Roadmap: split multi-campus into 1.43.0 campuses and 1.44.0 scoped staff

Records the decisions: scoped staff view and scan "All campuses" events but
can't edit them; "everyone at campus X" is home campus plus optional recent
registrants; campus landing pages in 1.43.0. Later phases move up by one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ROADMAP-v2.md

@@ -25,8 +25,10 @@ notifications. SnapScan and Zapper are dropped — Yoco and PayFast are enough (
 1.41.0 the Hub connection (licence, heartbeat, read-only mode, `/health`, install script) with Hub 1.0.0 (`joshua/events-hub`);
 1.41.1–1.41.2 licence and job-time fixes; 1.41.3 renamed **Hope Events → Cross Events** (Hub 1.0.1:
 Cross Events Hub); 1.42.0 **Request update** button instead of the deploy command, with Hub 1.1.0
-(update requests). Later versions moved up by one (2026-10-27).
-**Next: 1.43.0 Multi-campus.**
+(update requests); 1.42.1 the production Hub key built in. Later versions moved up by one
+(2026-10-27). Multi-campus is split in two — 1.43.0 campuses, 1.44.0 campus-scoped staff — so
+everything after moves up by one more (2026-10-27).
+**Next: 1.43.0 Campuses.**
 
 **Repositories:**
 
@@ -520,7 +522,12 @@ full data separation — which also helps the POPIA story — and lets each
 church run on a different server. **True multi-tenant is out of scope.**
 
 **Multi-campus** is in scope: one church with several campuses inside one
-install.
+install. It ships in **two releases** (2026-10-27):
+
+| Release | What | Why separate |
+|---------|------|--------------|
+| **1.43.0 Campuses** | Campuses in Site settings, events per campus, public filter and `/campus/<slug>` pages, home campus, campus on cards and tickets, campus filters on reports/cashup/dashboard/funnel, "everyone at campus X" messages, per-campus summary recipients | Adds features and filters; who can see what doesn't change |
+| **1.44.0 Campus-scoped staff** | Supervisors and staff limited to campuses, across every staff/supervisor endpoint (115 in 27 route files at 1.42.1) and their dashboards | Security-heavy: anything missed lets staff see another campus's data, so it gets its own release and testing |
 
 ### Setup
 
@@ -534,17 +541,22 @@ install.
 - **Events** belong to one campus, or to **All campuses** (church-wide
   conferences, camps).
 - **Public site:** campus filter on the events list, remembered per visitor;
-  campus shown on event cards and tickets. Optional campus landing pages
-  (`/campus/<slug>`).
+  campus shown on event cards and tickets. Campus landing pages
+  (`/campus/<slug>`) are part of 1.43.0.
 - **Users** can set a home campus (used as the default filter and for
   broadcasts). Accounts stay shared across campuses — one login for the
   church.
-- **Campus-scoped roles:** a supervisor or staff member can be limited to
+- **Campus-scoped roles (1.44.0):** a supervisor or staff member can be limited to
   one or more campuses (sees and manages only those events, registrations,
   scanning, cashups). Admins and unscoped supervisors see everything.
+  **"All campuses" events:** scoped staff can view and scan them; only admins
+  and unscoped supervisors can edit them.
 - **Reports, cashup, dashboard, funnel stats:** filter by campus plus a
-  church-wide total.
-- **Broadcasts:** target "everyone at campus X".
+  church-wide total. (Report PDFs/Excel are rendered from data the page sends,
+  so the filters go on the data endpoints.)
+- **Broadcasts:** target "everyone at campus X" — people whose home campus is X,
+  plus (tick box) people registered for campus X's events in the last 12 months.
+  Still filtered by news consent.
 - **Kids check-in rooms** and **volunteer roles** are per campus.
 - **Notification recipients** per campus (e.g. the campus pastor gets that
   campus's daily summary).
@@ -556,21 +568,42 @@ install.
 - Moving an event to another campus → scoped supervisors of the old campus
   lose access; logged in the audit log.
 
+### Plumbing (1.44.0)
+
+- Today access depends only on role — nothing limits staff to particular
+  events — so scoping is a new layer: one helper (`utils/campusScope.js`) that
+  works out a user's campuses once per request, gives a `where` for event lists
+  and checks single records (registrations, tickets, payments… traced back to
+  their event).
+- A test lists **every** staff/supervisor route and fails unless each is
+  campus-checked or explicitly marked campus-independent (the same pattern as
+  the read-only route test), so new endpoints can't skip the check.
+- The heartbeat's `features.campuses` / `stats.campuses` report the real setting
+  (hard-coded `false` until 1.43.0).
+
 ### Data model (sketch)
 
 ```prisma
 model Campus {
-  id        String   @id @default(uuid())
-  name      String
-  slug      String   @unique
-  address   String?
-  isActive  Boolean  @default(true)
-  order     Int      @default(0)
-  events    Event[]
+  id              String    @id @default(uuid())
+  name            String
+  slug            String    @unique
+  address         String?
+  contactName     String?
+  contactEmail    String?
+  contactPhone    String?
+  colour          String?
+  logoUrl         String?
+  defaultLocation String?
+  order           Int       @default(0)
+  archivedAt      DateTime? // archive instead of delete when it has events
+  events          Event[]
+  notifyRecipients User[]   // daily summary for this campus's events
 }
-// Event.campusId String? (null = all campuses)
-// User.homeCampusId String?
-// UserCampusScope { userId, campusId } — empty = unscoped
+// Event.campusId String? (null = all campuses)          — 1.43.0
+// User.homeCampusId String?                              — 1.43.0
+// AppSetting campuses_enabled                            — 1.43.0
+// UserCampusScope { userId, campusId } — empty = unscoped — 1.44.0
 ```
 
 ### Running many installs
@@ -876,11 +909,11 @@ income justify the hardware:
 | 4 | 1.36.0 ✅ – 1.37.2 | Payment provider interface (Yoco moved behind it) → PayFast, then hiding "Pay online" when it can't be used and payment status checks (SnapScan and Zapper dropped) | Payment code gets split out of the big controller as part of this |
 | 5 | 1.38.0 ✅ 1.39.0 ✅ 1.40.0 ✅ | **POPIA toolkit** (1.38.0: user privacy centre, unsubscribe, WhatsApp STOP, data requests inbox; 1.39.0: privacy notice editor + versions, operator register, consent log, access log; 1.40.0: retention jobs, breach register, children’s-data flags, readiness page) | Main selling point; retention jobs use the job queue |
 | 6 | 1.41.0 ✅ – 1.42.0 ✅ + Hub 1.0 ✅ – 1.1 ✅ | Install/update scripts, `/health`, licence step in `/setup`, "Connect to Hub", heartbeat, licence states — plus the **Hub** app (separate repo); rename to Cross Events (1.41.3); Request update (1.42.0 / Hub 1.1.0) | Must exist before the first church is sold; Hope Family Church registers as install #1 |
-| 7 | 1.43.0 | **Multi-campus** | Kids rooms and volunteer roles are per campus, so campuses come first |
-| 8 | 1.44.0 – 1.45.0 | Kids check-in, Volunteer rosters | Depend on sessions and campuses |
-| 9 | 1.46.0 – 1.48.0 | Event series & cloning, Wallet passes, Outbound webhooks | Smaller, independent wins |
-| 10 | 1.49.0 – 1.51.0 | Admin dashboard/Ctrl+K/bulk actions, Afrikaans, Accessibility pass | Polish before the big release |
-| 11 | 1.52.0 | TypeScript backend + OpenAPI + `/api/v2` alongside v1 | The breaking-change groundwork |
+| 7 | 1.43.0 – 1.44.0 | **Multi-campus**: 1.43.0 campuses (settings, events, public filter and landing pages, home campus, filters, messages, summaries); 1.44.0 campus-scoped staff | Kids rooms and volunteer roles are per campus, so campuses come first; scoping is split out because it's security-heavy |
+| 8 | 1.45.0 – 1.46.0 | Kids check-in, Volunteer rosters | Depend on sessions and campuses |
+| 9 | 1.47.0 – 1.49.0 | Event series & cloning, Wallet passes, Outbound webhooks | Smaller, independent wins |
+| 10 | 1.50.0 – 1.52.0 | Admin dashboard/Ctrl+K/bulk actions, Afrikaans, Accessibility pass | Polish before the big release |
+| 11 | 1.53.0 | TypeScript backend + OpenAPI + `/api/v2` alongside v1 | The breaking-change groundwork |
 | 12 | **2.0.0** | **AI helpers** (§15 — headline feature: draft an event, summarise reports and feedback, draft messages, improve text; through the Hub with a rand cap per licence), v1 API removed, migration guide, marketing site/docs for selling | The release. AI needs the Hub (phase 6) for the key, metering and caps |
 
 Each phase should add matching help content (`frontend/src/content/help/`),
@@ -927,6 +960,7 @@ feature.
 | — | POPIA: re-accepting the notice | The admin decides per version ("significant change — ask everyone to accept again"); people are asked once after login (2026-10-23) |
 | — | POPIA: inactive accounts | Anonymised after 5 years without a login or registration, **on by default**, with a warning email 30 days before; staff/supervisor/admin accounts never (2026-10-23) |
 | — | Product name | **Cross Events** (was Hope Events), Hub: **Cross Events Hub**. UI text and docs renamed in 1.41.3; technical identifiers (`hope-events` repo, storage keys, encryption salt, migrations, PM2/nginx names) stay, so installs and sign-ins keep working (2026-10-27) |
+| — | Multi-campus split | Two releases: **1.43.0 campuses**, **1.44.0 campus-scoped staff**; everything after moves up by one. Scoped staff can view and scan "All campuses" events, only admins and unscoped supervisors edit them. "Everyone at campus X" = home campus X, plus (tick box) registrants of campus X's events in the last 12 months. Campus landing pages are in 1.43.0 (2026-10-27) |
 | — | Updates | Sites show **Request update**, never the deploy command: the request goes to the Hub, which tells Joshua; he updates the server. 1.42.0 / Hub 1.1.0; Multi-campus and everything after moves up by one (2026-10-27) |
 | — | POPIA: WhatsApp STOP | In 1.38.0, via WAWP's incoming `message` webhook with a secret in the URL (WAWP doesn't sign webhooks) (2026-10-23) |