From bc04a5dcd2739a4b1b321bdcd08c9dd42279484c Mon Sep 17 00:00:00 2001
From: Tongsheng Wu <tongshengwu0@gmail.com>
Date: Mon, 15 Jun 2026 00:34:26 -0700
Subject: [PATCH 1/3] Add broadcast announcements service

Adds /broadcast_hackers with email and SMS broadcast forms, stub senders,
a broadcast log stub, and a success page. No real sending infrastructure yet.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/broadcast_hackers/actions.ts        | 31 +++++++++++++++++
 app/broadcast_hackers/page.tsx          | 45 +++++++++++++++++++++++++
 app/broadcast_hackers/styles.module.css | 32 ++++++++++++++++++
 app/broadcast_hackers/success/page.tsx  | 23 +++++++++++++
 lib/db/schema/broadcasts.ts             | 20 +++++++++++
 5 files changed, 151 insertions(+)
 create mode 100644 app/broadcast_hackers/actions.ts
 create mode 100644 app/broadcast_hackers/page.tsx
 create mode 100644 app/broadcast_hackers/styles.module.css
 create mode 100644 app/broadcast_hackers/success/page.tsx
 create mode 100644 lib/db/schema/broadcasts.ts

diff --git a/app/broadcast_hackers/actions.ts b/app/broadcast_hackers/actions.ts
new file mode 100644
index 0000000..06378af
--- /dev/null
+++ b/app/broadcast_hackers/actions.ts
@@ -0,0 +1,31 @@
+"use server";
+
+import { redirect } from "next/navigation";
+
+export async function broadcastEmail(formData: FormData) {
+  const subject = formData.get("subject") as string;
+  const body = formData.get("body") as string;
+  send_all_email_stub(subject, body);
+  log_broadcast_stub("email", body, subject);
+  redirect("/broadcast_hackers/success?channel=email");
+}
+
+export async function broadcastSms(formData: FormData) {
+  const message = formData.get("message") as string;
+  send_all_sms_stub(message);
+  log_broadcast_stub("sms", message);
+  redirect("/broadcast_hackers/success?channel=sms");
+}
+
+function send_all_email_stub(subject: string, body: string) {
+  console.log("[EMAIL STUB] subject:", subject);
+  console.log("[EMAIL STUB] body:", body);
+}
+
+function send_all_sms_stub(message: string) {
+  console.log("[SMS STUB] message:", message);
+}
+
+function log_broadcast_stub(channel: "email" | "sms", body: string, subject?: string) {
+  console.log("[BROADCAST LOG STUB] channel:", channel, "subject:", subject, "body:", body);
+}
diff --git a/app/broadcast_hackers/page.tsx b/app/broadcast_hackers/page.tsx
new file mode 100644
index 0000000..ec2eacc
--- /dev/null
+++ b/app/broadcast_hackers/page.tsx
@@ -0,0 +1,45 @@
+"use client";
+
+import { broadcastEmail, broadcastSms } from "./actions";
+import styles from "./styles.module.css";
+
+function confirm_send(count: number) {
+  return confirm(`This will alert all ${count} hackers. Are you sure?`);
+}
+
+export default function BroadcastPage() {
+  const hackerCount = 0; // TODO: replace with real count
+
+  return (
+    <div className={styles.container}>
+      <h1>Broadcast Announcements</h1>
+
+      <h2>Email</h2>
+      <form action={broadcastEmail} onSubmit={(e) => { if (!confirm_send(hackerCount)) e.preventDefault(); }} className={styles.form}>
+        <label>
+          Subject
+          <br />
+          <input name="subject" required className={styles.input} />
+        </label>
+        <label>
+          Body
+          <br />
+          <textarea name="body" rows={6} required className={styles.textarea} />
+        </label>
+        <button type="submit" className={styles.button}>Send Email to All Hackers</button>
+      </form>
+
+      <hr className={styles.divider} />
+
+      <h2>SMS</h2>
+      <form action={broadcastSms} onSubmit={(e) => { if (!confirm_send(hackerCount)) e.preventDefault(); }} className={styles.form}>
+        <label>
+          Message
+          <br />
+          <textarea name="message" rows={4} required className={styles.textarea} />
+        </label>
+        <button type="submit" className={styles.button}>Send SMS to All Hackers</button>
+      </form>
+    </div>
+  );
+}
diff --git a/app/broadcast_hackers/styles.module.css b/app/broadcast_hackers/styles.module.css
new file mode 100644
index 0000000..1988e77
--- /dev/null
+++ b/app/broadcast_hackers/styles.module.css
@@ -0,0 +1,32 @@
+.container {
+  max-width: 480px;
+  margin: 40px auto;
+  font-family: sans-serif;
+}
+
+.form {
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.input,
+.textarea {
+  width: 100%;
+  padding: 4px;
+  border: 1px solid #999;
+  box-sizing: border-box;
+}
+
+.button {
+  padding: 6px 12px;
+  border: 1px solid #333;
+  background: #eee;
+  cursor: pointer;
+  text-decoration: none;
+  display: inline-block;
+}
+
+.divider {
+  margin: 32px 0;
+}
diff --git a/app/broadcast_hackers/success/page.tsx b/app/broadcast_hackers/success/page.tsx
new file mode 100644
index 0000000..e11f78a
--- /dev/null
+++ b/app/broadcast_hackers/success/page.tsx
@@ -0,0 +1,23 @@
+import { redirect } from "next/navigation";
+import styles from "../styles.module.css";
+
+export default async function BroadcastSuccessPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ channel?: string }>;
+}) {
+  const { channel } = await searchParams;
+
+  if (channel !== "email" && channel !== "sms") {
+    redirect("/broadcast_hackers");
+  }
+
+  const label = channel === "email" ? "Email" : "SMS";
+
+  return (
+    <div className={styles.container}>
+      <h1>{label} sent successfully.</h1>
+      <a href="/broadcast_hackers" className={styles.button}>Send another?</a>
+    </div>
+  );
+}
diff --git a/lib/db/schema/broadcasts.ts b/lib/db/schema/broadcasts.ts
new file mode 100644
index 0000000..5065c27
--- /dev/null
+++ b/lib/db/schema/broadcasts.ts
@@ -0,0 +1,20 @@
+import { pgEnum, pgTable, uuid, text, timestamp } from "drizzle-orm/pg-core";
+import { users } from "./users";
+
+export const broadcastChannelEnum = pgEnum("broadcast_channel", [
+  "email",
+  "sms",
+  "all",
+]);
+
+export const broadcastLogs = pgTable("broadcast_logs", {
+  id: uuid("id").primaryKey().defaultRandom(),
+  channel: broadcastChannelEnum("channel").notNull(),
+  subject: text("subject"),
+  body: text("body").notNull(),
+  sentAt: timestamp("sent_at", { withTimezone: true }).notNull().defaultNow(),
+  sentBy: uuid("sent_by").references(() => users.id),
+});
+
+export type BroadcastLogRow = typeof broadcastLogs.$inferSelect;
+export type NewBroadcastLog = typeof broadcastLogs.$inferInsert;

From 67fe25263828dc8740f1911a015e4fcfe1c1c970 Mon Sep 17 00:00:00 2001
From: Tongsheng Wu <tongshengwu0@gmail.com>
Date: Sun, 19 Jul 2026 21:51:23 -0700
Subject: [PATCH 2/3] aws

---
 app/broadcast_hackers/BroadcastForm.tsx       | 47 +++++++++
 app/broadcast_hackers/actions.ts              | 52 ++++++----
 .../logs/[id]/recipients/route.ts             | 38 ++++++++
 app/broadcast_hackers/logs/page.tsx           | 96 +++++++++++++++++++
 app/broadcast_hackers/page.tsx                | 53 ++++------
 app/broadcast_hackers/success/page.tsx        | 26 ++---
 lib/aws/config.ts                             | 10 ++
 lib/aws/ses.placeholder.ts                    |  7 ++
 lib/aws/ses.ts                                | 36 +++++++
 lib/aws/sms.placeholder.ts                    |  6 ++
 lib/aws/sms.ts                                | 35 +++++++
 lib/db/index.ts                               |  3 +-
 lib/db/schema/broadcasts.ts                   | 15 +--
 package.json                                  |  2 +
 pnpm-lock.yaml                                | 36 +++++++
 scripts/gen-env-local.sh                      |  3 +-
 supabase/seed.sql                             | 35 +++++++
 17 files changed, 418 insertions(+), 82 deletions(-)
 create mode 100644 app/broadcast_hackers/BroadcastForm.tsx
 create mode 100644 app/broadcast_hackers/logs/[id]/recipients/route.ts
 create mode 100644 app/broadcast_hackers/logs/page.tsx
 create mode 100644 lib/aws/config.ts
 create mode 100644 lib/aws/ses.placeholder.ts
 create mode 100644 lib/aws/ses.ts
 create mode 100644 lib/aws/sms.placeholder.ts
 create mode 100644 lib/aws/sms.ts

diff --git a/app/broadcast_hackers/BroadcastForm.tsx b/app/broadcast_hackers/BroadcastForm.tsx
new file mode 100644
index 0000000..3fa005b
--- /dev/null
+++ b/app/broadcast_hackers/BroadcastForm.tsx
@@ -0,0 +1,47 @@
+"use client";
+
+import { useState } from "react";
+import { broadcastAll } from "./actions";
+import styles from "./styles.module.css";
+
+const BODY_LIMIT = 160;
+
+export default function BroadcastForm({ hackerCount }: { hackerCount: number }) {
+  const [bodyLength, setBodyLength] = useState(0);
+
+  return (
+    <form
+      action={broadcastAll}
+      onSubmit={(e) => {
+        if (!confirm(`This will alert all ${hackerCount} hackers. Are you sure?`)) {
+          e.preventDefault();
+        }
+      }}
+      className={styles.form}
+    >
+      <label>
+        Subject (email only)
+        <br />
+        <input name="subject" required className={styles.input} />
+      </label>
+      <label>
+        Body
+        <br />
+        <textarea
+          name="body"
+          rows={4}
+          required
+          maxLength={BODY_LIMIT}
+          className={styles.textarea}
+          onChange={(e) => setBodyLength(e.target.value.length)}
+        />
+        <span>
+          {bodyLength} / {BODY_LIMIT}
+        </span>
+      </label>
+      <button type="submit" className={styles.button}>
+        Send to All Hackers
+      </button>
+    </form>
+  );
+}
diff --git a/app/broadcast_hackers/actions.ts b/app/broadcast_hackers/actions.ts
index 06378af..d400d1d 100644
--- a/app/broadcast_hackers/actions.ts
+++ b/app/broadcast_hackers/actions.ts
@@ -1,31 +1,43 @@
 "use server";
 
 import { redirect } from "next/navigation";
+import { db } from "@/lib/db";
+import { users } from "@/lib/db/schema/users";
+import { hackerApplicants } from "@/lib/db/schema/applications";
+import { broadcastLogs } from "@/lib/db/schema/broadcasts";
+import { getSessionUser } from "@/lib/auth/session";
+import { sendBulkEmail } from "@/lib/aws/ses.placeholder";
+import { sendBulkSMS } from "@/lib/aws/sms.placeholder";
+
+export async function broadcastAll(formData: FormData) {
+  const sessionUser = await getSessionUser();
+  if (!sessionUser || sessionUser.role !== "organizer") {
+    throw new Error("Unauthorized");
+  }
 
-export async function broadcastEmail(formData: FormData) {
   const subject = formData.get("subject") as string;
   const body = formData.get("body") as string;
-  send_all_email_stub(subject, body);
-  log_broadcast_stub("email", body, subject);
-  redirect("/broadcast_hackers/success?channel=email");
-}
 
-export async function broadcastSms(formData: FormData) {
-  const message = formData.get("message") as string;
-  send_all_sms_stub(message);
-  log_broadcast_stub("sms", message);
-  redirect("/broadcast_hackers/success?channel=sms");
-}
+  const emailRows = await db.select({ email: users.email }).from(users);
+  const smsRows = await db
+    .select({ phoneNumber: hackerApplicants.phoneNumber })
+    .from(hackerApplicants);
 
-function send_all_email_stub(subject: string, body: string) {
-  console.log("[EMAIL STUB] subject:", subject);
-  console.log("[EMAIL STUB] body:", body);
-}
+  const emails = emailRows.map((r) => r.email);
+  const phoneNumbers = smsRows.map((r) => r.phoneNumber);
 
-function send_all_sms_stub(message: string) {
-  console.log("[SMS STUB] message:", message);
-}
+  await Promise.all([
+    sendBulkEmail(emails, subject, body),
+    sendBulkSMS(phoneNumbers, body),
+  ]);
+
+  await db.insert(broadcastLogs).values({
+    subject,
+    body,
+    sentBy: sessionUser.id,
+    broadcastedToEmail: emails,
+    broadcastedToText: phoneNumbers,
+  });
 
-function log_broadcast_stub(channel: "email" | "sms", body: string, subject?: string) {
-  console.log("[BROADCAST LOG STUB] channel:", channel, "subject:", subject, "body:", body);
+  redirect("/broadcast_hackers/success");
 }
diff --git a/app/broadcast_hackers/logs/[id]/recipients/route.ts b/app/broadcast_hackers/logs/[id]/recipients/route.ts
new file mode 100644
index 0000000..f0f7083
--- /dev/null
+++ b/app/broadcast_hackers/logs/[id]/recipients/route.ts
@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { eq } from "drizzle-orm";
+import { db } from "@/lib/db";
+import { broadcastLogs } from "@/lib/db/schema/broadcasts";
+import { getSessionUser } from "@/lib/auth/session";
+
+export async function GET(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const user = await getSessionUser();
+  if (!user || user.role !== "organizer") {
+    return new NextResponse("Unauthorized", { status: 401 });
+  }
+
+  const { id } = await params;
+  const type = request.nextUrl.searchParams.get("type");
+
+  const [log] = await db
+    .select()
+    .from(broadcastLogs)
+    .where(eq(broadcastLogs.id, id))
+    .limit(1);
+
+  if (!log) {
+    return new NextResponse("Not found", { status: 404 });
+  }
+
+  const isEmail = type === "email";
+  const title = isEmail ? "sent to email" : "sent to text";
+  const items: string[] = isEmail
+    ? (log.broadcastedToEmail as string[]) ?? []
+    : (log.broadcastedToText as string[]) ?? [];
+
+  return new NextResponse([title, ...items].join("\n"), {
+    headers: { "Content-Type": "text/plain; charset=utf-8" },
+  });
+}
diff --git a/app/broadcast_hackers/logs/page.tsx b/app/broadcast_hackers/logs/page.tsx
new file mode 100644
index 0000000..08f63ef
--- /dev/null
+++ b/app/broadcast_hackers/logs/page.tsx
@@ -0,0 +1,96 @@
+import { redirect } from "next/navigation";
+import { desc, eq } from "drizzle-orm";
+import { getSessionUser } from "@/lib/auth/session";
+import { db } from "@/lib/db";
+import { broadcastLogs } from "@/lib/db/schema/broadcasts";
+import { users } from "@/lib/db/schema/users";
+import {
+  Table,
+  TableBody,
+  TableCell,
+  TableHead,
+  TableHeader,
+  TableRow,
+} from "@/components/ui/table";
+import styles from "../styles.module.css";
+
+export default async function BroadcastLogsPage() {
+  const user = await getSessionUser();
+  if (!user || user.role !== "organizer") {
+    redirect("/");
+  }
+
+  const logs = await db
+    .select({
+      id: broadcastLogs.id,
+      subject: broadcastLogs.subject,
+      body: broadcastLogs.body,
+      sentAt: broadcastLogs.sentAt,
+      broadcastedToEmail: broadcastLogs.broadcastedToEmail,
+      broadcastedToText: broadcastLogs.broadcastedToText,
+      operatorEmail: users.email,
+    })
+    .from(broadcastLogs)
+    .leftJoin(users, eq(broadcastLogs.sentBy, users.id))
+    .orderBy(desc(broadcastLogs.sentAt));
+
+  return (
+    <div className={styles.container} style={{ maxWidth: 900 }}>
+      <h1>Broadcast Logs</h1>
+      <a href="/broadcast_hackers" className={styles.button} style={{ marginBottom: 16, display: "inline-block" }}>
+        ← Back
+      </a>
+      <Table>
+        <TableHeader>
+          <TableRow>
+            <TableHead>Time</TableHead>
+            <TableHead>Title</TableHead>
+            <TableHead>Body</TableHead>
+            <TableHead>Sent to Email</TableHead>
+            <TableHead>Sent to Text</TableHead>
+            <TableHead>Operator</TableHead>
+          </TableRow>
+        </TableHeader>
+        <TableBody>
+          {logs.map((log) => {
+            const emailCount = (log.broadcastedToEmail as string[])?.length ?? 0;
+            const textCount = (log.broadcastedToText as string[])?.length ?? 0;
+            return (
+              <TableRow key={log.id}>
+                <TableCell className="whitespace-nowrap">
+                  {new Date(log.sentAt).toLocaleString()}
+                </TableCell>
+                <TableCell>{log.subject}</TableCell>
+                <TableCell className="max-w-xs truncate">{log.body}</TableCell>
+                <TableCell>
+                  <a
+                    href={`/broadcast_hackers/logs/${log.id}/recipients?type=email`}
+                    className="underline"
+                  >
+                    {emailCount} addresses
+                  </a>
+                </TableCell>
+                <TableCell>
+                  <a
+                    href={`/broadcast_hackers/logs/${log.id}/recipients?type=text`}
+                    className="underline"
+                  >
+                    {textCount} numbers
+                  </a>
+                </TableCell>
+                <TableCell>{log.operatorEmail ?? "—"}</TableCell>
+              </TableRow>
+            );
+          })}
+          {logs.length === 0 && (
+            <TableRow>
+              <TableCell colSpan={6} className="text-center text-muted-foreground">
+                No broadcasts yet.
+              </TableCell>
+            </TableRow>
+          )}
+        </TableBody>
+      </Table>
+    </div>
+  );
+}
diff --git a/app/broadcast_hackers/page.tsx b/app/broadcast_hackers/page.tsx
index ec2eacc..2e407dc 100644
--- a/app/broadcast_hackers/page.tsx
+++ b/app/broadcast_hackers/page.tsx
@@ -1,45 +1,30 @@
-"use client";
-
-import { broadcastEmail, broadcastSms } from "./actions";
+import { redirect } from "next/navigation";
+import { count } from "drizzle-orm";
+import { getSessionUser } from "@/lib/auth/session";
+import { db } from "@/lib/db";
+import { hackerApplicants } from "@/lib/db/schema/applications";
+import BroadcastForm from "./BroadcastForm";
 import styles from "./styles.module.css";
 
-function confirm_send(count: number) {
-  return confirm(`This will alert all ${count} hackers. Are you sure?`);
-}
+export default async function BroadcastPage() {
+  const user = await getSessionUser();
+  if (!user || user.role !== "organizer") {
+    redirect("/");
+  }
 
-export default function BroadcastPage() {
-  const hackerCount = 0; // TODO: replace with real count
+  const [{ value: hackerCount }] = await db
+    .select({ value: count() })
+    .from(hackerApplicants);
 
   return (
     <div className={styles.container}>
       <h1>Broadcast Announcements</h1>
-
-      <h2>Email</h2>
-      <form action={broadcastEmail} onSubmit={(e) => { if (!confirm_send(hackerCount)) e.preventDefault(); }} className={styles.form}>
-        <label>
-          Subject
-          <br />
-          <input name="subject" required className={styles.input} />
-        </label>
-        <label>
-          Body
-          <br />
-          <textarea name="body" rows={6} required className={styles.textarea} />
-        </label>
-        <button type="submit" className={styles.button}>Send Email to All Hackers</button>
-      </form>
-
+      <p>Warning! This broadcasts to all {hackerCount} hackers through email and SMS.</p>
+      <BroadcastForm hackerCount={hackerCount} />
       <hr className={styles.divider} />
-
-      <h2>SMS</h2>
-      <form action={broadcastSms} onSubmit={(e) => { if (!confirm_send(hackerCount)) e.preventDefault(); }} className={styles.form}>
-        <label>
-          Message
-          <br />
-          <textarea name="message" rows={4} required className={styles.textarea} />
-        </label>
-        <button type="submit" className={styles.button}>Send SMS to All Hackers</button>
-      </form>
+      <a href="/broadcast_hackers/logs" className={styles.button}>
+        View Logs
+      </a>
     </div>
   );
 }
diff --git a/app/broadcast_hackers/success/page.tsx b/app/broadcast_hackers/success/page.tsx
index e11f78a..8b8265c 100644
--- a/app/broadcast_hackers/success/page.tsx
+++ b/app/broadcast_hackers/success/page.tsx
@@ -1,23 +1,17 @@
-import { redirect } from "next/navigation";
 import styles from "../styles.module.css";
 
-export default async function BroadcastSuccessPage({
-  searchParams,
-}: {
-  searchParams: Promise<{ channel?: string }>;
-}) {
-  const { channel } = await searchParams;
-
-  if (channel !== "email" && channel !== "sms") {
-    redirect("/broadcast_hackers");
-  }
-
-  const label = channel === "email" ? "Email" : "SMS";
-
+export default function BroadcastSuccessPage() {
   return (
     <div className={styles.container}>
-      <h1>{label} sent successfully.</h1>
-      <a href="/broadcast_hackers" className={styles.button}>Send another?</a>
+      <h1>Broadcast sent successfully.</h1>
+      <div className={styles.form}>
+        <a href="/broadcast_hackers" className={styles.button}>
+          Send another
+        </a>
+        <a href="/broadcast_hackers/logs" className={styles.button}>
+          View logs
+        </a>
+      </div>
     </div>
   );
 }
diff --git a/lib/aws/config.ts b/lib/aws/config.ts
new file mode 100644
index 0000000..0787d29
--- /dev/null
+++ b/lib/aws/config.ts
@@ -0,0 +1,10 @@
+// TODO: populate these in .env.local before deploying
+export const AWS_REGION = process.env.AWS_REGION ?? "us-east-1";
+export const AWS_ACCESS_KEY_ID = process.env.AWS_ACCESS_KEY_ID ?? "";
+export const AWS_SECRET_ACCESS_KEY = process.env.AWS_SECRET_ACCESS_KEY ?? "";
+
+// TODO: verified SES sender address (must be verified in AWS SES console)
+export const SES_FROM_ADDRESS = process.env.SES_FROM_ADDRESS ?? "";
+
+// TODO: End User Messaging origination identity (phone number or pool ARN from AWS console)
+export const EUM_ORIGINATION_NUMBER = process.env.EUM_ORIGINATION_NUMBER ?? "";
diff --git a/lib/aws/ses.placeholder.ts b/lib/aws/ses.placeholder.ts
new file mode 100644
index 0000000..9357e8f
--- /dev/null
+++ b/lib/aws/ses.placeholder.ts
@@ -0,0 +1,7 @@
+export async function sendBulkEmail(
+  emails: string[],
+  subject: string,
+  body: string
+): Promise<void> {
+  console.log("[placeholder] sendBulkEmail", { emails, subject, body });
+}
diff --git a/lib/aws/ses.ts b/lib/aws/ses.ts
new file mode 100644
index 0000000..d164800
--- /dev/null
+++ b/lib/aws/ses.ts
@@ -0,0 +1,36 @@
+import { SESClient, SendEmailCommand } from "@aws-sdk/client-ses";
+import {
+  AWS_REGION,
+  AWS_ACCESS_KEY_ID,
+  AWS_SECRET_ACCESS_KEY,
+  SES_FROM_ADDRESS,
+} from "./config";
+
+const client = new SESClient({
+  region: AWS_REGION,
+  credentials: {
+    accessKeyId: AWS_ACCESS_KEY_ID,
+    secretAccessKey: AWS_SECRET_ACCESS_KEY,
+  },
+});
+
+export async function sendBulkEmail(
+  emails: string[],
+  subject: string,
+  body: string
+): Promise<void> {
+  await Promise.allSettled(
+    emails.map((email) =>
+      client.send(
+        new SendEmailCommand({
+          Source: SES_FROM_ADDRESS,
+          Destination: { ToAddresses: [email] },
+          Message: {
+            Subject: { Data: subject },
+            Body: { Text: { Data: body } },
+          },
+        })
+      )
+    )
+  );
+}
diff --git a/lib/aws/sms.placeholder.ts b/lib/aws/sms.placeholder.ts
new file mode 100644
index 0000000..e086c8f
--- /dev/null
+++ b/lib/aws/sms.placeholder.ts
@@ -0,0 +1,6 @@
+export async function sendBulkSMS(
+  phoneNumbers: string[],
+  message: string
+): Promise<void> {
+  console.log("[placeholder] sendBulkSMS", { phoneNumbers, message });
+}
diff --git a/lib/aws/sms.ts b/lib/aws/sms.ts
new file mode 100644
index 0000000..65dc3bf
--- /dev/null
+++ b/lib/aws/sms.ts
@@ -0,0 +1,35 @@
+import {
+  PinpointSMSVoiceV2Client,
+  SendTextMessageCommand,
+} from "@aws-sdk/client-pinpoint-sms-voice-v2";
+import {
+  AWS_REGION,
+  AWS_ACCESS_KEY_ID,
+  AWS_SECRET_ACCESS_KEY,
+  EUM_ORIGINATION_NUMBER,
+} from "./config";
+
+const client = new PinpointSMSVoiceV2Client({
+  region: AWS_REGION,
+  credentials: {
+    accessKeyId: AWS_ACCESS_KEY_ID,
+    secretAccessKey: AWS_SECRET_ACCESS_KEY,
+  },
+});
+
+export async function sendBulkSMS(
+  phoneNumbers: string[],
+  message: string
+): Promise<void> {
+  await Promise.allSettled(
+    phoneNumbers.map((phone) =>
+      client.send(
+        new SendTextMessageCommand({
+          DestinationPhoneNumber: phone,
+          OriginationIdentity: EUM_ORIGINATION_NUMBER,
+          MessageBody: message,
+        })
+      )
+    )
+  );
+}
diff --git a/lib/db/index.ts b/lib/db/index.ts
index 7b6955c..de38052 100644
--- a/lib/db/index.ts
+++ b/lib/db/index.ts
@@ -1,6 +1,7 @@
 import { drizzle } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 import * as applicationsSchema from "./schema/applications";
+import * as broadcastsSchema from "./schema/broadcasts";
 import * as usersSchema from "./schema/users";
 
 // Disable prefetch — prepared statements are not supported in Supabase's
@@ -9,5 +10,5 @@ const client = postgres(process.env.DATABASE_URL ?? "", { prepare: false });
 
 export const db = drizzle({
   client,
-  schema: { ...applicationsSchema, ...usersSchema },
+  schema: { ...applicationsSchema, ...broadcastsSchema, ...usersSchema },
 });
diff --git a/lib/db/schema/broadcasts.ts b/lib/db/schema/broadcasts.ts
index 5065c27..505f05a 100644
--- a/lib/db/schema/broadcasts.ts
+++ b/lib/db/schema/broadcasts.ts
@@ -1,20 +1,15 @@
-import { pgEnum, pgTable, uuid, text, timestamp } from "drizzle-orm/pg-core";
+import { pgTable, uuid, text, timestamp, jsonb } from "drizzle-orm/pg-core";
 import { users } from "./users";
 
-export const broadcastChannelEnum = pgEnum("broadcast_channel", [
-  "email",
-  "sms",
-  "all",
-]);
-
 export const broadcastLogs = pgTable("broadcast_logs", {
   id: uuid("id").primaryKey().defaultRandom(),
-  channel: broadcastChannelEnum("channel").notNull(),
-  subject: text("subject"),
+  subject: text("subject").notNull(),
   body: text("body").notNull(),
   sentAt: timestamp("sent_at", { withTimezone: true }).notNull().defaultNow(),
   sentBy: uuid("sent_by").references(() => users.id),
-});
+  broadcastedToEmail: jsonb("broadcasted_to_email").$type<string[]>().notNull().default([]),
+  broadcastedToText: jsonb("broadcasted_to_text").$type<string[]>().notNull().default([]),
+}).enableRLS();
 
 export type BroadcastLogRow = typeof broadcastLogs.$inferSelect;
 export type NewBroadcastLog = typeof broadcastLogs.$inferInsert;
diff --git a/package.json b/package.json
index 3db72f6..573307e 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,9 @@
     "db:migrate": "DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:54322/postgres drizzle-kit migrate"
   },
   "dependencies": {
+    "@aws-sdk/client-pinpoint-sms-voice-v2": "^3.1079.0",
     "@aws-sdk/client-s3": "^3.1079.0",
+    "@aws-sdk/client-ses": "^3.1079.0",
     "@aws-sdk/s3-request-presigner": "^3.1079.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/modifiers": "^9.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 62a31fa..b5bfb0a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,9 +11,15 @@ importers:
 
   .:
     dependencies:
+      '@aws-sdk/client-pinpoint-sms-voice-v2':
+        specifier: ^3.1079.0
+        version: 3.1079.0
       '@aws-sdk/client-s3':
         specifier: ^3.1079.0
         version: 3.1079.0
+      '@aws-sdk/client-ses':
+        specifier: ^3.1079.0
+        version: 3.1079.0
       '@aws-sdk/s3-request-presigner':
         specifier: ^3.1079.0
         version: 3.1079.0
@@ -185,10 +191,18 @@ packages:
     resolution: {integrity: sha512-RgNDWfhNRIlNEzePIRrYTNi/6q+wwRMMapojn8YVzw4ZcJRa/gxVMtUbeZARR1gmopuv6oIhMbY7J66qIQ0ynw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-pinpoint-sms-voice-v2@3.1079.0':
+    resolution: {integrity: sha512-uXSEuqNmKronU/6Byg0hahxqSm4O48c0Yt/+AJNTVrqglscqXjN25dwlPk/ImHaZq6cNIXJxv0DJTn2eAJuXPw==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/client-s3@3.1079.0':
     resolution: {integrity: sha512-di9U/7Po7qlVYb2dq58ULsbBAE1pBIk53rux+50LQCvH1X+/l1Ys+BIk/QLBtdaK1nADk0xRNEBbA1QWVnMccw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-ses@3.1079.0':
+    resolution: {integrity: sha512-wQOqKTsoaeKuSnFekw8XCs0zaC7cu3TiLCYd7N5S/eiGdGBB20sob6OZhgGlg7C86izmWcy5Z2EGt8+ze0UHtQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/core@3.974.27':
     resolution: {integrity: sha512-WRWEgIq6vx+NU6ot3VrRu4Jovj9MIObitSi6of/GV5THDDPccBhivCRNkWJutMM+m3GvdeI3l/UbGNcoOobxOA==}
     engines: {node: '>=20.0.0'}
@@ -4976,6 +4990,17 @@ snapshots:
       '@smithy/types': 4.15.1
       tslib: 2.8.1
 
+  '@aws-sdk/client-pinpoint-sms-voice-v2@3.1079.0':
+    dependencies:
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/types': 4.15.1
+      tslib: 2.8.1
+
   '@aws-sdk/client-s3@3.1079.0':
     dependencies:
       '@aws-sdk/checksums': 3.1000.12
@@ -4990,6 +5015,17 @@ snapshots:
       '@smithy/types': 4.15.1
       tslib: 2.8.1
 
+  '@aws-sdk/client-ses@3.1079.0':
+    dependencies:
+      '@aws-sdk/core': 3.974.27
+      '@aws-sdk/credential-provider-node': 3.972.62
+      '@aws-sdk/types': 3.973.15
+      '@smithy/core': 3.29.1
+      '@smithy/fetch-http-handler': 5.6.3
+      '@smithy/node-http-handler': 4.9.3
+      '@smithy/types': 4.15.1
+      tslib: 2.8.1
+
   '@aws-sdk/core@3.974.27':
     dependencies:
       '@aws-sdk/types': 3.973.15
diff --git a/scripts/gen-env-local.sh b/scripts/gen-env-local.sh
index 4a66398..8013ef7 100755
--- a/scripts/gen-env-local.sh
+++ b/scripts/gen-env-local.sh
@@ -19,6 +19,8 @@ get_var() {
 
 DB_URL=$(get_var DB_URL)
 API_URL=$(get_var API_URL)
+# Newer CLI versions omit API_URL; fall back to the known local default
+[[ -z "$API_URL" ]] && API_URL="http://127.0.0.1:54321"
 PUBLISHABLE_KEY=$(get_var PUBLISHABLE_KEY)
 S3_ACCESS_KEY=$(get_var S3_PROTOCOL_ACCESS_KEY_ID)
 S3_SECRET_KEY=$(get_var S3_PROTOCOL_ACCESS_KEY_SECRET)
@@ -27,7 +29,6 @@ S3_REGION=$(get_var S3_PROTOCOL_REGION)
 
 missing=()
 [[ -z "$DB_URL" ]] && missing+=("DATABASE_URL")
-[[ -z "$API_URL" ]] && missing+=("NEXT_PUBLIC_SUPABASE_URL")
 [[ -z "$PUBLISHABLE_KEY" ]] && missing+=("NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY")
 [[ -z "$S3_ACCESS_KEY" ]] && missing+=("S3_PROTOCOL_ACCESS_KEY_ID")
 [[ -z "$S3_SECRET_KEY" ]] && missing+=("S3_PROTOCOL_ACCESS_KEY_SECRET")
diff --git a/supabase/seed.sql b/supabase/seed.sql
index 3284fa5..144a0d5 100644
--- a/supabase/seed.sql
+++ b/supabase/seed.sql
@@ -14,3 +14,38 @@ on conflict (id) do update set
   public = excluded.public,
   file_size_limit = excluded.file_size_limit,
   allowed_mime_types = excluded.allowed_mime_types;
+
+-- Test hackers
+insert into auth.users (id, email, raw_app_meta_data, raw_user_meta_data, is_super_admin, created_at, updated_at, email_confirmed_at, aud, role)
+values
+  ('11111111-1111-4111-8111-111111111111', 'alice@test.com', '{}', '{}', false, now(), now(), now(), 'authenticated', 'authenticated'),
+  ('22222222-2222-4222-8222-222222222222', 'bob@test.com',   '{}', '{}', false, now(), now(), now(), 'authenticated', 'authenticated'),
+  ('33333333-3333-4333-8333-333333333333', 'carol@test.com', '{}', '{}', false, now(), now(), now(), 'authenticated', 'authenticated'),
+  ('44444444-4444-4444-8444-444444444444', 'dave@test.com',  '{}', '{}', false, now(), now(), now(), 'authenticated', 'authenticated'),
+  ('55555555-5555-4555-8555-555555555555', 'eve@test.com',   '{}', '{}', false, now(), now(), now(), 'authenticated', 'authenticated')
+on conflict (id) do nothing;
+
+-- public.users rows are created by the handle_new_user trigger above,
+-- but we upsert here too so seed is idempotent on db reset.
+insert into public.users (id, email, role)
+values
+  ('11111111-1111-4111-8111-111111111111', 'alice@test.com', 'hacker'),
+  ('22222222-2222-4222-8222-222222222222', 'bob@test.com',   'hacker'),
+  ('33333333-3333-4333-8333-333333333333', 'carol@test.com', 'hacker'),
+  ('44444444-4444-4444-8444-444444444444', 'dave@test.com',  'hacker'),
+  ('55555555-5555-4555-8555-555555555555', 'eve@test.com',   'hacker')
+on conflict (id) do nothing;
+
+insert into public.hacker_applicants (
+  user_id, first_name, last_name, phone_number, age, gender, ethnicity,
+  university, country, degree, graduation_year, previous_hackathons, major,
+  what_would_you_do, why_mhacks, hill_to_die_on,
+  transportation_type, coming_from, shirt_size, needs_travel_reimbursement
+)
+values
+  ('11111111-1111-4111-8111-111111111111', 'Alice', 'Smith',   '+15550000001', 20, 'Female',         'Asian',             'University of Michigan',     'USA', 'Bachelor''s', 2026, 2, 'Computer Science',    'Build an AI study tool',        'MHacks is the best hackathon',  'Sleep is overrated',    'driving',  'Ann Arbor, MI',  'M',  false),
+  ('22222222-2222-4222-8222-222222222222', 'Bob',   'Johnson', '+15550000002', 22, 'Male',           'Hispanic',          'MIT',                        'USA', 'Bachelor''s', 2025, 5, 'Electrical Engineering', 'Create a smart grid optimizer', 'Learning never stops',          'Tabs over spaces',      'flying',   'Boston, MA',     'L',  true),
+  ('33333333-3333-4333-8333-333333333333', 'Carol', 'Lee',     '+15550000003', 21, 'Non-binary',     'Black',             'Stanford University',        'USA', 'Master''s',  2026, 3, 'Data Science',        'Visualize climate data',        'Stanford sent me here',         'Dark mode always',      'train',    'Palo Alto, CA',  'S',  false),
+  ('44444444-4444-4444-8444-444444444444', 'Dave',  'Patel',   '+15550000004', 23, 'Male',           'South Asian',       'Carnegie Mellon University', 'USA', 'Bachelor''s', 2025, 7, 'Robotics',            'Build an autonomous drone',     'CMU robotics club represent',   'Python over everything','driving',  'Pittsburgh, PA', 'XL', true),
+  ('55555555-5555-4555-8555-555555555555', 'Eve',   'Garcia',  '+15550000005', 19, 'Female',         'Latina',            'University of Texas Austin', 'USA', 'Bachelor''s', 2027, 1, 'Information Systems', 'Hack on accessibility tools',   'First hackathon, so excited!',  'Pineapple on pizza',    'bus',      'Austin, TX',     'S',  false)
+on conflict (user_id) do nothing;

From 441793804bdde9c9d57a8c6eee2dac65438097fb Mon Sep 17 00:00:00 2001
From: Tongsheng Wu <tongshengwu0@gmail.com>
Date: Mon, 20 Jul 2026 18:36:03 -0700
Subject: [PATCH 3/3] fix

---
 app/broadcast_hackers/actions.ts               | 18 ++++++++++++------
 .../logs/[id]/recipients/route.ts              |  3 +--
 lib/aws/ses.placeholder.ts                     |  3 ++-
 lib/aws/ses.ts                                 |  6 ++++--
 lib/aws/sms.placeholder.ts                     |  3 ++-
 lib/aws/sms.ts                                 |  8 ++++++--
 lib/db/schema/broadcasts.ts                    |  2 +-
 7 files changed, 28 insertions(+), 15 deletions(-)

diff --git a/app/broadcast_hackers/actions.ts b/app/broadcast_hackers/actions.ts
index d400d1d..e9af494 100644
--- a/app/broadcast_hackers/actions.ts
+++ b/app/broadcast_hackers/actions.ts
@@ -1,6 +1,7 @@
 "use server";
 
 import { redirect } from "next/navigation";
+import { eq } from "drizzle-orm";
 import { db } from "@/lib/db";
 import { users } from "@/lib/db/schema/users";
 import { hackerApplicants } from "@/lib/db/schema/applications";
@@ -18,15 +19,20 @@ export async function broadcastAll(formData: FormData) {
   const subject = formData.get("subject") as string;
   const body = formData.get("body") as string;
 
-  const emailRows = await db.select({ email: users.email }).from(users);
+  const emailRows = await db
+    .select({ email: users.email })
+    .from(users)
+    .where(eq(users.role, "hacker"));
   const smsRows = await db
     .select({ phoneNumber: hackerApplicants.phoneNumber })
     .from(hackerApplicants);
 
-  const emails = emailRows.map((r) => r.email);
-  const phoneNumbers = smsRows.map((r) => r.phoneNumber);
+  const emails = emailRows.map((r) => r.email).filter((e) => e.length > 0);
+  const phoneNumbers = smsRows
+    .map((r) => r.phoneNumber)
+    .filter((p) => p.length > 0);
 
-  await Promise.all([
+  const [emailResults, smsResults] = await Promise.all([
     sendBulkEmail(emails, subject, body),
     sendBulkSMS(phoneNumbers, body),
   ]);
@@ -35,8 +41,8 @@ export async function broadcastAll(formData: FormData) {
     subject,
     body,
     sentBy: sessionUser.id,
-    broadcastedToEmail: emails,
-    broadcastedToText: phoneNumbers,
+    broadcastedToEmail: emailResults.succeeded,
+    broadcastedToText: smsResults.succeeded,
   });
 
   redirect("/broadcast_hackers/success");
diff --git a/app/broadcast_hackers/logs/[id]/recipients/route.ts b/app/broadcast_hackers/logs/[id]/recipients/route.ts
index f0f7083..047d463 100644
--- a/app/broadcast_hackers/logs/[id]/recipients/route.ts
+++ b/app/broadcast_hackers/logs/[id]/recipients/route.ts
@@ -27,12 +27,11 @@ export async function GET(
   }
 
   const isEmail = type === "email";
-  const title = isEmail ? "sent to email" : "sent to text";
   const items: string[] = isEmail
     ? (log.broadcastedToEmail as string[]) ?? []
     : (log.broadcastedToText as string[]) ?? [];
 
-  return new NextResponse([title, ...items].join("\n"), {
+  return new NextResponse(items.join("\n"), {
     headers: { "Content-Type": "text/plain; charset=utf-8" },
   });
 }
diff --git a/lib/aws/ses.placeholder.ts b/lib/aws/ses.placeholder.ts
index 9357e8f..6978a10 100644
--- a/lib/aws/ses.placeholder.ts
+++ b/lib/aws/ses.placeholder.ts
@@ -2,6 +2,7 @@ export async function sendBulkEmail(
   emails: string[],
   subject: string,
   body: string
-): Promise<void> {
+): Promise<{ succeeded: string[] }> {
   console.log("[placeholder] sendBulkEmail", { emails, subject, body });
+  return { succeeded: emails };
 }
diff --git a/lib/aws/ses.ts b/lib/aws/ses.ts
index d164800..e3adf82 100644
--- a/lib/aws/ses.ts
+++ b/lib/aws/ses.ts
@@ -18,8 +18,8 @@ export async function sendBulkEmail(
   emails: string[],
   subject: string,
   body: string
-): Promise<void> {
-  await Promise.allSettled(
+): Promise<{ succeeded: string[] }> {
+  const results = await Promise.allSettled(
     emails.map((email) =>
       client.send(
         new SendEmailCommand({
@@ -33,4 +33,6 @@ export async function sendBulkEmail(
       )
     )
   );
+  const succeeded = emails.filter((_, i) => results[i].status === "fulfilled");
+  return { succeeded };
 }
diff --git a/lib/aws/sms.placeholder.ts b/lib/aws/sms.placeholder.ts
index e086c8f..07562db 100644
--- a/lib/aws/sms.placeholder.ts
+++ b/lib/aws/sms.placeholder.ts
@@ -1,6 +1,7 @@
 export async function sendBulkSMS(
   phoneNumbers: string[],
   message: string
-): Promise<void> {
+): Promise<{ succeeded: string[] }> {
   console.log("[placeholder] sendBulkSMS", { phoneNumbers, message });
+  return { succeeded: phoneNumbers };
 }
diff --git a/lib/aws/sms.ts b/lib/aws/sms.ts
index 65dc3bf..d0e3ba2 100644
--- a/lib/aws/sms.ts
+++ b/lib/aws/sms.ts
@@ -20,8 +20,8 @@ const client = new PinpointSMSVoiceV2Client({
 export async function sendBulkSMS(
   phoneNumbers: string[],
   message: string
-): Promise<void> {
-  await Promise.allSettled(
+): Promise<{ succeeded: string[] }> {
+  const results = await Promise.allSettled(
     phoneNumbers.map((phone) =>
       client.send(
         new SendTextMessageCommand({
@@ -32,4 +32,8 @@ export async function sendBulkSMS(
       )
     )
   );
+  const succeeded = phoneNumbers.filter(
+    (_, i) => results[i].status === "fulfilled"
+  );
+  return { succeeded };
 }
diff --git a/lib/db/schema/broadcasts.ts b/lib/db/schema/broadcasts.ts
index 505f05a..9de86f4 100644
--- a/lib/db/schema/broadcasts.ts
+++ b/lib/db/schema/broadcasts.ts
@@ -6,7 +6,7 @@ export const broadcastLogs = pgTable("broadcast_logs", {
   subject: text("subject").notNull(),
   body: text("body").notNull(),
   sentAt: timestamp("sent_at", { withTimezone: true }).notNull().defaultNow(),
-  sentBy: uuid("sent_by").references(() => users.id),
+  sentBy: uuid("sent_by").references(() => users.id, { onDelete: "set null" }),
   broadcastedToEmail: jsonb("broadcasted_to_email").$type<string[]>().notNull().default([]),
   broadcastedToText: jsonb("broadcasted_to_text").$type<string[]>().notNull().default([]),
 }).enableRLS();