feat: finalist.editAttendees with cutoff and diff-based update

Team-lead-only mutation that replaces the AttendingMember roster on a
CONFIRMED finalist confirmation. Diffs the requested user list against
existing rows: kept rows are updated in place (preserving FlightDetail),
removed rows are deleted, added rows are created. Enforces:
  - team-lead role
  - CONFIRMED status
  - defaultAttendeeCap
  - team-membership of every supplied userId
  - cutoff = LIVE_FINAL.windowOpenAt − attendeeEditCutoffHours (default 48)

Audit-logged as FINALIST_EDIT_ATTENDEES with the diff payload.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/server/routers/finalist.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod'
 import { TRPCError } from '@trpc/server'
 import { CompetitionCategory } from '@prisma/client'
-import { router, adminProcedure, publicProcedure } from '../trpc'
+import { router, adminProcedure, protectedProcedure, publicProcedure } from '../trpc'
 import { logAudit } from '../utils/audit'
 import {
   createPendingConfirmation,
@@ -723,4 +723,152 @@ export const finalistRouter = router({
       })
       return { confirmationId }
     }),
+
+  /**
+   * Team lead replaces the AttendingMember roster for a CONFIRMED finalist
+   * confirmation. Diff-based: rows for users who stay are kept (preserving
+   * their FlightDetail); removed users are deleted (cascading FlightDetail);
+   * added users get fresh rows. Closed once `attendeeEditCutoffHours` (default
+   * 48) before the LIVE_FINAL round's `windowOpenAt`.
+   */
+  editAttendees: protectedProcedure
+    .input(
+      z.object({
+        confirmationId: z.string(),
+        attendingUserIds: z.array(z.string()).min(1),
+        visaFlags: z.record(z.string(), z.boolean()).default({}),
+      }),
+    )
+    .mutation(async ({ ctx, input }) => {
+      const confirmation = await ctx.prisma.finalistConfirmation.findUniqueOrThrow({
+        where: { id: input.confirmationId },
+        include: {
+          project: {
+            select: {
+              id: true,
+              programId: true,
+              program: { select: { defaultAttendeeCap: true } },
+              teamMembers: { select: { userId: true, role: true } },
+            },
+          },
+          attendingMembers: { select: { id: true, userId: true } },
+        },
+      })
+
+      const callerMembership = confirmation.project.teamMembers.find(
+        (tm) => tm.userId === ctx.user.id,
+      )
+      if (!callerMembership) {
+        throw new TRPCError({
+          code: 'FORBIDDEN',
+          message: 'You are not a team member of this project',
+        })
+      }
+      if (callerMembership.role !== 'LEAD') {
+        throw new TRPCError({
+          code: 'FORBIDDEN',
+          message: 'Only the team lead can edit attendees',
+        })
+      }
+
+      if (confirmation.status !== 'CONFIRMED') {
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: 'Confirmation must be in CONFIRMED status to edit attendees',
+        })
+      }
+
+      // Cap check
+      const cap = confirmation.project.program.defaultAttendeeCap
+      if (input.attendingUserIds.length > cap) {
+        throw new TRPCError({
+          code: 'BAD_REQUEST',
+          message: `Selection exceeds attendee cap of ${cap}`,
+        })
+      }
+
+      // Team membership check for the new roster
+      const teamUserIds = new Set(confirmation.project.teamMembers.map((tm) => tm.userId))
+      for (const id of input.attendingUserIds) {
+        if (!teamUserIds.has(id)) {
+          throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: `User ${id} is not a team member`,
+          })
+        }
+      }
+
+      // Cutoff check — uses the LIVE_FINAL round's windowOpenAt + cfg.attendeeEditCutoffHours
+      const round = await ctx.prisma.round.findFirst({
+        where: {
+          competition: { programId: confirmation.project.programId },
+          roundType: 'LIVE_FINAL',
+        },
+        orderBy: { sortOrder: 'desc' },
+        select: { windowOpenAt: true, configJson: true },
+      })
+      if (round?.windowOpenAt) {
+        const cfg = (round.configJson ?? {}) as { attendeeEditCutoffHours?: number }
+        const cutoffHours = cfg.attendeeEditCutoffHours ?? 48
+        const cutoffAt = new Date(round.windowOpenAt.getTime() - cutoffHours * 3_600_000)
+        if (Date.now() > cutoffAt.getTime()) {
+          throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: `Attendee edits closed ${cutoffHours}h before the grand finale (cutoff was ${cutoffAt.toISOString()})`,
+          })
+        }
+      }
+
+      // Diff: keep users in both, delete removed, create added
+      const desiredIds = new Set(input.attendingUserIds)
+      const existingByUser = new Map(
+        confirmation.attendingMembers.map((m) => [m.userId, m] as const),
+      )
+      const toDelete = confirmation.attendingMembers.filter((m) => !desiredIds.has(m.userId))
+      const toCreate = input.attendingUserIds.filter((id) => !existingByUser.has(id))
+      const toUpdate = input.attendingUserIds.filter((id) => existingByUser.has(id))
+
+      await ctx.prisma.$transaction([
+        ...(toDelete.length > 0
+          ? [
+              ctx.prisma.attendingMember.deleteMany({
+                where: { id: { in: toDelete.map((m) => m.id) } },
+              }),
+            ]
+          : []),
+        ...toUpdate.map((userId) =>
+          ctx.prisma.attendingMember.update({
+            where: { id: existingByUser.get(userId)!.id },
+            data: { needsVisa: input.visaFlags[userId] ?? false },
+          }),
+        ),
+        ...(toCreate.length > 0
+          ? [
+              ctx.prisma.attendingMember.createMany({
+                data: toCreate.map((userId) => ({
+                  confirmationId: confirmation.id,
+                  userId,
+                  needsVisa: input.visaFlags[userId] ?? false,
+                })),
+              }),
+            ]
+          : []),
+      ])
+
+      await logAudit({
+        prisma: ctx.prisma,
+        userId: ctx.user.id,
+        action: 'FINALIST_EDIT_ATTENDEES',
+        entityType: 'FinalistConfirmation',
+        entityId: confirmation.id,
+        detailsJson: {
+          attendingUserIds: input.attendingUserIds,
+          visaFlags: input.visaFlags,
+          added: toCreate,
+          removed: toDelete.map((m) => m.userId),
+        },
+      })
+
+      return { ok: true }
+    }),
 })