# EventBuzz Backend

Node.js backend for EventBuzz built with **Hapi.js** and **MongoDB** (Mongoose), as per `FULL_STACK_MIGRATION_PLAN.md`.

## Stack

- **Runtime:** Node.js (v18+)
- **Framework:** Hapi.js
- **Database:** MongoDB with Mongoose ODM
- **Auth:** JWT (hapi-auth-jwt2)
- **Validation:** Joi

## Setup

1. **Install dependencies**
   ```bash
   cd backend && npm install
   ```

2. **Environment**
   - Copy `.env.example` to `.env`
   - Set `MONGODB_URI` (e.g. `mongodb://localhost:27017/eventbuzz`)
   - Set `JWT_SECRET` and `JWT_REFRESH_SECRET` for production
   - Optional **Google SSO:** set `GOOGLE_CLIENT_ID` to your OAuth 2.0 Web client ID (same value as the dashboard’s `VITE_GOOGLE_CLIENT_ID`). Add authorized JavaScript origins for each app URL in Google Cloud Console.

3. **Run**
   ```bash
   npm run dev
   ```
   Server runs at `http://localhost:3002` (or `PORT` from `.env`).

4. **Multi-tenant backfill (after pulling schema that requires org on forms/speakers)**  
   Run once against your database before restart if you have legacy rows:
   ```bash
   npm run backfill:tenant-organization
   ```

## API Overview

- **Auth:** `POST /api/auth/register`, `POST /api/auth/login`, `POST /api/auth/google`, `POST /api/auth/google/register`, `GET /api/auth/me`, etc.
- **Events:** `GET/POST /api/events`, `GET/PUT/DELETE /api/events/:id`
- **Participants:** `GET/POST /api/events/:eventId/participants`, `POST /api/participants/:id/check-in`
- **Sessions:** `GET/POST /api/events/:eventId/sessions`, `GET/PUT/DELETE /api/sessions/:id`
- **Speakers:** `GET/POST /api/speakers`, `GET /api/events/:eventId/speakers`
- **Questions:** `GET/POST /api/events/:eventId/questions`, `POST /api/questions/:id/upvote`, `POST /api/questions/:id/answer`
- **Quiz/Polls:** `GET/POST /api/events/:eventId/quiz-polls`, `POST /api/quiz-polls/:quizPollId/responses`
- **Campaigns:** `GET/POST /api/events/:eventId/campaigns`, `POST /api/campaigns/:id/send`
- **Notifications:** `GET /api/notifications`, `PUT /api/notifications/:id/read`
- **Forms:** `GET/POST /api/events/:eventId/forms`, `POST /api/forms/:formId/submit`
- **Design templates:** `GET/POST /api/design-templates`, `POST /api/design-templates/:id/use/:eventId`
- **Reward points:** `GET/POST /api/events/:eventId/reward-points`, `GET /api/events/:eventId/leaderboard`
- **Event pages:** `GET/POST /api/events/:eventId/pages`, `GET /api/pages/public/:eventSlug/:pageSlug`
- **Media:** `GET /api/media`, `POST /api/media/upload`
- **Payment:** `GET/POST /api/payment/config`, `POST /api/payment/create-order`, `POST /api/payment/verify`
- **Organization:** `GET/PUT /api/organization`, `GET/POST/PUT/DELETE /api/users`

Protected routes expect header: `Authorization: Bearer <token>`.

## Project structure

```
backend/
├── src/
│   ├── config/       # database, constants
│   ├── models/       # Mongoose models (User, Event, Participant, etc.)
│   ├── controllers/  # Route handlers
│   ├── routes/       # Hapi route definitions
│   ├── middleware/   # Auth helpers
│   ├── utils/        # response helpers
│   └── app.js        # Server setup
├── server.js
├── package.json
└── .env.example
```