# KC-App Backend

NestJS API for the KC-App platform (see repo root README + plan for
architecture context).

## Setup

```bash
npm install
cp .env.example .env   # then fill in DATABASE_URL / AUTHENTIK_ISSUER_URL / GUEST_JWT_SECRET
npx prisma generate
npx prisma migrate dev --name init   # requires a running PostgreSQL instance
npm run start:dev
```

## Auth model

- Team members (Leitungsteam, Gemeinde Verantwortliche, Gemeinde Teamer) are
  provisioned in Authentik; this API acts as an OIDC **resource server**,
  verifying access tokens against Authentik's JWKS (`AuthentikStrategy`) and
  then resolving local `Membership` rows to determine role + KC/Gemeinde
  scope. Clients perform the actual Authorization Code + PKCE flow against
  Authentik directly.
- Guests/Konfis get a temporary local account (first/last name required, no
  Authentik) created via `POST /auth/guest` with a KC invite code, returning
  a JWT signed with `GUEST_JWT_SECRET`.

## Modules implemented so far

- `prisma/` — shared `PrismaClient` provider.
- `auth/` — Authentik resource-server strategy + guest invite-code login.
- `kc/` — KC (event) creation/listing, Leitungsteam-only.
- `common/` — `Role` enum, `@Roles()` decorator, `RolesGuard` (KC-scoped,
  Leitungsteam roles are global across all KCs).

Not yet implemented: Wahl/Workshop/Zuteilung engine, file sharing, chat
realtime gateway, local/cloud sync engine.