Added Introduction Modal (#106)

* Added Modal with new handler/service

* PR Suggestions

* Transition to Tanstack forms

* fix(onboard): fix styling and update route

---------

Co-authored-by: Alexander Wang <alexander.yisu.wang@outlook.com>
Co-authored-by: Alexander Wang <98280966+AlexanderWangY@users.noreply.github.com>

Author: hugoliu-code

apps/api/cmd/api/main.go

@@ -66,13 +66,14 @@ func main() {
 
 	// Injections into services
 	authService := services.NewAuthService(userRepo, accountRepo, sessionRepo, txm, client, logger, &cfg.Auth)
+	userService := services.NewUserService(userRepo, logger)
 	eventInterestService := services.NewEventInterestService(eventInterestRepo, logger)
 	eventService := services.NewEventService(eventRepo, userRepo, logger)
 	emailService := services.NewEmailService(taskQueueClient, logger)
 	applicationService := services.NewApplicationService(applicationRepo, eventService, txm, r2Client, &cfg.CoreBuckets, logger)
 
 	// Injections into handlers
-	apiHandlers := handlers.NewHandlers(authService, eventInterestService, eventService, emailService, applicationService, cfg, logger)
+	apiHandlers := handlers.NewHandlers(authService, userService, eventInterestService, eventService, emailService, applicationService, cfg, logger)
 
 	api := api.NewAPI(&logger, apiHandlers, mw)
 

apps/api/internal/api/api.go

@@ -49,7 +49,7 @@ func (api *API) setupRoutes(mw *mw.Middleware) {
 	api.Router.Use(middleware.RealIP)
 	api.Router.Use(cors.Handler(cors.Options{
 		AllowedOrigins:   AllowedOrigins,
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowedMethods:   []string{"GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"},
 		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token"},
 		ExposedHeaders:   []string{"Link"},
 		AllowCredentials: true,
@@ -60,39 +60,60 @@ func (api *API) setupRoutes(mw *mw.Middleware) {
 	api.Router.Get("/ping", func(w http.ResponseWriter, r *http.Request) {
 		api.Logger.Trace().Str("method", r.Method).Str("path", r.URL.Path).Msg("Received ping.")
 		w.Header().Set("Content-Type", "text/plain")
-		w.Header().Set("Content-Length", "6") // "pong!\n" is 6 bytes
+		w.Header().Set("Content-Length", "6")
 		if _, err := w.Write([]byte("pong!\n")); err != nil {
 			log.Err(err)
 		}
 	})
 
-	// Auth routes
+	// --- Auth routes ---
 	api.Router.Route("/auth", func(r chi.Router) {
 		r.Get("/callback", api.Handlers.Auth.OAuthCallback)
 
+		// Protected auth routes
 		r.Group(func(r chi.Router) {
 			r.Use(mw.Auth.RequireAuth)
 			r.Get("/me", api.Handlers.Auth.GetMe)
 			r.Post("/logout", api.Handlers.Auth.Logout)
 		})
 	})
 
-	// Event routes
+	// --- User routes ---
+	api.Router.Route("/users", func(r chi.Router) {
+		r.Use(mw.Auth.RequireAuth)
+		r.Get("/me", api.Handlers.User.GetProfile)
+		r.Patch("/me/onboarding", api.Handlers.User.CompleteOnboarding)
+	})
+
+	// --- Event routes ---
 	api.Router.Route("/events", func(r chi.Router) {
+
+		// Superuser-only
 		r.With(mw.Auth.RequireAuth, ensureSuperuser).Post("/", api.Handlers.Event.CreateEvent)
+
+		// Authenticated
 		r.With(mw.Auth.RequireAuth).Get("/", api.Handlers.Event.GetEvents)
+
+		// Event-specific routes
 		r.Route("/{eventId}", func(r chi.Router) {
+			r.Use(mw.Auth.RequireAuth)
 
-			r.With(mw.Auth.RequireAuth, ensureEventAdmin).Patch("/", api.Handlers.Event.UpdateEventById)
-			r.With(mw.Auth.RequireAuth, ensureSuperuser).Delete("/", api.Handlers.Event.DeleteEventById)
-			r.With(mw.Auth.RequireAuth, ensureEventAdmin).Get("/staff", api.Handlers.Event.GetEventStaffUsers)
-			r.With(mw.Auth.RequireAuth, ensureEventAdmin).Post("/roles", api.Handlers.Event.AssignEventRole)
-			r.With(mw.Auth.RequireAuth).Get("/role", api.Handlers.Event.GetEventRole)
+			// General access
 			r.Get("/", api.Handlers.Event.GetEventByID)
-			r.With(httprate.LimitByIP(5, time.Minute)).Post("/interest", api.Handlers.EventInterest.AddEmailToEvent)
+			r.Post("/interest", api.Handlers.EventInterest.AddEmailToEvent)
+
+			// Admin-only
+			r.With(ensureEventAdmin).Patch("/", api.Handlers.Event.UpdateEventById)
+			r.With(ensureEventAdmin).Get("/staff", api.Handlers.Event.GetEventStaffUsers)
+			r.With(ensureEventAdmin).Post("/roles", api.Handlers.Event.AssignEventRole)
+			r.With(ensureEventAdmin).Get("/role", api.Handlers.Event.GetEventRole)
+
+			// Superuser-only
+			r.With(ensureSuperuser).Delete("/", api.Handlers.Event.DeleteEventById)
+
+			// Application routes
 			r.Route("/application", func(r chi.Router) {
 				r.Use(mw.Auth.RequireAuth)
-
 				r.Get("/", api.Handlers.Application.GetApplicationByUserAndEventID)
 				r.Post("/submit", api.Handlers.Application.SubmitApplication)
 				r.Post("/save", api.Handlers.Application.SaveApplication)

apps/api/internal/api/handlers/handlers.go

@@ -8,6 +8,7 @@ import (
 
 type Handlers struct {
 	Auth          *AuthHandler
+	User          *UserHandler
 	EventInterest *EventInterestHandler
 	Event         *EventHandler
 	Email         *EmailHandler
@@ -16,6 +17,7 @@ type Handlers struct {
 
 func NewHandlers(
 	authService *services.AuthService,
+	userService *services.UserService,
 	eventInterestService *services.EventInterestService,
 	eventService *services.EventService,
 	emailService *services.EmailService,
@@ -25,6 +27,7 @@ func NewHandlers(
 ) *Handlers {
 	return &Handlers{
 		Auth:          NewAuthHandler(authService, cfg, logger),
+		User:          NewUserHandler(userService, logger),
 		EventInterest: NewEventInterestHandler(eventInterestService, cfg, logger),
 		Event:         NewEventHandler(eventService, cfg, logger),
 		Email:         NewEmailHandler(emailService, logger),

apps/api/internal/api/handlers/user.go

@@ -0,0 +1,89 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/rs/zerolog"
+	res "github.com/swamphacks/core/apps/api/internal/api/response"
+	"github.com/swamphacks/core/apps/api/internal/ctxutils"
+	"github.com/swamphacks/core/apps/api/internal/email"
+	"github.com/swamphacks/core/apps/api/internal/services"
+)
+
+type UserHandler struct {
+	userService *services.UserService
+	logger      zerolog.Logger
+}
+
+func NewUserHandler(userService *services.UserService, logger zerolog.Logger) *UserHandler {
+	return &UserHandler{
+		userService: userService,
+		logger:      logger.With().Str("handler", "UserHandler").Str("component", "user").Logger(),
+	}
+}
+
+func (h *UserHandler) GetProfile(w http.ResponseWriter, r *http.Request) {
+	userId := ctxutils.GetUserIdFromCtx(r.Context())
+	if userId == nil {
+		res.SendError(w, http.StatusUnauthorized, res.NewError("unauthorized", "User not authenticated"))
+		return
+	}
+
+	user, err := h.userService.GetUser(r.Context(), *userId)
+	if err != nil {
+		h.logger.Err(err).Msg("failed to get user profile")
+		if err == services.ErrUserNotFound {
+			res.SendError(w, http.StatusNotFound, res.NewError("user_not_found", "User profile not found"))
+		} else {
+			res.SendError(w, http.StatusInternalServerError, res.NewError("internal_err", "Something went seriously wrong."))
+		}
+		return
+	}
+
+	res.Send(w, http.StatusOK, user)
+}
+
+type CompleteOnboardingRequest struct {
+	Name           string `json:"name"`
+	PreferredEmail string `json:"preferred_email"`
+}
+
+func (h *UserHandler) CompleteOnboarding(w http.ResponseWriter, r *http.Request) {
+	userId := ctxutils.GetUserIdFromCtx(r.Context())
+	if userId == nil {
+		res.SendError(w, http.StatusUnauthorized, res.NewError("unauthorized", "User not authenticated"))
+		return
+	}
+
+	var req CompleteOnboardingRequest
+	decoder := json.NewDecoder(r.Body)
+	decoder.DisallowUnknownFields() // Prevents requests with extraneous fields
+	if err := decoder.Decode(&req); err != nil {
+		res.SendError(w, http.StatusBadRequest, res.NewError("invalid_request", "Invalid request body"))
+		return
+	}
+
+	// Validate required fields
+	if req.Name == "" || req.PreferredEmail == "" {
+		res.SendError(w, http.StatusBadRequest, res.NewError("invalid_request", "Name and preferred email are required"))
+		return
+	}
+
+	// Validate email format
+	if !email.IsValidEmail(req.PreferredEmail) {
+		res.SendError(w, http.StatusBadRequest, res.NewError("invalid_email", "Invalid email format"))
+		return
+	}
+
+	err := h.userService.CompleteOnboarding(r.Context(), *userId, req.Name, req.PreferredEmail)
+	if err != nil {
+		h.logger.Err(err).Msg("failed to complete onboarding")
+		if err == services.ErrUserNotFound {
+			res.SendError(w, http.StatusNotFound, res.NewError("user_not_found", "User not found"))
+		} else {
+			res.SendError(w, http.StatusInternalServerError, res.NewError("update_failed", "Failed to complete onboarding"))
+		}
+		return
+	}
+}

apps/api/internal/db/migrations/20250905210705_add_preferred_email_column.sql

@@ -0,0 +1,11 @@
+-- +goose Up
+-- +goose StatementBegin
+ALTER TABLE auth.users
+ADD COLUMN preferred_email TEXT;
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+ALTER TABLE auth.users
+DROP COLUMN preferred_email;
+-- +goose StatementEnd

apps/api/internal/db/queries/users.sql

@@ -22,6 +22,7 @@ SET
     name = CASE WHEN @name_do_update::boolean THEN @name ELSE name END,
     email = CASE WHEN @email_do_update::boolean THEN @email ELSE email END,
     email_verified = CASE WHEN @email_verified_do_update::boolean THEN @email_verified ELSE email_verified END,
+    preferred_email = CASE WHEN @preferred_email_do_update::boolean THEN @preferred_email ELSE preferred_email END,
     onboarded = CASE WHEN @onboarded_do_update::boolean THEN @onboarded ELSE onboarded END,
     image = CASE WHEN @image_do_update::boolean THEN @image ELSE image END,
     updated_at = NOW()

apps/api/internal/db/repository/users.go

@@ -64,3 +64,13 @@ func (r *UserRepository) GetByEmail(ctx context.Context, email string) (*sqlc.Au
 
 	return &user, nil
 }
+
+func (r *UserRepository) UpdateUser(ctx context.Context, params sqlc.UpdateUserParams) error {
+	err := r.db.Query.UpdateUser(ctx, params)
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return ErrUserNotFound
+		}
+	}
+	return err
+}