Move ADMIN_EMAIL check to server side function

.cursor/.gitignore

@@ -0,0 +1 @@
+rules/pensive*

.cursor/rules/technology-stack.mdc

@@ -0,0 +1,89 @@
+---
+description: 
+globs: package.json
+alwaysApply: false
+---
+# Technology Stack
+
+Rule for documenting and maintaining consistency in the technology stack used across the project.
+
+<rule>
+name: technology-stack
+description: Documents the core technology stack and enforces consistent version usage
+filters:
+  - type: file_extension
+    pattern: "package.json"
+  - type: content
+    pattern: "import|require"
+  - type: event
+    pattern: "file_change|file_create"
+
+actions:
+  - type: suggest
+    message: |
+      This project uses the following technology stack:
+
+      Core Framework:
+      - Next.js 15.x (with Turbopack)
+      - React 19.x
+      - TypeScript 5.x
+
+      Backend & Authentication:
+      - Firebase 11.x
+        - Authentication
+        - Firestore
+        - Cloud Functions
+        - App Hosting
+      - Firebase Admin SDK 12.x
+      - Firebase Functions 6.x
+
+      UI Components & Styling:
+      - Radix UI (Headless Components)
+      - Tailwind CSS 3.x
+      - Class Variance Authority
+      - Framer Motion 12.x
+      - Lucide React (Icons)
+
+      Form Handling & Validation:
+      - React Hook Form 7.x
+      - Zod 3.x
+      - Class Validator
+      - Class Transformer
+
+      Rich Text Editing:
+      - Tiptap 2.x
+      - React Markdown 10.x
+
+      Data Visualization:
+      - Recharts 2.x
+
+      Development Tools:
+      - ESLint 9.x
+      - Vitest 3.x
+      - Husky (Git Hooks)
+      - Concurrently (Dev Process)
+
+      When adding new dependencies:
+      1. Ensure compatibility with existing stack versions
+      2. Prefer established libraries from current stack
+      3. Document major version changes
+      4. Consider bundle size impact
+      5. Check Firebase compatibility
+
+examples:
+  - input: |
+      # Adding a new UI component library
+      import { Button } from '@some-ui/react'
+    output: "Consider using Radix UI components with our existing styling system"
+
+  - input: |
+      # Using an older React version
+      "react": "^18.0.0"
+    output: "Project uses React 19.x, please update version"
+
+metadata:
+  priority: high
+  version: 1.0
+  last_updated: "2024-03-21"
+  maintainer: "Team"
+</rule>

.data/emulators/firebase-data/auth_export/accounts.json

@@ -1 +1 @@
-{"kind":"identitytoolkit#DownloadAccountResponse","users":[{"localId":"UROwK21E1TkI5mvhghjABOsXJEKr","createdAt":"1740076420437","lastLoginAt":"1740076715505","displayName":"Integration Test User","photoUrl":"https://randomuser.me/api/portraits/men/3.jpg","passwordHash":"fakeHash:salt=fakeSaltqKAUxV2CkCRe8e8iStQM:password=password123","salt":"fakeSaltqKAUxV2CkCRe8e8iStQM","passwordUpdatedAt":1740257459259,"providerUserInfo":[{"providerId":"password","email":"[email protected]","federatedId":"[email protected]","rawId":"[email protected]","displayName":"Integration Test User","photoUrl":"https://randomuser.me/api/portraits/men/3.jpg"}],"validSince":"1740257459","email":"[email protected]","emailVerified":false,"disabled":false},{"localId":"gzDyVhuHirc3oOumoSWS3hQHcGe6","createdAt":"1739972372247","lastLoginAt":"1740257499188","displayName":"David Laing (local emulator)","photoUrl":"https://lh3.googleusercontent.com/a/ACg8ocK4mNmS8Rre3cL6mwO1kMDiQ1DPqIVSaxjM46Jjg_f63IpK=s96-c","passwordHash":"fakeHash:salt=fakeSalt6aL1yBgXjipNiXDyEQHO:password=password","salt":"fakeSalt6aL1yBgXjipNiXDyEQHO","passwordUpdatedAt":1740257459259,"providerUserInfo":[{"providerId":"google.com","rawId":"3578890099700199420545762490298610907447","federatedId":"3578890099700199420545762490298610907447","displayName":"David Laing (local emulator)","email":"[email protected]"},{"providerId":"password","email":"[email protected]","federatedId":"[email protected]","rawId":"[email protected]","displayName":"David Laing (local emulator)","photoUrl":"https://lh3.googleusercontent.com/a/ACg8ocK4mNmS8Rre3cL6mwO1kMDiQ1DPqIVSaxjM46Jjg_f63IpK=s96-c"}],"validSince":"1740257459","email":"[email protected]","emailVerified":true,"disabled":false,"lastRefreshAt":"2025-02-22T20:51:39.188Z"}]}
+{"kind":"identitytoolkit#DownloadAccountResponse","users":[{"localId":"UROwK21E1TkI5mvhghjABOsXJEKr","createdAt":"1740076420437","lastLoginAt":"1742125645396","displayName":"Integration Test User","photoUrl":"https://randomuser.me/api/portraits/men/3.jpg","passwordHash":"fakeHash:salt=fakeSaltqKAUxV2CkCRe8e8iStQM:password=password123","salt":"fakeSaltqKAUxV2CkCRe8e8iStQM","passwordUpdatedAt":1743245010973,"providerUserInfo":[{"providerId":"password","email":"[email protected]","federatedId":"[email protected]","rawId":"[email protected]","displayName":"Integration Test User","photoUrl":"https://randomuser.me/api/portraits/men/3.jpg"}],"validSince":"1743245010","email":"[email protected]","emailVerified":false,"disabled":false},{"localId":"gzDyVhuHirc3oOumoSWS3hQHcGe6","createdAt":"1739972372247","lastLoginAt":"1742637216773","displayName":"David Laing (local emulator)","photoUrl":"https://lh3.googleusercontent.com/a/ACg8ocK4mNmS8Rre3cL6mwO1kMDiQ1DPqIVSaxjM46Jjg_f63IpK=s96-c","passwordHash":"fakeHash:salt=fakeSalt6aL1yBgXjipNiXDyEQHO:password=password","salt":"fakeSalt6aL1yBgXjipNiXDyEQHO","passwordUpdatedAt":1743245010974,"providerUserInfo":[{"providerId":"google.com","rawId":"3578890099700199420545762490298610907447","federatedId":"3578890099700199420545762490298610907447","displayName":"David Laing (local emulator)","email":"[email protected]"},{"providerId":"password","email":"[email protected]","federatedId":"[email protected]","rawId":"[email protected]","displayName":"David Laing (local emulator)","photoUrl":"https://lh3.googleusercontent.com/a/ACg8ocK4mNmS8Rre3cL6mwO1kMDiQ1DPqIVSaxjM46Jjg_f63IpK=s96-c"}],"validSince":"1743245010","email":"[email protected]","emailVerified":true,"disabled":false}]}

.data/emulators/firebase-data/firebase-export-metadata.json

@@ -1,12 +1,12 @@
 {
-  "version": "13.29.2",
+  "version": "13.31.2",
   "firestore": {
     "version": "1.19.8",
     "path": "firestore_export",
     "metadata_file": "firestore_export/firestore_export.overall_export_metadata"
   },
   "auth": {
-    "version": "13.29.2",
+    "version": "13.31.2",
     "path": "auth_export"
   }
 }

.env

@@ -1,4 +1,6 @@
 # These env vars should be defined in .env.{development,production}
+# NEXT_PUBLIC_BASE_URL="http://localhost:3000"
+
 # FIREBASE_SERVICE_ACCOUNT_JSON="contents of <appname>-adminsdk-<randomchars>.json"
 
 # Firebase emulator configuration

.eslintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": "next/core-web-vitals"
+} 

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# These owners will be the default owners for everything in
+# the repo. They will be requested for review when someone 
+# opens a pull request.
+*       @mrdavidlaing 

.github/workflows/firebase-hosting-merge.yml

@@ -1,4 +1,4 @@
-name: Deploy to Firebase Hosting on merge
+name: "Deploy to decision-copilot.wellmaintained.org App Hosting on merge"
 on:
   push:
     branches:
@@ -13,15 +13,51 @@ jobs:
           version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+          node-version: 20
+          cache: pnpm
+      - name: Install dependencies using pnpm
+        run: pnpm install --frozen-lockfile
+      - name: Build and run unit tests
+        run: pnpm build && pnpm test:unit
+      - name: "Authenticate to GCP Project: decision-copilot"
+        uses: google-github-actions/auth@v2
         with:
-          repoToken: ${{ secrets.GITHUB_TOKEN }}
-          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DECISION_COPILOT }}
-          channelId: live
-          projectId: decision-copilot
-          firebaseToolsVersion: 13.29.2
-        env:
-          FIREBASE_CLI_EXPERIMENTS: webframeworks
+          project_id: decision-copilot
+          credentials_json: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_DECISION_COPILOT }}'
+      - name: Patch firebase-tools/lib/commands/apphosting-rollouts-create.js to autoAuth for App Hosting
+        run: |
+          # Create patch file
+          cat > firebase-tools.patch << 'EOF'
+          --- node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js
+          +++ node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.new.js
+          @@ -5,12 +5,14 @@
+           const apphosting = require("../gcp/apphosting");
+           const command_1 = require("../command");
+           const projectUtils_1 = require("../projectUtils");
+          +const requireAuth_1 = require("../requireAuth");
+           const error_1 = require("../error");
+           const rollout_1 = require("../apphosting/rollout");
+           exports.command = new command_1.Command("apphosting:rollouts:create <backendId>")
+               .description("create a rollout using a build for an App Hosting backend")
+               .option("-l, --location <location>", "specify the region of the backend", "-")
+               .option("-b, --git-branch <gitBranch>", "repository branch to deploy (mutually exclusive with -g)")
+               .option("-g, --git-commit <gitCommit>", "git commit to deploy (mutually exclusive with -b)")
+               .withForce("Skip confirmation before creating rollout")
+          +    .before(requireAuth_1.requireAuth)
+               .before(apphosting.ensureApiEnabled)
+               .action(async (backendId, options) => {
+          EOF
+
+          # Apply the patch
+          patch node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js < firebase-tools.patch
+
+          # Verify patch was applied successfully
+          grep -q "requireAuth_1" node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js && echo "Patch applied successfully!" || echo "Patch failed!"
+
+      - name: Deploy to Firebase App Hosting production
+        run: |
+          pnpm firebase:apphosting:deploy:prod --git-branch main
+
+      # - name: If failure; launch tmate session to debug
+      #   if: ${{ failure() }}
+      #   uses: mxschmitt/action-tmate@v3

.github/workflows/firebase-hosting-pull-request.yml

@@ -1,4 +1,4 @@
-name: Deploy to Firebase Hosting on PR
+name: "Deploy to decision-copilot.staging.wellmaintained.org App Hosting on PR"
 on: pull_request
 permissions:
   checks: write
@@ -15,14 +15,51 @@ jobs:
           version: 9
       - uses: actions/setup-node@v4
         with:
-          node-version: 18
-          cache: 'pnpm'
-      - run: pnpm install --frozen-lockfile
-      - uses: FirebaseExtended/action-hosting-deploy@v0
+          node-version: 20
+          cache: pnpm
+      - name: Install dependencies using pnpm
+        run: pnpm install --frozen-lockfile
+      - name: Build and run unit tests
+        run: pnpm build && pnpm test:unit
+      - name: "Authenticate to GCP Project: decision-copilot"
+        uses: google-github-actions/auth@v2
         with:
-          repoToken: ${{ secrets.GITHUB_TOKEN }}
-          firebaseServiceAccount: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_DECISION_COPILOT }}
-          projectId: decision-copilot
-          firebaseToolsVersion: 13.29.2
-        env:
-          FIREBASE_CLI_EXPERIMENTS: webframeworks
+          project_id: decision-copilot
+          credentials_json: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_DECISION_COPILOT }}'
+      - name: Patch firebase-tools/lib/commands/apphosting-rollouts-create.js to autoAuth for App Hosting
+        run: |
+          # Create patch file
+          cat > firebase-tools.patch << 'EOF'
+          --- node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js
+          +++ node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.new.js
+          @@ -5,12 +5,14 @@
+           const apphosting = require("../gcp/apphosting");
+           const command_1 = require("../command");
+           const projectUtils_1 = require("../projectUtils");
+          +const requireAuth_1 = require("../requireAuth");
+           const error_1 = require("../error");
+           const rollout_1 = require("../apphosting/rollout");
+           exports.command = new command_1.Command("apphosting:rollouts:create <backendId>")
+               .description("create a rollout using a build for an App Hosting backend")
+               .option("-l, --location <location>", "specify the region of the backend", "-")
+               .option("-b, --git-branch <gitBranch>", "repository branch to deploy (mutually exclusive with -g)")
+               .option("-g, --git-commit <gitCommit>", "git commit to deploy (mutually exclusive with -b)")
+               .withForce("Skip confirmation before creating rollout")
+          +    .before(requireAuth_1.requireAuth)
+               .before(apphosting.ensureApiEnabled)
+               .action(async (backendId, options) => {
+          EOF
+
+          # Apply the patch
+          patch node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js < firebase-tools.patch
+
+          # Verify patch was applied successfully
+          grep -q "requireAuth_1" node_modules/firebase-tools/lib/commands/apphosting-rollouts-create.js && echo "Patch applied successfully!" || echo "Patch failed!"
+
+      - name: Deploy to Firebase App Hosting preview
+        run: |
+          pnpm firebase:apphosting:deploy:staging --git-branch ${{ github.head_ref }}
+
+      # - name: If failure; launch tmate session to debug
+      #   if: ${{ failure() }}
+      #   uses: mxschmitt/action-tmate@v3

.gitignore

@@ -37,11 +37,15 @@ firebase-debug.log
 !.env
 .env.*
 .env.*.local
+.local/
 
 # vercel
 .vercel
 
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+
+# misc
 firestore-debug.log
+redirect-to-wellmaintained/.firebase/hosting.cHVibGlj.cache

.husky/pre-push

@@ -0,0 +1 @@
+pnpm run pre:push 

.vscode/tasks.json

@@ -0,0 +1,48 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "Start Dev Environment",
+            "dependsOrder": "parallel",
+            "dependsOn": ["Firebase Emulators", "Next.js Dev", "Browser Tools MCP Server"]
+        },
+        {
+            "label": "Firebase Emulators",
+            "type": "shell",
+            "command": "pnpm",
+            "args": ["dev:emulators:with-data"],
+            "isBackground": true,
+            "presentation": {
+                "reveal": "always",
+                "panel": "new",
+                "group": "dev-servers"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Next.js Dev",
+            "type": "shell",
+            "command": "pnpm",
+            "args": ["dev:next"],
+            "isBackground": true,
+            "presentation": {
+                "reveal": "always",
+                "panel": "new",
+                "group": "dev-servers"
+            },
+            "problemMatcher": []
+        },
+        {
+            "label": "Browser Tools MCP Server",
+            "type": "shell",
+            "command": "npx",
+            "args": ["@agentdeskai/[email protected]"],
+            "isBackground": true,
+            "presentation": {
+                "reveal": "always",
+                "panel": "new"
+            },
+            "problemMatcher": []
+        }
+    ]
+} 

SPECS.md

@@ -0,0 +1,54 @@
+# Decision Copilot Specifications
+
+This document provides an overview of all specification documents for the Decision Copilot application. These specifications serve as a reference for developers working on the system and define the expected behavior of different components.
+
+## Specifications by Domain
+
+| Domain | Specification | Description |
+|--------|---------------|-------------|
+| **Model Context Protocol (MCP)** | [MCP Overview](specs/mcp-overview.md) | Overview of MCP integration for AI agent interaction |
+| | [MCP Resources](specs/mcp-resources.md) | Resources exposed through MCP for data access |
+| | [MCP Tools](specs/mcp-tools.md) | Tools exposed through MCP for interactive operations |
+| | [MCP Authentication](specs/mcp-authentication.md) | Authentication and authorization for MCP |
+| | [MCP API Endpoint](specs/mcp-api-endpoint.md) | Server-Sent Events endpoint implementation |
+| | [MCP Implementation](specs/mcp-implementation.md) | Implementation plan for MCP integration |
+
+## Understanding the Specifications
+
+Each specification document follows a standard format:
+
+1. **Introduction**: Describes the purpose and scope of the specification
+2. **Details**: Provides in-depth information about the feature or component
+3. **Implementation**: Offers guidance on how to implement the specification
+4. **Examples**: Illustrates usage with concrete examples where applicable
+5. **References**: Links to related specifications or external resources
+
+## Key Architectural Principles
+
+All specifications adhere to these core architectural principles:
+
+1. **Domain-Driven Design**: Clear separation of domain models, repositories, and infrastructure
+2. **Type Safety**: Strong typing throughout the application
+3. **Immutability**: Domain objects are immutable to prevent unexpected state changes
+4. **Validation**: Domain-level validation ensures data integrity
+5. **Repository Pattern**: Data access through repository interfaces
+6. **Organization Scoping**: Data is scoped to organizations for security
+
+## Development Workflow
+
+When implementing these specifications:
+
+1. Review the relevant specification documents
+2. Follow the implementation guidance provided
+3. Write tests that verify the behavior matches the specification
+4. Submit a pull request for review
+5. Update the specification if changes are needed during implementation
+
+## Contributing to Specifications
+
+To improve or expand these specifications:
+
+1. Propose changes through pull requests
+2. Ensure changes align with architectural principles
+3. Update all affected specifications to maintain consistency
+4. Include examples and implementation guidance for new features