From 9d047e168f4ea2fc6cc2e90608cb442560209ef4 Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Thu, 23 Jul 2026 22:27:46 +0800
Subject: [PATCH] =?UTF-8?q?feat(config):=20phase=207=20=E2=80=94=20drop=20?=
 =?UTF-8?q?/ims=20basePath,=20update=20all=20hardcoded=20paths,=20refresh?=
 =?UTF-8?q?=20env=20spec?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .env.local.example                            | 25 +++++++++++++------
 app/(protected)/hse/dashboard/page.tsx        |  6 ++---
 app/(protected)/hse/incidents/[id]/page.tsx   |  4 +--
 app/(protected)/management/page.tsx           |  2 +-
 app/layout.tsx                                |  4 +--
 components/admin/site-zone-manager.tsx        |  2 +-
 components/admin/truck-manager.tsx            |  2 +-
 components/admin/user-manager.tsx             |  2 +-
 components/capa/capa-owner-actions.tsx        |  2 +-
 components/capa/capa-owner-notes-form.tsx     |  2 +-
 components/capa/close-capa-button.tsx         |  2 +-
 components/capa/verify-form.tsx               |  2 +-
 components/incidents/closure-panel.tsx        |  8 +++---
 components/incidents/investigation-form.tsx   |  6 ++---
 .../incidents/similar-incidents-panel.tsx     |  2 +-
 components/incidents/triage-form.tsx          |  4 +--
 next.config.js                                |  1 -
 public/manifest.json                          |  6 ++---
 18 files changed, 45 insertions(+), 37 deletions(-)

diff --git a/.env.local.example b/.env.local.example
index 30c43bb..cb7f7c8 100644
--- a/.env.local.example
+++ b/.env.local.example
@@ -1,14 +1,23 @@
-# .env.local.example
-NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
-NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here
-NEXT_PUBLIC_APP_URL=http://localhost:3000
+# Database (plain PostgreSQL — no Supabase)
+DATABASE_URL=postgres://app_user:<password>@127.0.0.1:5432/ims
+DATABASE_URL_ADMIN=postgres://app_admin:<password>@127.0.0.1:5432/ims
+
+# Auth (custom JWT)
+JWT_SECRET=<generate with: openssl rand -hex 32>
+
+# App
+APP_URL=http://localhost:3000
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 CRON_SECRET=<generate with: openssl rand -hex 32>
 
-# Server-side only — never expose to the client
-SUPABASE_SERVICE_ROLE_KEY=<required for admin user invites (/admin)>
-RESEND_API_KEY=re_...
-RESEND_FROM_EMAIL=alerts@yourdomain.com
+# Evidence storage (local filesystem)
+EVIDENCE_DIR=/tmp/ims-evidence
+EVIDENCE_URL_SECRET=<generate with: openssl rand -hex 32>
+
+# Email (Brevo)
+BREVO_API_KEY=<your-brevo-api-key>
+BREVO_FROM_EMAIL=noreply@setia.com.my
+BREVO_FROM_NAME=Setia IMS
 
 # AI keys — optional here; preferred location is the app_settings table (/hse/settings)
 ANTHROPIC_API_KEY=sk-ant-...
diff --git a/app/(protected)/hse/dashboard/page.tsx b/app/(protected)/hse/dashboard/page.tsx
index 5615ea2..ebfa4cb 100644
--- a/app/(protected)/hse/dashboard/page.tsx
+++ b/app/(protected)/hse/dashboard/page.tsx
@@ -164,13 +164,13 @@ export default async function HseDashboardPage({
         <h1 className="text-2xl font-bold text-gray-900">Dashboard</h1>
         <div className="flex gap-3">
           <a
-            href="/ims/api/dashboard/export?role=hse"
+            href="/api/dashboard/export?role=hse"
             className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
           >
             Export CSV
           </a>
           <a
-            href={`/ims/api/reports/jkkp8?year=${now.getFullYear()}`}
+            href={`/api/reports/jkkp8?year=${now.getFullYear()}`}
             className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
           >
             JKKP 8
@@ -191,7 +191,7 @@ export default async function HseDashboardPage({
               <p className="text-sm text-amber-800">
                 <strong>JKKP 8 annual register due:</strong> the {now.getFullYear() - 1} register must be
                 submitted to DOSH before 31 January {now.getFullYear()}.{' '}
-                <a href={`/ims/api/reports/jkkp8?year=${now.getFullYear() - 1}`} className="underline font-medium">
+                <a href={`/api/reports/jkkp8?year=${now.getFullYear() - 1}`} className="underline font-medium">
                   Download {now.getFullYear() - 1} register
                 </a>
               </p>
diff --git a/app/(protected)/hse/incidents/[id]/page.tsx b/app/(protected)/hse/incidents/[id]/page.tsx
index a12502f..0e89e84 100644
--- a/app/(protected)/hse/incidents/[id]/page.tsx
+++ b/app/(protected)/hse/incidents/[id]/page.tsx
@@ -173,14 +173,14 @@ export default async function HseIncidentDetailPage({ params }: Props) {
         {needsJkkp && (
           <div className="mt-4 flex gap-3 flex-wrap">
             <a
-              href={`/ims/api/incidents/${id}/jkkp-pdf?form=jkkp6`}
+              href={`/api/incidents/${id}/jkkp-pdf?form=jkkp6`}
               target="_blank"
               className="inline-block bg-gray-800 text-white rounded-lg px-4 py-2 text-sm font-semibold hover:bg-gray-900"
             >
               Download JKKP 6 (PDF)
             </a>
             <a
-              href={`/ims/api/incidents/${id}/jkkp-pdf?form=jkkp7`}
+              href={`/api/incidents/${id}/jkkp-pdf?form=jkkp7`}
               target="_blank"
               className="inline-block bg-gray-600 text-white rounded-lg px-4 py-2 text-sm font-semibold hover:bg-gray-700"
             >
diff --git a/app/(protected)/management/page.tsx b/app/(protected)/management/page.tsx
index 2ca7303..e47015a 100644
--- a/app/(protected)/management/page.tsx
+++ b/app/(protected)/management/page.tsx
@@ -92,7 +92,7 @@ export default async function ManagementPage() {
       <div className="flex items-center justify-between mb-6">
         <h1 className="text-2xl font-bold text-gray-900">Management Dashboard</h1>
         <a
-          href="/ims/api/dashboard/export?role=management"
+          href="/api/dashboard/export?role=management"
           className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
         >
           Export CSV
diff --git a/app/layout.tsx b/app/layout.tsx
index d347dfb..a70b5f9 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -33,7 +33,7 @@ export default async function RootLayout({
       className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
     >
       <head>
-        <link rel="manifest" href="/ims/manifest.json" />
+        <link rel="manifest" href="/manifest.json" />
       </head>
       <body className="min-h-full flex flex-col">
         <I18nProvider messages={messages}>
@@ -41,7 +41,7 @@ export default async function RootLayout({
         </I18nProvider>
         <script
           dangerouslySetInnerHTML={{
-            __html: `if('serviceWorker'in navigator){navigator.serviceWorker.register('/ims/sw.js',{scope:'/ims/'}).catch(console.error)}`,
+            __html: `if('serviceWorker'in navigator){navigator.serviceWorker.register('/sw.js',{scope:'/'}).catch(console.error)}`,
           }}
         />
       </body>
diff --git a/components/admin/site-zone-manager.tsx b/components/admin/site-zone-manager.tsx
index 35aaffb..06e9101 100644
--- a/components/admin/site-zone-manager.tsx
+++ b/components/admin/site-zone-manager.tsx
@@ -153,7 +153,7 @@ export function SiteZoneManager({ sites }: Props) {
                     <span>{z.name}</span>
                     <div className="flex items-center gap-3">
                       <a
-                        href={`/ims/report?zone=${z.qr_code_token}`}
+                        href={`/report?zone=${z.qr_code_token}`}
                         target="_blank"
                         className="text-xs text-blue-600 hover:underline"
                       >
diff --git a/components/admin/truck-manager.tsx b/components/admin/truck-manager.tsx
index 900f86b..c821ea2 100644
--- a/components/admin/truck-manager.tsx
+++ b/components/admin/truck-manager.tsx
@@ -127,7 +127,7 @@ export function TruckManager({ trucks }: Props) {
                 </div>
                 <div className="flex items-center gap-3">
                   <a
-                    href={`/ims/report?truck_id=${tk.id}`}
+                    href={`/report?truck_id=${tk.id}`}
                     target="_blank"
                     className="text-xs text-blue-600 hover:underline"
                   >
diff --git a/components/admin/user-manager.tsx b/components/admin/user-manager.tsx
index b881e1a..d5242ce 100644
--- a/components/admin/user-manager.tsx
+++ b/components/admin/user-manager.tsx
@@ -51,7 +51,7 @@ export function UserManager({ users, sites }: Props) {
   const deleteUser = async (id: string) => {
     setBusyId(id)
     setError(null)
-    const res = await fetch(`/ims/api/admin/users?id=${encodeURIComponent(id)}`, { method: 'DELETE' })
+    const res = await fetch(`/api/admin/users?id=${encodeURIComponent(id)}`, { method: 'DELETE' })
     setBusyId(null)
     setConfirmDeleteId(null)
     if (!res.ok) {
diff --git a/components/capa/capa-owner-actions.tsx b/components/capa/capa-owner-actions.tsx
index a36bfb2..d63eb05 100644
--- a/components/capa/capa-owner-actions.tsx
+++ b/components/capa/capa-owner-actions.tsx
@@ -15,7 +15,7 @@ export function CapaOwnerActions({ capaId, currentStatus }: Props) {
   async function updateStatus(status: string) {
     setLoading(true)
     try {
-      const res = await fetch(`/ims/api/capa/${capaId}`, {
+      const res = await fetch(`/api/capa/${capaId}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ status }),
diff --git a/components/capa/capa-owner-notes-form.tsx b/components/capa/capa-owner-notes-form.tsx
index b9e3cf1..92102aa 100644
--- a/components/capa/capa-owner-notes-form.tsx
+++ b/components/capa/capa-owner-notes-form.tsx
@@ -17,7 +17,7 @@ export function CapaOwnerNotesForm({ capaId, initialNotes }: Props) {
     setSaving(true)
     setSaved(false)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}`, {
+    const res = await fetch(`/api/capa/${capaId}`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ owner_notes: notes }),
diff --git a/components/capa/close-capa-button.tsx b/components/capa/close-capa-button.tsx
index 4763657..b22879b 100644
--- a/components/capa/close-capa-button.tsx
+++ b/components/capa/close-capa-button.tsx
@@ -16,7 +16,7 @@ export function CloseCapaButton({ capaId }: Props) {
     if (!confirm('Close this CAPA? This marks it as fully resolved.')) return
     setLoading(true)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}`, {
+    const res = await fetch(`/api/capa/${capaId}`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ status: 'closed' }),
diff --git a/components/capa/verify-form.tsx b/components/capa/verify-form.tsx
index 1f67cef..5e58a2d 100644
--- a/components/capa/verify-form.tsx
+++ b/components/capa/verify-form.tsx
@@ -23,7 +23,7 @@ export function VerifyForm({ capaId }: Props) {
     }
     setSaving(true)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}/verify`, {
+    const res = await fetch(`/api/capa/${capaId}/verify`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ verdict, reopen_reason: reopenReason || null }),
diff --git a/components/incidents/closure-panel.tsx b/components/incidents/closure-panel.tsx
index d47d7b7..46af564 100644
--- a/components/incidents/closure-panel.tsx
+++ b/components/incidents/closure-panel.tsx
@@ -28,7 +28,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
 
   useEffect(() => {
     if (!isClosed) return
-    fetch(`/ims/api/incidents/${incidentId}/addenda`)
+    fetch(`/api/incidents/${incidentId}/addenda`)
       .then(r => (r.ok ? r.json() : Promise.reject()))
       .then((data: Addendum[]) => setAddenda(Array.isArray(data) ? data : []))
       .catch(() => {})
@@ -38,7 +38,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
     if (!confirm('Close this incident? The record will be locked — only addenda can be added afterwards.')) return
     setBusy(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/close`, { method: 'POST' })
+    const res = await fetch(`/api/incidents/${incidentId}/close`, { method: 'POST' })
     setBusy(false)
     if (!res.ok) {
       const data = await res.json().catch(() => ({}))
@@ -53,7 +53,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
     if (!text) return
     setBusy(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/addenda`, {
+    const res = await fetch(`/api/incidents/${incidentId}/addenda`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ body: text }),
@@ -65,7 +65,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
       return
     }
     setDraft('')
-    const list = await fetch(`/ims/api/incidents/${incidentId}/addenda`).then(r => r.json()).catch(() => [])
+    const list = await fetch(`/api/incidents/${incidentId}/addenda`).then(r => r.json()).catch(() => [])
     setAddenda(Array.isArray(list) ? list : [])
   }
 
diff --git a/components/incidents/investigation-form.tsx b/components/incidents/investigation-form.tsx
index 571a6b7..b52e3b6 100644
--- a/components/incidents/investigation-form.tsx
+++ b/components/incidents/investigation-form.tsx
@@ -64,7 +64,7 @@ export function InvestigationForm({ incidentId, existingInvestigationId }: Props
   async function getAiDraft() {
     setAiDraftLoading(true)
     try {
-      const res = await fetch(`/ims/api/incidents/${incidentId}/ai/rca-draft`, { method: 'POST' })
+      const res = await fetch(`/api/incidents/${incidentId}/ai/rca-draft`, { method: 'POST' })
       if (!res.ok) return
       const draft = await res.json() as {
         five_why_steps: Array<{ why: string; answer: string }>
@@ -106,13 +106,13 @@ export function InvestigationForm({ incidentId, existingInvestigationId }: Props
 
     let res: Response
     if (existingInvestigationId) {
-      res = await fetch(`/ims/api/incidents/${incidentId}/investigation`, {
+      res = await fetch(`/api/incidents/${incidentId}/investigation`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ ...payload, investigation_id: existingInvestigationId, complete }),
       })
     } else {
-      res = await fetch(`/ims/api/incidents/${incidentId}/investigation`, {
+      res = await fetch(`/api/incidents/${incidentId}/investigation`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(payload),
diff --git a/components/incidents/similar-incidents-panel.tsx b/components/incidents/similar-incidents-panel.tsx
index 35b761e..1c58967 100644
--- a/components/incidents/similar-incidents-panel.tsx
+++ b/components/incidents/similar-incidents-panel.tsx
@@ -31,7 +31,7 @@ export function SimilarIncidentsPanel({ incidentId }: Props) {
   const [error, setError] = useState(false)
 
   useEffect(() => {
-    fetch(`/ims/api/incidents/${incidentId}/similar`)
+    fetch(`/api/incidents/${incidentId}/similar`)
       .then(r => {
         if (!r.ok) throw new Error('failed')
         return r.json()
diff --git a/components/incidents/triage-form.tsx b/components/incidents/triage-form.tsx
index 21be4ee..9567e4f 100644
--- a/components/incidents/triage-form.tsx
+++ b/components/incidents/triage-form.tsx
@@ -42,7 +42,7 @@ export function TriageForm({ incidentId, currentSeverity }: Props) {
     setAiLoading(true)
     setAiRationale(null)
     try {
-      const res = await fetch(`/ims/api/incidents/${incidentId}/ai/triage-suggest`, { method: 'POST' })
+      const res = await fetch(`/api/incidents/${incidentId}/ai/triage-suggest`, { method: 'POST' })
       if (!res.ok) return
       const data = await res.json() as {
         severity: number
@@ -69,7 +69,7 @@ export function TriageForm({ incidentId, currentSeverity }: Props) {
     e.preventDefault()
     setSaving(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/triage`, {
+    const res = await fetch(`/api/incidents/${incidentId}/triage`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({
diff --git a/next.config.js b/next.config.js
index b9097bf..5cd8cc3 100644
--- a/next.config.js
+++ b/next.config.js
@@ -1,7 +1,6 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: 'standalone',
-  basePath: '/ims',
 }
 
 module.exports = nextConfig
diff --git a/public/manifest.json b/public/manifest.json
index 433b482..46fd8d3 100644
--- a/public/manifest.json
+++ b/public/manifest.json
@@ -2,14 +2,14 @@
   "name": "IMS — Incident Management",
   "short_name": "IMS",
   "description": "HSE Incident Management System — Setia Corporation",
-  "start_url": "/ims/report",
-  "scope": "/ims/",
+  "start_url": "/report",
+  "scope": "/",
   "display": "standalone",
   "background_color": "#ffffff",
   "theme_color": "#2563eb",
   "icons": [
     {
-      "src": "/ims/icons/icon.svg",
+      "src": "/icons/icon.svg",
       "sizes": "any",
       "type": "image/svg+xml",
       "purpose": "any maskable"