fix(capa): field-level auth split, status gate, RLS tightening, audit old_value, hide form on pending_verification

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/(protected)/capa-owner/page.tsx

@@ -100,7 +100,9 @@ export default async function CapaOwnerPage() {
                     <CapaOwnerActions capaId={capa.id} currentStatus={capa.status} />
                   </div>
                 </div>
-                <CapaOwnerNotesForm capaId={capa.id} initialNotes={(capa as { owner_notes: string | null }).owner_notes} />
+                {capa.status !== 'pending_verification' && (
+                  <CapaOwnerNotesForm capaId={capa.id} initialNotes={(capa as { owner_notes: string | null }).owner_notes} />
+                )}
               </div>
             )
           })}

app/api/capa/[id]/route.ts

@@ -53,11 +53,16 @@ export async function PATCH(
   const { data: profile } = await supabase.from('users').select('role').eq('id', user.id).single()
   const role = profile?.role ?? ''
 
-  const { data: capa } = await supabase.from('capa_actions').select('owner_user_id').eq('id', id).single()
+  const { data: capa } = await supabase.from('capa_actions').select('owner_user_id, status').eq('id', id).single()
   const isOwner = capa?.owner_user_id === user.id
   const canEdit = ['hse', 'admin'].includes(role) || isOwner
   if (!canEdit) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const terminalStatuses = ['verified', 'closed']
+  if (terminalStatuses.includes(capa?.status ?? '') && !['hse', 'admin'].includes(role)) {
+    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+  }
+
   const body = await request.json()
 
   // Only hse/admin can set privileged statuses
@@ -66,7 +71,9 @@ export async function PATCH(
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
-  const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref', 'owner_notes']
+  const allowed = ['hse', 'admin'].includes(role)
+    ? ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref', 'owner_notes']
+    : ['status', 'owner_notes']
   const update: Record<string, unknown> = {}
   for (const key of allowed) {
     if (key in body) update[key] = body[key]
@@ -76,6 +83,12 @@ export async function PATCH(
     update.completed_at = new Date().toISOString()
   }
 
+  let oldNotes: string | null = null
+  if ('owner_notes' in update) {
+    const { data: current } = await supabase.from('capa_actions').select('owner_notes').eq('id', id).single()
+    oldNotes = (current as { owner_notes: string | null } | null)?.owner_notes ?? null
+  }
+
   const admin = createAdminClient()
   const { error } = await admin
     .from('capa_actions')
@@ -88,6 +101,7 @@ export async function PATCH(
     p_table_name: 'capa_actions',
     p_record_id: id,
     p_action: 'updated',
+    p_old_value: oldNotes !== null ? { owner_notes: oldNotes } : undefined,
     p_new_value: update as Record<string, unknown>,
   })
 

supabase/migrations/20260723000002_tighten_capa_update_rls.sql

@@ -0,0 +1,6 @@
+-- Tighten capa_update_owner RLS policy: remove department clause so only the
+-- assigned owner can UPDATE their own CAPA row directly. Route-level auth
+-- enforces field-level restrictions; this ensures DB-level enforcement matches.
+DROP POLICY IF EXISTS "capa_update_owner" ON capa_actions;
+CREATE POLICY "capa_update_owner" ON capa_actions FOR UPDATE
+  USING (owner_user_id = auth.uid());