adminandClaude Sonnet 4.6
0e479b648f
- auth callback: remove debug redirect, handle both code (PKCE) and token_hash+type (recovery/magic link) flows correctly - capa PATCH: use admin client to bypass RLS for status updates Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ
167 lines
9.9 KiB
Markdown
167 lines
9.9 KiB
Markdown
# Phase 0 SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-09-phase-0-foundation.md
|
|
Started: 2026-07-09
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Scaffold Next.js + Supabase clients (commit f83686f, review clean)
|
|
- [x] Task 2: Role types + middleware (commit 6939a21, review clean)
|
|
- [x] Task 3: Database migrations (commit 05daf70, review clean — 2 advisories: concurrent ref_no race, evidence soft-delete needs SECURITY DEFINER fn)
|
|
- [x] Task 4: Apply migrations to Supabase cloud (user ran supabase login + link + db push)
|
|
- [x] Task 5: Auth flow (commit 5598594, review clean — LOW: open redirect in callback/route.ts:8 fix before prod)
|
|
- [x] Task 6: Protected dashboard pages (commit c3ba543, review clean)
|
|
- [x] Task 7: QR code generation (commit 152a660, review clean)
|
|
|
|
---
|
|
|
|
# Phase 2 SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-11-phase-2-investigation-capa.md
|
|
Started: 2026-07-11
|
|
Base commit (Phase 2 start): 1fe646d82d23c3d0f493cc4ce8844f5c19c8b699
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: DB Migration — triage fields, RCA structured data, write_audit_log RPC (commits dbbb663..a718a2d, review clean — MINOR: DROP CASCADE without explicit signature, no ON DELETE on triaged_by FK)
|
|
- [x] Task 2: DOSH obligation pure function + tests (commit 8b00c72, review clean)
|
|
- [x] Task 3: Triage panel — component, API route, page (commit e55c528, review pending)
|
|
- [x] Task 4: Investigation workspace — component, API route, page (commit 63cb28f, review pending)
|
|
- [x] Task 5: CAPA board + form + detail (commit 1780586, review pending)
|
|
- [x] Task 6: Verification flow (commit 804b1fb, review pending)
|
|
- [x] Task 7: CAPA overdue escalation cron (commit 75fa260, review pending)
|
|
- [x] Task 8: JKKP 6/7 PDF generation (commit 54332d0, review pending)
|
|
|
|
---
|
|
|
|
# Phase 3 SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md
|
|
Started: 2026-07-11
|
|
Base commit: 0e53d5c
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Claude client + Voyage AI embed helper (commit ebaa98d, review clean — MINOR: module cache isolation in embed test; client.ts uses ?? '' instead of throw on missing key)
|
|
- [x] Task 2: pgvector migration + match_incidents RPC (commit ab6299f, review clean)
|
|
- [x] Task 3: Report quality check (commits 3bec95a..a5933d2, review clean — MINOR: 400/500 fix branches untested; stale qualityCheck state on description edit)
|
|
- [x] Task 4: Triage AI suggestion (commit f10fa07, review clean — MINOR: 500 path untested; return toolBlock.input instead of narrowed input; submit not disabled during aiLoading)
|
|
- [x] Task 5: Similar incident retrieval (commit 547cc6e, review clean — MINOR: cast drops extra columns; error/empty indistinguishable in panel; <a> instead of <Link>)
|
|
- [x] Task 6: RCA/CAPA draft assistant (commit 10e7196, review clean — MINOR: as never cast on p_new_value; implementer added runtime validation beyond spec — positive deviation)
|
|
- [x] Task 7: Dashboard enhancement (commit 3473cf8, review clean — MINOR: by_site sort added beyond spec; verified_at/completed_at casts match brief verbatim)
|
|
- [x] Task 8: Final verification (build clean, 61/61 tests pass)
|
|
- [x] Task 8 final fixes: RLS guard + AI try/catch (commit c07bdb7, build clean, 61/61 pass)
|
|
|
|
---
|
|
|
|
# Phase 3 (v2) Progress Ledger — Role Dashboards + CSV Export
|
|
|
|
Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md
|
|
Started: 2026-07-11
|
|
Base commit: 16e8f9d
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Management dashboard (commit 3dac469, review clean — MINOR: status col selected but unused; unbounded allIncidents fetch is pre-prod perf risk)
|
|
- [x] Task 2: Supervisor dashboard (commits ceb5c79..69df452, review clean after fix — MINOR: serial pre-fetches before Promise.all; overdue/CAPA counts subject to 1000-row Supabase cap at volume)
|
|
- [x] Task 3: CAPA owner dashboard (commits a2f1be7..070e2d1, review clean after fix — MINOR: PRIORITY_COLORS defined inside render; en-MY ICU fallback risk on Vercel; incident link non-functional for capa_owner role)
|
|
- [x] Task 4: Reporter dashboard (commits 55b6dac..e631d04, review clean after fix — MINOR: profile/query errors silently swallowed; reviewer's second 🔴 on empty-string date is false positive — "" is falsy, existing && guard already blocks it)
|
|
- [x] Task 5: CSV export endpoint (commit dfca872, review clean — tests 67/67 pass)
|
|
- [x] Task 6: RCA draft test (commit 76d9363, review clean — 68/68 pass)
|
|
- [x] Final review fixes: rename on-time rate, hoist getApiKey, remove broken capa-owner link (commit 871ef7c, re-review clean — 88/88 pass)
|
|
- [x] Whole-branch review: clean — no critical defects; RLS on CSV export verified correct by design
|
|
- [x] Task 6: RCA draft test + final verification (commit 76d9363, 68/68 tests pass, build clean)
|
|
|
|
---
|
|
|
|
# Phase 4 SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-11-phase-4-scale-polish.md
|
|
Started: 2026-07-11
|
|
Base commit: 55b6dac
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: WhatsApp notification helper + migration (commit b6845f5, review clean — MINOR out-of-scope: export route allowedRoles[role] prototype-safe pattern)
|
|
- [x] Task 2: WhatsApp integration — incident alert + CAPA escalation (commit a47f3aa + edb0bde, review clean — MINOR: overdue_3d WhatsApp path untested; serial Meta calls in IIFE; mock call-index fragility in capa test; duplicate vi.clearAllMocks)
|
|
- [x] Task 3: CAPA effectiveness recheck (commit b9def9c, review clean — MINOR: getNextRecheckDate uses local setDate not UTC → fix setDate→setUTCDate before prod; CRON_SECRET undefined demotes to "Bearer undefined"; DB update after send has no error check; nextDate??null no-op)
|
|
- [x] Task 4: i18n infrastructure + EN/MS/ZH translations (commit 87264a5, review clean — MINOR: report page h1 still hardcoded English (plan gap); offline db stub throws at runtime (temporary, Task 5 replaces); language-switcher cookie value not URL-decoded; SW path /ims hardcoded in layout)
|
|
- [x] Task 5: PWA offline capture (commits c048878..448ea48, review clean after fix — MINOR: SW clients.claim() outside waitUntil; fixed basePath in fetch URL; fixed syncNow stable callback with useRef)
|
|
|
|
---
|
|
|
|
# Phase 5 & 6 SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-11-phase-5-6-usability-compliance-analytics.md
|
|
Started: 2026-07-11 · Completed: 2026-07-12
|
|
Branch: phase-5-6
|
|
|
|
## Tasks
|
|
|
|
- [x] Housekeeping: removed stray "whatsapp 2" duplicates (identical to canonical)
|
|
- [x] In-app notification bell + badge (migration 016, SECURITY DEFINER RPC, /api/notifications, bell in protected layout, wired into incident/CAPA/escalation flows)
|
|
- [x] Incident closure lock + addenda (migration 017: incident_addenda + DB triggers; POST /close endpoint added — did not exist; addenda UI)
|
|
- [x] Incident list pagination (server-side .range(), shared Pagination component, HSE + supervisor inboxes)
|
|
- [x] Witness statement + alcohol test UI (investigation form + route, existing schema columns)
|
|
- [x] Type-specific intake forms (migration 018: type_details JSONB; validateTypeDetails whitelist; env/asset/security/fire field groups; EN/MS/ZH; offline queue support)
|
|
- [x] JKKP 8 annual register export (lib/reports/jkkp8.ts + /api/reports/jkkp8 CSV; dashboard button + January deadline banner)
|
|
- [x] Admin user + site/zone management (invite via service-role client, role/site/active management, site+zone CRUD with QR link)
|
|
- [x] Evidence thumbnails (Supabase render transform + onError fallback, lazy loading)
|
|
- [x] Phase 6: 12-month trend chart + top root causes (lib/dashboard/trends.ts pure helpers + tests)
|
|
- [x] Phase 6: AI rising-risk zones (/api/dashboard/ai/risk-flags, claude-opus-4-8 forced tool_use, panel on HSE + management dashboards)
|
|
- [x] Drive-by: fixed 9 pre-existing missing /ims basePath prefixes
|
|
|
|
Verification: 112 tests passing (23 files), tsc clean, next build clean.
|
|
|
|
---
|
|
|
|
# Bugfix SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-17-bugfixes-invite-capa-drugtest.md
|
|
Started: 2026-07-17
|
|
Base commit: e682162
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Fix invite redirect URL — commit a3ce59f, review clean
|
|
- [x] Task 2: CAPA Assigned To — commit e687510, review clean
|
|
- [x] Task 3: Split alcohol/urine test — commits e30d583..ac2f072, review clean (2 minor: as never cast in supervisor page; cosmetic single-test grid)
|
|
|
|
## Final Review (2026-07-17)
|
|
Verdict: Approved — ready to merge
|
|
Minor findings (non-blocking):
|
|
- alcohol_test_result missing CHECK constraint (urine_test_result has it) — asymmetric, follow-up migration
|
|
- PATCH audit_log only on complete=true, not on every field save — pre-existing gap
|
|
- supervisor page `as never` cast — already logged
|
|
- cosmetic single-test grid — already logged
|
|
|
|
# Remove Invite-by-Email SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-18-remove-invite-by-email.md
|
|
Started: 2026-07-18
|
|
Base commit: ac2f072
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Strip invite mode from UI + API — commit 33d4dd4, review clean (minor: audit log skipped on DELETE when target row null; unreachable ?? fallback in DELETE)
|
|
- [x] Task 2: Delete invite-callback page — no commit needed (files were untracked), review clean
|
|
|
|
## Final Review (2026-07-18)
|
|
Verdict: Approved after fix
|
|
- Important fixed: orphaned auth user on profile update failure — commit d5803da
|
|
- Minor (non-blocking): confirmDeleteId cleared before error check in deleteUser; no client-side guard disabling Delete for own account row
|
|
|
|
# Forgot Password SDD Progress Ledger
|
|
|
|
Plan: docs/superpowers/plans/2026-07-21-forgot-password.md
|
|
Started: 2026-07-21
|
|
Base commit: 3a5daaa
|
|
|
|
## Tasks
|
|
|
|
- [x] Task 1: Add "Forgot password?" link to login form (commit 4d7ab5d, review clean)
|
|
- [x] Task 2: Create forgot-password page (commit 211117e, review clean — reviewer finding 1 false positive: /reset-password page created by Task 3; finding 3 false positive: disabled={loading} already on button; finding 2 minor: appUrl fallback non-blocking, NEXT_PUBLIC_APP_URL set in .env.production)
|
|
- [x] Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
|
|
- [x] Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
|
|
- [x] Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)
|