SVNR validation, CI, and a dependency/security pass

Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
  now-unreachable staffPositionInternally server action: a position is filled
  through the hire process, not from the positions list. Note that
  transfer_employee has no position_id at all and never touched `positions`,
  so with staff_position_internally out of the UI, hire_employee is the only
  thing that closes a position — a transfer into an open one leaves it open.
  The RPC itself is still in the database and still covered by its tests.

SVNR
- Austrian social security numbers are now validated: ten digits, weighted
  check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
  which is what catches a transposed date that a valid check digit would let
  through. A serial whose weighted sum lands on 11 is rejected rather than
  wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
  have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
  the same reason as the assignment history: both have been redefined by
  half a dozen migrations. Only a *newly written* value is checked, so a
  legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
  only by chance and every seeded Austrian row would now be rejected;
  it computes the check digit properly now.

Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
  middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
  app's entry gate. RLS remains the real boundary, so the blast radius was a
  blank page rather than data, but it is a patch-level fix. Also react
  19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
  replays every migration onto an empty database and runs the integration
  suite against it, so a migration that cannot be replayed from scratch
  fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
  against the migrations. Reading the SQL rather than a live database keeps
  Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
  first component test covers the org chart expand control, which broke
  earlier this session when elementsSelectable={false} made React Flow
  compute pointer-events:none for the whole node; re-introducing that prop
  fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
  from inspection rather than from violation reports risks blanking the app;
  'unsafe-inline' on script-src is required until a nonce is threaded through
  proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
  extensionless "../lib/svnr" import does not resolve under Node's ESM
  loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
  test:e2e script removed (no Playwright is installed).

tests/components/GraphOrgChart.test.tsx

@@ -0,0 +1,98 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useCallback, useState } from "react";
+import { describe, expect, it } from "vitest";
+import { GraphOrgChart } from "@/components/orgchart/GraphOrgChart";
+import type { ChartNode } from "@/components/orgchart/types";
+
+// Regression cover for the graphical org chart. The expand control lives
+// inside a React Flow custom node, and React Flow decides whether that node
+// receives pointer events at all from the props passed to <ReactFlow>:
+// setting elementsSelectable={false} alongside nodesDraggable={false} made it
+// compute pointer-events:none for the whole card, so neither the toggle nor
+// the employee link responded. Nothing in the type system catches that, and
+// no logic test would either — it only shows up when the tree is rendered
+// and actually clicked.
+
+function person(id: string, name: string, children: ChartNode[] = []): ChartNode {
+  return {
+    id,
+    kind: "person",
+    label: name,
+    sublabel: "Testrolle",
+    href: `/employees/${id}`,
+    avatar: { firstName: name.split(" ")[0], lastName: name.split(" ")[1] ?? "X" },
+    totalReports: children.length,
+    children,
+  };
+}
+
+const TREE: ChartNode[] = [
+  person("1", "Johanna Wiesinger", [
+    person("2", "Markus Steinbacher", [person("4", "Katharina Aigner"), person("5", "Kurt Aigner")]),
+    person("3", "Simon Aigner"),
+  ]),
+];
+
+function Harness({ initial = ["1"] }: { initial?: string[] }) {
+  const [expanded, setExpanded] = useState<Set<string>>(new Set(initial));
+  const onToggle = useCallback((id: string) => {
+    setExpanded((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  }, []);
+  const isExpanded = useCallback((id: string) => expanded.has(id), [expanded]);
+  return <GraphOrgChart tree={TREE} isExpanded={isExpanded} onToggle={onToggle} matchedIds={null} />;
+}
+
+describe("GraphOrgChart", () => {
+  it("renders the root and its expanded children", async () => {
+    render(<Harness />);
+    expect(await screen.findByText("Johanna Wiesinger")).toBeInTheDocument();
+    expect(screen.getByText("Markus Steinbacher")).toBeInTheDocument();
+    expect(screen.getByText("Simon Aigner")).toBeInTheDocument();
+    // Grandchildren stay hidden until their parent is expanded.
+    expect(screen.queryByText("Katharina Aigner")).not.toBeInTheDocument();
+  });
+
+  it("expands a collapsed branch when its control is clicked", async () => {
+    render(<Harness />);
+    await userEvent.click(await screen.findByRole("button", { name: /Markus Steinbacher aufklappen/i }));
+    expect(await screen.findByText("Katharina Aigner")).toBeInTheDocument();
+    expect(screen.getByText("Kurt Aigner")).toBeInTheDocument();
+  });
+
+  it("collapses again", async () => {
+    render(<Harness initial={["1", "2"]} />);
+    expect(await screen.findByText("Katharina Aigner")).toBeInTheDocument();
+    await userEvent.click(await screen.findByRole("button", { name: /Johanna Wiesinger zuklappen/i }));
+    expect(screen.queryByText("Markus Steinbacher")).not.toBeInTheDocument();
+  });
+
+  it("keeps the node's pointer events enabled", () => {
+    // The direct assertion on the regression: React Flow writes
+    // pointer-events onto the node wrapper as an inline style, and 'none'
+    // there silently disables everything inside the card.
+    const { container } = render(<Harness />);
+    const nodes = container.querySelectorAll<HTMLElement>(".react-flow__node");
+    expect(nodes.length).toBeGreaterThan(0);
+    for (const node of nodes) {
+      expect(node.style.pointerEvents).not.toBe("none");
+    }
+  });
+
+  it("shows the child count on a collapsed node and links to the employee", async () => {
+    render(<Harness />);
+    expect(await screen.findByRole("button", { name: /Markus Steinbacher aufklappen \(2\)/i })).toHaveTextContent("2");
+    expect(screen.getByRole("link", { name: /Johanna Wiesinger/i })).toHaveAttribute("href", "/employees/1");
+  });
+
+  it("gives a leaf no expand control", async () => {
+    render(<Harness />);
+    await screen.findByText("Simon Aigner");
+    expect(screen.queryByRole("button", { name: /Simon Aigner (auf|zu)klappen/i })).not.toBeInTheDocument();
+  });
+});

tests/components/setup.ts

@@ -0,0 +1,39 @@
+import "@testing-library/jest-dom/vitest";
+import { cleanup } from "@testing-library/react";
+import { afterEach, vi } from "vitest";
+
+afterEach(cleanup);
+
+// React Flow keeps a node at visibility:hidden until ResizeObserver has
+// reported its size, and Testing Library excludes hidden elements from the
+// accessibility tree — so an inert stub makes every node unqueryable by
+// role. This one reports a size, which is what actually makes the nodes
+// visible and the chart behave as it does in a browser.
+const NODE_WIDTH = 268;
+const NODE_HEIGHT = 80;
+
+class ResizeObserverStub {
+  constructor(private readonly callback: ResizeObserverCallback) {}
+  observe(target: Element) {
+    const entry = {
+      target,
+      contentRect: { width: NODE_WIDTH, height: NODE_HEIGHT, top: 0, left: 0, bottom: NODE_HEIGHT, right: NODE_WIDTH, x: 0, y: 0 },
+    } as unknown as ResizeObserverEntry;
+    queueMicrotask(() => this.callback([entry], this as unknown as ResizeObserver));
+  }
+  unobserve() {}
+  disconnect() {}
+}
+vi.stubGlobal("ResizeObserver", ResizeObserverStub);
+
+if (!("DOMMatrixReadOnly" in globalThis)) {
+  class DOMMatrixReadOnlyStub {
+    m22 = 1;
+  }
+  vi.stubGlobal("DOMMatrixReadOnly", DOMMatrixReadOnlyStub);
+}
+
+// jsdom reports 0 for every layout box; React Flow reads these to size nodes.
+Object.defineProperty(HTMLElement.prototype, "offsetWidth", { configurable: true, value: NODE_WIDTH });
+Object.defineProperty(HTMLElement.prototype, "offsetHeight", { configurable: true, value: NODE_HEIGHT });
+Object.defineProperty(SVGElement.prototype, "getBBox", { configurable: true, value: () => ({ x: 0, y: 0, width: 0, height: 0 }) });

tests/integration/svnr-validation.test.ts

@@ -0,0 +1,122 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import type { Database } from "@/lib/supabase/types";
+import { adminClient, createHrUser, deleteTestEmployee, deleteTestUser, hireTestEmployee, pickSeededTeam, signInAs, type TestUser } from "./helpers";
+
+// SVNR validation (supabase/migrations/20260725120000_svnr_validation.sql).
+// Enforced by a trigger, so these drive it through the real write paths and
+// through a direct update — both must be covered by the same rule.
+describe("SVNR validation", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let team: { id: string };
+  const employeeIds: string[] = [];
+
+  // 3·1 + 7·2 + 9·3 = 44; 010180 contributes 18; 62 mod 11 = 7
+  const VALID = "1237 010180";
+  const BIRTH_DATE = "1980-01-01";
+
+  async function locationIn(country: string): Promise<string> {
+    const { data } = await adminClient.from("locations").select("id").eq("country", country).limit(1).maybeSingle();
+    if (!data) throw new Error(`no seeded location in ${country}`);
+    return data.id;
+  }
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    team = await pickSeededTeam();
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function hireAt(country: string, overrides: Record<string, unknown> = {}): Promise<string> {
+    const id = await hireTestEmployee(hrClient, team.id, {
+      location_id: await locationIn(country),
+      birth_date: BIRTH_DATE,
+      ...overrides,
+    });
+    employeeIds.push(id);
+    return id;
+  }
+
+  describe("is_valid_svnr", () => {
+    async function check(svnr: string, birthDate: string | null = null): Promise<boolean> {
+      const { data, error } = await adminClient.rpc("is_valid_svnr", { p_svnr: svnr, p_birth_date: birthDate });
+      if (error) throw new Error(error.message);
+      return data as unknown as boolean;
+    }
+
+    it("matches the TypeScript implementation on the documented cases", async () => {
+      expect(await check(VALID)).toBe(true);
+      expect(await check("1237010180")).toBe(true);
+      expect(await check("1234 010180")).toBe(false); // wrong check digit
+      expect(await check("0007 010180")).toBe(false); // 000 serial
+      expect(await check("0040 010180")).toBe(false); // check digit would be 10
+      expect(await check("1237 011380")).toBe(false); // month 13
+      expect(await check("123701018")).toBe(false); // nine digits
+    });
+
+    it("cross-checks the birth date when one is given", async () => {
+      expect(await check(VALID, BIRTH_DATE)).toBe(true);
+      expect(await check(VALID, "1980-01-02")).toBe(false);
+    });
+  });
+
+  describe("at an Austrian location", () => {
+    it("accepts a hire carrying a valid number", async () => {
+      const id = await hireAt("Österreich", { sv_nummer: VALID });
+      const { data } = await adminClient.from("employees").select("sv_nummer").eq("id", id).single();
+      expect(data?.sv_nummer).toBe(VALID);
+    });
+
+    it("rejects a hire carrying an invalid number", async () => {
+      await expect(hireAt("Österreich", { sv_nummer: "1234 010180" })).rejects.toThrow(/SV-Nummer/i);
+    });
+
+    it("rejects a number whose birth date disagrees with the employee record", async () => {
+      await expect(hireAt("Österreich", { sv_nummer: VALID, birth_date: "1975-06-30" })).rejects.toThrow(/SV-Nummer/i);
+    });
+
+    it("allows the field to stay empty", async () => {
+      const id = await hireAt("Österreich");
+      const { data } = await adminClient.from("employees").select("sv_nummer").eq("id", id).single();
+      expect(data?.sv_nummer ?? null).toBeNull();
+    });
+
+    it("rejects an update to an invalid number", async () => {
+      const id = await hireAt("Österreich", { sv_nummer: VALID });
+      const { error } = await adminClient.from("employees").update({ sv_nummer: "9999 010180" }).eq("id", id);
+      expect(error?.message ?? "").toMatch(/SV-Nummer/i);
+    });
+  });
+
+  describe("outside Austria", () => {
+    it("leaves the field free-form", async () => {
+      // The German equivalent has a different format entirely; validating it
+      // against the Austrian standard would reject correct data.
+      const id = await hireAt("Deutschland", { sv_nummer: "12 345678 A 901" });
+      const { data } = await adminClient.from("employees").select("sv_nummer").eq("id", id).single();
+      expect(data?.sv_nummer).toBe("12 345678 A 901");
+    });
+  });
+
+  describe("legacy rows", () => {
+    it("does not block an unrelated edit when the stored number is invalid", async () => {
+      // Rows predating the migration hold unvalidated values. A transfer or
+      // a name change must not fail because of a number nobody is touching.
+      const id = await hireAt("Deutschland", { sv_nummer: "0000 000000" });
+      const { error: moveError } = await adminClient
+        .from("employees")
+        .update({ location_id: await locationIn("Österreich") })
+        .eq("id", id);
+      expect(moveError).toBeNull();
+
+      const { error: nameError } = await adminClient.from("employees").update({ phone: "+43 1 9999999" }).eq("id", id);
+      expect(nameError).toBeNull();
+    });
+  });
+});

tests/unit/svnr.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it } from "vitest";
+import { formatSvnr, isValidSvnr, normalizeSvnr, requiresAustrianSvnr, svnrCheckDigit, validateSvnr } from "@/lib/svnr";
+
+// Weights 3,7,9 on the serial and 5,8,4,2,1,6 on TTMMJJ; sum mod 11 is the
+// check digit. Worked through by hand for "123? 010180":
+//   3·1 + 7·2 + 9·3  = 44   (serial)
+//   5·0 + 8·1 + 4·0 + 2·1 + 1·8 + 6·0 = 18   (010180)
+//   62 mod 11 = 7        → 1237 010180
+const VALID = "1237 010180";
+
+describe("svnrCheckDigit", () => {
+  it("computes the documented check digit", () => {
+    expect(svnrCheckDigit("1230010180")).toBe(7);
+  });
+
+  it("computes it independently of the digit already in that slot", () => {
+    // The check position is skipped, so a wrong digit there cannot influence
+    // the result — otherwise the check would validate itself.
+    expect(svnrCheckDigit("1234010180")).toBe(7);
+    expect(svnrCheckDigit("1239010180")).toBe(7);
+  });
+
+  it("computes 3 for serial 432 on the same date", () => {
+    // 3·4 + 7·3 + 9·2 = 51; 51 + 18 = 69; 69 mod 11 = 3
+    expect(svnrCheckDigit("4320010180")).toBe(3);
+  });
+
+  it("returns null for a serial that would need a check digit of 10", () => {
+    // 9·4 = 36; 36 + 18 = 54; 54 mod 11 = 10 — never issued, since there is
+    // no single digit for it.
+    expect(svnrCheckDigit("0040010180")).toBeNull();
+  });
+});
+
+describe("validateSvnr", () => {
+  it("accepts a well-formed number", () => {
+    expect(validateSvnr(VALID)).toBeNull();
+    expect(isValidSvnr(VALID)).toBe(true);
+  });
+
+  it("accepts it regardless of spacing or separators", () => {
+    for (const variant of ["1237010180", "1237 010180", "1237-010180", "1237.010180", " 1237  010180 "]) {
+      expect(validateSvnr(variant), variant).toBeNull();
+    }
+  });
+
+  it("rejects a wrong check digit", () => {
+    expect(validateSvnr("1234 010180")).toBe("checksum");
+  });
+
+  it("rejects a serial whose check digit would be 10", () => {
+    expect(validateSvnr("0040 010180")).toBe("checksum");
+  });
+
+  it("rejects anything that is not ten digits", () => {
+    for (const bad of ["", "123701018", "12370101801", "1237 01018X", "abcdefghij"]) {
+      expect(validateSvnr(bad), bad).toBe("length");
+    }
+  });
+
+  it("rejects the unissued 000 serial", () => {
+    expect(validateSvnr("0007 010180")).toBe("serial");
+  });
+
+  it("rejects an impossible date tail", () => {
+    // Month 13 and day 32 never occur; the checksum is irrelevant once the
+    // tail cannot be a date at all.
+    expect(validateSvnr("1237 011380")).toBe("date");
+    expect(validateSvnr("1237 320180")).toBe("date");
+    expect(validateSvnr("1237 310280")).toBe("date");
+  });
+
+  it("allows 29 February, which a two-digit year cannot disambiguate", () => {
+    // 3·1+7·2+9·3 = 44; 5·2+8·9+4·0+2·2+1·8+6·0 = 10+72+0+4+8 = 94; 138 mod 11 = 6
+    expect(validateSvnr("1236 290280")).toBeNull();
+  });
+});
+
+describe("cross-check against the stored birth date", () => {
+  it("passes when the tail matches", () => {
+    expect(validateSvnr(VALID, "1980-01-01")).toBeNull();
+  });
+
+  it("catches a transposed birth date the checksum cannot", () => {
+    expect(validateSvnr(VALID, "1980-01-02")).toBe("birthDateMismatch");
+    expect(validateSvnr(VALID, "1981-01-01")).toBe("birthDateMismatch");
+  });
+
+  it("skips the cross-check when no birth date is known", () => {
+    expect(validateSvnr(VALID, null)).toBeNull();
+    expect(validateSvnr(VALID, undefined)).toBeNull();
+  });
+});
+
+describe("helpers", () => {
+  it("normalises and formats", () => {
+    expect(normalizeSvnr("1237 010180")).toBe("1237010180");
+    expect(formatSvnr("1237010180")).toBe("1237 010180");
+  });
+
+  it("leaves non-canonical input alone when formatting", () => {
+    expect(formatSvnr("12")).toBe("12");
+  });
+
+  it("applies only to Austrian locations", () => {
+    expect(requiresAustrianSvnr("Österreich")).toBe(true);
+    for (const c of ["Deutschland", "Tschechien", "Slowenien", null, undefined]) {
+      expect(requiresAustrianSvnr(c)).toBe(false);
+    }
+  });
+});