m.stubhan/alpenwerk-hr
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Browse Source 
Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).
This commit is contained in:
Maximilian Stubhan
2026-07-14 20:32:20 +02:00
parent 4299277af0
commit 901c5c426e
67 changed files with 4765 additions and 286 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
app/(app)/layout.tsx
View File

@@ -13,25 +13,27 @@ export default async function AppLayout({ children }: { children: ReactNode }) {
} = await supabase.auth.getUser();
if (!user) redirect("/login");
const { data: profile } = await supabase.from("profiles").select("full_name, email, role").eq("id", user.id).single();
const canEdit = profile?.role === "hr_admin";
// Defense in depth: proxy.ts already redirects any non-active-HR session
// away before this layout ever renders. Re-checking here means a gap in
// the proxy matcher (or a future route added outside it) still fails
// closed instead of silently granting access — see docs/security.md.
const { data: profile } = await supabase.from("profiles").select("full_name, email, role, is_active").eq("id", user.id).maybeSingle();
if (profile?.role !== "hr" || profile?.is_active !== true) redirect("/login");
const userLabel = profile?.full_name || profile?.email || user.email || "";
const userLabel = profile.full_name || profile.email || user.email || "";
const [openPositions, locationsRes, draftsRes] = canEdit
? await Promise.all([
loadOpenPositions(supabase),
supabase.from("locations").select("id, name, country").order("name"),
supabase.from("hire_drafts").select("id, step, payload, updated_at").eq("created_by", user.id).order("updated_at", { ascending: false }),
])
: [[], { data: [] }, { data: [] }];
const [openPositions, locationsRes, draftsRes] = await Promise.all([
loadOpenPositions(supabase),
supabase.from("locations").select("id, name, country").order("name"),
supabase.from("hire_drafts").select("id, step, payload, updated_at").eq("created_by", user.id).order("updated_at", { ascending: false }),
]);
return (
<HireWizardProvider openPositions={openPositions} locations={locationsRes.data ?? []} drafts={draftsRes.data ?? []}>
<div className="flex min-h-screen">
<Sidebar />
<div className="ml-[236px] flex flex-1 flex-col">
<Topbar userLabel={userLabel} role={profile?.role} canEdit={canEdit} />
<Topbar userLabel={userLabel} />
<main className="flex-1 px-6 py-6">
<div className="mx-auto w-full max-w-[1280px]">{children}</div>
</main>