Major Enhancement: NestJS Migration + CASL Authorization + Error Handling

Complete rewrite from Express to NestJS with enterprise-grade features:

## Backend Improvements
- Migrated from Express to NestJS 11.0.1 with TypeScript
- Implemented Prisma ORM 7.3.0 for type-safe database access
- Added CASL authorization system replacing role-based guards
- Created global exception filters with structured logging
- Implemented Auth0 JWT authentication with Passport.js
- Added vehicle management with conflict detection
- Enhanced event scheduling with driver/vehicle assignment
- Comprehensive error handling and logging

## Frontend Improvements
- Upgraded to React 19.2.0 with Vite 7.2.4
- Implemented CASL-based permission system
- Added AbilityContext for declarative permissions
- Created ErrorHandler utility for consistent error messages
- Enhanced API client with request/response logging
- Added War Room (Command Center) dashboard
- Created VIP Schedule view with complete itineraries
- Implemented Vehicle Management UI
- Added mock data generators for testing (288 events across 20 VIPs)

## New Features
- Vehicle fleet management (types, capacity, status tracking)
- Complete 3-day Jamboree schedule generation
- Individual VIP schedule pages with PDF export (planned)
- Real-time War Room dashboard with auto-refresh
- Permission-based navigation filtering
- First user auto-approval as administrator

## Documentation
- Created CASL_AUTHORIZATION.md (comprehensive guide)
- Created ERROR_HANDLING.md (error handling patterns)
- Updated CLAUDE.md with new architecture
- Added migration guides and best practices

## Technical Debt Resolved
- Removed custom authentication in favor of Auth0
- Replaced role checks with CASL abilities
- Standardized error responses across API
- Implemented proper TypeScript typing
- Added comprehensive logging

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

backend/src/flights/dto/create-flight.dto.ts

@@ -0,0 +1,42 @@
+import { IsString, IsDateString, IsInt, IsUUID, IsOptional } from 'class-validator';
+
+export class CreateFlightDto {
+  @IsUUID()
+  vipId: string;
+
+  @IsString()
+  flightNumber: string;
+
+  @IsDateString()
+  flightDate: string;
+
+  @IsInt()
+  @IsOptional()
+  segment?: number;
+
+  @IsString()
+  departureAirport: string;
+
+  @IsString()
+  arrivalAirport: string;
+
+  @IsDateString()
+  @IsOptional()
+  scheduledDeparture?: string;
+
+  @IsDateString()
+  @IsOptional()
+  scheduledArrival?: string;
+
+  @IsDateString()
+  @IsOptional()
+  actualDeparture?: string;
+
+  @IsDateString()
+  @IsOptional()
+  actualArrival?: string;
+
+  @IsString()
+  @IsOptional()
+  status?: string;
+}

backend/src/flights/dto/index.ts

@@ -0,0 +1,2 @@
+export * from './create-flight.dto';
+export * from './update-flight.dto';

backend/src/flights/dto/update-flight.dto.ts

@@ -0,0 +1,4 @@
+import { PartialType } from '@nestjs/mapped-types';
+import { CreateFlightDto } from './create-flight.dto';
+
+export class UpdateFlightDto extends PartialType(CreateFlightDto) {}

backend/src/flights/flights.controller.ts

@@ -0,0 +1,72 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Patch,
+  Delete,
+  Body,
+  Param,
+  Query,
+  UseGuards,
+} from '@nestjs/common';
+import { FlightsService } from './flights.service';
+import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
+import { RolesGuard } from '../auth/guards/roles.guard';
+import { Roles } from '../auth/decorators/roles.decorator';
+import { Role } from '@prisma/client';
+import { CreateFlightDto, UpdateFlightDto } from './dto';
+
+@Controller('flights')
+@UseGuards(JwtAuthGuard, RolesGuard)
+export class FlightsController {
+  constructor(private readonly flightsService: FlightsService) {}
+
+  @Post()
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  create(@Body() createFlightDto: CreateFlightDto) {
+    return this.flightsService.create(createFlightDto);
+  }
+
+  @Get()
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  findAll() {
+    return this.flightsService.findAll();
+  }
+
+  @Get('status/:flightNumber')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  getFlightStatus(
+    @Param('flightNumber') flightNumber: string,
+    @Query('date') date?: string,
+  ) {
+    return this.flightsService.getFlightStatus(flightNumber, date);
+  }
+
+  @Get('vip/:vipId')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  findByVip(@Param('vipId') vipId: string) {
+    return this.flightsService.findByVip(vipId);
+  }
+
+  @Get(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  findOne(@Param('id') id: string) {
+    return this.flightsService.findOne(id);
+  }
+
+  @Patch(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  update(@Param('id') id: string, @Body() updateFlightDto: UpdateFlightDto) {
+    return this.flightsService.update(id, updateFlightDto);
+  }
+
+  @Delete(':id')
+  @Roles(Role.ADMINISTRATOR, Role.COORDINATOR)
+  remove(
+    @Param('id') id: string,
+    @Query('hard') hard?: string,
+  ) {
+    const isHardDelete = hard === 'true';
+    return this.flightsService.remove(id, isHardDelete);
+  }
+}

backend/src/flights/flights.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { HttpModule } from '@nestjs/axios';
+import { FlightsController } from './flights.controller';
+import { FlightsService } from './flights.service';
+
+@Module({
+  imports: [HttpModule],
+  controllers: [FlightsController],
+  providers: [FlightsService],
+  exports: [FlightsService],
+})
+export class FlightsModule {}

backend/src/flights/flights.service.ts

@@ -0,0 +1,170 @@
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { HttpService } from '@nestjs/axios';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '../prisma/prisma.service';
+import { CreateFlightDto, UpdateFlightDto } from './dto';
+import { firstValueFrom } from 'rxjs';
+
+@Injectable()
+export class FlightsService {
+  private readonly logger = new Logger(FlightsService.name);
+  private readonly apiKey: string;
+  private readonly baseUrl = 'http://api.aviationstack.com/v1';
+
+  constructor(
+    private prisma: PrismaService,
+    private httpService: HttpService,
+    private configService: ConfigService,
+  ) {
+    this.apiKey = this.configService.get('AVIATIONSTACK_API_KEY') || '';
+  }
+
+  async create(createFlightDto: CreateFlightDto) {
+    this.logger.log(
+      `Creating flight: ${createFlightDto.flightNumber} for VIP ${createFlightDto.vipId}`,
+    );
+
+    return this.prisma.flight.create({
+      data: {
+        ...createFlightDto,
+        flightDate: new Date(createFlightDto.flightDate),
+        scheduledDeparture: createFlightDto.scheduledDeparture
+          ? new Date(createFlightDto.scheduledDeparture)
+          : undefined,
+        scheduledArrival: createFlightDto.scheduledArrival
+          ? new Date(createFlightDto.scheduledArrival)
+          : undefined,
+      },
+      include: { vip: true },
+    });
+  }
+
+  async findAll() {
+    return this.prisma.flight.findMany({
+      include: { vip: true },
+      orderBy: { flightDate: 'desc' },
+    });
+  }
+
+  async findByVip(vipId: string) {
+    return this.prisma.flight.findMany({
+      where: { vipId },
+      orderBy: [{ flightDate: 'asc' }, { segment: 'asc' }],
+    });
+  }
+
+  async findOne(id: string) {
+    const flight = await this.prisma.flight.findUnique({
+      where: { id },
+      include: { vip: true },
+    });
+
+    if (!flight) {
+      throw new NotFoundException(`Flight with ID ${id} not found`);
+    }
+
+    return flight;
+  }
+
+  async update(id: string, updateFlightDto: UpdateFlightDto) {
+    const flight = await this.findOne(id);
+
+    this.logger.log(`Updating flight ${id}: ${flight.flightNumber}`);
+
+    const updateData: any = { ...updateFlightDto };
+    const dto = updateFlightDto as any; // Type assertion to work around PartialType
+
+    if (dto.flightDate) {
+      updateData.flightDate = new Date(dto.flightDate);
+    }
+    if (dto.scheduledDeparture) {
+      updateData.scheduledDeparture = new Date(dto.scheduledDeparture);
+    }
+    if (dto.scheduledArrival) {
+      updateData.scheduledArrival = new Date(dto.scheduledArrival);
+    }
+    if (dto.actualDeparture) {
+      updateData.actualDeparture = new Date(dto.actualDeparture);
+    }
+    if (dto.actualArrival) {
+      updateData.actualArrival = new Date(dto.actualArrival);
+    }
+
+    return this.prisma.flight.update({
+      where: { id: flight.id },
+      data: updateData,
+      include: { vip: true },
+    });
+  }
+
+  async remove(id: string, hardDelete = false) {
+    const flight = await this.findOne(id);
+
+    this.logger.log(`Deleting flight: ${flight.flightNumber}`);
+
+    // Flights are always hard deleted (no soft delete for flights)
+    return this.prisma.flight.delete({
+      where: { id: flight.id },
+    });
+  }
+
+  /**
+   * Fetch real-time flight status from AviationStack API
+   */
+  async getFlightStatus(flightNumber: string, flightDate?: string) {
+    if (!this.apiKey) {
+      this.logger.warn('AviationStack API key not configured');
+      return {
+        message: 'Flight tracking API not configured',
+        flightNumber,
+      };
+    }
+
+    try {
+      const params: any = {
+        access_key: this.apiKey,
+        flight_iata: flightNumber,
+      };
+
+      if (flightDate) {
+        params.flight_date = flightDate;
+      }
+
+      const response = await firstValueFrom(
+        this.httpService.get(`${this.baseUrl}/flights`, { params }),
+      );
+
+      const data = response.data as any;
+      if (data && data.data && data.data.length > 0) {
+        const flightData = data.data[0];
+
+        return {
+          flightNumber: flightData.flight.iata,
+          status: flightData.flight_status,
+          departure: {
+            airport: flightData.departure.iata,
+            scheduled: flightData.departure.scheduled,
+            actual: flightData.departure.actual,
+          },
+          arrival: {
+            airport: flightData.arrival.iata,
+            scheduled: flightData.arrival.scheduled,
+            estimated: flightData.arrival.estimated,
+            actual: flightData.arrival.actual,
+          },
+        };
+      }
+
+      return {
+        message: 'Flight not found',
+        flightNumber,
+      };
+    } catch (error) {
+      this.logger.error(
+        `Failed to fetch flight status: ${error.message}`,
+        error.stack,
+      );
+      throw error;
+    }
+  }
+}