Major Enhancement: NestJS Migration + CASL Authorization + Error Handling

Complete rewrite from Express to NestJS with enterprise-grade features:

## Backend Improvements
- Migrated from Express to NestJS 11.0.1 with TypeScript
- Implemented Prisma ORM 7.3.0 for type-safe database access
- Added CASL authorization system replacing role-based guards
- Created global exception filters with structured logging
- Implemented Auth0 JWT authentication with Passport.js
- Added vehicle management with conflict detection
- Enhanced event scheduling with driver/vehicle assignment
- Comprehensive error handling and logging

## Frontend Improvements
- Upgraded to React 19.2.0 with Vite 7.2.4
- Implemented CASL-based permission system
- Added AbilityContext for declarative permissions
- Created ErrorHandler utility for consistent error messages
- Enhanced API client with request/response logging
- Added War Room (Command Center) dashboard
- Created VIP Schedule view with complete itineraries
- Implemented Vehicle Management UI
- Added mock data generators for testing (288 events across 20 VIPs)

## New Features
- Vehicle fleet management (types, capacity, status tracking)
- Complete 3-day Jamboree schedule generation
- Individual VIP schedule pages with PDF export (planned)
- Real-time War Room dashboard with auto-refresh
- Permission-based navigation filtering
- First user auto-approval as administrator

## Documentation
- Created CASL_AUTHORIZATION.md (comprehensive guide)
- Created ERROR_HANDLING.md (error handling patterns)
- Updated CLAUDE.md with new architecture
- Added migration guides and best practices

## Technical Debt Resolved
- Removed custom authentication in favor of Auth0
- Replaced role checks with CASL abilities
- Standardized error responses across API
- Implemented proper TypeScript typing
- Added comprehensive logging

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

backend/src/events/dto/create-event.dto.ts

@@ -0,0 +1,58 @@
+import {
+  IsString,
+  IsEnum,
+  IsOptional,
+  IsUUID,
+  IsDateString,
+} from 'class-validator';
+import { EventType, EventStatus } from '@prisma/client';
+
+export class CreateEventDto {
+  @IsUUID()
+  vipId: string;
+
+  @IsString()
+  title: string;
+
+  @IsString()
+  @IsOptional()
+  location?: string;
+
+  @IsString()
+  @IsOptional()
+  pickupLocation?: string;
+
+  @IsString()
+  @IsOptional()
+  dropoffLocation?: string;
+
+  @IsDateString()
+  startTime: string;
+
+  @IsDateString()
+  endTime: string;
+
+  @IsString()
+  @IsOptional()
+  description?: string;
+
+  @IsString()
+  @IsOptional()
+  notes?: string;
+
+  @IsEnum(EventType)
+  @IsOptional()
+  type?: EventType;
+
+  @IsEnum(EventStatus)
+  @IsOptional()
+  status?: EventStatus;
+
+  @IsUUID()
+  @IsOptional()
+  driverId?: string;
+
+  @IsUUID()
+  @IsOptional()
+  vehicleId?: string;
+}

backend/src/events/dto/index.ts

@@ -0,0 +1,3 @@
+export * from './create-event.dto';
+export * from './update-event.dto';
+export * from './update-event-status.dto';

backend/src/events/dto/update-event-status.dto.ts

@@ -0,0 +1,7 @@
+import { IsEnum } from 'class-validator';
+import { EventStatus } from '@prisma/client';
+
+export class UpdateEventStatusDto {
+  @IsEnum(EventStatus)
+  status: EventStatus;
+}

backend/src/events/dto/update-event.dto.ts

@@ -0,0 +1,4 @@
+import { PartialType } from '@nestjs/mapped-types';
+import { CreateEventDto } from './create-event.dto';
+
+export class UpdateEventDto extends PartialType(CreateEventDto) {}

backend/src/events/events.controller.ts

@@ -0,0 +1,66 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Body,
+  Param,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import { EventsService } from './events.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { RolesGuard } from '../auth/guards/roles.guard';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { Role } from '@prisma/client';
+import { CreateEventDto, UpdateEventDto, UpdateEventStatusDto } from './dto';
+
+@Controller('events')
+@UseGuards(JwtAuthGuard, RolesGuard)
+export class EventsController {
+  constructor(private readonly eventsService: EventsService) {}
+
+  @Post()
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  create(@Body() createEventDto: CreateEventDto) {
+    return this.eventsService.create(createEventDto);
+  }
+
+  @Get()
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR, Role.DRIVER)
+  findAll() {
+    return this.eventsService.findAll();
+  }
+
+  @Get(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR, Role.DRIVER)
+  findOne(@Param('id') id: string) {
+    return this.eventsService.findOne(id);
+  }
+
+  @Patch(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  update(@Param('id') id: string, @Body() updateEventDto: UpdateEventDto) {
+    return this.eventsService.update(id, updateEventDto);
+  }
+
+  @Patch(':id/status')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR, Role.DRIVER)
+  updateStatus(
+    @Param('id') id: string,
+    @Body() updateEventStatusDto: UpdateEventStatusDto,
+  ) {
+    return this.eventsService.updateStatus(id, updateEventStatusDto);
+  }
+
+  @Delete(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  remove(
+    @Param('id') id: string,
+    @Query('hard') hard?: string,
+  ) {
+    const isHardDelete = hard === 'true';
+    return this.eventsService.remove(id, isHardDelete);
+  }
+}

backend/src/events/events.module.ts

@@ -0,0 +1,10 @@
+import { Module } from '@nestjs/common';
+import { EventsController } from './events.controller';
+import { EventsService } from './events.service';
+
+@Module({
+  controllers: [EventsController],
+  providers: [EventsService],
+  exports: [EventsService],
+})
+export class EventsModule {}

backend/src/events/events.service.ts

@@ -0,0 +1,222 @@
+import {
+  Injectable,
+  NotFoundException,
+  BadRequestException,
+  Logger,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+import { CreateEventDto, UpdateEventDto, UpdateEventStatusDto } from './dto';
+
+@Injectable()
+export class EventsService {
+  private readonly logger = new Logger(EventsService.name);
+
+  constructor(private prisma: PrismaService) {}
+
+  async create(createEventDto: CreateEventDto) {
+    this.logger.log(`Creating event: ${createEventDto.title}`);
+
+    // Check for conflicts if driver is assigned
+    if (createEventDto.driverId) {
+      const conflicts = await this.checkConflicts(
+        createEventDto.driverId,
+        new Date(createEventDto.startTime),
+        new Date(createEventDto.endTime),
+      );
+
+      if (conflicts.length > 0) {
+        this.logger.warn(
+          `Conflict detected for driver ${createEventDto.driverId}`,
+        );
+        throw new BadRequestException({
+          message: 'Driver has conflicting events',
+          conflicts: conflicts.map((e) => ({
+            id: e.id,
+            title: e.title,
+            startTime: e.startTime,
+            endTime: e.endTime,
+          })),
+        });
+      }
+    }
+
+    return this.prisma.scheduleEvent.create({
+      data: {
+        ...createEventDto,
+        startTime: new Date(createEventDto.startTime),
+        endTime: new Date(createEventDto.endTime),
+      },
+      include: {
+        vip: true,
+        driver: true,
+        vehicle: true,
+      },
+    });
+  }
+
+  async findAll() {
+    return this.prisma.scheduleEvent.findMany({
+      where: { deletedAt: null },
+      include: {
+        vip: true,
+        driver: true,
+        vehicle: true,
+      },
+      orderBy: { startTime: 'asc' },
+    });
+  }
+
+  async findOne(id: string) {
+    const event = await this.prisma.scheduleEvent.findFirst({
+      where: { id, deletedAt: null },
+      include: {
+        vip: true,
+        driver: true,
+        vehicle: true,
+      },
+    });
+
+    if (!event) {
+      throw new NotFoundException(`Event with ID ${id} not found`);
+    }
+
+    return event;
+  }
+
+  async update(id: string, updateEventDto: UpdateEventDto) {
+    const event = await this.findOne(id);
+
+    // Check for conflicts if driver or times are being updated
+    if (
+      updateEventDto.driverId ||
+      updateEventDto.startTime ||
+      updateEventDto.endTime
+    ) {
+      const driverId = updateEventDto.driverId || event.driverId;
+      const startTime = updateEventDto.startTime
+        ? new Date(updateEventDto.startTime)
+        : event.startTime;
+      const endTime = updateEventDto.endTime
+        ? new Date(updateEventDto.endTime)
+        : event.endTime;
+
+      if (driverId) {
+        const conflicts = await this.checkConflicts(
+          driverId,
+          startTime,
+          endTime,
+          event.id, // Exclude current event from conflict check
+        );
+
+        if (conflicts.length > 0) {
+          this.logger.warn(`Conflict detected for driver ${driverId}`);
+          throw new BadRequestException({
+            message: 'Driver has conflicting events',
+            conflicts: conflicts.map((e) => ({
+              id: e.id,
+              title: e.title,
+              startTime: e.startTime,
+              endTime: e.endTime,
+            })),
+          });
+        }
+      }
+    }
+
+    this.logger.log(`Updating event ${id}: ${event.title}`);
+
+    const updateData: any = { ...updateEventDto };
+    if (updateEventDto.startTime) {
+      updateData.startTime = new Date(updateEventDto.startTime);
+    }
+    if (updateEventDto.endTime) {
+      updateData.endTime = new Date(updateEventDto.endTime);
+    }
+
+    return this.prisma.scheduleEvent.update({
+      where: { id: event.id },
+      data: updateData,
+      include: {
+        vip: true,
+        driver: true,
+        vehicle: true,
+      },
+    });
+  }
+
+  async updateStatus(id: string, updateEventStatusDto: UpdateEventStatusDto) {
+    const event = await this.findOne(id);
+
+    this.logger.log(
+      `Updating event status ${id}: ${event.title} -> ${updateEventStatusDto.status}`,
+    );
+
+    return this.prisma.scheduleEvent.update({
+      where: { id: event.id },
+      data: { status: updateEventStatusDto.status },
+      include: {
+        vip: true,
+        driver: true,
+        vehicle: true,
+      },
+    });
+  }
+
+  async remove(id: string, hardDelete = false) {
+    const event = await this.findOne(id);
+
+    if (hardDelete) {
+      this.logger.log(`Hard deleting event: ${event.title}`);
+      return this.prisma.scheduleEvent.delete({
+        where: { id: event.id },
+      });
+    }
+
+    this.logger.log(`Soft deleting event: ${event.title}`);
+    return this.prisma.scheduleEvent.update({
+      where: { id: event.id },
+      data: { deletedAt: new Date() },
+    });
+  }
+
+  /**
+   * Check for conflicting events for a driver
+   */
+  private async checkConflicts(
+    driverId: string,
+    startTime: Date,
+    endTime: Date,
+    excludeEventId?: string,
+  ) {
+    return this.prisma.scheduleEvent.findMany({
+      where: {
+        driverId,
+        deletedAt: null,
+        id: excludeEventId ? { not: excludeEventId } : undefined,
+        OR: [
+          {
+            // New event starts during existing event
+            AND: [
+              { startTime: { lte: startTime } },
+              { endTime: { gt: startTime } },
+            ],
+          },
+          {
+            // New event ends during existing event
+            AND: [
+              { startTime: { lt: endTime } },
+              { endTime: { gte: endTime } },
+            ],
+          },
+          {
+            // New event completely contains existing event
+            AND: [
+              { startTime: { gte: startTime } },
+              { endTime: { lte: endTime } },
+            ],
+          },
+        ],
+      },
+    });
+  }
+}