Deployment Overview

mynatca-discord/
├── pages/                  # Next.js pages (API routes)
│   ├── api/
│   │   ├── auth/          # Auth0 callback handlers
│   │   ├── verify/        # Verification endpoints
│   │   └── webhook/       # Discord webhooks
│   ├── verify/            # Verification UI pages
│   └── _app.js           # App configuration
├── vercel.json            # Vercel configuration
├── next.config.js         # Next.js configuration
└── package.json          # Dependencies and scripts

mynatca-platform/
├── pages/
│   └── api/              # API endpoints
│       ├── sync/         # Data sync endpoints
│       ├── health/       # Health check endpoints
│       └── admin/        # Administrative endpoints
├── vercel.json           # Vercel configuration
└── package.json          # Dependencies and scripts

{
  "version": 2,
  "name": "mynatca-discord",
  "alias": ["discord.mynatca.org"],
  "builds": [
    {
      "src": "package.json",
      "use": "@vercel/node"
    }
  ],
  "routes": [
    {
      "src": "/api/(.*)",
      "dest": "/api/$1"
    },
    {
      "src": "/verify/(.*)",
      "dest": "/verify/$1"
    },
    {
      "src": "/(.*)",
      "dest": "/index.html"
    }
  ],
  "env": {
    "NODE_ENV": "production"
  },
  "functions": {
    "pages/api/**/*.js": {
      "maxDuration": 30
    }
  },
  "headers": [
    {
      "source": "/api/(.*)",
      "headers": [
        {
          "key": "Access-Control-Allow-Origin",
          "value": "https://discord.mynatca.org"
        },
        {
          "key": "Access-Control-Allow-Methods",
          "value": "GET, POST, PUT, DELETE, OPTIONS"
        },
        {
          "key": "Access-Control-Allow-Headers",
          "value": "X-Requested-With, Content-Type, Authorization"
        }
      ]
    }
  ],
  "redirects": [
    {
      "source": "/",
      "destination": "/verify",
      "permanent": false
    }
  ]
}

{
  "version": 2,
  "name": "mynatca-platform-api",
  "alias": ["api.mynatca.org"],
  "builds": [
    {
      "src": "package.json",
      "use": "@vercel/node"
    }
  ],
  "routes": [
    {
      "src": "/api/(.*)",
      "dest": "/api/$1"
    }
  ],
  "env": {
    "NODE_ENV": "production"
  },
  "functions": {
    "pages/api/**/*.js": {
      "maxDuration": 60
    },
    "pages/api/sync/**/*.js": {
      "maxDuration": 300
    }
  },
  "crons": [
    {
      "path": "/api/sync/scheduled",
      "schedule": "0 */6 * * *"
    },
    {
      "path": "/api/health/check",
      "schedule": "*/15 * * * *"
    }
  ]
}

# Core Discord Configuration
DISCORD_TOKEN=your_discord_bot_token
DISCORD_CLIENT_ID=your_discord_application_id
DISCORD_GUILD_ID=your_discord_server_id
 
# Auth0 Configuration
AUTH0_DOMAIN=natca-prod.us.auth0.com
AUTH0_CLIENT_ID=your_auth0_client_id
AUTH0_CLIENT_SECRET=your_auth0_client_secret
# ⚠️ CRITICAL: AUTH0_SECRET is REQUIRED for NextJS Auth0 SDK
# Generate with: openssl rand -hex 32
AUTH0_SECRET=your_auth0_secret_32_chars_minimum
AUTH0_BASE_URL=https://discord.mynatca.org
AUTH0_ISSUER_BASE_URL=https://natca-prod.us.auth0.com
AUTH0_SCOPE=openid profile email
 
# Database Configuration
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_supabase_service_key
 
# ⚠️ CRITICAL: Supabase Schema Exposure Required
# In Supabase Dashboard > Settings > API > Exposed schemas
# Add both 'discord' and 'discord_dev' schemas to exposed schemas list
# This allows Discord bot to access verification tables directly
 
# MySQL Configuration (for sync operations)
MYSQL_HOST=your_mysql_host
MYSQL_USER=your_mysql_username
MYSQL_PASS=your_mysql_password
MYSQL_DB=your_mysql_database
 
# Application Configuration
NODE_ENV=production
VERCEL_URL=discord.mynatca.org
WEBHOOK_SECRET=your_webhook_secret
 
# Monitoring
SENTRY_DSN=your_sentry_dsn
LOG_LEVEL=info

# Database Configuration
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_KEY=your_supabase_service_key
 
# MySQL Configuration
MYSQL_HOST=your_mysql_host
MYSQL_USER=your_mysql_username
MYSQL_PASS=your_mysql_password
MYSQL_DB=your_mysql_database
 
# Auth0 Management API
AUTH0_DOMAIN=natca-prod.us.auth0.com
AUTH0_M2M_CLIENT_ID=your_m2m_client_id
AUTH0_M2M_CLIENT_SECRET=your_m2m_client_secret
 
# Session Management (CRITICAL)
SESSION_SECRET=your_long_random_secret_min_32_chars
REDIS_URL=redis://redis:6379
# Note: Generate with: openssl rand -base64 32
 
# Application Configuration
NODE_ENV=production
API_SECRET=your_api_secret
WEBHOOK_SECRET=your_webhook_secret
# CRITICAL: Trust proxy setting (required for reverse proxy deployments)
TRUST_PROXY=1
 
# Rackspace Email Integration
RACKSPACE_API_KEY=your_rackspace_api_key
RACKSPACE_SECRET_KEY=your_rackspace_secret_key
RACKSPACE_CUSTOMER_ID=123456
 
# Intercom Integration
INTERCOM_ACCESS_TOKEN=your_intercom_access_token
 
# Sync Configuration
SYNC_BATCH_SIZE=1000
SYNC_RETRY_COUNT=3
SYNC_TIMEOUT=300000
 
# Monitoring
SENTRY_DSN=your_sentry_dsn
LOG_LEVEL=info

npm install -g vercel

vercel login

# In Discord bot repository
cd mynatca-discord
vercel link
 
# In platform repository
cd mynatca-platform
vercel link

# Set project settings
vercel --prod --confirm
 
# Configure environment variables
vercel env add NODE_ENV production
vercel env add AUTH0_DOMAIN natca-prod.us.auth0.com
vercel env add AUTH0_CLIENT_ID
vercel env add AUTH0_CLIENT_SECRET
# ⚠️ CRITICAL: AUTH0_SECRET must be added or deployment will fail
# Generate with: openssl rand -hex 32
vercel env add AUTH0_SECRET
vercel env add AUTH0_BASE_URL https://discord.mynatca.org
vercel env add AUTH0_ISSUER_BASE_URL https://natca-prod.us.auth0.com
vercel env add DISCORD_TOKEN
vercel env add DISCORD_CLIENT_ID
vercel env add DISCORD_GUILD_ID
vercel env add SUPABASE_URL
vercel env add SUPABASE_KEY
vercel env add MYSQL_HOST
vercel env add MYSQL_USER
vercel env add MYSQL_PASS
vercel env add MYSQL_DB

# Pre-deployment verification
vercel env ls | grep AUTH0_SECRET  # Ensure AUTH0_SECRET is set
 
# Production deployment
vercel --prod
 
# Verify deployment
curl https://discord.mynatca.org/api/health
 
# Test authentication endpoint
curl -I https://discord.mynatca.org/api/auth/login

# In platform repository
vercel env add NODE_ENV production
vercel env add SUPABASE_URL
vercel env add SUPABASE_KEY
vercel env add MYSQL_HOST
vercel env add MYSQL_USER
vercel env add MYSQL_PASS
vercel env add MYSQL_DB
vercel env add AUTH0_DOMAIN
vercel env add AUTH0_M2M_CLIENT_ID
vercel env add AUTH0_M2M_CLIENT_SECRET
vercel env add API_SECRET
vercel env add SYNC_BATCH_SIZE 1000
vercel env add SYNC_RETRY_COUNT 3

# Production deployment
vercel --prod
 
# Verify deployment
curl https://api.mynatca.org/api/health

# DNS Records (Configure in your DNS provider)
Type: CNAME
Name: discord
Value: cname.vercel-dns.com
 
Type: CNAME
Name: api
Value: cname.vercel-dns.com
 
Type: CNAME
Name: hub
Value: cname.vercel-dns.com

# Add domain to Vercel project
vercel domains add discord.mynatca.org
vercel domains add api.mynatca.org
vercel domains add hub.mynatca.org
 
# Verify domain ownership
vercel domains verify discord.mynatca.org

Discord Bot Application:
- Allowed Callback URLs: https://discord.mynatca.org/api/auth/callback
- Allowed Logout URLs: https://discord.mynatca.org/api/auth/logout
- Allowed Web Origins: https://discord.mynatca.org

Member Hub Application:
- Allowed Callback URLs: https://hub.mynatca.org/callback
- Allowed Logout URLs: https://hub.mynatca.org
- Allowed Web Origins: https://hub.mynatca.org

OAuth2 Redirect URLs:
- https://discord.mynatca.org/api/auth/callback

Interactions Endpoint URL:
- https://discord.mynatca.org/api/interactions

# .github/workflows/deploy.yml
name: Deploy to Vercel
 
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
 
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
          cache: 'npm'
 
      - name: Install dependencies
        run: npm ci
 
      - name: Run tests
        run: npm test
 
      - name: Deploy to Vercel
        uses: amondnet/vercel-action@v25
        with:
          vercel-token: ${{ secrets.VERCEL_TOKEN }}
          vercel-org-id: ${{ secrets.ORG_ID }}
          vercel-project-id: ${{ secrets.PROJECT_ID }}
          vercel-args: '--prod'
        if: github.ref == 'refs/heads/main'

#!/bin/bash
# scripts/promote-to-production.sh
 
echo "🚀 Promoting to production..."
 
# Run pre-deployment checks
npm run test
npm run lint
npm run security-audit
 
# Deploy to Vercel
vercel --prod --confirm
 
# Update Auth0 settings
node scripts/update-auth0-production.js
 
# Verify deployment
npm run verify-production
 
echo "✅ Production deployment complete!"

# Critical Auth0 variables
vercel env ls | grep AUTH0_SECRET      # Must be present
vercel env ls | grep AUTH0_CLIENT_ID   # Must be present
vercel env ls | grep AUTH0_CLIENT_SECRET # Must be present
vercel env ls | grep AUTH0_DOMAIN      # Must be present
vercel env ls | grep AUTH0_BASE_URL    # Must match deployment URL
 
# Database variables
vercel env ls | grep SUPABASE_URL      # Must be present
vercel env ls | grep SUPABASE_KEY      # Must be present
 
# Discord variables (for Discord bot)
vercel env ls | grep DISCORD_TOKEN     # Must be present
vercel env ls | grep DISCORD_CLIENT_ID # Must be present
vercel env ls | grep DISCORD_GUILD_ID  # Must be present

# 1. Verify environment variables
vercel env ls | grep -E "(AUTH0_SECRET|DISCORD_TOKEN|SUPABASE)"
 
# 2. Test configuration locally
vercel dev --listen 3000
curl http://localhost:3000/api/health
 
# 3. Run deployment with verification
vercel --prod --confirm
 
# 4. Wait for deployment to complete
# 5. Verify deployment URL is accessible
curl -I https://discord.mynatca.org/api/health

# 1. Health check
curl https://discord.mynatca.org/api/health
# Expected: 200 OK with health status
 
# 2. Auth endpoints
curl -I https://discord.mynatca.org/api/auth/login
# Expected: 302 redirect to Auth0
 
# 3. Database connectivity
curl https://discord.mynatca.org/api/sync/status
# Expected: 200 OK with sync status
 
# 4. Discord bot functionality
# Test /register command in Discord
# Verify verification flow works end-to-end

openssl rand -hex 32
vercel env add AUTH0_SECRET production

// Add BEFORE session middleware
app.set('trust proxy', 1);

// server.js
const app = express();
 
// Trust Digital Ocean's reverse proxy
app.set('trust proxy', 1);
 
app.use(session({
  cookie: {
    secure: process.env.NODE_ENV === 'production'  // Now works correctly
  }
}));

# Test that secure cookie is set
curl -c cookies.txt -v https://platform.natca.org/api/auth/login 2>&1 | grep -i set-cookie
# Should see: Set-Cookie: platform.session=...; Secure; HttpOnly

# Test schema access
curl https://your-project.supabase.co/rest/v1/discord.verification_requests \
  -H "apikey: your_anon_key" \
  -H "Authorization: Bearer your_service_key"
# Should return data or empty array, not 404

# 1. Pull current production schema as baseline
supabase db pull
 
# This creates: supabase/migrations/20251024122438_remote_schema.sql
# This file represents the CURRENT production database state
 
# 2. For new schema changes, create new migrations after this baseline
supabase migration new add_new_feature
 
# 3. Apply new migrations to production
supabase db push

-- 1. Add enddate column (already in baseline)
ALTER TABLE public.positions
ADD COLUMN IF NOT EXISTS enddate DATE;
 
-- 2. Add unique constraint (already in baseline)
ALTER TABLE public.positions
ADD CONSTRAINT positions_member_position_unique
UNIQUE (membernumber, positiontype);

# Option 1: Using Supabase CLI (Recommended)
supabase db push
 
# Option 2: Using psql
psql "postgresql://postgres:[password]@db.[project-ref].supabase.co:5432/postgres" \
  -f migrations/add_positions_enddate.sql
 
# Option 3: Using Supabase SQL Editor
# Navigate to Dashboard > SQL Editor > New Query
# Paste migration SQL and execute

# Verify enddate column exists
psql -c "\d public.positions"
 
# Verify unique constraint exists
psql -c "SELECT conname FROM pg_constraint WHERE conrelid = 'public.positions'::regclass;"
 
# Check migration history
supabase migration list

# 1. Make schema changes locally
# Edit your Supabase schema as needed
 
# 2. Create a new migration
supabase migration new descriptive_name_of_change
 
# 3. Test locally
supabase db reset  # Applies all migrations including new one
npm run dev        # Test your application
 
# 4. Deploy to production
git add supabase/migrations/
git commit -m "Add new schema migration"
git push
 
# 5. Apply migration to production
supabase db push --linked

# Navigate to platform directory
cd platform
 
# Run full production sync
node sync/sync-all.js --env=prod

🎯 Syncing to public schema
Syncing regions...
✓ Synced 10 regions
Syncing facilities...
✓ Synced 342 facilities
Syncing members...
✓ Synced 15,234 members
Syncing positions...
✓ Synced 1,247 positions
Syncing teams...
✓ Synced 89 teams
All syncs completed successfully!

# Sync only positions (fast, skips dependencies)
node sync/sync-all.js positions --skip-deps --env=prod
 
# Sync only members
node sync/sync-all.js members --skip-deps --env=prod
 
# Sync only teams
node sync/sync-all.js teams --skip-deps --env=prod

# Check record counts
psql -c "SELECT COUNT(*) FROM public.members;"
psql -c "SELECT COUNT(*) FROM public.positions;"
psql -c "SELECT COUNT(*) FROM public.teams;"
 
# Verify recent sync timestamp
psql -c "SELECT MAX(updated_at) FROM public.members;"

# Discord Bot
docker logs discord-bot | head -1
# Should output: {"timestamp":"...","level":"info","service":"discord-bot",...}
 
# Platform
docker logs platform | head -1
# Should output: {"timestamp":"...","level":"info","service":"platform",...}

# filebeat.yml
filebeat.inputs:
  - type: container
    paths:
      - '/var/lib/docker/containers/*/*.log'
    json.keys_under_root: true
    json.add_error_key: true
    processors:
      - add_docker_metadata:
          host: "unix:///var/run/docker.sock"
 
output.elasticsearch:
  hosts: ["opensearch:9200"]
  username: "admin"
  password: "${OPENSEARCH_PASSWORD}"
  indices:
    - index: "discord-bot-logs-%{+yyyy.MM.dd}"
      when.contains:
        container.labels.service: "discord-bot"
    - index: "platform-logs-%{+yyyy.MM.dd}"
      when.contains:
        container.labels.service: "platform"

# fluent.conf
<source>
  @type tail
  path /var/log/containers/*.log
  pos_file /var/log/fluentd-containers.pos
  tag docker.*
  format json
  time_key timestamp
  time_format %Y-%m-%dT%H:%M:%S.%LZ
</source>
 
<match docker.**>
  @type opensearch
  host opensearch
  port 9200
  user admin
  password ${OPENSEARCH_PASSWORD}
  index_name logs
  logstash_format true
  logstash_prefix logs
</match>

// Discord Bot Index Pattern
{
  "index_patterns": ["discord-bot-logs-*"],
  "mappings": {
    "properties": {
      "timestamp": { "type": "date" },
      "level": { "type": "keyword" },
      "service": { "type": "keyword" },
      "message": { "type": "text" },
      "context": { "type": "object" },
      "error.message": { "type": "text" },
      "error.stack": { "type": "text" }
    }
  }
}
 
// Platform Index Pattern
{
  "index_patterns": ["platform-logs-*"],
  "mappings": {
    "properties": {
      "timestamp": { "type": "date" },
      "level": { "type": "keyword" },
      "service": { "type": "keyword" },
      "message": { "type": "text" },
      "context": { "type": "object" },
      "error.message": { "type": "text" },
      "error.stack": { "type": "text" }
    }
  }
}

# Check OpenSearch receiving logs
curl -u admin:password http://opensearch:9200/_cat/indices?v | grep logs
 
# Query recent logs
curl -u admin:password -X GET "http://opensearch:9200/discord-bot-logs-*/_search?size=10&sort=timestamp:desc"
 
# Check log count by service
curl -u admin:password -X GET "http://opensearch:9200/logs-*/_search" -H 'Content-Type: application/json' -d'
{
  "size": 0,
  "aggs": {
    "by_service": {
      "terms": { "field": "service" }
    }
  }
}'

# OpenSearch Configuration
OPENSEARCH_HOST=opensearch.natca.org
OPENSEARCH_PORT=9200
OPENSEARCH_USER=admin
OPENSEARCH_PASSWORD=secure_password
OPENSEARCH_INDEX_PREFIX=mynatca-logs

# Full production sync (all tables in correct dependency order)
node sync/sync-all.js --env=prod
 
# Individual table sync with dependencies (syncs base tables first)
node sync/sync-all.js positions --env=prod
node sync/sync-all.js members --env=prod
node sync/sync-all.js teams --env=prod
 
# Fast re-sync without dependencies (New October 2025)
# Use after initial full sync when only specific table needs updating
node sync/sync-all.js positions --skip-deps --env=prod
node sync/sync-all.js members --skip-deps --env=prod
 
# View sync help and options
node sync/sync-all.js --help

# Sync to dev schema (default)
node sync/sync-all.js
 
# Individual table sync to dev
node sync/sync-all.js positions
node sync/sync-all.js members
node sync/sync-all.js teams
 
# Fast re-sync to dev without dependencies
node sync/sync-all.js positions --skip-deps

# Run command test suite
npm test
 
# Run tests with detailed output
npm run test:verbose

# Deploy slash commands to Discord
npm run deploy
 
# Start bot in production
npm start
 
# Start bot in development
npm run dev

# Symptom: Production sync writes to dev schema
# Solution: Verify script respects --env=prod flag
 
# Check sync output for schema confirmation
node sync/sync-all.js positions --env=prod
# Should show: "🎯 Syncing to public schema"

# Symptom: Sync fails with "column does not exist"
# Solution: Run required migrations first
 
# Check if migrations needed
psql -c "\d public.positions"
 
# Run migrations
psql -f migrations/add_positions_enddate.sql
psql -f migrations/add_positions_unique_constraint.sql

# Symptom: Sync fails with foreign key violation
# Solution: Sync base tables first or use full sync
 
# Wrong: Syncing dependent table first
node sync/sync-all.js positions --skip-deps --env=prod  # Fails if members not synced
 
# Correct: Full sync respects dependencies
node sync/sync-all.js --env=prod  # Syncs in correct order

# Symptom: /status fails for Staff (membertypeid=8) or RNAV (membertypeid=10)
# Solution: Verify query includes all member types
 
# Correct query should use .in('membertypeid', [6, 8, 10])
# Not .eq('membertypeid', 6)

# Run tests with verbose output
npm run test:verbose
 
# Check for missing mock data
# Verify test-commands.js has Staff and RNAV test cases

// Increase timeout in vercel.json
{
  "functions": {
    "pages/api/sync/**/*.js": {
      "maxDuration": 300
    }
  }
}

# Check environment variables
vercel env ls
 
# Pull environment variables locally
vercel env pull .env.local
 
# Add missing variables
vercel env add VARIABLE_NAME

# Check build logs
vercel logs <deployment-url>
 
# Debug locally
vercel dev
 
# Clear build cache
vercel --force