feat: member portal Sprint 4 — Events + RSVP

- Event + EventRsvp models + migration (RsvpStatus enum: GOING/MAYBE/NOT_GOING)
- EventsModule: admin CRUD (create/update/delete/publish) + RSVP list
- GET /my/events + POST /my/events/:id/rsvp in MyController/MyService
- Admin BFF routes: GET/POST /api/admin/events, PATCH/DELETE /api/admin/events/[id]
- Member BFF routes: GET /api/my/events, POST /api/my/events/[id]/rsvp
- /my/events page: upcoming/past split, RSVP button (client component, optimistic)
- Register DigestModule, OrgModule, ThreadsModule, EventsModule in AppModule
- Add EVENT_CREATED/DELETED/UPDATED and DIGEST_SENT to AuditAction

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/prisma/migrations/20260617210000_add_events_rsvp/migration.sql

@@ -0,0 +1,36 @@
+CREATE TYPE "RsvpStatus" AS ENUM ('GOING', 'NOT_GOING', 'MAYBE');
+
+CREATE TABLE "Event" (
+    "id" TEXT NOT NULL,
+    "tenantId" TEXT NOT NULL,
+    "title" TEXT NOT NULL,
+    "description" TEXT,
+    "location" TEXT,
+    "startsAt" TIMESTAMP(3) NOT NULL,
+    "endsAt" TIMESTAMP(3),
+    "createdBy" TEXT NOT NULL,
+    "isPublished" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "Event_pkey" PRIMARY KEY ("id")
+);
+
+CREATE TABLE "EventRsvp" (
+    "id" TEXT NOT NULL,
+    "eventId" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "status" "RsvpStatus" NOT NULL,
+    "note" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "EventRsvp_pkey" PRIMARY KEY ("id")
+);
+
+CREATE INDEX "Event_tenantId_startsAt_idx" ON "Event"("tenantId", "startsAt");
+CREATE INDEX "Event_tenantId_isPublished_idx" ON "Event"("tenantId", "isPublished");
+CREATE UNIQUE INDEX "EventRsvp_eventId_userId_key" ON "EventRsvp"("eventId", "userId");
+CREATE INDEX "EventRsvp_userId_idx" ON "EventRsvp"("userId");
+
+ALTER TABLE "Event" ADD CONSTRAINT "Event_tenantId_fkey" FOREIGN KEY ("tenantId") REFERENCES "Tenant"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "EventRsvp" ADD CONSTRAINT "EventRsvp_eventId_fkey" FOREIGN KEY ("eventId") REFERENCES "Event"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "EventRsvp" ADD CONSTRAINT "EventRsvp_userId_fkey" FOREIGN KEY ("userId") REFERENCES "TowerUser"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

apps/api/prisma/schema.prisma

@@ -90,6 +90,7 @@ model Tenant {
   groupAccesses  GroupAccess[]
   digestConfig   DigestConfig?
   digests        Digest[]
+  events         Event[]
 }
 
 enum AdminRole {
@@ -387,6 +388,7 @@ model TowerUser {
   optOuts  MemberOptOut[]
   sessions TowerSession[]
   messages Message[]      @relation("senderTowerUser")
+  rsvps    EventRsvp[]
 
   @@unique([tenantId, phoneHash])
   @@index([phoneHash])
@@ -528,3 +530,48 @@ model Digest {
   @@unique([tenantId, digestDate])
   @@index([tenantId])
 }
+
+// ============================================================================
+// Events + RSVP
+// ============================================================================
+
+enum RsvpStatus {
+  GOING
+  NOT_GOING
+  MAYBE
+}
+
+model Event {
+  id          String   @id @default(cuid())
+  tenantId    String
+  tenant      Tenant   @relation(fields: [tenantId], references: [id])
+  title       String
+  description String?
+  location    String?
+  startsAt    DateTime
+  endsAt      DateTime?
+  createdBy   String
+  isPublished Boolean  @default(false)
+  createdAt   DateTime @default(now())
+  updatedAt   DateTime @updatedAt
+
+  rsvps EventRsvp[]
+
+  @@index([tenantId, startsAt])
+  @@index([tenantId, isPublished])
+}
+
+model EventRsvp {
+  id        String     @id @default(cuid())
+  eventId   String
+  event     Event      @relation(fields: [eventId], references: [id], onDelete: Cascade)
+  userId    String
+  user      TowerUser  @relation(fields: [userId], references: [id])
+  status    RsvpStatus
+  note      String?
+  createdAt DateTime   @default(now())
+  updatedAt DateTime   @updatedAt
+
+  @@unique([eventId, userId])
+  @@index([userId])
+}

apps/api/src/app.module.ts

@@ -14,6 +14,10 @@ import { MessagesModule } from './modules/messages/messages.module';
 import { RulesModule } from './modules/rules/rules.module';
 import { SuperAdminModule } from './modules/super-admin/super-admin.module';
 import { TenantModule } from './modules/tenant/tenant.module';
+import { DigestModule } from './modules/digest/digest.module';
+import { OrgModule } from './modules/org/org.module';
+import { ThreadsModule } from './modules/threads/threads.module';
+import { EventsModule } from './modules/events/events.module';
 
 @Module({
   imports: [
@@ -32,6 +36,10 @@ import { TenantModule } from './modules/tenant/tenant.module';
     RulesModule,
     SuperAdminModule,
     TenantModule,
+    DigestModule,
+    OrgModule,
+    ThreadsModule,
+    EventsModule,
   ],
 })
 export class AppModule {}

apps/api/src/modules/audit/audit.types.ts

@@ -37,6 +37,10 @@ export const AuditAction = {
   MEMBER_DELETED: 'MEMBER_DELETED',
   OTP_REQUESTED: 'OTP_REQUESTED',
   OTP_VERIFIED: 'OTP_VERIFIED',
+  EVENT_CREATED: 'EVENT_CREATED',
+  EVENT_UPDATED: 'EVENT_UPDATED',
+  EVENT_DELETED: 'EVENT_DELETED',
+  DIGEST_SENT: 'DIGEST_SENT',
 } as const;
 
 export type AuditActionValue = (typeof AuditAction)[keyof typeof AuditAction];

apps/api/src/modules/events/events.controller.ts

@@ -0,0 +1,60 @@
+import { Body, Controller, Delete, Get, Param, Patch, Post, UseGuards } from '@nestjs/common';
+import { EventsService } from './events.service';
+import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { RolesGuard } from '../auth/roles.guard';
+import { Roles } from '../auth/roles.decorator';
+import { CurrentTenantContext } from '../auth/current-tenant.decorator';
+import { TenantContext } from '../../common/tenant-context';
+
+@Controller('admin/events')
+@UseGuards(JwtAuthGuard, RolesGuard)
+@Roles('OWNER', 'ADMIN')
+export class EventsController {
+  constructor(private readonly service: EventsService) {}
+
+  @Get()
+  list(@CurrentTenantContext() ctx: TenantContext) {
+    return this.service.list(ctx.tenantId, true);
+  }
+
+  @Post()
+  create(
+    @CurrentTenantContext() ctx: TenantContext,
+    @Body() body: {
+      title: string;
+      description?: string;
+      location?: string;
+      startsAt: string;
+      endsAt?: string;
+      isPublished?: boolean;
+    },
+  ) {
+    return this.service.create(ctx.tenantId, ctx.adminId!, body);
+  }
+
+  @Patch(':id')
+  update(
+    @CurrentTenantContext() ctx: TenantContext,
+    @Param('id') id: string,
+    @Body() body: {
+      title?: string;
+      description?: string;
+      location?: string;
+      startsAt?: string;
+      endsAt?: string;
+      isPublished?: boolean;
+    },
+  ) {
+    return this.service.update(ctx.tenantId, ctx.adminId!, id, body);
+  }
+
+  @Delete(':id')
+  remove(@CurrentTenantContext() ctx: TenantContext, @Param('id') id: string) {
+    return this.service.remove(ctx.tenantId, ctx.adminId!, id);
+  }
+
+  @Get(':id/rsvps')
+  rsvps(@CurrentTenantContext() ctx: TenantContext, @Param('id') id: string) {
+    return this.service.getRsvps(ctx.tenantId, id);
+  }
+}

apps/api/src/modules/events/events.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { EventsController } from './events.controller';
+import { EventsService } from './events.service';
+import { AuthModule } from '../auth/auth.module';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [EventsController],
+  providers: [EventsService],
+})
+export class EventsModule {}

apps/api/src/modules/events/events.service.ts

@@ -0,0 +1,108 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { PrismaService } from '../../prisma/prisma.service';
+import { AuditService } from '../audit/audit.service';
+import { AuditAction } from '../audit/audit.types';
+
+@Injectable()
+export class EventsService {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly audit: AuditService,
+  ) {}
+
+  async list(tenantId: string, includeUnpublished = false) {
+    return this.prisma.event.findMany({
+      where: {
+        tenantId,
+        ...(includeUnpublished ? {} : { isPublished: true }),
+      },
+      orderBy: { startsAt: 'asc' },
+      include: { _count: { select: { rsvps: true } } },
+    });
+  }
+
+  async create(tenantId: string, adminId: string, dto: {
+    title: string;
+    description?: string;
+    location?: string;
+    startsAt: string;
+    endsAt?: string;
+    isPublished?: boolean;
+  }) {
+    const event = await this.prisma.event.create({
+      data: {
+        tenantId,
+        title: dto.title,
+        description: dto.description ?? null,
+        location: dto.location ?? null,
+        startsAt: new Date(dto.startsAt),
+        endsAt: dto.endsAt ? new Date(dto.endsAt) : null,
+        createdBy: adminId,
+        isPublished: dto.isPublished ?? false,
+      },
+    });
+
+    await this.audit.log({
+      tenantId,
+      actorId: adminId,
+      action: AuditAction.EVENT_CREATED,
+      resourceType: 'Event',
+      resourceId: event.id,
+      payload: { title: event.title, isPublished: event.isPublished },
+    });
+
+    return event;
+  }
+
+  async update(tenantId: string, adminId: string, eventId: string, dto: {
+    title?: string;
+    description?: string;
+    location?: string;
+    startsAt?: string;
+    endsAt?: string;
+    isPublished?: boolean;
+  }) {
+    const event = await this.prisma.event.findFirst({ where: { id: eventId, tenantId } });
+    if (!event) throw new NotFoundException('Event not found');
+
+    return this.prisma.event.update({
+      where: { id: eventId },
+      data: {
+        ...(dto.title !== undefined && { title: dto.title }),
+        ...(dto.description !== undefined && { description: dto.description }),
+        ...(dto.location !== undefined && { location: dto.location }),
+        ...(dto.startsAt !== undefined && { startsAt: new Date(dto.startsAt) }),
+        ...(dto.endsAt !== undefined && { endsAt: new Date(dto.endsAt) }),
+        ...(dto.isPublished !== undefined && { isPublished: dto.isPublished }),
+      },
+    });
+  }
+
+  async remove(tenantId: string, adminId: string, eventId: string) {
+    const event = await this.prisma.event.findFirst({ where: { id: eventId, tenantId } });
+    if (!event) throw new NotFoundException('Event not found');
+    await this.prisma.event.delete({ where: { id: eventId } });
+
+    await this.audit.log({
+      tenantId,
+      actorId: adminId,
+      action: AuditAction.EVENT_DELETED,
+      resourceType: 'Event',
+      resourceId: eventId,
+      payload: { deleted: true },
+    });
+
+    return { ok: true };
+  }
+
+  async getRsvps(tenantId: string, eventId: string) {
+    const event = await this.prisma.event.findFirst({ where: { id: eventId, tenantId } });
+    if (!event) throw new NotFoundException('Event not found');
+
+    return this.prisma.eventRsvp.findMany({
+      where: { eventId },
+      include: { user: { select: { id: true, displayName: true, jid: true } } },
+      orderBy: { createdAt: 'asc' },
+    });
+  }
+}

apps/api/src/modules/my/my.controller.ts

@@ -34,6 +34,20 @@ export class MyController {
     return this.service.getDigests(member.tenantId);
   }
 
+  @Get('events')
+  listEvents(@CurrentMember() member: MemberJwtPayload) {
+    return this.service.listEvents(member.sub, member.tenantId);
+  }
+
+  @Post('events/:id/rsvp')
+  rsvp(
+    @CurrentMember() member: MemberJwtPayload,
+    @Param('id') eventId: string,
+    @Body() body: { status: 'GOING' | 'NOT_GOING' | 'MAYBE'; note?: string },
+  ) {
+    return this.service.upsertRsvp(member.sub, member.tenantId, eventId, body.status, body.note);
+  }
+
   @Get('profile')
   profile(@CurrentMember() member: MemberJwtPayload) {
     return this.service.getProfile(member.sub, member.tenantId);

apps/api/src/modules/my/my.service.ts

@@ -26,6 +26,46 @@ export class MyService {
     };
   }
 
+  async listEvents(userId: string, tenantId: string) {
+    const now = new Date();
+    const events = await this.prisma.event.findMany({
+      where: { tenantId, isPublished: true, startsAt: { gte: new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000) } },
+      orderBy: { startsAt: 'asc' },
+      take: 20,
+      include: {
+        rsvps: {
+          where: { userId },
+          select: { status: true },
+        },
+        _count: { select: { rsvps: true } },
+      },
+    });
+
+    return events.map((e) => ({
+      id: e.id,
+      title: e.title,
+      description: e.description,
+      location: e.location,
+      startsAt: e.startsAt.toISOString(),
+      endsAt: e.endsAt?.toISOString() ?? null,
+      rsvpCount: e._count.rsvps,
+      myRsvp: e.rsvps[0]?.status ?? null,
+    }));
+  }
+
+  async upsertRsvp(userId: string, tenantId: string, eventId: string, status: 'GOING' | 'NOT_GOING' | 'MAYBE', note?: string) {
+    const event = await this.prisma.event.findFirst({ where: { id: eventId, tenantId, isPublished: true } });
+    if (!event) throw new NotFoundException('Event not found');
+
+    const rsvp = await this.prisma.eventRsvp.upsert({
+      where: { eventId_userId: { eventId, userId } },
+      create: { eventId, userId, status, note: note ?? null },
+      update: { status, note: note ?? null },
+    });
+
+    return { ok: true, rsvpId: rsvp.id, status: rsvp.status };
+  }
+
   async updateProfile(userId: string, tenantId: string, body: {
     displayName?: string;
     hometown?: string;