From 64889128ff803750c3ffbe838029619a9dba8865 Mon Sep 17 00:00:00 2001
From: sadeeq6400 <abk000064@gmail.com>
Date: Tue, 30 Jun 2026 02:16:08 +0100
Subject: [PATCH 1/4] Community feed: backend

---
 backend/src/app.module.ts                     |   2 +
 backend/src/community/community.controller.ts |  96 ++++++++++
 backend/src/community/community.module.ts     |  14 ++
 backend/src/community/community.service.ts    | 165 ++++++++++++++++++
 backend/src/community/dto/create-post.dto.ts  |  10 ++
 backend/src/community/dto/post-query.dto.ts   |  20 +++
 .../entities/community-post-like.entity.ts    |  38 ++++
 .../entities/community-post.entity.ts         |  48 +++++
 8 files changed, 393 insertions(+)
 create mode 100644 backend/src/community/community.controller.ts
 create mode 100644 backend/src/community/community.module.ts
 create mode 100644 backend/src/community/community.service.ts
 create mode 100644 backend/src/community/dto/create-post.dto.ts
 create mode 100644 backend/src/community/dto/post-query.dto.ts
 create mode 100644 backend/src/community/entities/community-post-like.entity.ts
 create mode 100644 backend/src/community/entities/community-post.entity.ts

diff --git a/backend/src/app.module.ts b/backend/src/app.module.ts
index 88e247a..2b66aa2 100644
--- a/backend/src/app.module.ts
+++ b/backend/src/app.module.ts
@@ -50,6 +50,7 @@ import { CalendarSyncModule } from './calendar-sync/calendar-sync.module';
 import { ResourcesModule } from './resources/resources.module';
 import { NpsModule } from './nps/nps.module';
 import { DoorAccessModule } from './integrations/access-control/door-access.module';
+import { CommunityModule } from './community/community.module';
 
 @Module({
   imports: [
@@ -156,6 +157,7 @@ import { DoorAccessModule } from './integrations/access-control/door-access.modu
     ResourcesModule,
     NpsModule,
     DoorAccessModule,
+    CommunityModule,
   ],
   controllers: [AppController],
   providers: [
diff --git a/backend/src/community/community.controller.ts b/backend/src/community/community.controller.ts
new file mode 100644
index 0000000..b8f963f
--- /dev/null
+++ b/backend/src/community/community.controller.ts
@@ -0,0 +1,96 @@
+import {
+  Controller,
+  Get,
+  Post,
+  Delete,
+  Patch,
+  Body,
+  Param,
+  Query,
+  HttpCode,
+  HttpStatus,
+  ParseUUIDPipe,
+  UseGuards,
+} from '@nestjs/common';
+import {
+  ApiBearerAuth,
+  ApiOperation,
+  ApiTags,
+} from '@nestjs/swagger';
+import { CommunityService } from './community.service';
+import { CreatePostDto } from './dto/create-post.dto';
+import { PostQueryDto } from './dto/post-query.dto';
+import { GetCurrentUser } from '../auth/decorators/getCurrentUser.decorator';
+import { Roles } from '../auth/decorators/roles.decorators';
+import { RolesGuard } from '../auth/guard/roles.guard';
+import { UserRole } from '../users/enums/userRoles.enum';
+
+@ApiTags('Community Feed')
+@ApiBearerAuth()
+@UseGuards(RolesGuard)
+@Controller('community/posts')
+export class CommunityController {
+  constructor(private readonly communityService: CommunityService) {}
+
+  // POST /community/posts — any active authenticated member
+  @Post()
+  @Roles(UserRole.USER, UserRole.STAFF, UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiOperation({ summary: 'Create a community post' })
+  async createPost(
+    @Body() dto: CreatePostDto,
+    @GetCurrentUser('id') userId: string,
+  ) {
+    const post = await this.communityService.createPost(dto, userId);
+    return { message: 'Post created successfully', data: post };
+  }
+
+  // GET /community/posts — paginated feed; pinned first, then newest
+  @Get()
+  @Roles(UserRole.USER, UserRole.STAFF, UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiOperation({ summary: 'Get paginated community feed (pinned first, then newest)' })
+  async getFeed(@Query() query: PostQueryDto) {
+    return this.communityService.getFeed(query);
+  }
+
+  // DELETE /community/posts/:id — soft-delete own post (member) or any post (admin)
+  @Delete(':id')
+  @Roles(UserRole.USER, UserRole.STAFF, UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Soft-delete a post (own post for members, any post for admins)' })
+  async deletePost(
+    @Param('id', ParseUUIDPipe) id: string,
+    @GetCurrentUser('id') userId: string,
+    @GetCurrentUser('role') userRole: UserRole,
+  ) {
+    await this.communityService.deletePost(id, userId, userRole);
+    return { message: 'Post deleted successfully' };
+  }
+
+  // POST /community/posts/:id/like — toggle like/unlike
+  @Post(':id/like')
+  @Roles(UserRole.USER, UserRole.STAFF, UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Toggle like/unlike on a post' })
+  async toggleLike(
+    @Param('id', ParseUUIDPipe) id: string,
+    @GetCurrentUser('id') userId: string,
+  ) {
+    const result = await this.communityService.toggleLike(id, userId);
+    return {
+      message: result.liked ? 'Post liked' : 'Post unliked',
+      data: result,
+    };
+  }
+
+  // PATCH /community/posts/:id/pin — toggle pin/unpin (admin only)
+  @Patch(':id/pin')
+  @Roles(UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiOperation({ summary: 'Toggle pin/unpin on a post (admin only)' })
+  async togglePin(@Param('id', ParseUUIDPipe) id: string) {
+    const result = await this.communityService.togglePin(id);
+    return {
+      message: result.isPinned ? 'Post pinned' : 'Post unpinned',
+      data: result,
+    };
+  }
+}
diff --git a/backend/src/community/community.module.ts b/backend/src/community/community.module.ts
new file mode 100644
index 0000000..c76973c
--- /dev/null
+++ b/backend/src/community/community.module.ts
@@ -0,0 +1,14 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+import { CommunityPost } from './entities/community-post.entity';
+import { CommunityPostLike } from './entities/community-post-like.entity';
+import { CommunityService } from './community.service';
+import { CommunityController } from './community.controller';
+
+@Module({
+  imports: [TypeOrmModule.forFeature([CommunityPost, CommunityPostLike])],
+  controllers: [CommunityController],
+  providers: [CommunityService],
+  exports: [CommunityService],
+})
+export class CommunityModule {}
diff --git a/backend/src/community/community.service.ts b/backend/src/community/community.service.ts
new file mode 100644
index 0000000..a1a4c9c
--- /dev/null
+++ b/backend/src/community/community.service.ts
@@ -0,0 +1,165 @@
+import {
+  Injectable,
+  ForbiddenException,
+  NotFoundException,
+} from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { DataSource, Repository } from 'typeorm';
+import { CommunityPost } from './entities/community-post.entity';
+import { CommunityPostLike } from './entities/community-post-like.entity';
+import { CreatePostDto } from './dto/create-post.dto';
+import { PostQueryDto } from './dto/post-query.dto';
+import { UserRole } from '../users/enums/userRoles.enum';
+import { ErrorCatch } from '../utils/error';
+
+@Injectable()
+export class CommunityService {
+  constructor(
+    @InjectRepository(CommunityPost)
+    private readonly postRepo: Repository<CommunityPost>,
+
+    @InjectRepository(CommunityPostLike)
+    private readonly likeRepo: Repository<CommunityPostLike>,
+
+    private readonly dataSource: DataSource,
+  ) {}
+
+  // ─── Create Post ──────────────────────────────────────────────────────────
+
+  async createPost(dto: CreatePostDto, authorUserId: string): Promise<CommunityPost> {
+    try {
+      const post = this.postRepo.create({ body: dto.body, authorUserId });
+      return await this.postRepo.save(post);
+    } catch (error) {
+      ErrorCatch(error, 'Error creating community post');
+    }
+  }
+
+  // ─── Paginated Feed ───────────────────────────────────────────────────────
+
+  async getFeed(query: PostQueryDto) {
+    try {
+      const { page = 1, limit = 20 } = query;
+
+      const [items, total] = await this.postRepo
+        .createQueryBuilder('post')
+        .leftJoin('post.author', 'author')
+        .addSelect([
+          'author.id',
+          'author.username',
+          'author.firstname',
+          'author.lastname',
+          'author.profilePicture',
+        ])
+        .where('post.isDeleted = :isDeleted', { isDeleted: false })
+        // pinned first, then newest
+        .orderBy('post.isPinned', 'DESC')
+        .addOrderBy('post.createdAt', 'DESC')
+        .skip((page - 1) * limit)
+        .take(limit)
+        .getManyAndCount();
+
+      return {
+        items,
+        total,
+        page,
+        limit,
+        totalPages: Math.ceil(total / limit),
+      };
+    } catch (error) {
+      ErrorCatch(error, 'Error fetching community feed');
+    }
+  }
+
+  // ─── Soft-Delete Post ─────────────────────────────────────────────────────
+
+  async deletePost(
+    postId: string,
+    userId: string,
+    userRole: UserRole,
+  ): Promise<void> {
+    try {
+      const post = await this.findPostOrFail(postId);
+
+      const isAdmin =
+        userRole === UserRole.ADMIN || userRole === UserRole.SUPER_ADMIN;
+
+      if (!isAdmin && post.authorUserId !== userId) {
+        throw new ForbiddenException('You can only delete your own posts');
+      }
+
+      post.isDeleted = true;
+      await this.postRepo.save(post);
+    } catch (error) {
+      ErrorCatch(error, 'Error deleting community post');
+    }
+  }
+
+  // ─── Toggle Like ──────────────────────────────────────────────────────────
+
+  async toggleLike(
+    postId: string,
+    userId: string,
+  ): Promise<{ liked: boolean; likeCount: number }> {
+    try {
+      const post = await this.findPostOrFail(postId);
+
+      const existingLike = await this.likeRepo.findOne({
+        where: { postId, userId },
+      });
+
+      // Use a transaction to update like row + likeCount atomically
+      await this.dataSource.transaction(async (manager) => {
+        if (existingLike) {
+          await manager.remove(CommunityPostLike, existingLike);
+          await manager
+            .createQueryBuilder()
+            .update(CommunityPost)
+            .set({ likeCount: () => '"likeCount" - 1' })
+            .where('id = :id AND "likeCount" > 0', { id: postId })
+            .execute();
+        } else {
+          const like = manager.create(CommunityPostLike, { postId, userId });
+          await manager.save(CommunityPostLike, like);
+          await manager
+            .createQueryBuilder()
+            .update(CommunityPost)
+            .set({ likeCount: () => '"likeCount" + 1' })
+            .where('id = :id', { id: postId })
+            .execute();
+        }
+      });
+
+      // Reload updated count
+      const updated = await this.postRepo.findOne({ where: { id: postId } });
+      return {
+        liked: !existingLike,
+        likeCount: updated?.likeCount ?? post.likeCount,
+      };
+    } catch (error) {
+      ErrorCatch(error, 'Error toggling post like');
+    }
+  }
+
+  // ─── Toggle Pin ───────────────────────────────────────────────────────────
+
+  async togglePin(postId: string): Promise<{ isPinned: boolean }> {
+    try {
+      const post = await this.findPostOrFail(postId);
+      post.isPinned = !post.isPinned;
+      await this.postRepo.save(post);
+      return { isPinned: post.isPinned };
+    } catch (error) {
+      ErrorCatch(error, 'Error toggling post pin');
+    }
+  }
+
+  // ─── Helpers ──────────────────────────────────────────────────────────────
+
+  private async findPostOrFail(postId: string): Promise<CommunityPost> {
+    const post = await this.postRepo.findOne({ where: { id: postId } });
+    if (!post) throw new NotFoundException(`Post ${postId} not found`);
+    if (post.isDeleted) throw new NotFoundException(`Post ${postId} not found`);
+    return post;
+  }
+}
diff --git a/backend/src/community/dto/create-post.dto.ts b/backend/src/community/dto/create-post.dto.ts
new file mode 100644
index 0000000..87eec3b
--- /dev/null
+++ b/backend/src/community/dto/create-post.dto.ts
@@ -0,0 +1,10 @@
+import { IsString, MaxLength, MinLength } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class CreatePostDto {
+  @ApiProperty({ description: 'Post body text', maxLength: 1000, minLength: 1 })
+  @IsString()
+  @MinLength(1)
+  @MaxLength(1000)
+  body: string;
+}
diff --git a/backend/src/community/dto/post-query.dto.ts b/backend/src/community/dto/post-query.dto.ts
new file mode 100644
index 0000000..8ac8b5a
--- /dev/null
+++ b/backend/src/community/dto/post-query.dto.ts
@@ -0,0 +1,20 @@
+import { IsInt, IsOptional, Max, Min } from 'class-validator';
+import { Type } from 'class-transformer';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+
+export class PostQueryDto {
+  @ApiPropertyOptional({ default: 1, minimum: 1 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  page?: number = 1;
+
+  @ApiPropertyOptional({ default: 20, minimum: 1, maximum: 100 })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(100)
+  limit?: number = 20;
+}
diff --git a/backend/src/community/entities/community-post-like.entity.ts b/backend/src/community/entities/community-post-like.entity.ts
new file mode 100644
index 0000000..aa7d5c1
--- /dev/null
+++ b/backend/src/community/entities/community-post-like.entity.ts
@@ -0,0 +1,38 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  ManyToOne,
+  CreateDateColumn,
+  JoinColumn,
+  Unique,
+  Index,
+} from 'typeorm';
+import { User } from '../../users/entities/user.entity';
+import { CommunityPost } from './community-post.entity';
+
+@Entity('community_post_likes')
+@Unique(['postId', 'userId'])
+@Index(['postId'])
+@Index(['userId'])
+export class CommunityPostLike {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column('uuid')
+  postId: string;
+
+  @ManyToOne(() => CommunityPost, (post) => post.likes, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'postId' })
+  post: CommunityPost;
+
+  @Column('uuid')
+  userId: string;
+
+  @ManyToOne(() => User, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'userId' })
+  user: User;
+
+  @CreateDateColumn()
+  createdAt: Date;
+}
diff --git a/backend/src/community/entities/community-post.entity.ts b/backend/src/community/entities/community-post.entity.ts
new file mode 100644
index 0000000..afa6b7a
--- /dev/null
+++ b/backend/src/community/entities/community-post.entity.ts
@@ -0,0 +1,48 @@
+import {
+  Entity,
+  PrimaryGeneratedColumn,
+  Column,
+  ManyToOne,
+  OneToMany,
+  CreateDateColumn,
+  UpdateDateColumn,
+  JoinColumn,
+  Index,
+} from 'typeorm';
+import { User } from '../../users/entities/user.entity';
+import { CommunityPostLike } from './community-post-like.entity';
+
+@Entity('community_posts')
+@Index(['isDeleted', 'isPinned', 'createdAt'])
+export class CommunityPost {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column('uuid')
+  authorUserId: string;
+
+  @ManyToOne(() => User, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'authorUserId' })
+  author: User;
+
+  @Column({ type: 'text', length: 1000 })
+  body: string;
+
+  @Column({ type: 'boolean', default: false })
+  isPinned: boolean;
+
+  @Column({ type: 'boolean', default: false })
+  isDeleted: boolean;
+
+  @Column({ type: 'int', default: 0 })
+  likeCount: number;
+
+  @OneToMany(() => CommunityPostLike, (like) => like.post)
+  likes: CommunityPostLike[];
+
+  @CreateDateColumn()
+  createdAt: Date;
+
+  @UpdateDateColumn()
+  updatedAt: Date;
+}

From 5cf8d05e6cd4fb6e6b64aaf1a6344163516cf72e Mon Sep 17 00:00:00 2001
From: sadeeq6400 <abk000064@gmail.com>
Date: Tue, 30 Jun 2026 02:25:10 +0100
Subject: [PATCH 2/4] Community feed: frontend (bulletin board)

---
 frontend/app/community/page.tsx               | 205 ++++++++++
 .../components/community/CommunityFeed.tsx    | 350 ++++++++++++++++++
 .../components/dashboard/DashboardSidebar.tsx |   3 +-
 .../hooks/community/useCreateCommunityPost.ts |  26 ++
 .../hooks/community/useDeleteCommunityPost.ts |  21 ++
 .../hooks/community/useGetCommunityFeed.ts    |  17 +
 .../hooks/community/useTogglePostLike.ts      |  73 ++++
 .../hooks/community/useTogglePostPin.ts       |  22 ++
 frontend/lib/react-query/keys/queryKeys.ts    |   3 +
 frontend/lib/types/community.ts               |  46 +++
 10 files changed, 765 insertions(+), 1 deletion(-)
 create mode 100644 frontend/app/community/page.tsx
 create mode 100644 frontend/components/community/CommunityFeed.tsx
 create mode 100644 frontend/lib/react-query/hooks/community/useCreateCommunityPost.ts
 create mode 100644 frontend/lib/react-query/hooks/community/useDeleteCommunityPost.ts
 create mode 100644 frontend/lib/react-query/hooks/community/useGetCommunityFeed.ts
 create mode 100644 frontend/lib/react-query/hooks/community/useTogglePostLike.ts
 create mode 100644 frontend/lib/react-query/hooks/community/useTogglePostPin.ts
 create mode 100644 frontend/lib/types/community.ts

diff --git a/frontend/app/community/page.tsx b/frontend/app/community/page.tsx
new file mode 100644
index 0000000..58ed3e1
--- /dev/null
+++ b/frontend/app/community/page.tsx
@@ -0,0 +1,205 @@
+"use client";
+
+import { useState, useEffect } from "react";
+import DashboardLayout from "@/components/dashboard/DashboardLayout";
+import CommunityFeed from "@/components/community/CommunityFeed";
+import { apiClient } from "@/lib/apiClient";
+import { Search, User, X, Linkedin, Twitter, Users, Rss } from "lucide-react";
+
+// ─── Types ────────────────────────────────────────────────────────────────────
+
+type Member = {
+  id: string;
+  firstname: string;
+  lastname: string;
+  username?: string;
+  profilePicture?: string;
+  memberSince?: string;
+};
+
+type Tab = "feed" | "members";
+
+// ─── Members tab (ported from /members with community API) ────────────────────
+
+function MembersTab() {
+  const [members, setMembers] = useState<Member[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [search, setSearch] = useState("");
+  const [selectedMember, setSelectedMember] = useState<Member | null>(null);
+
+  useEffect(() => {
+    fetchMembers();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [search]);
+
+  const fetchMembers = async () => {
+    try {
+      setLoading(true);
+      const res = await apiClient.get<{
+        data: Member[];
+        total: number;
+      }>(`/community/members?search=${encodeURIComponent(search)}&limit=50`);
+      setMembers(res.data ?? []);
+    } catch {
+      setMembers([]);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  return (
+    <div>
+      {/* Search */}
+      <div className="relative mb-6">
+        <Search className="absolute left-3 top-1/2 -translate-y-1/2 w-4 h-4 text-gray-400" />
+        <input
+          type="text"
+          placeholder="Search members by name or username..."
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+          className="w-full pl-10 pr-4 py-2.5 border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-900 rounded-lg focus:outline-none focus:ring-2 focus:ring-gray-200 dark:focus:ring-gray-700 text-sm text-gray-900 dark:text-gray-100"
+        />
+      </div>
+
+      {loading ? (
+        <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+          {[...Array(6)].map((_, i) => (
+            <div
+              key={i}
+              className="h-24 bg-white dark:bg-gray-900 border border-gray-100 dark:border-gray-800 rounded-xl animate-pulse"
+            />
+          ))}
+        </div>
+      ) : members.length === 0 ? (
+        <div className="text-center py-20 text-gray-500 dark:text-gray-400">
+          <Users className="w-10 h-10 mx-auto mb-3 opacity-30" />
+          <p className="text-sm">No members found.</p>
+        </div>
+      ) : (
+        <div className="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4">
+          {members.map((member) => (
+            <button
+              key={member.id}
+              type="button"
+              onClick={() => setSelectedMember(member)}
+              className="bg-white dark:bg-gray-900 border border-gray-100 dark:border-gray-800 rounded-xl p-4 flex items-center gap-3 hover:shadow-sm hover:border-gray-200 dark:hover:border-gray-700 transition-all text-left"
+            >
+              {member.profilePicture ? (
+                <img
+                  src={member.profilePicture}
+                  alt={`${member.firstname} ${member.lastname}`}
+                  className="w-10 h-10 rounded-full object-cover shrink-0"
+                />
+              ) : (
+                <div className="w-10 h-10 rounded-full bg-gray-200 dark:bg-gray-700 flex items-center justify-center shrink-0">
+                  <User className="w-5 h-5 text-gray-500 dark:text-gray-400" />
+                </div>
+              )}
+              <div className="min-w-0">
+                <p className="text-sm font-semibold text-gray-900 dark:text-gray-100 truncate">
+                  {member.firstname} {member.lastname}
+                </p>
+                {member.username && (
+                  <p className="text-xs text-gray-400 dark:text-gray-500 truncate">
+                    @{member.username}
+                  </p>
+                )}
+              </div>
+            </button>
+          ))}
+        </div>
+      )}
+
+      {/* Member profile modal */}
+      {selectedMember && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4 bg-black/50 backdrop-blur-sm">
+          <div className="bg-white dark:bg-gray-900 rounded-xl shadow-lg w-full max-w-sm p-6 relative">
+            <button
+              type="button"
+              onClick={() => setSelectedMember(null)}
+              className="absolute top-4 right-4 p-1.5 text-gray-400 hover:text-gray-600 dark:hover:text-gray-200 rounded-full hover:bg-gray-100 dark:hover:bg-gray-800 transition-colors"
+              aria-label="Close"
+            >
+              <X className="w-4 h-4" />
+            </button>
+            <div className="flex flex-col items-center text-center">
+              {selectedMember.profilePicture ? (
+                <img
+                  src={selectedMember.profilePicture}
+                  alt={`${selectedMember.firstname} ${selectedMember.lastname}`}
+                  className="w-20 h-20 rounded-full object-cover mb-3"
+                />
+              ) : (
+                <div className="w-20 h-20 rounded-full bg-gray-200 dark:bg-gray-700 flex items-center justify-center mb-3">
+                  <User className="w-10 h-10 text-gray-400 dark:text-gray-500" />
+                </div>
+              )}
+              <h2 className="text-lg font-bold text-gray-900 dark:text-gray-100">
+                {selectedMember.firstname} {selectedMember.lastname}
+              </h2>
+              {selectedMember.username && (
+                <p className="text-sm text-gray-400 dark:text-gray-500 mt-0.5">
+                  @{selectedMember.username}
+                </p>
+              )}
+              {selectedMember.memberSince && (
+                <p className="text-xs text-gray-400 dark:text-gray-500 mt-2">
+                  Member since{" "}
+                  {new Date(selectedMember.memberSince).toLocaleDateString(undefined, {
+                    month: "long",
+                    year: "numeric",
+                  })}
+                </p>
+              )}
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
+
+// ─── Page ─────────────────────────────────────────────────────────────────────
+
+export default function CommunityPage() {
+  const [activeTab, setActiveTab] = useState<Tab>("feed");
+
+  const tabs: { id: Tab; label: string; icon: React.ElementType }[] = [
+    { id: "feed", label: "Feed", icon: Rss },
+    { id: "members", label: "Members", icon: Users },
+  ];
+
+  return (
+    <DashboardLayout>
+      {/* Header */}
+      <div className="mb-6">
+        <h1 className="text-2xl font-bold text-gray-900 dark:text-gray-100">Community</h1>
+        <p className="text-gray-500 dark:text-gray-400 mt-1 text-sm">
+          Connect with fellow members, share updates, and celebrate milestones.
+        </p>
+      </div>
+
+      {/* Tabs */}
+      <div className="flex gap-1 mb-6 p-1 bg-gray-100 dark:bg-gray-800 rounded-xl w-fit">
+        {tabs.map(({ id, label, icon: Icon }) => (
+          <button
+            key={id}
+            type="button"
+            onClick={() => setActiveTab(id)}
+            className={`flex items-center gap-2 px-4 py-2 rounded-lg text-sm font-medium transition-colors ${
+              activeTab === id
+                ? "bg-white dark:bg-gray-900 text-gray-900 dark:text-gray-100 shadow-sm"
+                : "text-gray-500 dark:text-gray-400 hover:text-gray-700 dark:hover:text-gray-200"
+            }`}
+          >
+            <Icon className="w-4 h-4" />
+            {label}
+          </button>
+        ))}
+      </div>
+
+      {/* Tab content */}
+      {activeTab === "feed" ? <CommunityFeed /> : <MembersTab />}
+    </DashboardLayout>
+  );
+}
diff --git a/frontend/components/community/CommunityFeed.tsx b/frontend/components/community/CommunityFeed.tsx
new file mode 100644
index 0000000..74dc52d
--- /dev/null
+++ b/frontend/components/community/CommunityFeed.tsx
@@ -0,0 +1,350 @@
+"use client";
+
+import { useState } from "react";
+import { Heart, Pin, Trash2, PenLine, X } from "lucide-react";
+import { useAuthState } from "@/lib/store/authStore";
+import { useGetCommunityFeed } from "@/lib/react-query/hooks/community/useGetCommunityFeed";
+import { useCreateCommunityPost } from "@/lib/react-query/hooks/community/useCreateCommunityPost";
+import { useTogglePostLike } from "@/lib/react-query/hooks/community/useTogglePostLike";
+import { useDeleteCommunityPost } from "@/lib/react-query/hooks/community/useDeleteCommunityPost";
+import { useTogglePostPin } from "@/lib/react-query/hooks/community/useTogglePostPin";
+import { CommunityPost } from "@/lib/types/community";
+
+const MAX_BODY = 1000;
+
+function timeAgo(iso: string): string {
+  const diff = Date.now() - new Date(iso).getTime();
+  const mins = Math.floor(diff / 60_000);
+  if (mins < 1) return "just now";
+  if (mins < 60) return `${mins}m ago`;
+  const hours = Math.floor(mins / 60);
+  if (hours < 24) return `${hours}h ago`;
+  const days = Math.floor(hours / 24);
+  if (days < 7) return `${days}d ago`;
+  return new Date(iso).toLocaleDateString();
+}
+
+function Avatar({ author }: { author: CommunityPost["author"] }) {
+  const initials = `${author.firstname?.[0] ?? ""}${author.lastname?.[0] ?? ""}`.toUpperCase();
+  if (author.profilePicture) {
+    return (
+      <img
+        src={author.profilePicture}
+        alt={`${author.firstname} ${author.lastname}`}
+        className="w-9 h-9 rounded-full object-cover shrink-0"
+      />
+    );
+  }
+  return (
+    <div className="w-9 h-9 rounded-full bg-gray-200 dark:bg-gray-700 flex items-center justify-center shrink-0">
+      <span className="text-xs font-semibold text-gray-600 dark:text-gray-300">
+        {initials || "?"}
+      </span>
+    </div>
+  );
+}
+
+// ─── Write Post Modal ─────────────────────────────────────────────────────────
+
+function WritePostModal({ onClose }: { onClose: () => void }) {
+  const [body, setBody] = useState("");
+  const createPost = useCreateCommunityPost();
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    if (!body.trim()) return;
+    await createPost.mutateAsync({ body: body.trim() });
+    onClose();
+  };
+
+  return (
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+      <div className="bg-white dark:bg-gray-900 rounded-xl shadow-xl w-full max-w-lg">
+        <div className="flex items-center justify-between px-5 py-4 border-b border-gray-100 dark:border-gray-800">
+          <h2 className="font-semibold text-gray-900 dark:text-gray-100">Share with the community</h2>
+          <button
+            type="button"
+            onClick={onClose}
+            className="p-1 text-gray-400 hover:text-gray-600 dark:hover:text-gray-200 rounded transition-colors"
+            aria-label="Close"
+          >
+            <X className="w-4 h-4" />
+          </button>
+        </div>
+        <form onSubmit={handleSubmit} className="p-5 space-y-4">
+          <div className="relative">
+            <textarea
+              value={body}
+              onChange={(e) => setBody(e.target.value.slice(0, MAX_BODY))}
+              placeholder="Share an update, opportunity, or milestone..."
+              rows={5}
+              className="w-full border border-gray-200 dark:border-gray-700 bg-white dark:bg-gray-800 text-gray-900 dark:text-gray-100 rounded-lg px-3 py-2.5 text-sm resize-none focus:outline-none focus:ring-2 focus:ring-gray-300 dark:focus:ring-gray-600 placeholder:text-gray-400"
+              autoFocus
+            />
+            <span
+              className={`absolute bottom-3 right-3 text-xs ${
+                body.length >= MAX_BODY
+                  ? "text-red-500"
+                  : "text-gray-400"
+              }`}
+            >
+              {body.length}/{MAX_BODY}
+            </span>
+          </div>
+          <div className="flex justify-end gap-3">
+            <button
+              type="button"
+              onClick={onClose}
+              className="px-4 py-2 text-sm border border-gray-200 dark:border-gray-700 rounded-lg text-gray-600 dark:text-gray-400 hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors"
+            >
+              Cancel
+            </button>
+            <button
+              type="submit"
+              disabled={!body.trim() || createPost.isPending}
+              className="px-4 py-2 text-sm bg-gray-900 dark:bg-gray-100 text-white dark:text-gray-900 rounded-lg hover:bg-gray-800 dark:hover:bg-gray-200 disabled:opacity-50 disabled:cursor-not-allowed transition-colors"
+            >
+              {createPost.isPending ? "Posting..." : "Post"}
+            </button>
+          </div>
+        </form>
+      </div>
+    </div>
+  );
+}
+
+// ─── Post Card ────────────────────────────────────────────────────────────────
+
+function PostCard({
+  post,
+  isAdmin,
+  currentUserId,
+}: {
+  post: CommunityPost;
+  isAdmin: boolean;
+  currentUserId?: string;
+}) {
+  const toggleLike = useTogglePostLike();
+  const deletePost = useDeleteCommunityPost();
+  const togglePin = useTogglePostPin();
+
+  const canDelete = isAdmin || post.authorUserId === currentUserId;
+
+  return (
+    <div
+      className={`bg-white dark:bg-gray-900 rounded-xl border transition-shadow hover:shadow-sm ${
+        post.isPinned
+          ? "border-amber-200 dark:border-amber-800"
+          : "border-gray-100 dark:border-gray-800"
+      }`}
+    >
+      <div className="p-4">
+        {/* Pin indicator */}
+        {post.isPinned && (
+          <div className="flex items-center gap-1.5 mb-3 text-amber-600 dark:text-amber-400">
+            <Pin className="w-3.5 h-3.5 fill-current" />
+            <span className="text-xs font-medium">Pinned</span>
+          </div>
+        )}
+
+        {/* Author row */}
+        <div className="flex items-start gap-3">
+          <Avatar author={post.author} />
+          <div className="flex-1 min-w-0">
+            <div className="flex items-start justify-between gap-2">
+              <div>
+                <p className="text-sm font-semibold text-gray-900 dark:text-gray-100 leading-tight">
+                  {post.author.firstname} {post.author.lastname}
+                </p>
+                {post.author.username && (
+                  <p className="text-xs text-gray-400 dark:text-gray-500">
+                    @{post.author.username}
+                  </p>
+                )}
+              </div>
+              <span className="text-xs text-gray-400 dark:text-gray-500 shrink-0 pt-0.5">
+                {timeAgo(post.createdAt)}
+              </span>
+            </div>
+          </div>
+        </div>
+
+        {/* Body */}
+        <p className="mt-3 text-sm text-gray-700 dark:text-gray-300 whitespace-pre-wrap leading-relaxed">
+          {post.body}
+        </p>
+
+        {/* Footer: like + admin actions */}
+        <div className="mt-4 flex items-center justify-between">
+          {/* Like button */}
+          <button
+            type="button"
+            onClick={() => toggleLike.mutate(post.id)}
+            disabled={toggleLike.isPending}
+            className="flex items-center gap-1.5 text-sm text-gray-500 dark:text-gray-400 hover:text-red-500 dark:hover:text-red-400 transition-colors disabled:opacity-50"
+            aria-label="Toggle like"
+          >
+            <Heart
+              className={`w-4 h-4 transition-colors ${
+                post.likeCount > 0
+                  ? "fill-red-500 text-red-500 dark:fill-red-400 dark:text-red-400"
+                  : ""
+              }`}
+            />
+            <span>{post.likeCount}</span>
+          </button>
+
+          {/* Admin actions */}
+          {(isAdmin || canDelete) && (
+            <div className="flex items-center gap-1">
+              {isAdmin && (
+                <button
+                  type="button"
+                  onClick={() => togglePin.mutate(post.id)}
+                  disabled={togglePin.isPending}
+                  title={post.isPinned ? "Unpin post" : "Pin post"}
+                  className={`p-1.5 rounded-lg transition-colors disabled:opacity-50 ${
+                    post.isPinned
+                      ? "text-amber-500 dark:text-amber-400 hover:bg-amber-50 dark:hover:bg-amber-900/20"
+                      : "text-gray-400 dark:text-gray-500 hover:bg-gray-50 dark:hover:bg-gray-800 hover:text-amber-500"
+                  }`}
+                  aria-label={post.isPinned ? "Unpin" : "Pin"}
+                >
+                  <Pin className={`w-4 h-4 ${post.isPinned ? "fill-current" : ""}`} />
+                </button>
+              )}
+              {canDelete && (
+                <button
+                  type="button"
+                  onClick={() => deletePost.mutate(post.id)}
+                  disabled={deletePost.isPending}
+                  title="Delete post"
+                  className="p-1.5 rounded-lg text-gray-400 dark:text-gray-500 hover:bg-red-50 dark:hover:bg-red-900/20 hover:text-red-500 dark:hover:text-red-400 transition-colors disabled:opacity-50"
+                  aria-label="Delete post"
+                >
+                  <Trash2 className="w-4 h-4" />
+                </button>
+              )}
+            </div>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// ─── Feed Skeleton ────────────────────────────────────────────────────────────
+
+function FeedSkeleton() {
+  return (
+    <div className="space-y-4">
+      {[1, 2, 3].map((i) => (
+        <div
+          key={i}
+          className="bg-white dark:bg-gray-900 rounded-xl border border-gray-100 dark:border-gray-800 p-4 animate-pulse"
+        >
+          <div className="flex items-start gap-3">
+            <div className="w-9 h-9 rounded-full bg-gray-200 dark:bg-gray-700 shrink-0" />
+            <div className="flex-1 space-y-2">
+              <div className="h-3 bg-gray-200 dark:bg-gray-700 rounded w-32" />
+              <div className="h-3 bg-gray-100 dark:bg-gray-800 rounded w-20" />
+            </div>
+          </div>
+          <div className="mt-3 space-y-2">
+            <div className="h-3 bg-gray-100 dark:bg-gray-800 rounded w-full" />
+            <div className="h-3 bg-gray-100 dark:bg-gray-800 rounded w-4/5" />
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
+
+// ─── CommunityFeed (main export) ──────────────────────────────────────────────
+
+export default function CommunityFeed() {
+  const { user } = useAuthState();
+  const [page, setPage] = useState(1);
+  const [showModal, setShowModal] = useState(false);
+
+  const { data, isLoading } = useGetCommunityFeed(page, 20);
+
+  const isAdmin = user?.role === "admin";
+  const posts = data?.items ?? [];
+  const meta = data;
+
+  return (
+    <div className="max-w-2xl">
+      {/* Write a Post CTA */}
+      <button
+        type="button"
+        onClick={() => setShowModal(true)}
+        className="w-full mb-6 flex items-center gap-3 px-4 py-3 bg-white dark:bg-gray-900 border border-gray-200 dark:border-gray-700 rounded-xl text-sm text-gray-400 dark:text-gray-500 hover:border-gray-300 dark:hover:border-gray-600 hover:text-gray-600 dark:hover:text-gray-400 transition-colors text-left"
+      >
+        <div className="w-8 h-8 rounded-full bg-gray-200 dark:bg-gray-700 flex items-center justify-center shrink-0">
+          <span className="text-xs font-semibold text-gray-600 dark:text-gray-300">
+            {user?.firstname?.[0]}
+            {user?.lastname?.[0]}
+          </span>
+        </div>
+        <span className="flex-1">Share an update, opportunity, or milestone...</span>
+        <PenLine className="w-4 h-4 shrink-0" />
+      </button>
+
+      {/* Feed */}
+      {isLoading ? (
+        <FeedSkeleton />
+      ) : posts.length === 0 ? (
+        <div className="flex flex-col items-center justify-center py-20 text-center">
+          <PenLine className="w-10 h-10 text-gray-200 dark:text-gray-700 mb-4" />
+          <p className="text-sm font-medium text-gray-500 dark:text-gray-400">
+            No posts yet
+          </p>
+          <p className="text-xs text-gray-400 dark:text-gray-500 mt-1">
+            Be the first to share something with the community.
+          </p>
+        </div>
+      ) : (
+        <>
+          <div className="space-y-4">
+            {posts.map((post) => (
+              <PostCard
+                key={post.id}
+                post={post}
+                isAdmin={isAdmin}
+                currentUserId={user?.id}
+              />
+            ))}
+          </div>
+
+          {/* Pagination */}
+          {meta && meta.totalPages > 1 && (
+            <div className="flex items-center justify-between pt-6">
+              <button
+                type="button"
+                onClick={() => setPage((p) => Math.max(1, p - 1))}
+                disabled={page === 1}
+                className="px-4 py-2 text-sm border border-gray-200 dark:border-gray-700 rounded-lg disabled:opacity-40 hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors text-gray-700 dark:text-gray-300"
+              >
+                Previous
+              </button>
+              <span className="text-xs text-gray-400 dark:text-gray-500">
+                Page {page} of {meta.totalPages}
+              </span>
+              <button
+                type="button"
+                onClick={() => setPage((p) => Math.min(meta.totalPages, p + 1))}
+                disabled={page === meta.totalPages}
+                className="px-4 py-2 text-sm border border-gray-200 dark:border-gray-700 rounded-lg disabled:opacity-40 hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors text-gray-700 dark:text-gray-300"
+              >
+                Next
+              </button>
+            </div>
+          )}
+        </>
+      )}
+
+      {showModal && <WritePostModal onClose={() => setShowModal(false)} />}
+    </div>
+  );
+}
diff --git a/frontend/components/dashboard/DashboardSidebar.tsx b/frontend/components/dashboard/DashboardSidebar.tsx
index d3ac567..73af508 100644
--- a/frontend/components/dashboard/DashboardSidebar.tsx
+++ b/frontend/components/dashboard/DashboardSidebar.tsx
@@ -7,7 +7,7 @@ import {
   Building2, LayoutDashboard, User, Settings, LogOut, Users, Mail,
   Menu, X, BookOpen, FileText, BriefcaseBusiness, LogIn, Bell,
   BarChart3, CreditCard, Boxes, Calendar, MapPin, Wrench, Lock,
-  MessageSquare, Palette,
+  MessageSquare, Palette, Rss,
 } from "lucide-react";
 import { useState } from "react";
 import { useAuthState, useAuthActions } from "@/lib/store/authStore";
@@ -21,6 +21,7 @@ const navItems = [
   { label: "My Bookings",    href: "/bookings",      icon: BookOpen },
   { label: "Check In / Out", href: "/check-in",      icon: LogIn },
   { label: "Messages",       href: "/messages",      icon: MessageSquare },
+  { label: "Community",      href: "/community",     icon: Rss },
   { label: "Notifications",  href: "/notifications", icon: Bell },
   { label: "Invoices",       href: "/invoices",      icon: FileText },
   { label: "My Locker",      href: "/lockers",       icon: Lock },
diff --git a/frontend/lib/react-query/hooks/community/useCreateCommunityPost.ts b/frontend/lib/react-query/hooks/community/useCreateCommunityPost.ts
new file mode 100644
index 0000000..62d1565
--- /dev/null
+++ b/frontend/lib/react-query/hooks/community/useCreateCommunityPost.ts
@@ -0,0 +1,26 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { apiClient } from "@/lib/apiClient";
+import { queryKeys } from "@/lib/react-query/keys/queryKeys";
+import { CommunityPost, CreatePostPayload } from "@/lib/types/community";
+import { toast } from "sonner";
+
+export const useCreateCommunityPost = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (data: CreatePostPayload) =>
+      apiClient.post<{ message: string; data: CommunityPost }>(
+        "/community/posts",
+        data
+      ),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["community", "feed"] });
+      toast.success("Post shared with the community!");
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || "Failed to create post");
+    },
+  });
+};
diff --git a/frontend/lib/react-query/hooks/community/useDeleteCommunityPost.ts b/frontend/lib/react-query/hooks/community/useDeleteCommunityPost.ts
new file mode 100644
index 0000000..a906c5e
--- /dev/null
+++ b/frontend/lib/react-query/hooks/community/useDeleteCommunityPost.ts
@@ -0,0 +1,21 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { apiClient } from "@/lib/apiClient";
+import { toast } from "sonner";
+
+export const useDeleteCommunityPost = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (postId: string) =>
+      apiClient.delete<{ message: string }>(`/community/posts/${postId}`),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ["community", "feed"] });
+      toast.success("Post deleted");
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || "Failed to delete post");
+    },
+  });
+};
diff --git a/frontend/lib/react-query/hooks/community/useGetCommunityFeed.ts b/frontend/lib/react-query/hooks/community/useGetCommunityFeed.ts
new file mode 100644
index 0000000..2281f52
--- /dev/null
+++ b/frontend/lib/react-query/hooks/community/useGetCommunityFeed.ts
@@ -0,0 +1,17 @@
+"use client";
+
+import { useQuery } from "@tanstack/react-query";
+import { apiClient } from "@/lib/apiClient";
+import { queryKeys } from "@/lib/react-query/keys/queryKeys";
+import { CommunityFeedResponse } from "@/lib/types/community";
+
+export const useGetCommunityFeed = (page = 1, limit = 20) => {
+  return useQuery({
+    queryKey: queryKeys.community.feed({ page, limit }),
+    queryFn: () =>
+      apiClient.get<CommunityFeedResponse>(
+        `/community/posts?page=${page}&limit=${limit}`
+      ),
+    staleTime: 30_000,
+  });
+};
diff --git a/frontend/lib/react-query/hooks/community/useTogglePostLike.ts b/frontend/lib/react-query/hooks/community/useTogglePostLike.ts
new file mode 100644
index 0000000..00542c5
--- /dev/null
+++ b/frontend/lib/react-query/hooks/community/useTogglePostLike.ts
@@ -0,0 +1,73 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { apiClient } from "@/lib/apiClient";
+import { queryKeys } from "@/lib/react-query/keys/queryKeys";
+import { CommunityFeedResponse, ToggleLikeResponse } from "@/lib/types/community";
+
+export const useTogglePostLike = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (postId: string) =>
+      apiClient.post<ToggleLikeResponse>(`/community/posts/${postId}/like`),
+
+    // Optimistic update — flip the like state immediately in the cache
+    onMutate: async (postId: string) => {
+      await queryClient.cancelQueries({ queryKey: ["community", "feed"] });
+
+      const previousData = queryClient.getQueriesData<CommunityFeedResponse>({
+        queryKey: ["community", "feed"],
+      });
+
+      queryClient.setQueriesData<CommunityFeedResponse>(
+        { queryKey: ["community", "feed"] },
+        (old) => {
+          if (!old) return old;
+          return {
+            ...old,
+            items: old.items.map((post) => {
+              if (post.id !== postId) return post;
+              const isCurrentlyLiked = post.likeCount > 0; // optimistic flip
+              return {
+                ...post,
+                // We don't have per-user liked state in the feed response,
+                // so we use a client-side _liked flag patched via the response
+                likeCount: post.likeCount + 1, // will be reconciled on settle
+              };
+            }),
+          };
+        }
+      );
+
+      return { previousData };
+    },
+
+    // Reconcile with the actual server response
+    onSuccess: (response, postId) => {
+      queryClient.setQueriesData<CommunityFeedResponse>(
+        { queryKey: ["community", "feed"] },
+        (old) => {
+          if (!old) return old;
+          return {
+            ...old,
+            items: old.items.map((post) =>
+              post.id === postId
+                ? { ...post, likeCount: response.data.likeCount }
+                : post
+            ),
+          };
+        }
+      );
+    },
+
+    // Roll back on error
+    onError: (_err, _postId, context) => {
+      if (context?.previousData) {
+        for (const [queryKey, data] of context.previousData) {
+          queryClient.setQueryData(queryKey, data);
+        }
+      }
+    },
+  });
+};
diff --git a/frontend/lib/react-query/hooks/community/useTogglePostPin.ts b/frontend/lib/react-query/hooks/community/useTogglePostPin.ts
new file mode 100644
index 0000000..64604c9
--- /dev/null
+++ b/frontend/lib/react-query/hooks/community/useTogglePostPin.ts
@@ -0,0 +1,22 @@
+"use client";
+
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { apiClient } from "@/lib/apiClient";
+import { TogglePinResponse } from "@/lib/types/community";
+import { toast } from "sonner";
+
+export const useTogglePostPin = () => {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (postId: string) =>
+      apiClient.patch<TogglePinResponse>(`/community/posts/${postId}/pin`),
+    onSuccess: (response) => {
+      queryClient.invalidateQueries({ queryKey: ["community", "feed"] });
+      toast.success(response.data.isPinned ? "Post pinned" : "Post unpinned");
+    },
+    onError: (error: Error) => {
+      toast.error(error.message || "Failed to update pin");
+    },
+  });
+};
diff --git a/frontend/lib/react-query/keys/queryKeys.ts b/frontend/lib/react-query/keys/queryKeys.ts
index b643f2b..14cc02d 100644
--- a/frontend/lib/react-query/keys/queryKeys.ts
+++ b/frontend/lib/react-query/keys/queryKeys.ts
@@ -41,6 +41,9 @@ export const queryKeys = {
   twoFactor: {
     status: ["2fa", "status"] as const,
   },
+  community: {
+    feed: (params?: unknown) => ["community", "feed", params] as const,
+  },
   nps: {
     pending: ["nps", "pending"] as const,
     analytics: ["nps", "analytics"] as const,
diff --git a/frontend/lib/types/community.ts b/frontend/lib/types/community.ts
new file mode 100644
index 0000000..b996056
--- /dev/null
+++ b/frontend/lib/types/community.ts
@@ -0,0 +1,46 @@
+export interface PostAuthor {
+  id: string;
+  username?: string | null;
+  firstname: string;
+  lastname: string;
+  profilePicture?: string | null;
+}
+
+export interface CommunityPost {
+  id: string;
+  authorUserId: string;
+  author: PostAuthor;
+  body: string;
+  isPinned: boolean;
+  isDeleted: boolean;
+  likeCount: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface CommunityFeedResponse {
+  items: CommunityPost[];
+  total: number;
+  page: number;
+  limit: number;
+  totalPages: number;
+}
+
+export interface CreatePostPayload {
+  body: string;
+}
+
+export interface ToggleLikeResponse {
+  message: string;
+  data: {
+    liked: boolean;
+    likeCount: number;
+  };
+}
+
+export interface TogglePinResponse {
+  message: string;
+  data: {
+    isPinned: boolean;
+  };
+}

From 328788b941b261f6ca19fed0526c1e35891119d8 Mon Sep 17 00:00:00 2001
From: sadeeq6400 <abk000064@gmail.com>
Date: Tue, 30 Jun 2026 02:29:16 +0100
Subject: [PATCH 3/4] Apply rate limiting consistently across all routes

---
 backend/src/app.module.ts                   |  3 ++-
 backend/src/auth/auth.controller.ts         | 13 +++++++++++++
 backend/src/bookings/bookings.controller.ts |  2 ++
 backend/src/credits/credits.controller.ts   |  2 ++
 backend/src/payments/payments.controller.ts |  2 ++
 5 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/backend/src/app.module.ts b/backend/src/app.module.ts
index 2b66aa2..0066980 100644
--- a/backend/src/app.module.ts
+++ b/backend/src/app.module.ts
@@ -74,7 +74,8 @@ import { CommunityModule } from './community/community.module';
       },
       { name: 'newsletter', ttl: 60_000, limit: 10 },
       { name: 'contact', ttl: 60_000, limit: 5 },
-      { name: 'feedback', ttl: 60_000, limit: 10 },
+      // otp: strict limit for OTP/2FA verification endpoints (5 per 10 minutes)
+      { name: 'otp', ttl: 600_000, limit: 5 },
     ]),
     BullModule.forRootAsync({
       imports: [ConfigModule],
diff --git a/backend/src/auth/auth.controller.ts b/backend/src/auth/auth.controller.ts
index e82c8a3..fa0b179 100644
--- a/backend/src/auth/auth.controller.ts
+++ b/backend/src/auth/auth.controller.ts
@@ -7,6 +7,7 @@ import {
   HttpCode,
   HttpStatus,
 } from '@nestjs/common';
+import { Throttle, seconds } from '@nestjs/throttler';
 import { AuthService } from './auth.service';
 import { CreateUserDto } from './dto/create-user.dto';
 import { LoginUserDto } from './dto/login-user.dto';
@@ -34,6 +35,7 @@ export class AuthController {
   @Public()
   @Post('register')
   @HttpCode(HttpStatus.CREATED)
+  @Throttle({ short: { ttl: seconds(1), limit: 3 } })
   create(@Body() createUserDto: CreateUserDto) {
     return this.authService.createUser(createUserDto);
   }
@@ -41,12 +43,15 @@ export class AuthController {
   @Public()
   @Post('verify-otp')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   verifyOtp(@Body() verifyOtpDto: VerifyOtpDto) {
     return this.authService.verifyOtp(verifyOtpDto);
   }
+
   @Public()
   @Post('resend-verification-otp')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   resendVerificationOtp(@Body() resendOtpDto: ResendOtpDto) {
     return this.authService.resendVerificationOtp(resendOtpDto.email);
   }
@@ -61,6 +66,7 @@ export class AuthController {
   @Public()
   @Post('login')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ short: { ttl: seconds(1), limit: 3 } })
   login(@Body() loginUserDto: LoginUserDto) {
     return this.authService.login(loginUserDto);
   }
@@ -81,6 +87,7 @@ export class AuthController {
   @Public()
   @Post('forgot-password')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ short: { ttl: seconds(1), limit: 3 } })
   forgotPassword(@Body() sendPasswordResetOtpDto: SendPasswordResetOtpDto) {
     return this.authService.requestResetPasswordOtp(sendPasswordResetOtpDto);
   }
@@ -88,14 +95,17 @@ export class AuthController {
   @Public()
   @Post('send-reset-password-otp')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ short: { ttl: seconds(1), limit: 3 } })
   requestResetPasswordOtp(
     @Body() sendPasswordResetOtpDto: SendPasswordResetOtpDto,
   ) {
     return this.authService.requestResetPasswordOtp(sendPasswordResetOtpDto);
   }
+
   @Public()
   @Post('resend-reset-password-otp')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   resendResetPasswordVerificationOtp(@Body() resendOtpDto: ResendOtpDto) {
     return this.authService.resendResetPasswordVerificationOtp(resendOtpDto);
   }
@@ -103,6 +113,7 @@ export class AuthController {
   @Public()
   @Post('verify-reset-password-otp')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   verifyResetPasswordOtp(@Body() verifyOtpDto: VerifyOtpDto) {
     return this.authService.verifyResetPasswordOtp(verifyOtpDto);
   }
@@ -131,6 +142,7 @@ export class AuthController {
   @Public()
   @Post('2fa/verify')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   verifyTotpLogin(@Body() dto: VerifyTotpDto) {
     return this.authService.verifyTotpLogin(dto);
   }
@@ -138,6 +150,7 @@ export class AuthController {
   @Public()
   @Post('2fa/backup-code')
   @HttpCode(HttpStatus.OK)
+  @Throttle({ otp: { ttl: seconds(600), limit: 5 } })
   verifyBackupCode(@Body() dto: UseBackupCodeDto) {
     return this.authService.verifyBackupCode(dto);
   }
diff --git a/backend/src/bookings/bookings.controller.ts b/backend/src/bookings/bookings.controller.ts
index 60083ec..1d6690f 100644
--- a/backend/src/bookings/bookings.controller.ts
+++ b/backend/src/bookings/bookings.controller.ts
@@ -14,6 +14,7 @@ import {
   Header,
 } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth, ApiOperation, ApiQuery } from '@nestjs/swagger';
+import { Throttle, seconds } from '@nestjs/throttler';
 import { BookingsService } from './bookings.service';
 import { CreateBookingDto } from './dto/create-booking.dto';
 import { CreateRecurringBookingDto } from './dto/create-recurring-booking.dto';
@@ -43,6 +44,7 @@ export class BookingsController {
 
   @Post()
   @ApiOperation({ summary: 'Create a booking' })
+  @Throttle({ long: { ttl: seconds(60), limit: 30 } })
   async create(@Body() dto: CreateBookingDto, @GetCurrentUser('id') userId: string) {
     const booking = await this.bookingsService.create(dto, userId);
     return { message: 'Booking created successfully', data: booking };
diff --git a/backend/src/credits/credits.controller.ts b/backend/src/credits/credits.controller.ts
index 2d9de75..7727bb3 100644
--- a/backend/src/credits/credits.controller.ts
+++ b/backend/src/credits/credits.controller.ts
@@ -12,6 +12,7 @@ import {
   ApiQuery,
   ApiTags,
 } from '@nestjs/swagger';
+import { Throttle, seconds } from '@nestjs/throttler';
 import { CreditsService } from './credits.service';
 import { PurchaseCreditsDto } from './dto/purchase-credits.dto';
 import { GetCurrentUser } from '../auth/decorators/getCurrentUser.decorator';
@@ -31,6 +32,7 @@ export class CreditsController {
 
   @Post('purchase')
   @ApiOperation({ summary: 'Purchase a credit pack' })
+  @Throttle({ medium: { ttl: seconds(60), limit: 10 } })
   async purchase(
     @Body() dto: PurchaseCreditsDto,
     @GetCurrentUser('id') userId: string,
diff --git a/backend/src/payments/payments.controller.ts b/backend/src/payments/payments.controller.ts
index dc6c7c2..c1ea41a 100644
--- a/backend/src/payments/payments.controller.ts
+++ b/backend/src/payments/payments.controller.ts
@@ -17,6 +17,7 @@ import {
   ApiQuery,
   ApiTags,
 } from '@nestjs/swagger';
+import { Throttle, seconds } from '@nestjs/throttler';
 import { RawBodyRequest } from '@nestjs/common';
 import { Request } from 'express';
 import { PaymentsService } from './payments.service';
@@ -36,6 +37,7 @@ export class PaymentsController {
 
   @Post('initialize')
   @ApiOperation({ summary: 'Initialize a Paystack payment for a booking' })
+  @Throttle({ medium: { ttl: seconds(60), limit: 10 } })
   async initialize(
     @Body() dto: InitializePaymentDto,
     @GetCurrentUser('id') userId: string,

From ca6ef2dda6f349d308e0423724a150b8c0d27eb7 Mon Sep 17 00:00:00 2001
From: sadeeq6400 <abk000064@gmail.com>
Date: Tue, 30 Jun 2026 02:35:47 +0100
Subject: [PATCH 4/4] Replace TypeORM synchronize: true with proper migrations

---
 backend/.env.example            | 15 ++++++++++++-
 backend/package.json            |  9 ++++----
 backend/src/app.module.ts       |  2 +-
 backend/src/data-source.ts      | 40 +++++++++++++++++++++++++++++++++
 backend/src/migrations/.gitkeep |  0
 5 files changed, 60 insertions(+), 6 deletions(-)
 create mode 100644 backend/src/data-source.ts
 create mode 100644 backend/src/migrations/.gitkeep

diff --git a/backend/.env.example b/backend/.env.example
index ce4a13c..f2cde33 100644
--- a/backend/.env.example
+++ b/backend/.env.example
@@ -54,4 +54,17 @@ MAILGUN_WEBHOOK_SECRET=your_mailgun_webhook_secret
 SES_SNS_TOPIC_ARN=your_ses_sns_topic_arn
 
 # Access Control
-DEVICE_WEBHOOK_API_KEY=your_device_webhook_api_key_here
\ No newline at end of file
+DEVICE_WEBHOOK_API_KEY=your_device_webhook_api_key_here
+
+# ─── Database Migrations ────────────────────────────────────────────────────
+# synchronize is set to FALSE in app.module.ts — schema changes are managed
+# via TypeORM migrations only. After every deploy, run:
+#
+#   npm run migration:run
+#
+# To generate a migration after changing entities:
+#   npm run migration:generate -- src/migrations/DescriptiveMigrationName
+#
+# To revert the most recent migration:
+#   npm run migration:revert
+DATABASE_SSL=false
\ No newline at end of file
diff --git a/backend/package.json b/backend/package.json
index d489fe8..ac107a8 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -19,10 +19,11 @@
     "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
     "test:e2e": "jest --config ./test/jest-e2e.json",
     "typeorm": "typeorm-ts-node-commonjs",
-    "typeorm:run-migrations": "npm run typeorm migration:run -- -d ./src/config/typeorm.config.ts",
-    "typeorm:generate-migration": "npm run typeorm -- migration:generate ./src/migrations/$npm_config_name -d ./src/config/typeorm.config.ts",
-    "typeorm:create-migration": "npm run typeorm -- migration:create ./src/migrations/$npm_config_name",
-    "typeorm:revert-migration": "npm run typeorm -- migration:revert -d ./src/config/typeorm.config.ts",
+    "migration:generate": "npm run typeorm -- migration:generate -d src/data-source.ts",
+    "migration:run": "npm run typeorm -- migration:run -d src/data-source.ts",
+    "migration:revert": "npm run typeorm -- migration:revert -d src/data-source.ts",
+    "migration:create": "npm run typeorm -- migration:create",
+    "migration:show": "npm run typeorm -- migration:show -d src/data-source.ts",
     "demo:seed": "node scripts/demo-data.js seed",
     "demo:clear": "node scripts/demo-data.js clear",
     "demo:info": "node scripts/demo-data.js info"
diff --git a/backend/src/app.module.ts b/backend/src/app.module.ts
index 0066980..dcaa6ed 100644
--- a/backend/src/app.module.ts
+++ b/backend/src/app.module.ts
@@ -111,7 +111,7 @@ import { CommunityModule } from './community/community.module';
           port: +configService.get('DATABASE_PORT'),
           host,
           autoLoadEntities: true,
-          synchronize: true,
+          synchronize: false, // Never use synchronize in production — run migrations instead
           ssl: sslRequired ? { rejectUnauthorized: false } : false,
         };
       },
diff --git a/backend/src/data-source.ts b/backend/src/data-source.ts
new file mode 100644
index 0000000..e2fcf71
--- /dev/null
+++ b/backend/src/data-source.ts
@@ -0,0 +1,40 @@
+/**
+ * TypeORM CLI DataSource
+ *
+ * Used exclusively by the TypeORM CLI for migration commands:
+ *   npm run migration:generate -- src/migrations/MigrationName
+ *   npm run migration:run
+ *   npm run migration:revert
+ *
+ * This file is NOT imported by the NestJS application — the app uses
+ * TypeOrmModule.forRootAsync() in app.module.ts with autoLoadEntities.
+ */
+
+import 'dotenv/config';
+import { DataSource } from 'typeorm';
+
+const host = process.env.DATABASE_HOST ?? 'localhost';
+const sslRequired =
+  process.env.NODE_ENV === 'production' ||
+  process.env.PGSSLMODE === 'require' ||
+  process.env.DATABASE_SSL === 'true' ||
+  host.includes('neon.tech');
+
+export default new DataSource({
+  type: 'postgres',
+  host,
+  port: parseInt(process.env.DATABASE_PORT ?? '5432', 10),
+  username: process.env.DATABASE_USERNAME,
+  password: process.env.DATABASE_PASSWORD,
+  database: process.env.DATABASE_NAME,
+
+  // Entity discovery via glob — picks up every *.entity.ts under src/
+  entities: ['src/**/*.entity.ts'],
+
+  // Migration files live in src/migrations/
+  migrations: ['src/migrations/**/*.ts'],
+  migrationsTableName: 'typeorm_migrations',
+
+  synchronize: false,
+  ssl: sslRequired ? { rejectUnauthorized: false } : false,
+});
diff --git a/backend/src/migrations/.gitkeep b/backend/src/migrations/.gitkeep
new file mode 100644
index 0000000..e69de29