# Tasks: add-event-invitation-card Groups 1–2 are done and their work is unchanged by the revision. Group 3 (event and guest scoping) is the new foundation everything else sits on, so it comes next. **Order:** 1–2 ✓ → 3 → 4 → 6 → 7 → 5 → 8 → 9 → 10 → 11 → 12. Groups 4/6/7 are the vertical slice: the greeting API plus the recomposed header/body/footer and the drawer/sheet. That puts a visibly different invitation on a phone well before the card authoring pipeline is finished, with the body showing the existing cover image until group 5 replaces it with a real uploaded card. `(api)`, `(web)`, `(infra)` mark where the work lives. Decisions are cited as `D1`–`D12` against `design.md`. ## 1. Media storage and infrastructure - [x] 1.1 (infra) Add a `./media` volume to `docker-compose.yml`: read-write into `api`, read-only into `caddy`. Ensure the api container's user can write it, and add `media/` to `.gitignore` - [x] 1.2 (infra) Serve `/media/*` from Caddy directly off the volume with `Cache-Control: public, max-age=31536000, immutable` — never through FastAPI. Add the handler to both `Caddyfile.dev` and `Caddyfile.prod` - [x] 1.3 (api) Storage seam (D6): a module exposing `save(data, suffix) -> url` and `delete(url)` writing to `/srv/media/cards/{event_id}/{sha256[:16]}.{ext}`. Nothing else in the codebase touches the media filesystem, so the later S3 swap is one file - [x] 1.4 (api) Upload guards: content-type allowlist, per-file size ceiling, and SVG sanitisation stripping `script`, `foreignObject`, `on*` handlers and external references. Rejections name the actual size or type against the limit - [x] 1.5 (infra) Extend `make backup` to cover `./media` alongside `pg_dump`, and `make restore` to put it back (D6). Without this a restore produces card rows pointing at files that no longer exist - [x] 1.6 (api) `MEDIA_ROOT`, `MEDIA_MAX_BYTES` and the allowlist in `config.py`, with sane dev defaults ## 2. Data model — cards and greeting - [x] 2.1 (api) `event_card_design` model: `event_id`, `renderer` enum, `config` JSONB, `assets` JSONB, `version`, `status`, `published_at`, `created_by`, timestamps. Partial unique index enforcing at most one published row per event - [x] 2.2 (api) `guest.invitation_type` enum (`single`, `family`) with `server_default='single'` so existing rows are valid without a backfill (D8) - [x] 2.3 (api) `wedding.invitation_messages` JSONB defaulting to `{}`, keyed `{locale}.{type}` (D9) - [x] 2.4 (api) One Alembic migration covering 2.1–2.3, reversible, all additive. Verify `alembic upgrade head` then `downgrade` runs clean against a seeded database ## 3. Events as records, guests scoped to them - [x] 3.1 (api) Second migration: add `html` to the `card_renderer` enum; add `guest.event_id` (FK, cascade); replace `uq_guest_wedding_phone`/`uq_guest_wedding_email` with per-event equivalents; drop `uq_event_wedding_type` (D11, D12). **Take a backup first — the guest split is not cleanly reversible** - [x] 3.2 (api) Data step in the same migration: split a guest holding invitations to several events into one record per event, carrying contact details, locale, tags and `invitation_type`, each keeping its own invitation and token. Pre-launch the practical path is a re-seed; the split exists so the migration is correct either way - [x] 3.3 (api) `Guest.event_id` on the model with the relationship; a guest holds exactly one invitation, to its own event - [x] 3.4 (api) Event create and delete routes behind `Action.EDIT_CONTENT`. Create takes type, name, Bangla name, date, venue; slug derived from the name and de-duplicated on collision; slug never changes on rename (D12). Delete requires confirmation and reports what it destroys - [x] 3.5 (api) Scope guest list, create, update, delete and CSV import to an event. Duplicate detection operates within the event only; a phone or email already used under another event is not a duplicate - [x] 3.6 (api) Per-event contact suppression: `do_not_contact` and `email_invalid` apply to the guest record, so they suppress that event alone. Unsubscribe copy names the event it covers - [x] 3.7 (api) Remove the multi-event switcher from the token payload — no cross-event link survives the scoping change (D11) - [x] 3.8 (api) Update the seed script: create the three events through the same path an admin would, and seed guests under their event - [x] 3.9 (api) Tests: two events of one type coexist, slug collision resolves, same phone under two events accepted, duplicate within one event refused, CSV import dedupes within the event only, unsubscribe suppresses one event and not another, event delete cascades to guests and invitations - [x] 3.10 (web) Label any figure spanning events as guest records rather than people, and remove the cross-event link from the invitation page ## 4. Greeting API - [x] 4.1 (api) `invitation_type` on the guest read and write schemas; accepted by create and update, returned by list and detail. CSV import maps it when present and defaults to `single` when absent - [x] 4.2 (api) Invitation-message validation (D9): ≤100 characters after normalisation, markup stripped or rejected, consecutive newlines collapsed, trimmed. Applied on the wedding settings write path - [x] 4.3 (api) Resolve the greeting server-side — guest's `invitation_type` → customer message for the resolved locale → built-in default — and return it on the token and open payloads. A null or empty greeting must be unreachable - [x] 4.4 (api) Tests: all four locale×type combinations, partial customisation falling back per key, over-limit rejection, markup submission, a guest with no explicit type resolving as `single` - [x] 4.5 Regenerate the TypeScript client (`make client`) and commit it — CI fails on a stale `schema.d.ts` ## 5. Card upload and rendering - [x] 5.1 (api) HTML sanitiser (D4): strip `script`, `on*` handlers and references to external hosts from uploaded card documents, storing the sanitised bytes. Rejections name the offending reference rather than dropping it silently - [x] 5.2 (api) Asset reference rewriting (D5): accept a card document plus its companion files in one upload, store each, rewrite every relative reference to its stored content-addressed URL, and refuse publication when a reference has no matching file - [x] 5.3 (api) Config models as a discriminated union on `renderer`: `html` (document asset key, companion assets) and `image` (per-locale alt text). Saving `component` or `layered` is rejected naming the supported renderers (D1) - [x] 5.4 (web) Extend the view models with an explicit card view model, carrying the sanitised document and no guest fields - [x] 5.5 (web) `html` renderer: a server component emitting `