F3-Nation/f3-nation

Affected app apps/api Provide environment information Chromium Desktop Describe the bug Not every api route has .output(). Example: f3-nation/packages/api/src/router/org-chart/index.ts Line 34 in cd58c21 all: protectedProcedure has .outpu() and f3-nation/packages/api/src/router/event-tag.ts Lines 30 to 31 in cd58c21 all: protectedProcedure .input( does not. The .output() is used in api documentation and /docs to tell developers what to expect. It's very important. Link to reproduction https://api.f3nation.com/docs#tag/event-tag/GET/v1/event-tag To reproduce Go to the link above and try to inspect the sample response payload. Additional information ALSO very important, it overrides the return. So if you return 3 properti

Summary The two Slackbot Docker images (apps/slackbot/Dockerfile and apps/slackbot/scripts/Dockerfile) run as the root user. Every other app in this repo (map, me, auth, admin, api) already runs as a dedicated, limited user instead of root. The Slackbot images are the odd ones out. Why it matters Running as root inside a container is a common security weak spot. If anything inside the container is ever compromised, root access makes it much easier for that problem to spread. Switching to a regular, limited user is a standard, low-risk hardening step — most other containers in this repo already do it. What to do In both apps/slackbot/Dockerfile and apps/slackbot/scripts/Dockerfile, add a dedicated non-root user and switch to it before the final CMD, the same way apps/map/Dockerfile and apps/api/Dockerfile already do (search those files for USER to see the existing pattern — create a system user/group, chown any files that user needs to read, then add a USER <name> line near the end)

Summary Checklist of small housekeeping items found during an architectural assessment. None is urgent; all reduce confusion for new contributors and AI agents reading the repo. Each checkbox is independently PR-able. Items Delete vercel.json. Contains only {"github": {"silent": true}}, untouched since the initial commit. Apps deploy to Cloud Run + GitHub Pages; this file falsely implies a Vercel integration. Relocate or delete iframe-test.html (repo root). A 14-line manual embed test pointing at http://localhost:3000. If still useful for testing the map embed, move to apps/map/ or docs/; otherwise delete. Remove dead turbo.json output globs. build.outputs lists .expo/** and .output/** (turbo.json:59-60) — leftovers from the t3-turbo template; no Expo/Nitro apps exist. Consider inputs on turbo tasks. No task defines inputs, so any file in a package (README edits, test files) invalidates its build cache. Scoping build inputs (e.g. excluding **/*.md) cuts needless rebuilds. Measur

Summary Checklist of small, independent, individually-verified performance fixes. Each checkbox is a self-contained ~15-minute PR — good first issues; pick off one box at a time. Items Full lodash import in the shared UI package. packages/ui/src/radio-group.tsx:3 does import { omit } from "lodash"; — pulls all of lodash into the client bundle of every app that uses radio-group. Change to import omit from "lodash/omit"; (the repo already does this correctly in packages/api/src/router/map/location.ts:2). This is the only offending import repo-wide (verified by grep). map.location.regions over-selects. packages/api/src/router/map/location.ts (~:477-489) runs .select() — the entire orgs row including the json meta blob, website, socials — then maps to just {id, name, logo, website}. Use an explicit column projection so Postgres doesn't ship the wide rows. me.profile sequential waterfall. packages/api/src/router/me/index.ts (fetchFullProfile): user, then roles, then positions ar

Summary Across all six Next.js apps there is exactly one route boundary file in the entire repo: apps/map has a single error.tsx. No app has any loading.tsx or not-found.tsx. Unhandled route errors fall through to Next's unstyled default screen, bad URLs get the generic 404, and server-component navigations show nothing while loading. Evidence Counted with find apps/*/src/app -name "<boundary>.tsx": App page.tsx loading error not-found admin 21 0 0 0 map 8 0 1 0 me 2 0 0 0 auth 6 0 0 0 homepage 1 0 0 0 Why it matters Error UX: any thrown error in a server component (a DB hiccup, a bad ID in a URL) shows users an unstyled crash screen with no recovery path. A root error.tsx + global-error.tsx also gives Sentry a natural reporting hook. Loading UX: admin's 21 data-heavy pages navigate with no pending feedback; loading.tsx enables streaming + instant skeletons for free. This is a high-visibility, low-risk win that suits newer contributors (hence good first issue). Sugg