setia/ims
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
46d82df377b53eb1b2f7fbd7474f7accd4f7a1d2
ims/.superpowers/sdd/progress.md
T
adminandClaude Sonnet 4.6 d18d29168a feat(auth): phase 3 — replace Supabase GoTrue with bcryptjs+jose 
Custom auth stack: bcryptjs password hashing (cost 10, GoTrue-compatible),
jose JWT session cookies (edge-safe, 8hr TTL), new API routes for
login/logout/reset/change-password, middleware rewritten to JWT-only
verification with no DB access. All 38 protected pages and API routes
migrated from supabase.auth.getUser() to getSession(). Supabase .from()
queries retained for Phase 4. lib/db/index.ts refactored to lazy Proxy
singleton to avoid module-level throw during Next.js build.

tsc: clean, build: clean, tests: 4/4 passed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-23 16:20:04 +08:00

11 KiB
Raw Blame History

Phase 0 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-09-phase-0-foundation.md Started: 2026-07-09

Tasks

  • Task 1: Scaffold Next.js + Supabase clients (commit f83686f, review clean)
  • Task 2: Role types + middleware (commit 6939a21, review clean)
  • Task 3: Database migrations (commit 05daf70, review clean — 2 advisories: concurrent ref_no race, evidence soft-delete needs SECURITY DEFINER fn)
  • Task 4: Apply migrations to Supabase cloud (user ran supabase login + link + db push)
  • Task 5: Auth flow (commit 5598594, review clean — LOW: open redirect in callback/route.ts:8 fix before prod)
  • Task 6: Protected dashboard pages (commit c3ba543, review clean)
  • Task 7: QR code generation (commit 152a660, review clean)

Phase 2 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-2-investigation-capa.md Started: 2026-07-11 Base commit (Phase 2 start): 1fe646d82d

Tasks

  • Task 1: DB Migration — triage fields, RCA structured data, write_audit_log RPC (commits dbbb663..a718a2d, review clean — MINOR: DROP CASCADE without explicit signature, no ON DELETE on triaged_by FK)
  • Task 2: DOSH obligation pure function + tests (commit 8b00c72, review clean)
  • Task 3: Triage panel — component, API route, page (commit e55c528, review pending)
  • Task 4: Investigation workspace — component, API route, page (commit 63cb28f, review pending)
  • Task 5: CAPA board + form + detail (commit 1780586, review pending)
  • Task 6: Verification flow (commit 804b1fb, review pending)
  • Task 7: CAPA overdue escalation cron (commit 75fa260, review pending)
  • Task 8: JKKP 6/7 PDF generation (commit 54332d0, review pending)

Phase 3 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md Started: 2026-07-11 Base commit: 0e53d5c

Tasks

  • Task 1: Claude client + Voyage AI embed helper (commit ebaa98d, review clean — MINOR: module cache isolation in embed test; client.ts uses ?? '' instead of throw on missing key)
  • Task 2: pgvector migration + match_incidents RPC (commit ab6299f, review clean)
  • Task 3: Report quality check (commits 3bec95a..a5933d2, review clean — MINOR: 400/500 fix branches untested; stale qualityCheck state on description edit)
  • Task 4: Triage AI suggestion (commit f10fa07, review clean — MINOR: 500 path untested; return toolBlock.input instead of narrowed input; submit not disabled during aiLoading)
  • Task 5: Similar incident retrieval (commit 547cc6e, review clean — MINOR: cast drops extra columns; error/empty indistinguishable in panel; instead of )
  • Task 6: RCA/CAPA draft assistant (commit 10e7196, review clean — MINOR: as never cast on p_new_value; implementer added runtime validation beyond spec — positive deviation)
  • Task 7: Dashboard enhancement (commit 3473cf8, review clean — MINOR: by_site sort added beyond spec; verified_at/completed_at casts match brief verbatim)
  • Task 8: Final verification (build clean, 61/61 tests pass)
  • Task 8 final fixes: RLS guard + AI try/catch (commit c07bdb7, build clean, 61/61 pass)

Phase 3 (v2) Progress Ledger — Role Dashboards + CSV Export

Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md Started: 2026-07-11 Base commit: 16e8f9d

Tasks

  • Task 1: Management dashboard (commit 3dac469, review clean — MINOR: status col selected but unused; unbounded allIncidents fetch is pre-prod perf risk)
  • Task 2: Supervisor dashboard (commits ceb5c79..69df452, review clean after fix — MINOR: serial pre-fetches before Promise.all; overdue/CAPA counts subject to 1000-row Supabase cap at volume)
  • Task 3: CAPA owner dashboard (commits a2f1be7..070e2d1, review clean after fix — MINOR: PRIORITY_COLORS defined inside render; en-MY ICU fallback risk on Vercel; incident link non-functional for capa_owner role)
  • Task 4: Reporter dashboard (commits 55b6dac..e631d04, review clean after fix — MINOR: profile/query errors silently swallowed; reviewer's second 🔴 on empty-string date is false positive — "" is falsy, existing && guard already blocks it)
  • Task 5: CSV export endpoint (commit dfca872, review clean — tests 67/67 pass)
  • Task 6: RCA draft test (commit 76d9363, review clean — 68/68 pass)
  • Final review fixes: rename on-time rate, hoist getApiKey, remove broken capa-owner link (commit 871ef7c, re-review clean — 88/88 pass)
  • Whole-branch review: clean — no critical defects; RLS on CSV export verified correct by design
  • Task 6: RCA draft test + final verification (commit 76d9363, 68/68 tests pass, build clean)

Phase 4 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-4-scale-polish.md Started: 2026-07-11 Base commit: 55b6dac

Tasks

  • Task 1: WhatsApp notification helper + migration (commit b6845f5, review clean — MINOR out-of-scope: export route allowedRoles[role] prototype-safe pattern)
  • Task 2: WhatsApp integration — incident alert + CAPA escalation (commit a47f3aa + edb0bde, review clean — MINOR: overdue_3d WhatsApp path untested; serial Meta calls in IIFE; mock call-index fragility in capa test; duplicate vi.clearAllMocks)
  • Task 3: CAPA effectiveness recheck (commit b9def9c, review clean — MINOR: getNextRecheckDate uses local setDate not UTC → fix setDate→setUTCDate before prod; CRON_SECRET undefined demotes to "Bearer undefined"; DB update after send has no error check; nextDate??null no-op)
  • Task 4: i18n infrastructure + EN/MS/ZH translations (commit 87264a5, review clean — MINOR: report page h1 still hardcoded English (plan gap); offline db stub throws at runtime (temporary, Task 5 replaces); language-switcher cookie value not URL-decoded; SW path /ims hardcoded in layout)
  • Task 5: PWA offline capture (commits c048878..448ea48, review clean after fix — MINOR: SW clients.claim() outside waitUntil; fixed basePath in fetch URL; fixed syncNow stable callback with useRef)

Phase 5 & 6 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-5-6-usability-compliance-analytics.md Started: 2026-07-11 · Completed: 2026-07-12 Branch: phase-5-6

Tasks

  • Housekeeping: removed stray "whatsapp 2" duplicates (identical to canonical)
  • In-app notification bell + badge (migration 016, SECURITY DEFINER RPC, /api/notifications, bell in protected layout, wired into incident/CAPA/escalation flows)
  • Incident closure lock + addenda (migration 017: incident_addenda + DB triggers; POST /close endpoint added — did not exist; addenda UI)
  • Incident list pagination (server-side .range(), shared Pagination component, HSE + supervisor inboxes)
  • Witness statement + alcohol test UI (investigation form + route, existing schema columns)
  • Type-specific intake forms (migration 018: type_details JSONB; validateTypeDetails whitelist; env/asset/security/fire field groups; EN/MS/ZH; offline queue support)
  • JKKP 8 annual register export (lib/reports/jkkp8.ts + /api/reports/jkkp8 CSV; dashboard button + January deadline banner)
  • Admin user + site/zone management (invite via service-role client, role/site/active management, site+zone CRUD with QR link)
  • Evidence thumbnails (Supabase render transform + onError fallback, lazy loading)
  • Phase 6: 12-month trend chart + top root causes (lib/dashboard/trends.ts pure helpers + tests)
  • Phase 6: AI rising-risk zones (/api/dashboard/ai/risk-flags, claude-opus-4-8 forced tool_use, panel on HSE + management dashboards)
  • Drive-by: fixed 9 pre-existing missing /ims basePath prefixes

Verification: 112 tests passing (23 files), tsc clean, next build clean.

Bugfix SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-17-bugfixes-invite-capa-drugtest.md Started: 2026-07-17 Base commit: e682162

Tasks

  • Task 1: Fix invite redirect URL — commit a3ce59f, review clean
  • Task 2: CAPA Assigned To — commit e687510, review clean
  • Task 3: Split alcohol/urine test — commits e30d583..ac2f072, review clean (2 minor: as never cast in supervisor page; cosmetic single-test grid)

Final Review (2026-07-17)

Verdict: Approved — ready to merge Minor findings (non-blocking):

  • alcohol_test_result missing CHECK constraint (urine_test_result has it) — asymmetric, follow-up migration
  • PATCH audit_log only on complete=true, not on every field save — pre-existing gap
  • supervisor page as never cast — already logged
  • cosmetic single-test grid — already logged

Remove Invite-by-Email SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-18-remove-invite-by-email.md Started: 2026-07-18 Base commit: ac2f072

Tasks

  • Task 1: Strip invite mode from UI + API — commit 33d4dd4, review clean (minor: audit log skipped on DELETE when target row null; unreachable ?? fallback in DELETE)
  • Task 2: Delete invite-callback page — no commit needed (files were untracked), review clean

Final Review (2026-07-18)

Verdict: Approved after fix

  • Important fixed: orphaned auth user on profile update failure — commit d5803da
  • Minor (non-blocking): confirmDeleteId cleared before error check in deleteUser; no client-side guard disabling Delete for own account row

Forgot Password SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-21-forgot-password.md Started: 2026-07-21 Base commit: 3a5daaa

Tasks

  • Task 1: Add "Forgot password?" link to login form (commit 4d7ab5d, review clean)
  • Task 2: Create forgot-password page (commit 211117e, review clean — reviewer finding 1 false positive: /reset-password page created by Task 3; finding 3 false positive: disabled={loading} already on button; finding 2 minor: appUrl fallback non-blocking, NEXT_PUBLIC_APP_URL set in .env.production)
  • Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
  • Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
  • Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)

CAPA Owner Notes SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-23-capa-owner-notes.md Started: 2026-07-23 Base commit: 71cf90e

Tasks

  • Task 1: DB migration — owner_notes column (commit 52171ac, review clean — Critical finding resolved: column confirmed live via admin client SELECT)
  • Task 2: API expose owner_notes (commit 96eaeb7, review clean)
  • Task 3: CapaOwnerNotesForm component (commit 5f34dbb, review clean)
  • Task 4: Wire pages + deploy (commit 938eb7e, review clean)
  • Task 4: Wire pages + deploy (commit 938eb7e, review clean)
  • Final review fixes: field-level auth split, status gate, RLS migration, audit old_value, pending_verification form guard (commit 509ed90, re-review approved)

Status: COMPLETE (deployed)

One manual step outstanding: apply supabase/migrations/20260723000002_tighten_capa_update_rls.sql via Supabase dashboard SQL editor.

Reference in New Issue View Git Blame Copy Permalink