event tags

[rgodha24]

Closes #130

Checklist:

• I have mentioned a ticket above
• My changes meet the acceptance criteria of said ticket
• I have self-reviewed my changes
• I have requested a review from the appropriate team member(s)
• I have fixed all merge conflicts
• I have ensured CI checks pass

[netlify]

✅ Deploy Preview for servicestart ready!

Name	Link
🔨 Latest commit	02ac9ac
🔍 Latest deploy log	https://app.netlify.com/projects/servicestart/deploys/69d2b89a7897b10008c8f257
😎 Deploy Preview	https://deploy-preview-193--servicestart.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR adds an event tagging system: tags/event_tags DB tables, a TagService, tag CRUD endpoints, a TagInput component, and wiring into event creation and display. The frontend work is clean and functional. However, three P1 defects must be resolved before merging:

• The migration SQL is missing the composite primary key on event_tags that the Drizzle schema defines, allowing duplicate rows at the database level.
• The tag PATCH/DELETE endpoints are not scoped to the caller's organization, enabling any admin to mutate tags belonging to another org.
• tagIds supplied at event-creation time are not validated against activeOrganizationId, allowing cross-org tag associations.

Confidence Score: 4/5

Not safe to merge — three P1 issues (missing DB constraint, cross-org tag mutation, unvalidated tagIds) must be fixed first.

Score 4 reflects three distinct P1 defects in the changed code: a migration that will silently omit a uniqueness constraint in production, two API endpoints with broken organization-scope authorization, and missing input validation that allows cross-org tag associations. All three are directly verifiable from the diff and require fixes before the feature ships.

migration.sql (missing composite PK), api/tags.ts (cross-org PATCH/DELETE), api/events.ts (unvalidated tagIds on create)

Important Files Changed

Filename	Overview
drizzle/20260405185548_romantic_princess_powerful/migration.sql	Creates tags/event_tags tables but omits the composite PK on event_tags, desynchronizing the DB from the Drizzle schema
api/tags.ts	New tag CRUD endpoints; PATCH and DELETE handlers lack org-scoping, allowing any admin to mutate tags across organizations
api/events.ts	Adds tagIds to event creation; tagIds are not validated against the active organization before insert
lib/services/EventService.ts	create() inserts event_tags and findById() left-joins tags correctly; logic is sound given trusted inputs
lib/services/TagService.ts	Correct CRUD operations; missing a findById helper needed for org-scoping in the API layer
components/TagInput.tsx	Functional AsyncCreatableSelect tag input; fires a redundant API fetch on every keystroke instead of filtering cached allTags
lib/schema.ts	Adds tags and eventTags tables with correct FK constraints, composite PK, and Drizzle relations
app/events/create/page.tsx	Integrates TagInput and includes tagIds in the create-event payload correctly
app/events/[id]/page.tsx	Correctly renders event tags from the enriched result returned by EventService.findById
scripts/seed.ts	Adds sample tags and event-tag associations for the seeded org

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph VULNERABLE["Current — PATCH/DELETE /api/tags/:tagId"]
        A[Admin Org A] -->|knows tagId from Org B| B[api/tags.ts handler]
        B --> C{requireAdmin?}
        C -->|PASS| D[No org check]
        D --> E[TagService.updateTag / deleteTag]
        E --> F[(DB: mutates Org B tag)]
        F --> G[🔴 Cross-org tag modified]
    end

    subgraph FIXED["Fixed — with org ownership check"]
        A2[Admin Org A] -->|knows tagId from Org B| B2[api/tags.ts handler]
        B2 --> C2{requireAdmin?}
        C2 -->|PASS| D2[TagService.findById tagId]
        D2 --> E2{tag.organizationId == activeOrganizationId?}
        E2 -->|NO| F2[404 Not Found ✅]
        E2 -->|YES| G2[TagService.updateTag — safe ✅]
    end

Loading

Comments Outside Diff (1)

1. api/events.ts, line 292-305 (link)

   PATCH endpoint cannot update event tags

   The PATCH /:eventId Zod schema omits tagIds, so there is no way for a client to change an event's tags after creation. Consider adding tagIds: z.array(z.string()).optional() to the schema and handling it by deleting existing event_tags rows and inserting new ones (ideally in a transaction), with the same org-scoping validation used at creation.

_{Reviews (1): Last reviewed commit: "event tags: creation polish" | Re-trigger Greptile}

[renatodellosso]

Ensure users can only use, edit, and delete tags in their organization. You can merge once that's done.

[rgodha24]

fixed & enabling auto merge