Columbia Community Mini Program

A WeChat mini program for a campus community: members can coordinate shared rides, publish or join ride requests, list second-hand goods, manage notifications and profiles, and browse selected local offers.

This repository is a sanitized, reviewable source release. It contains no production AppID, CloudBase environment ID, user records, or deployment credentials. You must connect your own WeChat Mini Program and CloudBase environment before running it.

What it includes

• Driver-created ride offers with seat management and trip history
• Passenger-created ride requests that drivers and other passengers can join
• Marketplace listing, editing, browsing, seller contact, and deletion flows
• Profile, notification, feedback, saved-template, coupon, and local-discovery pages
• 32 CloudBase functions with server-side identity and ownership checks
• America/New_York time conversion that handles daylight-saving transitions
• Example database, storage, and cloud-function security rules
• Dependency-free Node.js tests for structure, privacy policies, and time handling

Architecture

WeChat client pages
  ├─ public/owner-scoped CloudBase reads
  ├─ authenticated cloud-function calls
  └─ Cloud Storage image uploads
             │
             ▼
Cloud functions
  ├─ derive identity from getWXContext()
  ├─ validate and sanitize input
  ├─ enforce ownership/participant access
  └─ transact ride and profile updates
             │
             ▼
CloudBase Database + Storage

The important trust boundary is the cloud-function layer. Client-provided OpenIDs, ownership fields, status values, participant lists, and seat counts are not trusted for protected mutations.

Local setup

Requirements:

• WeChat DevTools
• A WeChat Mini Program account
• A CloudBase environment
• Node.js 20+ for repository checks

1. Clone the repository and open its root in WeChat DevTools.
2. Copy config.example.js to config.js.
3. Set cloudEnvId to your CloudBase environment ID. Set cloudAssetPrefix only if you want to use Cloud Storage assets; it should be the complete prefix before an asset path, such as cloud://ENV_ID.BUCKET_ID.
4. Set your own Mini Program AppID through local/private DevTools configuration. Do not commit it.
5. Create the collections and indexes described in docs/DATA_MODEL.md.
6. Apply the rule examples in security-rules and review them against your production requirements.
7. Upload every folder under cloudfunctions/ with cloud dependencies installed by CloudBase.
8. Build and test in WeChat DevTools using non-production sample data first.

Detailed deployment and verification steps are in docs/DEPLOYMENT.md.

Development checks

The repository test suite does not need third-party packages:

npm run verify

It checks JavaScript syntax, JSON validity, registered pages, cloud-function references, image references, SDK versions, excluded private files, privacy-field filtering, and DST-sensitive time conversion.

Security and privacy

The current release includes server-side authorization for ride mutations, marketplace mutations, contact disclosure, and history responses. Database rules deliberately deny client access to core ride collections; protected operations go through cloud functions.

Before a real launch, you still need to:

• confirm every deployed security rule in the CloudBase console;
• add image moderation or a manual review workflow for marketplace photos;
• publish a privacy policy and obtain all required WeChat user-data disclosures;
• configure operational logging, abuse controls, retention, and deletion procedures;
• test with separate owner, participant, non-participant, and guest accounts.

See SECURITY.md for the security model and reporting guidance.

Project status

This is a maintained source portfolio project, not a hosted public service. There is no shared production backend or demo account in this repository.

License

Source code is released under the MIT License. Images, business names, logos, and other media assets are excluded from that license unless their own source file explicitly states otherwise; see NOTICE.