adminandClaude Sonnet 4.6
0e479b648f
- auth callback: remove debug redirect, handle both code (PKCE) and token_hash+type (recovery/magic link) flows correctly - capa PATCH: use admin client to bypass RLS for status updates Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WMymkhHZiaYZtUeH9MEHZQ
9.9 KiB
9.9 KiB
Phase 0 SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-09-phase-0-foundation.md Started: 2026-07-09
Tasks
- Task 1: Scaffold Next.js + Supabase clients (commit
f83686f, review clean) - Task 2: Role types + middleware (commit
6939a21, review clean) - Task 3: Database migrations (commit
05daf70, review clean — 2 advisories: concurrent ref_no race, evidence soft-delete needs SECURITY DEFINER fn) - Task 4: Apply migrations to Supabase cloud (user ran supabase login + link + db push)
- Task 5: Auth flow (commit
5598594, review clean — LOW: open redirect in callback/route.ts:8 fix before prod) - Task 6: Protected dashboard pages (commit
c3ba543, review clean) - Task 7: QR code generation (commit
152a660, review clean)
Phase 2 SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-11-phase-2-investigation-capa.md
Started: 2026-07-11
Base commit (Phase 2 start): 1fe646d82d
Tasks
- Task 1: DB Migration — triage fields, RCA structured data, write_audit_log RPC (commits dbbb663..a718a2d, review clean — MINOR: DROP CASCADE without explicit signature, no ON DELETE on triaged_by FK)
- Task 2: DOSH obligation pure function + tests (commit
8b00c72, review clean) - Task 3: Triage panel — component, API route, page (commit
e55c528, review pending) - Task 4: Investigation workspace — component, API route, page (commit
63cb28f, review pending) - Task 5: CAPA board + form + detail (commit
1780586, review pending) - Task 6: Verification flow (commit
804b1fb, review pending) - Task 7: CAPA overdue escalation cron (commit
75fa260, review pending) - Task 8: JKKP 6/7 PDF generation (commit
54332d0, review pending)
Phase 3 SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md
Started: 2026-07-11
Base commit: 0e53d5c
Tasks
- Task 1: Claude client + Voyage AI embed helper (commit
ebaa98d, review clean — MINOR: module cache isolation in embed test; client.ts uses ?? '' instead of throw on missing key) - Task 2: pgvector migration + match_incidents RPC (commit
ab6299f, review clean) - Task 3: Report quality check (commits 3bec95a..a5933d2, review clean — MINOR: 400/500 fix branches untested; stale qualityCheck state on description edit)
- Task 4: Triage AI suggestion (commit
f10fa07, review clean — MINOR: 500 path untested; return toolBlock.input instead of narrowed input; submit not disabled during aiLoading) - Task 5: Similar incident retrieval (commit
547cc6e, review clean — MINOR: cast drops extra columns; error/empty indistinguishable in panel; instead of ) - Task 6: RCA/CAPA draft assistant (commit 10e7196, review clean — MINOR: as never cast on p_new_value; implementer added runtime validation beyond spec — positive deviation)
- Task 7: Dashboard enhancement (commit 3473cf8, review clean — MINOR: by_site sort added beyond spec; verified_at/completed_at casts match brief verbatim)
- Task 8: Final verification (build clean, 61/61 tests pass)
- Task 8 final fixes: RLS guard + AI try/catch (commit c07bdb7, build clean, 61/61 pass)
Phase 3 (v2) Progress Ledger — Role Dashboards + CSV Export
Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md Started: 2026-07-11 Base commit: 16e8f9d
Tasks
- Task 1: Management dashboard (commit 3dac469, review clean — MINOR: status col selected but unused; unbounded allIncidents fetch is pre-prod perf risk)
- Task 2: Supervisor dashboard (commits ceb5c79..69df452, review clean after fix — MINOR: serial pre-fetches before Promise.all; overdue/CAPA counts subject to 1000-row Supabase cap at volume)
- Task 3: CAPA owner dashboard (commits a2f1be7..070e2d1, review clean after fix — MINOR: PRIORITY_COLORS defined inside render; en-MY ICU fallback risk on Vercel; incident link non-functional for capa_owner role)
- Task 4: Reporter dashboard (commits 55b6dac..e631d04, review clean after fix — MINOR: profile/query errors silently swallowed; reviewer's second 🔴 on empty-string date is false positive — "" is falsy, existing && guard already blocks it)
- Task 5: CSV export endpoint (commit dfca872, review clean — tests 67/67 pass)
- Task 6: RCA draft test (commit 76d9363, review clean — 68/68 pass)
- Final review fixes: rename on-time rate, hoist getApiKey, remove broken capa-owner link (commit 871ef7c, re-review clean — 88/88 pass)
- Whole-branch review: clean — no critical defects; RLS on CSV export verified correct by design
- Task 6: RCA draft test + final verification (commit 76d9363, 68/68 tests pass, build clean)
Phase 4 SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-11-phase-4-scale-polish.md Started: 2026-07-11 Base commit: 55b6dac
Tasks
- Task 1: WhatsApp notification helper + migration (commit b6845f5, review clean — MINOR out-of-scope: export route allowedRoles[role] prototype-safe pattern)
- Task 2: WhatsApp integration — incident alert + CAPA escalation (commit a47f3aa + edb0bde, review clean — MINOR: overdue_3d WhatsApp path untested; serial Meta calls in IIFE; mock call-index fragility in capa test; duplicate vi.clearAllMocks)
- Task 3: CAPA effectiveness recheck (commit b9def9c, review clean — MINOR: getNextRecheckDate uses local setDate not UTC → fix setDate→setUTCDate before prod; CRON_SECRET undefined demotes to "Bearer undefined"; DB update after send has no error check; nextDate??null no-op)
- Task 4: i18n infrastructure + EN/MS/ZH translations (commit 87264a5, review clean — MINOR: report page h1 still hardcoded English (plan gap); offline db stub throws at runtime (temporary, Task 5 replaces); language-switcher cookie value not URL-decoded; SW path /ims hardcoded in layout)
- Task 5: PWA offline capture (commits c048878..448ea48, review clean after fix — MINOR: SW clients.claim() outside waitUntil; fixed basePath in fetch URL; fixed syncNow stable callback with useRef)
Phase 5 & 6 SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-11-phase-5-6-usability-compliance-analytics.md Started: 2026-07-11 · Completed: 2026-07-12 Branch: phase-5-6
Tasks
- Housekeeping: removed stray "whatsapp 2" duplicates (identical to canonical)
- In-app notification bell + badge (migration 016, SECURITY DEFINER RPC, /api/notifications, bell in protected layout, wired into incident/CAPA/escalation flows)
- Incident closure lock + addenda (migration 017: incident_addenda + DB triggers; POST /close endpoint added — did not exist; addenda UI)
- Incident list pagination (server-side .range(), shared Pagination component, HSE + supervisor inboxes)
- Witness statement + alcohol test UI (investigation form + route, existing schema columns)
- Type-specific intake forms (migration 018: type_details JSONB; validateTypeDetails whitelist; env/asset/security/fire field groups; EN/MS/ZH; offline queue support)
- JKKP 8 annual register export (lib/reports/jkkp8.ts + /api/reports/jkkp8 CSV; dashboard button + January deadline banner)
- Admin user + site/zone management (invite via service-role client, role/site/active management, site+zone CRUD with QR link)
- Evidence thumbnails (Supabase render transform + onError fallback, lazy loading)
- Phase 6: 12-month trend chart + top root causes (lib/dashboard/trends.ts pure helpers + tests)
- Phase 6: AI rising-risk zones (/api/dashboard/ai/risk-flags, claude-opus-4-8 forced tool_use, panel on HSE + management dashboards)
- Drive-by: fixed 9 pre-existing missing /ims basePath prefixes
Verification: 112 tests passing (23 files), tsc clean, next build clean.
Bugfix SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-17-bugfixes-invite-capa-drugtest.md Started: 2026-07-17 Base commit: e682162
Tasks
- Task 1: Fix invite redirect URL — commit a3ce59f, review clean
- Task 2: CAPA Assigned To — commit e687510, review clean
- Task 3: Split alcohol/urine test — commits e30d583..ac2f072, review clean (2 minor: as never cast in supervisor page; cosmetic single-test grid)
Final Review (2026-07-17)
Verdict: Approved — ready to merge Minor findings (non-blocking):
- alcohol_test_result missing CHECK constraint (urine_test_result has it) — asymmetric, follow-up migration
- PATCH audit_log only on complete=true, not on every field save — pre-existing gap
- supervisor page
as nevercast — already logged - cosmetic single-test grid — already logged
Remove Invite-by-Email SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-18-remove-invite-by-email.md Started: 2026-07-18 Base commit: ac2f072
Tasks
- Task 1: Strip invite mode from UI + API — commit 33d4dd4, review clean (minor: audit log skipped on DELETE when target row null; unreachable ?? fallback in DELETE)
- Task 2: Delete invite-callback page — no commit needed (files were untracked), review clean
Final Review (2026-07-18)
Verdict: Approved after fix
- Important fixed: orphaned auth user on profile update failure — commit d5803da
- Minor (non-blocking): confirmDeleteId cleared before error check in deleteUser; no client-side guard disabling Delete for own account row
Forgot Password SDD Progress Ledger
Plan: docs/superpowers/plans/2026-07-21-forgot-password.md Started: 2026-07-21 Base commit: 3a5daaa
Tasks
- Task 1: Add "Forgot password?" link to login form (commit 4d7ab5d, review clean)
- Task 2: Create forgot-password page (commit 211117e, review clean — reviewer finding 1 false positive: /reset-password page created by Task 3; finding 3 false positive: disabled={loading} already on button; finding 2 minor: appUrl fallback non-blocking, NEXT_PUBLIC_APP_URL set in .env.production)
- Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
- Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
- Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)