MOSONiE — Socio-Economic Foundation Platform

// src/pages/+config.ts
export default {
  // Enable SSR for all pages
  ssr: true,
  // Use React as the renderer
  clientRouting: true,
  // Prefetch on hover for fast navigation
  prefetchLinks: true,
} satisfies Config;

// src/components/common/SEOHead.tsx
export function SEOHead({ 
  title, 
  description, 
  image, 
  type = 'website',
  schema 
}: SEOProps) {
  return (
    <>
      <title>{title}</title>
      <meta name="description" content={description} />
      <meta property="og:title" content={title} />
      <meta property="og:description" content={description} />
      <meta property="og:image" content={image} />
      <meta property="og:type" content={type} />
      {schema && (
        <script type="application/ld+json">
          {JSON.stringify(schema)}
        </script>
      )}
    </>
  );
}

// server/middleware/cache.middleware.ts
const cacheMiddleware = async (c: Context, next: Next) => {
  const cacheKey = `api:${c.req.path}:${JSON.stringify(c.req.query())}`;
  
  // Check Redis cache
  const cached = await redis.get(cacheKey);
  if (cached) {
    return c.json(JSON.parse(cached));
  }

  await next();

  // Cache successful responses for 5 minutes
  if (c.res.status === 200) {
    await redis.setex(cacheKey, 300, JSON.stringify(response));
  }
};

// server/services/storage.service.ts
class StorageService {
  private client: S3Client;
  private bucket = 'mosonie-media';

  async uploadFile(buffer: Buffer, filename: string, contentType: string) {
    const key = `uploads/${Date.now()}-${filename}`;
    
    await this.client.send(new PutObjectCommand({
      Bucket: this.bucket,
      Key: key,
      Body: buffer,
      ContentType: contentType,
    }));

    return this.getPresignedUrl(key);
  }

  async getPresignedUrl(key: string, expires = 3600) {
    const command = new GetObjectCommand({
      Bucket: this.bucket,
      Key: key,
    });
    
    return getSignedUrl(this.client, command, { expiresIn: expires });
  }
}

// server/services/payment.service.ts
async function createDonationOrder(amount: number, email: string, name: string) {
  const razorpay = new Razorpay({
    key_id: process.env.RAZORPAY_KEY_ID,
    key_secret: process.env.RAZORPAY_KEY_SECRET,
  });

  const order = await razorpay.orders.create({
    amount: amount * 100, // Convert to paise
    currency: 'INR',
    receipt: `DON-${Date.now()}`,
    notes: {
      email,
      name,
      type: 'donation',
    },
  });

  return order;
}

async function verifyWebhookSignature(payload: string, signature: string) {
  const expected = crypto
    .createHmac('sha256', process.env.RAZORPAY_WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

// server/index.ts
const app = new Hono();

// Security headers via Helmet
app.use('*', helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      imgSrc: ["'self'", "data:", "https://storage.mosonie.org"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
    },
  },
  hsts: process.env.DISABLE_HSTS !== 'true' ? { maxAge: 31536000 } : false,
}));

// Rate limiting
app.use('*', rateLimit({
  limit: 100,
  window: 60, // 100 requests per minute
}));

// CORS
app.use('*', cors({
  origin: ['https://mosonie.org', 'https://admin.mosonie.org'],
  credentials: true,
}));

// Audit logging
app.use('*', auditLogMiddleware);

// JWT authentication for admin routes
app.use('/api/v1/admin/*', authMiddleware);

/* src/index.css - Tailwind v4 tokens */
@theme {
  --font-sans: 'Inter', system-ui, sans-serif;
  
  --spacing-xs: 8px;
  --spacing-sm: 16px;
  --spacing-md: 24px;
  --spacing-lg: 32px;
  --spacing-xl: 48px;
  
  --shadow-premium: 0 4px 6px -1px rgb(0 0 0 / 0.1), 
                   0 2px 4px -2px rgb(0 0 0 / 0.1),
                   0 0 0 1px rgb(0 0 0 / 0.05);
  
  --ease-premium: cubic-bezier(0.22, 1, 0.36, 1);
}

@layer utilities {
  .animate-premium {
    animation-duration: 300-500ms;
    animation-timing-function: var(--ease-premium);
  }
}

// vite.config.ts
export default {
  plugins: [
    partytown({
      dest: join(__dirname, 'dist', 'public', '~partytown'),
      forward: ['dataLayer.push'],
    }),
  ],
};

/api/v1/
├── /auth          # Authentication (login, logout, session)
├── /programs      # Program CRUD
├── /team          # Team member management
├── /events        # Event management
├── /blog          # Blog posts
├── /gallery       # Media galleries
├── /partners      # Partner management
├── /donations     # Donation tracking
├── /reports       # Report downloads
├── /faqs          # FAQ management
├── /inquiries     # Contact form submissions
├── /newsletters   # Subscriber management
├── /storage       # Minio file operations
└── /health        # Health check endpoints

// server/api/v1/auth.routes.ts
const authRouter = new Hono();

authRouter.post('/login', async (c) => {
  const { email, password } = await c.req.json();
  
  const user = await prisma.user.findUnique({ where: { email } });
  if (!user) {
    throw new HTTPException(401, { message: 'Invalid credentials' });
  }

  const valid = await argon2.verify(user.password, password);
  if (!valid) {
    throw new HTTPException(401, { message: 'Invalid credentials' });
  }

  const token = await sign({ userId: user.id, role: user.role }, JWT_SECRET, {
    expiresIn: '7d',
  });

  c.header('Set-Cookie', `token=${token}; HttpOnly; Path=/; Max-Age=604800; SameSite=Strict`);
  
  return c.json({ success: true, user: { id: user.id, email: user.email, role: user.role } });
});

// src/pages/admin/+config.ts
export default {
  // Disable SSR for admin - better for interactive editing
  ssr: false,
  // Enable client-side navigation
  clientRouting: true,
} satisfies Config;

# lighthouserc.json
{
  "ci": {
    "collect": {
      "numberOfRuns": 3,
      "url": ["http://localhost:3000/"],
      "staticDistDir": "./dist/public"
    },
    "assert": {
      "assertions": {
        "categories:performance": ["error", { "minScore": 0.95 }],
        "categories:accessibility": ["error", { "minScore": 1 }],
        "categories:best-practices": ["error", { "minScore": 1 }],
        "categories:seo": ["error", { "minScore": 1 }]
      }
    }
  }
}

# Full automated deployment
./deploy.sh "commit message"

# Options
./deploy.sh --auto          # Non-interactive
./deploy.sh --skip-build    # Restart only
./deploy.sh --skip-test     # Skip API verification
./deploy.sh --dry-run       # Preview