/features/Modals/Event/EventModal/EventModal.jsx
@@ -478,7 +478,13 @@ const EventModal = (props) => {
                     <div className={EventCardModal.backbtn}>
                       <div className={EventCardModal.eventname}>
                         {info.eventTitle}
-                        <p>
+                        {/*
+                          A <div>, not a <p> — it contains `div.price`, which
+                          contains a <p>. Same parser-reparenting hydration
+                          mismatch EventCard had; `.meta` is listed alongside
+                          `.eventname p` so the styling is unchanged.
+                        */}
+                        <div className={EventCardModal.meta}>
                           {info.participationType === "Team" ? (
                             <>
                               <MdGroups color="#f97507" size={25} />
@@ -521,7 +527,7 @@ const EventModal = (props) => {
                               </p>
                             )}
                           </div>
-                        </p>
+                        </div>
                       </div>
                       <div className={EventCardModal.registerbtn}>
                         <button
diff --git a/src/features/Modals/Event/EventModal/styles/EventModal.module.scss b/src/features/Modals/Event/EventModal/styles/EventModal.module.scss
index 17f82a0..5972256 100644
--- a/src/features/Modals/Event/EventModal/styles/EventModal.module.scss
+++ b/src/features/Modals/Event/EventModal/styles/EventModal.module.scss
@@ -118,7 +118,9 @@
   background-clip: text;
 }
 
-.eventname p {
+// `.meta` is the wrapper that used to be a <p> — see EventModal.jsx.
+.eventname p,
+.eventname .meta {
   font-size: 0.9rem;
   display: flex;
   align-items: center;
@@ -316,7 +318,8 @@ input:checked + .slider:before {
   .eventname {
     font-size: 0.95rem;
   }
-  .eventname p{
+  .eventname p,
+  .eventname .meta {
     font-size: 0.7rem;
   }
 
diff --git a/src/features/Modals/Profile/Admin/PreviewForm.jsx b/src/features/Modals/Profile/Admin/PreviewForm.jsx
index 3c874f7..3a911ab 100644
--- a/src/features/Modals/Profile/Admin/PreviewForm.jsx
+++ b/src/features/Modals/Profile/Admin/PreviewForm.jsx
@@ -171,42 +171,66 @@ const PreviewForm = ({
       const participationType = eventData?.participationType;
       const successMessage = eventData?.successMessage;
       console.log(participationType);
-      const handleAutoClose = async () => {
-        // [v2] If teamCode is present (invite link), auto-join the team after registration
-        if (teamCode && participationType === "Team") {
-          try {
-            const joinResponse = await api.post("/api/form/joinTeam", {
-              formId: form.id,
-              teamCode: teamCode,
+      // [v2] Redeems an invite link's team code once registration has gone
+      // through. Returns where to send them next, so the caller owns navigation.
+      const autoJoinTeam = async () => {
+        try {
+          const joinResponse = await api.post("/api/form/joinTeam", {
+            formId: form.id,
+            teamCode,
+          });
+
+          if (joinResponse?.data?.success) {
+            Alert({
+              type: "success",
+              message: joinResponse.data.message || `Joined team successfully!`,
+              position: "bottom-right",
+              duration: 3000,
             });
-            if (joinResponse.data?.success) {
-              Alert({
-                type: "success",
-                message: joinResponse.data.message || `Joined team successfully!`,
-                position: "bottom-right",
-                duration: 3000,
-              });
-              const eventId = joinResponse.data.data?.eventId || form.id;
-              setTimeout(() => {
-                router.replace(`/Events/${form.id}/team`);
-              }, 1000);
-              return;
-            }
-          } catch (joinErr) {
-            console.error("Auto-join failed:", joinErr);
-            // Fall through to normal flow if join fails
+            return { path: `/Events/${form.id}/team`, replace: true };
           }
+
+          return failedJoinDestination(joinResponse?.data?.message);
+        } catch (joinErr) {
+          console.error("Auto-join failed:", joinErr);
+          return failedJoinDestination(joinErr?.response?.data?.message);
+        }
+      };
+
+      // The invite could not be honoured — the team filled up while they were
+      // registering, the code is stale, or registration closed. Registration
+      // itself succeeded, so they go to the team page, which renders the team
+      // search for an unaffiliated registrant, rather than to /Events with no
+      // explanation. The reason rides along as a query param for the toast.
+      const failedJoinDestination = (reason) => {
+        const query = new URLSearchParams({ toast: "join_failed" });
+        if (reason) query.set("reason", reason);
+        return {
+          path: `/Events/${form.id}/team?${query.toString()}`,
+          replace: true,
+        };
+      };
+
+      const eventsDestination = () => {
+        if (participationType === "Team") {
+          setTeamCode(code);
+          setTeamName(team);
         }
+        if (successMessage) setSuccessMessage(successMessage);
+        return { path: "/Events", replace: false };
+      };
 
+      const handleAutoClose = async () => {
+        const destination =
+          teamCode && participationType === "Team"
+            ? await autoJoinTeam()
+            : eventsDestination();
+
+        // Single navigation for every outcome. The delay lets the success or
+        // failure toast be read before the page changes.
         setTimeout(() => {
-          if (participationType === "Team") {
-            setTeamCode(code);
-            setTeamName(team);
-          }
-          if (successMessage) {
-            setSuccessMessage(successMessage);
-          }
-          router.push("/Events");
+          if (destination.replace) router.replace(destination.path);
+          else router.push(destination.path);
         }, 1000);
       };
 
diff --git a/src/sections/Home/Contact/Contact.jsx b/src/sections/Home/Contact/Contact.jsx
index 915ba2e..6694d52 100644
--- a/src/sections/Home/Contact/Contact.jsx
+++ b/src/sections/Home/Contact/Contact.jsx
@@ -5,7 +5,7 @@ import React, { useState, useEffect } from "react";
 import { api } from "../../../services";
 import styles from "./styles/Contact.module.scss";
 import contactImg from "../../../assets/images/contact.png";
-import { Button } from "../../../components";
+import Button from "../../../components/Core/Button";
 import { AnimatedBox } from "../../../assets/animations/AnimatedBox";
 import { Alert, MicroLoading } from "../../../microInteraction";
 
diff --git a/src/sections/Home/Hero/Hero.jsx b/src/sections/Home/Hero/Hero.jsx
index 783898c..4354527 100644
--- a/src/sections/Home/Hero/Hero.jsx
+++ b/src/sections/Home/Hero/Hero.jsx
@@ -3,7 +3,7 @@
 import React, { useEffect, useState } from "react";
 import styles from "./styles/Hero.module.scss";
 import CarouselImg from "../../../data/Carousel.json";
-import { Carousel } from "../../../components";
+import Carousel from "../../../components/Carousel/Carousel";
 import { AnimatedBox } from "../../../assets/animations/AnimatedBox";
 
 const titles = [
@@ -56,7 +56,15 @@ function Hero() {
         <div className={styles.heroTextContainer}>
           <AnimatedBox direction="left">
             <div className={styles.largeContent}>
-              <p>
+              {/*
+                A <div>, not the <p> the original used: it contains the animated
+                <h3>, which the HTML parser will not keep inside a <p>. That was
+                harmless client-rendered and a hydration mismatch once
+                server-rendered. `.tagline` is listed alongside `.largeContent p`
+                in the stylesheet, so the text is styled exactly as before, and
+                the <h3> stays an <h3> rather than being downgraded to a span.
+              */}
+              <div className={styles.tagline}>
                 Nurturing Using Innovative & Creative strategies{" "}
                 <span
                   className={styles.dynamicText}
@@ -68,7 +76,7 @@ function Hero() {
                 >
                   <h3 className={styles.typing}>{currentTitle}</h3>
                 </span>{" "}
-              </p>
+              </div>
             </div>
             <div className={styles.smallContainer}>
               <div className={styles.smallContent}>
diff --git a/src/sections/Home/Hero/styles/Hero.module.scss b/src/sections/Home/Hero/styles/Hero.module.scss
index 3e51b42..e08b74f 100644
--- a/src/sections/Home/Hero/styles/Hero.module.scss
+++ b/src/sections/Home/Hero/styles/Hero.module.scss
@@ -38,7 +38,8 @@
   background-clip: text;
 }
 
-.largeContent p {
+.largeContent p,
+.largeContent .tagline {
   font-weight: 700;
   font-size: 2.45rem;
   color: #FFFFFF;
@@ -125,7 +126,8 @@
 
 
 @media (max-width: 1025px) {
-.largeContent p{
+.largeContent p,
+.largeContent .tagline {
   font-size: 1.3rem;
 }
 
@@ -161,7 +163,8 @@
 
 @media screen and (max-width: 480px) {
 
-  .largeContent p{
+  .largeContent p,
+.largeContent .tagline {
     font-size: 1.2rem;
     text-align: center;
     
diff --git a/src/sections/Profile/Admin/View/VerifyCertificate/VerifyCertificate.jsx b/src/sections/Profile/Admin/View/VerifyCertificate/VerifyCertificate.jsx
index 2e591d7..c4a8f0c 100644
--- a/src/sections/Profile/Admin/View/VerifyCertificate/VerifyCertificate.jsx
+++ b/src/sections/Profile/Admin/View/VerifyCertificate/VerifyCertificate.jsx
@@ -11,7 +11,9 @@ import shareOutline from "../../../../../assets/images/shareOutline.svg";
 import { useParams, useSearchParams } from "next/navigation";
 
 const VerifyCertificate = () => {
-  const [searchParams] = useSearchParams();
+  // Next returns the params object itself, not React Router's [params, setter]
+  // pair. Destructuring it as an array yields undefined and crashes on `.get`.
+  const searchParams = useSearchParams();
   const certificateId = searchParams.get("id");
   const { issuedCertificateId } = useParams();
   const [certificateData, setCertificateData] = useState(null);
diff --git a/src/sections/Profile/Admin/View/VerifyCertificate/styles/VerifyCertificate.module.scss b/src/sections/Profile/Admin/View/VerifyCertificate/styles/VerifyCertificate.module.scss
index aeb6847..10943f4 100644
--- a/src/sections/Profile/Admin/View/VerifyCertificate/styles/VerifyCertificate.module.scss
+++ b/src/sections/Profile/Admin/View/VerifyCertificate/styles/VerifyCertificate.module.scss
@@ -1,3 +1,4 @@
+@use "sass:color";
 @use "../../../../../../assets/styles/Global.scss" as *;
 $primary-color: #1C1C1C;
 $secondary-color: #1DB954;
@@ -151,7 +152,7 @@ $shadow: 0 8px 24px rgba(0, 0, 0, 0.2);
     transition: all 0.3s ease;
 
     &:hover {
-      background-color: darken($accent-color, 10%);
+      background-color: color.adjust($accent-color, $lightness: -10%);
       transform: scale(1.05);
     }
   }
@@ -206,7 +207,7 @@ $shadow: 0 8px 24px rgba(0, 0, 0, 0.2);
   font-size: smaller;
 
   &:hover {
-    background-color: darken($accent-color, 10%);
+    background-color: color.adjust($accent-color, $lightness: -10%);
     transform: scale(1.05);
   }
 }
\ No newline at end of file
diff --git a/src/utils/postAuthRedirect.js b/src/utils/postAuthRedirect.js
index ffbe02e..632ef8f 100644
--- a/src/utils/postAuthRedirect.js
+++ b/src/utils/postAuthRedirect.js
@@ -21,8 +21,13 @@
 const isSafeInternalPath = (path) =>
   typeof path === "string" && path.startsWith("/") && !path.startsWith("//");
 
-export default function postAuthRedirect() {
-  if (typeof window === "undefined") return "/profile";
+/**
+ * @param {string} fallback Where to go when nothing was pending. Login lands on
+ *   /profile as `LoginRedirect` did; the signup screens pass "/" because that is
+ *   where they always sent a brand-new account.
+ */
+export default function postAuthRedirect(fallback = "/profile") {
+  if (typeof window === "undefined") return fallback;
 
   const next = new URLSearchParams(window.location.search).get("next");
   const prevPage = sessionStorage.getItem("prevPage");
@@ -30,5 +35,5 @@ export default function postAuthRedirect() {
 
   if (isSafeInternalPath(next)) return next;
   if (isSafeInternalPath(prevPage)) return prevPage;
-  return "/profile";
+  return fallback;
 }
diff --git a/src/views/Event/EventForm.jsx b/src/views/Event/EventForm.jsx
index c2972ac..8afd8db 100644
--- a/src/views/Event/EventForm.jsx
+++ b/src/views/Event/EventForm.jsx
@@ -15,7 +15,9 @@ const EventForm = () => {
   const [isLoading, setIsLoading] = useState(true);
   const [alert, setAlert] = useState(null);
   const { eventId } = useParams();
-  const [searchParams] = useSearchParams();
+  // Next returns the params object itself, not React Router's [params, setter]
+  // pair. Destructuring it as an array yields undefined and crashes on `.get`.
+  const searchParams = useSearchParams();
   const router = useRouter();
   const authCtx = useContext(AuthContext);
 
diff --git a/src/views/Home/Home.jsx b/src/views/Home/Home.jsx
index 5f2fd57..bde3af8 100644
--- a/src/views/Home/Home.jsx
+++ b/src/views/Home/Home.jsx
@@ -2,8 +2,14 @@
 
 /* eslint-disable no-unused-vars */
 import React, { useEffect } from 'react';
-import { Hero, About, Sponser, Feedback, Contact } from "../../sections";
-import { LiveEventPopup } from "../../features";
+// Imported from sections/Home, not the sections barrel. That barrel also
+// re-exports sections/Profile — the whole admin panel — and because every one
+// of them is a client component the bundler pulled the entire graph into the
+// landing page: certificate tooling, admin tables, the lot.
+import { Hero, About, Sponser, Feedback, Contact } from "../../sections/Home";
+// Direct, for the same reason: the features barrel also exports EventStats,
+// the avatar editor and the admin form modals.
+import LiveEventPopup from "../../features/Modals/Event/LiveEventPopup/LiveEventPopup";
 
 const Home = () => {
 
diff --git a/src/views/Social/Social.jsx b/src/views/Social/Social.jsx
index 66f2052..20ae13d 100644
--- a/src/views/Social/Social.jsx
+++ b/src/views/Social/Social.jsx
@@ -19,7 +19,13 @@ const Social = () => {
     <div className={styles.socialMcontainer}>
       <div className={styles.text}>
         <div className={styles.circleCenter}></div>
-        <p className={styles.content}>
+        {/*
+          A <div>, not a <p>: it wraps `div.fed`, which the parser will not keep
+          inside a <p>. `.content` had no rule in the stylesheet — so this
+          className resolved to `undefined` and did nothing — and now carries the
+          same declarations as `.text p`, which is what actually styled it.
+        */}
+        <div className={styles.content}>
           Welcome to the social media page of <br />
           <div className={styles.fed}>
             <div className={styles.box} id={styles.box1}>
@@ -46,7 +52,7 @@ const Social = () => {
             </div>
           </div>
           <br />
-        </p>
+        </div>
       </div>
       <div className={styles.socialMedia}>
         <div className={styles.container}>
diff --git a/src/views/Social/styles/Social.module.scss b/src/views/Social/styles/Social.module.scss
index aa02912..9556b46 100644
--- a/src/views/Social/styles/Social.module.scss
+++ b/src/views/Social/styles/Social.module.scss
@@ -13,7 +13,8 @@
 }
 
 
-.text p {
+.text p,
+.text .content {
   font-size: 33.45px;
   text-align: center;
   //font-family: "Poppins", sans-serif;
@@ -195,7 +196,8 @@
     justify-content: center;
   }
   
-  .text p {
+  .text p,
+  .text .content {
     font-size: 40px;
     text-align: center;
     //font-family: Poppins;
@@ -410,7 +412,8 @@
   }
 
 
-  .text p {
+  .text p,
+  .text .content {
     font-size: 40px;
     text-align: center;
     //font-family: Poppins;
@@ -494,7 +497,8 @@
     max-width: 780px;
   }
 
-  .text p{
+  .text p,
+  .text .content {
     font-size: 30px;
   }
 
@@ -642,7 +646,8 @@
   }
 
   
-  .text p {
+  .text p,
+  .text .content {
     margin-top: 1.5rem;
     font-size: 20px;
     text-align: center;
@@ -764,7 +769,8 @@
     max-width: 370px;
   }
 
-  .text p {
+  .text p,
+  .text .content {
     max-width: 350px;
     font-size: 17px;
     text-align: center;
diff --git a/src/views/TeamManagement/TeamManagement.jsx b/src/views/TeamManagement/TeamManagement.jsx
index 9d2c4c7..ee05259 100644
--- a/src/views/TeamManagement/TeamManagement.jsx
+++ b/src/views/TeamManagement/TeamManagement.jsx
@@ -18,7 +18,12 @@ import { useRouter, useParams, useSearchParams } from "next/navigation";
 const TeamManagement = () => {
     const { eventId: formId } = useParams();
     const router = useRouter();
-    const [searchParams, setSearchParams] = useSearchParams();
+    // Not `const [searchParams] = useSearchParams()`: that is React Router's
+    // shape. Next returns a ReadonlyURLSearchParams directly, and because it is
+    // iterable the array destructuring silently took the first [key, value]
+    // entry — `undefined` when the URL has no query string, hence
+    // "Cannot read properties of undefined (reading 'get')".
+    const searchParams = useSearchParams();
     const authCtx = useContext(AuthContext);
 
     const [teamData, setTeamData] = useState(null);
@@ -52,6 +57,7 @@ const TeamManagement = () => {
     useEffect(() => {
         const toast = searchParams.get("toast");
         const name = searchParams.get("name");
+        const reason = searchParams.get("reason");
         if (toast) {
             const toastMessages = {
                 joined: { type: "success", message: `${name || "User"} has been added to the team! 🎉` },
@@ -62,16 +68,39 @@ const TeamManagement = () => {
                 already_joined: { type: "info", message: `${name || "This user"} has already joined another team.` },
                 team_full: { type: "warning", message: `Team is full. ${name || "The user"} could not be added.` },
                 invalid: { type: "error", message: "Invalid request." },
+                // Set by PreviewForm when an invite link's auto-join fails after
+                // registration. `reason` is the API's own message ("This team is
+                // full", "Invalid team code", ...) so the user is told why they
+                // are looking at the team search instead of their invited team.
+                join_failed: {
+                    type: "warning",
+                    message: reason
+                        ? `${reason} You can join another team below.`
+                        : "Couldn't join that team. You can join another team below.",
+                },
             };
             const t = toastMessages[toast];
             if (t) {
                 Alert({ type: t.type, message: t.message, position: "top-right" });
             }
-            // Clean URL params after showing toast
-            searchParams.delete("toast");
-            searchParams.delete("name");
-            setSearchParams(searchParams, { replace: true });
+            // Clean URL params after showing toast.
+            //
+            // The original mutated the params object and handed it back to
+            // React Router's setter. Next's is a *read-only* view with no
+            // setter, so the equivalent is a copy plus a replace — same result:
+            // the toast does not fire again on refresh, and no history entry is
+            // added.
+            const next = new URLSearchParams(searchParams.toString());
+            next.delete("toast");
+            next.delete("name");
+            next.delete("reason");
+            const query = next.toString();
+            router.replace(
+                `${window.location.pathname}${query ? `?${query}` : ""}`,
+                { scroll: false },
+            );
         }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, []); // Run once on mount
 
     const fetchTeamDetails = useCallback(async () => {

From 75480f5d65ac879e7bca258eecf203c2e0cfef71 Mon Sep 17 00:00:00 2001
From: Ansh Raj <146376691+AnshRaj112@users.noreply.github.com>
Date: Wed, 5 Aug 2026 10:53:57 +0530
Subject: [PATCH 3/3] Potential fix for pull request finding 'CodeQL /
 Inefficient regular expression'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 scripts/audit-nesting.mjs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/audit-nesting.mjs b/scripts/audit-nesting.mjs
index daec1cf..71efc9c 100644
--- a/scripts/audit-nesting.mjs
+++ b/scripts/audit-nesting.mjs
@@ -57,7 +57,7 @@ const stripLiterals = (s) =>
   s
     // `<` and `>` are deliberately absent: with them, the `/` of a closing tag
     // like `</span>` reads as the start of a regex and eats the tags after it.
-    .replace(/(^|[=(,:[!&|?{};\n])(\s*)\/(?![/*])((?:\\.|\[(?:\\.|[^\]])*\]|[^/\\\n])+)\/[gimsuyv]*/g,
+    .replace(/(^|[=(,:[!&|?{};\n])(\s*)\/(?![/*])((?:\\.|\[(?:\\.|[^\]\\\n])*\]|[^/\\\[\n])+)\/[gimsuyv]*/g,
       (m, pre, ws, body) => pre + ws + blank("/" + body + "/"))
     .replace(/'(?:\\.|[^'\\\n])*'/g, blank)
     .replace(/`(?:\\.|[^`\\])*`/g, blank);