From dacc1a5265b76bef2be55aaa8599e6312ae81831 Mon Sep 17 00:00:00 2001
From: weeihan <whyap79@gmail.com>
Date: Thu, 23 Jul 2026 17:33:48 +0800
Subject: [PATCH] =?UTF-8?q?fix(db):=20phase=204=20group=206=20=E2=80=94=20?=
 =?UTF-8?q?session=20guard,=20type=20safety,=20SQL=20filter=20fixes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/(protected)/hse/capa/page.tsx                  | 2 +-
 app/(protected)/hse/dashboard/page.tsx             | 7 ++++---
 app/(protected)/supervisor/incidents/[id]/page.tsx | 6 +++++-
 app/(protected)/supervisor/page.tsx                | 4 ++--
 4 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/app/(protected)/hse/capa/page.tsx b/app/(protected)/hse/capa/page.tsx
index 6a89495..29686ce 100644
--- a/app/(protected)/hse/capa/page.tsx
+++ b/app/(protected)/hse/capa/page.tsx
@@ -53,7 +53,7 @@ export default async function CapaListPage() {
           ← Incidents
         </Link>
       </div>
-      <CapaBoard capas={capas as Parameters<typeof CapaBoard>[0]['capas']} />
+      <CapaBoard capas={capas} />
     </main>
   )
 }
diff --git a/app/(protected)/hse/dashboard/page.tsx b/app/(protected)/hse/dashboard/page.tsx
index 0e4d232..5615ea2 100644
--- a/app/(protected)/hse/dashboard/page.tsx
+++ b/app/(protected)/hse/dashboard/page.tsx
@@ -5,7 +5,7 @@ import { asAdmin } from '@/lib/db/with-user'
 import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth/get-session'
 import { incidents, sites, zones, capaActions, doshReports, investigations } from '@/lib/db/schema'
-import { eq, gte, isNotNull } from 'drizzle-orm'
+import { eq, gte, isNotNull, and } from 'drizzle-orm'
 import { StatCard } from '@/components/dashboard/stat-card'
 import { bucketIncidentsByMonth, topRootCauses } from '@/lib/dashboard/trends'
 import { RiskFlagsPanel } from '@/components/dashboard/risk-flags-panel'
@@ -67,8 +67,8 @@ export default async function HseDashboardPage({
       db.select({ zoneName: zones.name })
       .from(incidents)
       .leftJoin(zones, eq(incidents.zoneId, zones.id))
-      .where(gte(incidents.reportedAt, ninetyDaysAgo))
-    ).then(rows => rows.filter(r => r.zoneName !== null)),
+      .where(and(gte(incidents.reportedAt, ninetyDaysAgo), isNotNull(incidents.zoneId)))
+    ),
     asAdmin(db =>
       db.select({
         dueDate: capaActions.dueDate,
@@ -133,6 +133,7 @@ export default async function HseDashboardPage({
 
   const capas = completedCapas
   const onTime = capas.filter(c => {
+    if (!c.dueDate) return false
     const due = new Date(c.dueDate)
     const done = c.verifiedAt
       ? new Date(c.verifiedAt)
diff --git a/app/(protected)/supervisor/incidents/[id]/page.tsx b/app/(protected)/supervisor/incidents/[id]/page.tsx
index cc44806..f76c5a2 100644
--- a/app/(protected)/supervisor/incidents/[id]/page.tsx
+++ b/app/(protected)/supervisor/incidents/[id]/page.tsx
@@ -1,7 +1,8 @@
 export const dynamic = 'force-dynamic'
 
-import { notFound } from 'next/navigation'
+import { notFound, redirect } from 'next/navigation'
 import Link from 'next/link'
+import { getSession } from '@/lib/auth/get-session'
 import { asAdmin } from '@/lib/db/with-user'
 import { incidents, sites, zones, trucks, users, evidenceFiles, investigations } from '@/lib/db/schema'
 import { eq, and } from 'drizzle-orm'
@@ -16,6 +17,9 @@ interface Props {
 export default async function SupervisorIncidentDetailPage({ params }: Props) {
   const { id } = await params
 
+  const session = await getSession()
+  if (!session) redirect('/login')
+
   const reporterAlias = aliasedTable(users, 'reporter')
   const investigatorAlias = aliasedTable(users, 'investigator')
 
diff --git a/app/(protected)/supervisor/page.tsx b/app/(protected)/supervisor/page.tsx
index afaf1ee..7a8e812 100644
--- a/app/(protected)/supervisor/page.tsx
+++ b/app/(protected)/supervisor/page.tsx
@@ -5,7 +5,7 @@ import { asAdmin } from '@/lib/db/with-user'
 import { redirect } from 'next/navigation'
 import { getSession } from '@/lib/auth/get-session'
 import { incidents, sites, capaActions, users } from '@/lib/db/schema'
-import { eq, not, and, inArray, sql } from 'drizzle-orm'
+import { eq, not, and, inArray, sql, desc } from 'drizzle-orm'
 import { aliasedTable } from 'drizzle-orm'
 import { StatCard } from '@/components/dashboard/stat-card'
 
@@ -65,7 +65,7 @@ export default async function SupervisorPage() {
       })
       .from(incidents)
       .where(and(eq(incidents.siteId, session.siteId!), not(eq(incidents.status, 'closed'))))
-      .orderBy(sql`${incidents.reportedAt} desc`)
+      .orderBy(desc(incidents.reportedAt))
       .limit(10)
     ),
     asAdmin(db =>