Fixes from QA

Author: jmgasper

docs/api-usage-analysis.md

@@ -95,7 +95,7 @@
 | PATCH | `/v5/projects/copilots/requests/:copilotRequestId` | `platform-ui` | none | `{data:{...partial editable fields...}}` | Updated request object |
 | POST | `/v5/projects/:projectId/copilots/requests/:copilotRequestId/approve` | `platform-ui` | none | `{type}` | Created copilot opportunity object |
 | GET | `/v5/projects/copilots/opportunities` | `platform-ui`, `community-app` | `page`, `pageSize`, `sort`; `community-app` also sends `noGrouping=true` | none | Opportunity list derived from request `data`; public endpoint |
-| GET | `/v5/projects/copilot/opportunity/:id` | `platform-ui` | none | none | Single opportunity details; includes flattened request fields, plus `members` and `canApplyAsCopilot` |
+| GET | `/v5/projects/copilot/opportunity/:id` | `platform-ui` | none | none | Single opportunity details; includes flattened request fields, plus `members`, `canApplyAsCopilot`, and admin/manager-only `project` metadata |
 | POST | `/v5/projects/copilots/opportunity/:id/apply` | `platform-ui` | none | `{notes}` | Created (or existing) copilot application object |
 | GET | `/v5/projects/copilots/opportunity/:id/applications` | `platform-ui` | Optional `sort` | none | For admin/PM: full applications (`id,userId,status,notes,existingMembership,...`); for non-admin: reduced fields (`userId,status,createdAt`) |
 | POST | `/v5/projects/copilots/opportunity/:id/assign` | `platform-ui` | none | `{applicationId: string}` | `{id: applicationId}` and side effects (member/requests/opportunity state transitions) |

src/api/copilot/copilot-opportunity.controller.ts

@@ -69,7 +69,7 @@ export class CopilotOpportunityController {
   @ApiOperation({
     summary: 'List copilot opportunities',
     description:
-      'Lists available copilot opportunities. This endpoint is accessible to authenticated users, including copilots.',
+      'Lists available copilot opportunities. This endpoint is accessible to authenticated users, including copilots. Admin and manager callers also receive minimal nested project metadata for v5 compatibility.',
   })
   @ApiQuery({ name: 'page', required: false, type: Number })
   @ApiQuery({ name: 'pageSize', required: false, type: Number })
@@ -119,7 +119,7 @@ export class CopilotOpportunityController {
   @ApiOperation({
     summary: 'Get copilot opportunity',
     description:
-      'Returns one copilot opportunity with flattened request data and apply eligibility context for /projects/copilots/opportunity/:id.',
+      'Returns one copilot opportunity with flattened request data and apply eligibility context for /projects/copilots/opportunity/:id. Admin and manager callers also receive minimal nested project metadata for v5 compatibility.',
   })
   @ApiParam({ name: 'id', required: true, type: String })
   @ApiResponse({ status: 200, type: CopilotOpportunityResponseDto })

src/api/copilot/copilot-opportunity.service.spec.ts

@@ -0,0 +1,107 @@
+import {
+  CopilotOpportunityStatus,
+  CopilotOpportunityType,
+} from '@prisma/client';
+import { UserRole } from 'src/shared/enums/userRole.enum';
+import { JwtUser } from 'src/shared/modules/global/jwt.service';
+import { CopilotOpportunityService } from './copilot-opportunity.service';
+
+describe('CopilotOpportunityService', () => {
+  const prismaMock = {
+    copilotOpportunity: {
+      findFirst: jest.fn(),
+      findMany: jest.fn(),
+    },
+    projectMember: {
+      findMany: jest.fn(),
+    },
+  };
+
+  const permissionServiceMock = {};
+  const notificationServiceMock = {};
+
+  const pmUser: JwtUser = {
+    userId: '1001',
+    roles: [UserRole.PROJECT_MANAGER],
+    isMachine: false,
+  };
+
+  const regularUser: JwtUser = {
+    userId: '3001',
+    roles: [UserRole.TOPCODER_USER],
+    isMachine: false,
+  };
+
+  const baseOpportunity = {
+    id: BigInt(21),
+    projectId: BigInt(100),
+    copilotRequestId: BigInt(11),
+    status: CopilotOpportunityStatus.active,
+    type: CopilotOpportunityType.dev,
+    createdAt: new Date('2026-03-01T00:00:00.000Z'),
+    updatedAt: new Date('2026-03-02T00:00:00.000Z'),
+    copilotRequest: {
+      data: {
+        opportunityTitle: 'Need a dev copilot',
+        projectType: 'dev',
+      },
+    },
+    project: {
+      id: BigInt(100),
+      name: 'Demo Project',
+      members: [
+        {
+          userId: BigInt(3001),
+        },
+      ],
+    },
+  };
+
+  let service: CopilotOpportunityService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    prismaMock.projectMember.findMany.mockResolvedValue([]);
+    service = new CopilotOpportunityService(
+      prismaMock as any,
+      permissionServiceMock as any,
+      notificationServiceMock as any,
+    );
+  });
+
+  it('includes nested project metadata for project managers when fetching one opportunity', async () => {
+    prismaMock.copilotOpportunity.findFirst.mockResolvedValue(baseOpportunity);
+
+    const response = await service.getOpportunity('21', pmUser);
+
+    expect(response.projectId).toBe('100');
+    expect(response.project).toEqual({
+      name: 'Demo Project',
+    });
+    expect(response.members).toEqual(['3001']);
+    expect(response.canApplyAsCopilot).toBe(true);
+  });
+
+  it('omits nested project metadata for regular users while preserving membership eligibility checks', async () => {
+    prismaMock.copilotOpportunity.findFirst.mockResolvedValue(baseOpportunity);
+
+    const response = await service.getOpportunity('21', regularUser);
+
+    expect(response.projectId).toBeUndefined();
+    expect(response.project).toBeUndefined();
+    expect(response.members).toEqual(['3001']);
+    expect(response.canApplyAsCopilot).toBe(false);
+  });
+
+  it('includes nested project metadata in list results for project managers', async () => {
+    prismaMock.copilotOpportunity.findMany.mockResolvedValue([baseOpportunity]);
+
+    const response = await service.listOpportunities({}, pmUser);
+
+    expect(response.data).toHaveLength(1);
+    expect(response.data[0].projectId).toBe('100');
+    expect(response.data[0].project).toEqual({
+      name: 'Demo Project',
+    });
+  });
+});

src/api/copilot/copilot-opportunity.service.ts

@@ -82,6 +82,7 @@ export class CopilotOpportunityService {
    * Lists opportunities with pagination and status-priority grouping.
    * Uses a two-phase fetch: opportunities first, then membership lookup to compute canApplyAsCopilot.
    * Default ordering groups by status priority active -> canceled -> completed unless noGrouping is true.
+   * Admin/manager responses also include minimal project metadata for v5 compatibility.
    *
    * @param query Pagination, sort, and noGrouping parameters.
    * @param user Authenticated JWT user.
@@ -156,6 +157,7 @@ export class CopilotOpportunityService {
   /**
    * Returns a single opportunity with eligibility context.
    * canApplyAsCopilot is true when the user is not already a member of the project.
+   * Admin/manager responses also include minimal project metadata for v5 compatibility.
    *
    * @param opportunityId Opportunity id path value.
    * @param user Authenticated JWT user.
@@ -169,6 +171,7 @@ export class CopilotOpportunityService {
   ): Promise<CopilotOpportunityResponseDto> {
     // TODO [SECURITY]: No permission check is applied; any authenticated user can access any opportunity by id.
     const parsedOpportunityId = parseNumericId(opportunityId, 'Opportunity');
+    const includeProject = isAdminOrManager(user);
 
     const opportunity = await this.prisma.copilotOpportunity.findFirst({
       where: {
@@ -213,7 +216,7 @@ export class CopilotOpportunityService {
       opportunity,
       canApplyAsCopilot,
       members,
-      isAdminOrManager(user),
+      includeProject,
     );
   }
 
@@ -521,14 +524,14 @@ export class CopilotOpportunityService {
    * @param input Opportunity row with relations.
    * @param canApplyAsCopilot Whether caller can apply.
    * @param members Optional member userId list.
-   * @param includeProjectId Whether to include projectId in response.
+   * @param includeProjectDetails Whether to include admin/manager project metadata.
    * @returns Formatted opportunity response.
    */
   private formatOpportunity(
     input: OpportunityWithRelations,
     canApplyAsCopilot: boolean,
     members: string[] | undefined,
-    includeProjectId: boolean,
+    includeProjectDetails: boolean,
   ): CopilotOpportunityResponseDto {
     const normalized = normalizeEntity(input) as Record<string, any>;
     const requestData = getCopilotRequestData(
@@ -549,8 +552,26 @@ export class CopilotOpportunityService {
       ...requestData,
     };
 
-    if (includeProjectId && normalized.projectId) {
-      response.projectId = String(normalized.projectId);
+    const projectId =
+      normalized.projectId !== undefined && normalized.projectId !== null
+        ? String(normalized.projectId)
+        : normalized.project?.id !== undefined &&
+            normalized.project?.id !== null
+          ? String(normalized.project.id)
+          : undefined;
+
+    if (includeProjectDetails && projectId) {
+      response.projectId = projectId;
+    }
+
+    if (
+      includeProjectDetails &&
+      projectId &&
+      typeof normalized.project?.name === 'string'
+    ) {
+      response.project = {
+        name: normalized.project.name,
+      };
     }
 
     return response;

src/api/copilot/dto/copilot-opportunity.dto.ts

@@ -15,9 +15,18 @@ import { CopilotSkillDto } from './copilot-request.dto';
  * DTOs for listing and responding with copilot opportunities.
  */
 
+/**
+ * Minimal project metadata included in admin/manager opportunity responses.
+ */
+export class CopilotOpportunityProjectDto {
+  @ApiProperty()
+  name: string;
+}
+
 /**
  * Flattened response merging opportunity fields with request data.
  * canApplyAsCopilot indicates whether the current user is eligible to apply.
+ * Admin/manager callers also receive minimal nested project metadata.
  */
 export class CopilotOpportunityResponseDto {
   @ApiProperty()
@@ -94,6 +103,9 @@ export class CopilotOpportunityResponseDto {
 
   @ApiPropertyOptional({ type: [String] })
   members?: string[];
+
+  @ApiPropertyOptional({ type: () => CopilotOpportunityProjectDto })
+  project?: CopilotOpportunityProjectDto;
 }
 
 /**

src/api/project/dto/project-list-query.dto.ts

@@ -119,7 +119,8 @@ export class ProjectListQueryDto extends PaginationDto {
   memberOnly?: boolean;
 
   @ApiPropertyOptional({
-    description: 'Keyword for text search over name/description',
+    description:
+      'Keyword for text search over name/description; accepts plain text and quoted phrases.',
   })
   @IsOptional()
   @IsString()

src/shared/utils/project.utils.spec.ts

@@ -0,0 +1,67 @@
+import { buildProjectWhereClause } from './project.utils';
+
+describe('buildProjectWhereClause', () => {
+  it('normalizes quoted keyword phrases into safe search filters', () => {
+    const where = buildProjectWhereClause(
+      {
+        keyword: '"my ba"',
+      } as any,
+      {
+        userId: '123',
+        isMachine: false,
+      } as any,
+      true,
+    );
+
+    expect(where).toEqual(
+      expect.objectContaining({
+        deletedAt: null,
+        AND: [
+          {
+            OR: [
+              {
+                name: {
+                  search: 'my & ba',
+                },
+              },
+              {
+                description: {
+                  search: 'my & ba',
+                },
+              },
+              {
+                name: {
+                  contains: 'my ba',
+                  mode: 'insensitive',
+                },
+              },
+              {
+                description: {
+                  contains: 'my ba',
+                  mode: 'insensitive',
+                },
+              },
+            ],
+          },
+        ],
+      }),
+    );
+  });
+
+  it('does not append invalid full-text filters for empty quoted keywords', () => {
+    const where = buildProjectWhereClause(
+      {
+        keyword: '""',
+      } as any,
+      {
+        userId: '123',
+        isMachine: false,
+      } as any,
+      true,
+    );
+
+    expect(where).toEqual({
+      deletedAt: null,
+    });
+  });
+});