fix: resolve api build errors and multi-tenant unique key constraints

apps/api/src/index.ts

@@ -21,19 +21,24 @@ import { runWithTenant } from '@repo/database';
 
 declare module 'fastify' {
     interface FastifyInstance {
-        prisma: any; // Using any because of Prisma extensions complex types
+        prisma: any; 
     }
     interface FastifyRequest {
         rawBody?: Buffer;
+    }
+    interface FastifyContextConfig {
+        requireAuth?: boolean;
+    }
+}
+
+declare module '@fastify/jwt' {
+    interface FastifyJWT {
         user: {
             id: string;
             organizationId: string;
             role: 'STUDENT' | 'ORG_MEMBER' | 'ORG_ADMIN' | 'SUPER_ADMIN' | 'ADMIN';
         };
     }
-    interface FastifyContextConfig {
-        requireAuth?: boolean;
-    }
 }
 
 
@@ -144,15 +149,16 @@ server.register(async function guardedRoutes(scope) {
 
         // 🏢 Multi-Tenant Enforcement
         const requestedOrgId = request.headers['x-organization-id'] as string;
+        const user = request.user as any;
         
         // Ensure requested Org matches User's Org (unless Super Admin)
-        if (request.user.role !== 'SUPER_ADMIN' && requestedOrgId && requestedOrgId !== request.user.organizationId) {
+        if (user.role !== 'SUPER_ADMIN' && requestedOrgId && requestedOrgId !== user.organizationId) {
             return reply.code(403).send({ error: 'Forbidden', message: 'You do not have access to this organization' });
         }
 
         // Auto-inject OrgId into request if missing and available in token
-        if (!requestedOrgId && request.user.organizationId) {
-            request.headers['x-organization-id'] = request.user.organizationId;
+        if (!requestedOrgId && user.organizationId) {
+            request.headers['x-organization-id'] = user.organizationId;
         }
 
         // Final check for routes requiring an organization

apps/api/src/routes/auth.ts

@@ -10,13 +10,18 @@ export async function authRoutes(fastify: FastifyInstance) {
         schema: {
             body: z.object({
                 email: z.string().email(),
-                password: z.string()
+                password: z.string(),
+                organizationId: z.string().optional() // Optional for super admins, required for others
             })
         }
     }, async (request, reply) => {
-        const { email, password } = request.body as any;
+        const { email, password, organizationId } = request.body as any;
 
-        const user = await AuthService.findUserByEmail(email);
+        // If no organizationId provided, we check for Super Admin in 'default-org-id' 
+        // or we need to ask for it.
+        const orgId = organizationId || 'default-org-id';
+
+        const user = await AuthService.findUserByEmail(email, orgId);
         
         if (!user || !user.passwordHash) {
             return reply.code(401).send({ error: 'Unauthorized', message: 'Invalid email or password' });
@@ -34,7 +39,7 @@ export async function authRoutes(fastify: FastifyInstance) {
             role: user.role
         });
 
-        logger.info(`[AUTH] User ${email} logged in successfully for org ${user.organization?.name}`);
+        logger.info(`[AUTH] User ${email} logged in successfully for org ${user.organizationId}`);
 
         return {
             token,
@@ -44,14 +49,14 @@ export async function authRoutes(fastify: FastifyInstance) {
                 email: user.email,
                 role: user.role,
                 organizationId: user.organizationId,
-                organization: user.organization
+                organization: (user as any).organization
             }
         };
     });
 
     // Get current user profile (guarded by JWT)
     fastify.get('/me', async (request, reply) => {
-        const { id } = request.user;
+        const { id } = request.user as any;
         
         const user = await fastify.prisma.user.findUnique({
             where: { id },
@@ -69,7 +74,7 @@ export async function authRoutes(fastify: FastifyInstance) {
                 email: user.email,
                 role: user.role,
                 organizationId: user.organizationId,
-                organization: user.organization
+                organization: (user as any).organization
             }
         };
     });

apps/api/src/routes/organizations.ts

@@ -4,42 +4,22 @@ import { z } from 'zod';
 import { logger } from '../logger';
 import { scheduleEmail } from '../services/queue';
 import { decryptSecrets, encryptSecrets, invalidateOrganizationCache } from '../services/organization';
-import { FlowConfigSchema, OrganizationSchema, encrypt, decrypt } from '@repo/shared-types';
+import { OrganizationSchema } from '@repo/shared-types';
 import { AuthService } from '../services/auth';
-import { EmailService } from '../services/email';
-
-const ENCRYPTION_SECRET = process.env.ENCRYPTION_SECRET || 'default-secret-at-least-32-chars-long-!!!';
-
-function encryptSecrets(data: any) {
-    if (data.systemUserToken && !data.systemUserToken.startsWith('enc:')) {
-        data.systemUserToken = encrypt(data.systemUserToken, ENCRYPTION_SECRET);
-    }
-    if (data.webhookSecret && !data.webhookSecret.startsWith('enc:')) {
-        data.webhookSecret = encrypt(data.webhookSecret, ENCRYPTION_SECRET);
-    }
-    return data;
-}
-
-function decryptSecrets(org: any) {
-    if (org.systemUserToken) org.systemUserToken = decrypt(org.systemUserToken, ENCRYPTION_SECRET);
-    if (org.webhookSecret) org.webhookSecret = decrypt(org.webhookSecret, ENCRYPTION_SECRET);
-    return org;
-}
-
-const OrganizationCreationSchema = OrganizationSchema.extend({
-    slug: z.string().min(3).regex(/^[a-z0-9-]+$/),
-    adminEmail: z.string().email(),
-    adminName: z.string().min(2)
-});
-
-const PersonalityConfigSchema = z.object({
-    botName: z.string().optional(),
-    coreMission: z.string().optional(),
-    toneDescription: z.string().optional(),
-    languageConstraints: z.string().optional()
-});
 
 export async function organizationRoutes(fastify: FastifyInstance) {
+    const OrganizationCreationSchema = OrganizationSchema.extend({
+        slug: z.string().min(3).regex(/^[a-z0-9-]+$/),
+        adminEmail: z.string().email(),
+        adminName: z.string().min(2)
+    });
+
+    const PersonalityConfigSchema = z.object({
+        botName: z.string().optional(),
+        coreMission: z.string().optional(),
+        toneDescription: z.string().optional(),
+        languageConstraints: z.string().optional()
+    });
     // 1. List all organizations
     fastify.get('/', async () => {
         const orgs = await prisma.organization.findMany({

apps/api/src/routes/payments.ts

@@ -38,7 +38,7 @@ export async function paymentRoutes(fastify: FastifyInstance) {
                 user.id,
                 track.id,
                 track.stripePriceId,
-                user.phone
+                user.phone || ''
             );
 
             return { success: true, url: checkoutUrl };

apps/api/src/routes/student.ts

@@ -12,6 +12,11 @@ export async function studentRoutes(fastify: FastifyInstance) {
     // Returns user profile + enrollments + generated documents
     fastify.get('/me', async (req, reply) => {
         const query = req.query as { phone?: string };
+        const organizationId = req.headers['x-organization-id'] as string;
+
+        if (!organizationId) {
+            return reply.code(400).send({ error: 'x-organization-id header is required' });
+        }
 
         const phoneSchema = z.string().min(7);
         const phoneResult = phoneSchema.safeParse(query.phone);
@@ -22,7 +27,7 @@ export async function studentRoutes(fastify: FastifyInstance) {
         const phone = phoneResult.data.replace(/\s+/g, '').replace(/^\+/, '');
 
         const user = await prisma.user.findUnique({
-            where: { phone },
+            where: { phone_organizationId: { phone, organizationId } },
             include: {
                 enrollments: {
                     include: {
@@ -53,7 +58,7 @@ export async function studentRoutes(fastify: FastifyInstance) {
             language: user.language,
             activity: user.activity,
             createdAt: user.createdAt,
-            enrollments: user.enrollments.map(e => ({
+            enrollments: (user as any).enrollments.map((e: any) => ({
                 id: e.id,
                 trackId: e.trackId,
                 trackTitle: e.track.title,
@@ -64,7 +69,7 @@ export async function studentRoutes(fastify: FastifyInstance) {
                 startedAt: e.startedAt,
                 completedAt: e.completedAt,
             })),
-            payments: user.payments,
+            payments: (user as any).payments,
             // R2 document URLs are stored as Payment metadata (future enhancement)
         };
     });

apps/api/src/services/auth.ts

@@ -1,6 +1,5 @@
 import bcrypt from 'bcrypt';
 import { prisma } from './prisma';
-import { logger } from '../logger';
 
 const SALT_ROUNDS = 10;
 
@@ -22,9 +21,9 @@ export class AuthService {
     /**
      * Finds a user by email and includes organization context.
      */
-    static async findUserByEmail(email: string) {
+    static async findUserByEmail(email: string, organizationId: string) {
         return prisma.user.findUnique({
-            where: { email },
+            where: { email_organizationId: { email, organizationId } },
             include: { organization: true }
         });
     }

apps/api/src/services/organization.ts

@@ -56,3 +56,22 @@ export async function invalidateOrganizationCache(organizationId: string, phoneN
         logger.error('[ORG-SERVICE] Cache invalidation failed:', err);
     }
 }
+
+const ENCRYPTION_SECRET = process.env.ENCRYPTION_SECRET || 'default-secret-at-least-32-chars-long-!!!';
+import { encrypt, decrypt } from '@repo/shared-types';
+
+export function encryptSecrets(data: any) {
+    if (data.systemUserToken && !data.systemUserToken.startsWith('enc:')) {
+        data.systemUserToken = encrypt(data.systemUserToken, ENCRYPTION_SECRET);
+    }
+    if (data.webhookSecret && !data.webhookSecret.startsWith('enc:')) {
+        data.webhookSecret = encrypt(data.webhookSecret, ENCRYPTION_SECRET);
+    }
+    return data;
+}
+
+export function decryptSecrets(org: any) {
+    if (org.systemUserToken) org.systemUserToken = decrypt(org.systemUserToken, ENCRYPTION_SECRET);
+    if (org.webhookSecret) org.webhookSecret = decrypt(org.webhookSecret, ENCRYPTION_SECRET);
+    return org;
+}