refactor: migrate admin dashboard and web projects to TanStack Start

.dockerignore

@@ -3,5 +3,6 @@ Dockerfile
 node_modules
 npm-debug.log
 README.md
-.next
+.output
+.tanstack
 .git

.env.example

@@ -1,3 +1,3 @@
-# this file might be outdated, please check /src/env.js for required env
 BACKEND_URL="http://localhost:3000"
-ADMIN_ORG_EMAIL="## Email address of admin Azure account ##"),
+# Local preview bypass. This is ignored unless NODE_ENV is development.
+AGENT_MODE="false"

.github/workflows/docker.yml

@@ -1,32 +1,65 @@
 name: Docker Image CI
 on:
-  workflow_dispatch:
-  workflow_run:
-    workflows: [Test]
+  push:
     branches: [main]
-    types:
-      - completed
+
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-    name: Build
-    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
-    runs-on: ubuntu-latest
+    name: Build ${{ matrix.platform }}
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ubuntu-latest
+            suffix: amd64
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            suffix: arm64
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
-      - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@v2
+      - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build the Docker image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64
+          platforms: ${{ matrix.platform }}
           push: true
-          tags: ghcr.io/polinetworkorg/admin:latest
+          tags: ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-${{ matrix.suffix }}
+
+  manifest:
+    name: Publish multi-arch manifest
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Publish latest manifest
+        run: |
+          docker buildx imagetools create \
+            --tag ghcr.io/polinetworkorg/admin:latest \
+            ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-amd64 \
+            ghcr.io/polinetworkorg/admin:build-${{ github.sha }}-arm64
+          docker buildx imagetools inspect ghcr.io/polinetworkorg/admin:latest

.gitignore

@@ -13,12 +13,11 @@
 /prisma/db.sqlite-journal
 db.sqlite
 
-# next.js
-/.next/
-/out/
-
 # production
 /build
+/dist
+/.output
+/.tanstack
 
 # misc
 .DS_Store
@@ -31,7 +30,6 @@ yarn-error.log*
 .pnpm-debug.log*
 
 # local env files
-# do not commit any .env files to git, except for the .env.example file. https://create.t3.gg/en/usage/env-variables#using-environment-variables
 .env
 .env*.local
 
@@ -44,4 +42,4 @@ yarn-error.log*
 # idea files
 .idea
 
-certificates
+certificates

AGENTS.md

@@ -0,0 +1,33 @@
+# Agent instructions
+
+## Previewing the authenticated dashboard
+
+When checking UI changes through a preview or browser, start the app with agent mode enabled:
+
+```sh
+PORT=xxxxx AGENT_MODE=true pnpm dev
+```
+
+Setting the `PORT=xxxxx` to an high enough port that is unlikely to hit
+another service or conflict with another workflow in preview (min 10000).
+
+Then open `/dashboard` directly (if not working on a page outside dashboard).
+`AGENT_MODE` bypasses session and role authorization and disables the auth-based
+redirects between `/login` and `/dashboard`, so no real account or login flow is needed.
+You can indipendently check /dashboard and /login for modifying those pages
+
+Use this flag only for local agent-driven development and previews.
+Never enable it in a deployed environment.
+
+When modifing auth-related code or redirects between authed and non-authed contexts,
+always verify that normal behavior still works with `AGENT_MODE=false`.
+
+> [!IMPORTANT]
+> Do not run destructive actions across multiple rows, unless specific prompt indication or
+> ask for user confirmation ALWAYS.
+
+## Git
+
+Always do commits with conventional commits.
+Set description when a commit includes lot of changes that cannot
+be divided into multiple commits, to specify the most important changes of the commit.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

Dockerfile

@@ -1,52 +1,21 @@
-FROM node:22-alpine AS base
-
-FROM base AS deps
-# Check https://github.com/nodejs/docker-node/tree/b4117f9333da4138b03a546ec926ef50a31506c3#nodealpine to understand why libc6-compat might be needed.
-RUN apk add --no-cache libc6-compat
+FROM node:22-alpine AS deps
 WORKDIR /app
+COPY package.json pnpm-lock.yaml ./
+RUN corepack enable && pnpm install --frozen-lockfile
 
-# Install dependencies based on the preferred package manager
-COPY package.json pnpm-lock.yaml* .npmrc* ./
-RUN corepack enable pnpm && pnpm i --frozen-lockfile
-
-# Rebuild the source code only when needed
-FROM base AS builder
+FROM node:22-alpine AS builder
 WORKDIR /app
 COPY --from=deps /app/node_modules ./node_modules
 COPY . .
+RUN corepack enable && pnpm build
 
-# Next.js collects completely anonymous telemetry data about general usage.
-# Learn more here: https://nextjs.org/telemetry
-# Uncomment the following line in case you want to disable telemetry during the build.
-# ENV NEXT_TELEMETRY_DISABLED=1
-ENV SKIP_ENV_VALIDATION=true
-
-RUN corepack enable pnpm && pnpm run build
-
-# Production image, copy all the files and run next
-FROM base AS runner
+FROM node:22-alpine AS runner
 WORKDIR /app
-
 ENV NODE_ENV=production
-# Uncomment the following line in case you want to disable telemetry during runtime.
-# ENV NEXT_TELEMETRY_DISABLED=1
-
-RUN addgroup --system --gid 1001 nodejs
-RUN adduser --system --uid 1001 nextjs
-
-COPY --from=builder /app/public ./public
-
-# Automatically leverage output traces to reduce image size
-# https://nextjs.org/docs/advanced-features/output-file-tracing
-COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
-COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
-
-USER nextjs
-
-EXPOSE 3001
 ENV PORT=3001
-
-# server.js is created by next build from the standalone output
-# https://nextjs.org/docs/pages/api-reference/config/next-config-js/output
-ENV HOSTNAME="0.0.0.0"
-CMD ["node", "server.js"]
+ENV HOST=0.0.0.0
+COPY --from=builder /app/.output ./.output
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/package.json ./package.json
+EXPOSE 3001
+CMD ["node", ".output/server/index.mjs"]

README.md

@@ -1,3 +1,29 @@
-# Admin
+# PoliNetwork Admin
 
-[WIP] Dashboard for admin and members of PoliNetwork APS
+The PoliNetwork operations console, rebuilt with TanStack Start, React 19, Vite, Nitro, Tailwind CSS v4, and shadcn/ui.
+
+## Development
+
+```bash
+pnpm install
+pnpm dev
+```
+
+Open `http://localhost:3001`. The production server is generated with `pnpm build` and starts with `pnpm start`.
+
+The UI uses shadcn's base components with a custom semantic theme in `src/styles.css`. The theme preserves the console's paper canvas, dark navy shell, cobalt `#1156ae` primary, DM Sans body copy, Libre Baskerville headings, and DM Mono metadata while keeping page layout in Tailwind utilities.
+
+## Environment
+
+Set `BACKEND_URL` to the PoliNetwork backend origin. TanStack Start proxies Better Auth at `/api/auth/*`, and each server-function request creates its own tRPC client with that request's session cookie. Private dashboard functions also verify the linked Telegram identity and an administrator role before contacting the backend.
+
+`AGENT_MODE=true` provides a fake administrator only while the app runs in development. Production ignores the flag.
+
+## Checks
+
+```bash
+pnpm typecheck
+pnpm test
+pnpm check
+pnpm build
+```

biome.jsonc

@@ -7,15 +7,7 @@
   },
   "files": {
     "ignoreUnknown": true,
-    "includes": [
-      "**",
-      "!node_modules",
-      "!.next",
-      "!dist",
-      "!build",
-      "!src/app/globals.css", // modified by shadcn
-      "!src/components/ui/*" // modified by shadcn
-    ]
+    "includes": ["**", "!node_modules", "!dist", "!build", "!.output", "!.tanstack", "!src/routeTree.gen.ts"]
   },
   "formatter": {
     "enabled": true,
@@ -36,29 +28,21 @@
       "recommended": true,
       "suspicious": {
         "noVar": "error"
-        // "noUnknownAtRules": "off" // until fix for tailwind rules is released
+        // Project-specific suspicious rules live here.
       },
       "nursery": {
         "noFloatingPromises": "error",
         "noMisusedPromises": "error",
         "noUnnecessaryConditions": "error",
         "noImportCycles": "warn",
-        "useSortedClasses": {
-          "options": {
-            "attributes": ["classList"],
-            "functions": ["cn"]
-          }
-        }
+        "useSortedClasses": "off"
       },
       "correctness": {
         "useJsonImportAttributes": "warn",
         "noPrivateImports": "error"
       }
     },
-    "domains": {
-      "project": "recommended",
-      "next": "recommended"
-    }
+    "domains": { "project": "recommended" }
   },
   "javascript": {
     "formatter": {

components.json

@@ -1,25 +1,28 @@
 {
   "$schema": "https://ui.shadcn.com/schema.json",
   "style": "base-nova",
-  "rsc": true,
+  "rsc": false,
   "tsx": true,
   "tailwind": {
-    "config": "",
-    "css": "src/index.css",
+    "config": "tailwind.config.ts",
+    "css": "src/styles.css",
     "baseColor": "neutral",
     "cssVariables": true,
     "prefix": ""
   },
   "iconLibrary": "lucide",
   "rtl": false,
+  "menuColor": "default",
+  "menuAccent": "subtle",
   "aliases": {
     "components": "@/components",
-    "utils": "@/lib/utils/shadcn",
+    "utils": "@/lib/utils",
     "ui": "@/components/ui",
     "lib": "@/lib",
     "hooks": "@/hooks"
   },
-  "menuColor": "default",
-  "menuAccent": "subtle",
-  "registries": {}
+  "registries": {
+    "@iconiq": "https://iconiqui.com/r/{name}.json",
+    "@reui": "https://reui.io/r/{style}/{name}.json"
+  }
 }