Consolidation pass: HR-only access, effective-dated mutations, data integrity guards, test suite

Reworks the app from a two-role (hr_admin/manager) model to a single
HR-only role gated by profiles.is_active, fixes transfer/promote/karenz/
reorg RPCs to actually defer future-dated changes via a new
pending_org_changes table instead of writing them immediately (applied
by a daily Vercel Cron route), makes reorg undo append-only instead of
deleting history, adds Karenz-return and history-date integrity guards,
deprecates the salary column, and adds explicit schema grants + perf
indexes needed to run against a fresh (non-hosted) Postgres instance.

Adds vitest unit + integration test suites (the latter against a real
local Supabase instance) covering all of the above, plus lint/typecheck/
build wiring (`npm run check`).

tests/integration/authorization.test.ts

@@ -0,0 +1,93 @@
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createBareAuthUser,
+  createHrUser,
+  deleteTestUser,
+  signInAs,
+  type TestUser,
+} from "./helpers";
+
+// HR-only access model (supabase/migrations/20260714120000_hr_only_access.sql):
+// nobody except an active, explicitly-provisioned HR user may read or write
+// anything beyond their own profile row.
+describe("HR-only access (is_hr_user gate)", () => {
+  const createdUsers: TestUser[] = [];
+
+  afterEach(async () => {
+    while (createdUsers.length) {
+      const user = createdUsers.pop()!;
+      await deleteTestUser(user);
+    }
+  });
+
+  it("a bare authenticated user (no profile row) reads zero employees, not an error", async () => {
+    const user = await createBareAuthUser();
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("employees").select("id");
+    expect(error).toBeNull();
+    expect(data).toEqual([]);
+  });
+
+  it("a bare authenticated user cannot insert into org reference tables", async () => {
+    const user = await createBareAuthUser();
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { error } = await client.from("divisions").insert({ org_number: "20999999", name: `Test-${user.id}` });
+    expect(error).not.toBeNull();
+  });
+
+  it("an inactive HR profile can read its own profile row", async () => {
+    const user = await createHrUser({ active: false });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("profiles").select("id, is_active").eq("id", user.id);
+    expect(error).toBeNull();
+    expect(data).toHaveLength(1);
+    expect(data?.[0].is_active).toBe(false);
+  });
+
+  it("an inactive HR profile reads zero employees and cannot call mutation RPCs", async () => {
+    const user = await createHrUser({ active: false });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data: employees, error: readError } = await client.from("employees").select("id");
+    expect(readError).toBeNull();
+    expect(employees).toEqual([]);
+
+    const { error: rpcError } = await client.rpc("hire_employee", {
+      payload: { first_name: "X", last_name: "Y", gender: "m", birth_date: "1990-01-01", entry_date: "2020-01-01" },
+    });
+    expect(rpcError?.message).toMatch(/Nicht berechtigt/);
+  });
+
+  it("an active HR user reads the seeded employee roster", async () => {
+    const user = await createHrUser({ active: true });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { data, error } = await client.from("employees").select("id").limit(1);
+    expect(error).toBeNull();
+    expect((data ?? []).length).toBeGreaterThan(0);
+  });
+
+  it("apply_due_pending_changes is revoked from authenticated users, even active HR", async () => {
+    const user = await createHrUser({ active: true });
+    createdUsers.push(user);
+    const client = await signInAs(user);
+
+    const { error } = await client.rpc("apply_due_pending_changes");
+    expect(error).not.toBeNull();
+  });
+
+  it("apply_due_pending_changes is callable by the service-role client", async () => {
+    const { data, error } = await adminClient.rpc("apply_due_pending_changes");
+    expect(error).toBeNull();
+    expect(typeof data).toBe("number");
+  });
+});

tests/integration/data-integrity.test.ts

@@ -0,0 +1,123 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Two guards added by supabase/migrations/20260714120600_data_integrity_guards.sql
+// that previously had no enforcement anywhere: a Karenz return date may not
+// precede its own Karenz start, and a history entry may not predate the
+// employee's entry date.
+describe("data integrity guards", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployeeOnKarenz(): Promise<{ employeeId: string; karenzStartDate: string }> {
+    const employeeId = await hireTestEmployee(hrClient, teamA.id);
+    employeeIds.push(employeeId);
+    const karenzStartDate = isoDateOffset(-5);
+    const { error } = await hrClient.rpc("start_karenz", {
+      payload: { employee_id: employeeId, karenz_start_date: karenzStartDate, planned_return_date: isoDateOffset(100) },
+    });
+    if (error) throw new Error(`start_karenz setup failed: ${error.message}`);
+    return { employeeId, karenzStartDate };
+  }
+
+  it("adjust_karenz_return rejects a return date on or before karenz_start_date", async () => {
+    const { employeeId, karenzStartDate } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("adjust_karenz_return", {
+      payload: { employee_id: employeeId, new_return_date: karenzStartDate },
+    });
+    expect(error?.message).toMatch(/Rückkehrdatum muss nach dem Karenzbeginn/);
+  });
+
+  it("adjust_karenz_return accepts a return date after karenz_start_date", async () => {
+    const { employeeId } = await freshEmployeeOnKarenz();
+    const newReturnDate = isoDateOffset(50);
+
+    const { error } = await hrClient.rpc("adjust_karenz_return", {
+      payload: { employee_id: employeeId, new_return_date: newReturnDate },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient.from("employees").select("karenz_return_date").eq("id", employeeId).single();
+    expect(employee?.karenz_return_date).toBe(newReturnDate);
+  });
+
+  it("record_karenz_return rejects a return date on or before karenz_start_date", async () => {
+    const { employeeId, karenzStartDate } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("record_karenz_return", {
+      payload: { employee_id: employeeId, return_date: karenzStartDate, employment_mode: "unverändert" },
+    });
+    expect(error?.message).toMatch(/Rückkehrdatum muss nach dem Karenzbeginn/);
+  });
+
+  it("record_karenz_return with a valid date flips status back to Aktiv and clears karenz_start_date", async () => {
+    const { employeeId } = await freshEmployeeOnKarenz();
+
+    const { error } = await hrClient.rpc("record_karenz_return", {
+      payload: { employee_id: employeeId, return_date: isoDateOffset(0), employment_mode: "unverändert" },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient
+      .from("employees")
+      .select("status, karenz_start_date, karenz_return_date")
+      .eq("id", employeeId)
+      .single();
+    expect(employee?.status).toBe("Aktiv");
+    expect(employee?.karenz_start_date).toBeNull();
+    expect(employee?.karenz_return_date).toBeNull();
+  });
+
+  it("rejects an employee_history row dated before the employee's entry_date", async () => {
+    const employeeId = await hireTestEmployee(hrClient, teamA.id, { entry_date: isoDateOffset(-10) });
+    employeeIds.push(employeeId);
+
+    const { error } = await adminClient.from("employee_history").insert({
+      employee_id: employeeId,
+      event_date: isoDateOffset(-11),
+      event_type: "Vertragsänderung",
+      description: "Sollte vom Trigger abgelehnt werden",
+    });
+    expect(error?.message).toMatch(/darf nicht vor dem Eintrittsdatum/);
+  });
+
+  it("accepts an employee_history row dated exactly on the entry_date", async () => {
+    const entryDate = isoDateOffset(-10);
+    const employeeId = await hireTestEmployee(hrClient, teamA.id, { entry_date: entryDate });
+    employeeIds.push(employeeId);
+
+    const { error } = await adminClient.from("employee_history").insert({
+      employee_id: employeeId,
+      event_date: entryDate,
+      event_type: "Vertragsänderung",
+      description: "Am Eintrittsdatum selbst, sollte erlaubt sein",
+    });
+    expect(error).toBeNull();
+  });
+});

tests/integration/effective-dating.test.ts

@@ -0,0 +1,163 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  teamLeadId,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Deferred/effective-dated changes (supabase/migrations/20260714120200_
+// effective_dating_rpcs.sql): a future "wirksam ab" date must queue a
+// pending_org_changes row instead of writing to `employees` immediately;
+// apply_due_pending_changes() applies it once due.
+describe("effective-dated mutations", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  it("transfer_employee with today's date writes immediately", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const newLead = await teamLeadId(teamB.id);
+
+    const { error } = await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(0), new_team_id: teamB.id },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(employee?.team_id).toBe(teamB.id);
+    expect(employee?.manager_id).toBe(newLead);
+  });
+
+  it("transfer_employee with a future date defers the write and applies it once due", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const newLead = await teamLeadId(teamB.id);
+
+    const { error } = await hrClient.rpc("transfer_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(30), new_team_id: teamB.id },
+    });
+    expect(error).toBeNull();
+
+    // Not written yet — this is the exact bug the migration fixes: a
+    // future-dated transfer must not overwrite the live record today.
+    const { data: unchanged } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(unchanged?.team_id).toBe(teamA.id);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id, status, payload")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "transfer")
+      .single();
+    expect(pending?.status).toBe("pending");
+    expect(pending?.payload.new_team_id).toBe(teamB.id);
+
+    // Fast-forward: simulate the effective date having arrived, then run
+    // the same function the daily cron route calls.
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    const { data: appliedCount, error: applyError } = await adminClient.rpc("apply_due_pending_changes");
+    expect(applyError).toBeNull();
+    expect(appliedCount).toBeGreaterThanOrEqual(1);
+
+    const { data: employee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(employee?.team_id).toBe(teamB.id);
+    expect(employee?.manager_id).toBe(newLead);
+
+    const { data: appliedRow } = await adminClient
+      .from("pending_org_changes")
+      .select("status, applied_at")
+      .eq("id", pending!.id)
+      .single();
+    expect(appliedRow?.status).toBe("applied");
+    expect(appliedRow?.applied_at).not.toBeNull();
+  });
+
+  it("promote_employee with a future date does not change job_title/paygrade until applied", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+
+    const { error } = await hrClient.rpc("promote_employee", {
+      payload: { employee_id: employeeId, effective_date: isoDateOffset(14), new_title: "Senior Testperson", new_paygrade: "D" },
+    });
+    expect(error).toBeNull();
+
+    const { data: unchanged } = await adminClient.from("employees").select("job_title, paygrade").eq("id", employeeId).single();
+    expect(unchanged?.job_title).not.toBe("Senior Testperson");
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "promotion")
+      .single();
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    await adminClient.rpc("apply_due_pending_changes");
+
+    const { data: employee } = await adminClient.from("employees").select("job_title, paygrade").eq("id", employeeId).single();
+    expect(employee?.job_title).toBe("Senior Testperson");
+    expect(employee?.paygrade).toBe("D");
+  });
+
+  it("start_karenz with a future date sets karenz_start_date immediately but keeps status Aktiv", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const startDate = isoDateOffset(20);
+    const returnDate = isoDateOffset(200);
+
+    const { error } = await hrClient.rpc("start_karenz", {
+      payload: { employee_id: employeeId, karenz_start_date: startDate, planned_return_date: returnDate },
+    });
+    expect(error).toBeNull();
+
+    const { data: employee } = await adminClient
+      .from("employees")
+      .select("status, karenz_start_date")
+      .eq("id", employeeId)
+      .single();
+    expect(employee?.status).toBe("Aktiv");
+    expect(employee?.karenz_start_date).toBe(startDate);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("change_type", "karenz_start")
+      .single();
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    await adminClient.rpc("apply_due_pending_changes");
+
+    const { data: afterApply } = await adminClient
+      .from("employees")
+      .select("status, karenz_return_date")
+      .eq("id", employeeId)
+      .single();
+    expect(afterApply?.status).toBe("Karenz");
+    expect(afterApply?.karenz_return_date).toBe(returnDate);
+  });
+});

tests/integration/helpers.ts

@@ -0,0 +1,146 @@
+import { createClient, type SupabaseClient } from "@supabase/supabase-js";
+import { randomUUID } from "node:crypto";
+import type { Database, EmploymentStatus } from "@/lib/supabase/types";
+
+const URL = process.env.NEXT_PUBLIC_SUPABASE_URL;
+const ANON_KEY = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
+const SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+
+if (!URL || !ANON_KEY || !SERVICE_ROLE_KEY) {
+  throw new Error(
+    "Missing Supabase env vars for integration tests. Start local Supabase (`npx supabase start`) and run " +
+      "`npm run test:integration`, which loads .env.test.local automatically. See README.md."
+  );
+}
+
+export const adminClient: SupabaseClient<Database> = createClient(URL, SERVICE_ROLE_KEY, {
+  auth: { autoRefreshToken: false, persistSession: false },
+});
+
+export function anonClient(): SupabaseClient<Database> {
+  return createClient(URL!, ANON_KEY!, { auth: { autoRefreshToken: false, persistSession: false } });
+}
+
+export type TestUser = { id: string; email: string; password: string };
+
+// Creates a real auth.users row (via the admin API) with no profiles row —
+// this is exactly the "signed up but never provisioned" state §2.3
+// describes: authenticated, but not HR.
+export async function createBareAuthUser(): Promise<TestUser> {
+  const email = `test-${randomUUID()}@example.test`;
+  const password = `Test-${randomUUID()}!`;
+  const { data, error } = await adminClient.auth.admin.createUser({ email, password, email_confirm: true });
+  if (error || !data.user) throw new Error(`createBareAuthUser failed: ${error?.message}`);
+  return { id: data.user.id, email, password };
+}
+
+export async function createHrUser(opts: { active: boolean }): Promise<TestUser> {
+  const user = await createBareAuthUser();
+  const { error } = await adminClient
+    .from("profiles")
+    .insert({ id: user.id, email: user.email, full_name: "Integrationstest HR", role: "hr", is_active: opts.active });
+  if (error) throw new Error(`createHrUser profile insert failed: ${error.message}`);
+  return user;
+}
+
+export async function deleteTestUser(user: TestUser): Promise<void> {
+  await adminClient.from("profiles").delete().eq("id", user.id);
+  await adminClient.auth.admin.deleteUser(user.id);
+}
+
+export async function signInAs(user: TestUser): Promise<SupabaseClient<Database>> {
+  const client = anonClient();
+  const { error } = await client.auth.signInWithPassword({ email: user.email, password: user.password });
+  if (error) throw new Error(`signInAs(${user.email}) failed: ${error.message}`);
+  return client;
+}
+
+// Pulled from the seeded dataset (supabase/seed.ts) — any active, non-lead
+// employee works for read/mutation tests that don't care which one.
+export async function pickSeededEmployee(
+  filter: Partial<{ status: EmploymentStatus; is_lead: boolean }> = {}
+): Promise<{
+  id: string;
+  team_id: string | null;
+  division_id: string;
+  manager_id: string | null;
+  status: string;
+}> {
+  let q = adminClient.from("employees").select("id, team_id, division_id, manager_id, status").limit(1);
+  if (filter.status) q = q.eq("status", filter.status);
+  if (filter.is_lead !== undefined) q = q.eq("is_lead", filter.is_lead);
+  const { data, error } = await q.maybeSingle();
+  if (error || !data) throw new Error(`pickSeededEmployee failed: ${error?.message ?? "no matching row"}`);
+  return data;
+}
+
+export async function pickSeededTeam(excludeTeamId?: string): Promise<{ id: string }> {
+  const q = adminClient.from("teams").select("id").limit(2);
+  const { data, error } = await q;
+  if (error || !data?.length) throw new Error(`pickSeededTeam failed: ${error?.message}`);
+  const match = data.find((t) => t.id !== excludeTeamId) ?? data[0];
+  return match;
+}
+
+export async function pickSeededLocation(): Promise<{ id: string }> {
+  const { data, error } = await adminClient.from("locations").select("id").limit(1).maybeSingle();
+  if (error || !data) throw new Error(`pickSeededLocation failed: ${error?.message ?? "no rows"}`);
+  return data;
+}
+
+// The seeded org guarantees exactly one active team lead per team (§2's
+// "reports-to" rule) — resolve_manager_for() relies on the same query.
+export async function teamLeadId(teamId: string): Promise<string | null> {
+  const { data, error } = await adminClient
+    .from("employees")
+    .select("id")
+    .eq("team_id", teamId)
+    .eq("is_lead", true)
+    .neq("status", "Ausgetreten")
+    .maybeSingle();
+  if (error) throw new Error(`teamLeadId(${teamId}) failed: ${error.message}`);
+  return data?.id ?? null;
+}
+
+// YYYY-MM-DD, offset from today — for building "wirksam ab" test payloads
+// without hardcoding dates that eventually go stale.
+export function isoDateOffset(days: number): string {
+  const d = new Date();
+  d.setDate(d.getDate() + days);
+  return d.toISOString().slice(0, 10);
+}
+
+// Hires a throwaway employee into `teamId` via the real hire_employee RPC
+// (not a raw insert) so every mutation test starts from a state the app
+// itself can produce. Caller must clean up with deleteTestEmployee.
+export async function hireTestEmployee(
+  hrClient: SupabaseClient<Database>,
+  teamId: string,
+  overrides: Partial<Record<string, unknown>> = {}
+): Promise<string> {
+  const location = await pickSeededLocation();
+  const payload = {
+    first_name: "Integrationstest",
+    last_name: `Person-${randomUUID().slice(0, 8)}`,
+    gender: "w",
+    birth_date: "1990-01-01",
+    location_id: location.id,
+    team_id: teamId,
+    job_title: "Integrationstest-Rolle",
+    entry_date: isoDateOffset(-30),
+    source: "Extern",
+    ...overrides,
+  };
+  const { data, error } = await hrClient.rpc("hire_employee", { payload });
+  if (error || !data) throw new Error(`hireTestEmployee failed: ${error?.message ?? "no id returned"}`);
+  return data;
+}
+
+// employees has no cascade from audit_log (target_employee_id is a plain
+// FK, immutable log by design) — clear those rows first so the employee
+// delete itself doesn't fail with a foreign key violation. employee_history
+// and pending_org_changes do cascade on employee_id.
+export async function deleteTestEmployee(employeeId: string): Promise<void> {
+  await adminClient.from("audit_log").delete().eq("target_employee_id", employeeId);
+  await adminClient.from("employees").delete().eq("id", employeeId);
+}

tests/integration/reorg.test.ts

@@ -0,0 +1,147 @@
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  adminClient,
+  createHrUser,
+  deleteTestEmployee,
+  deleteTestUser,
+  hireTestEmployee,
+  isoDateOffset,
+  pickSeededTeam,
+  signInAs,
+  teamLeadId,
+  type TestUser,
+} from "./helpers";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import type { Database } from "@/lib/supabase/types";
+
+// Reorg scenarios: immediate apply/undo must respect employee_history's
+// append-only contract (20260714120300_reorg_undo_append_only.sql), and a
+// future-dated scenario must defer every move via pending_org_changes until
+// its effective date, flipping reorg_scenarios.applied only once every move
+// has landed (20260714120200_effective_dating_rpcs.sql).
+describe("reorg scenarios", () => {
+  let hrUser: TestUser;
+  let hrClient: SupabaseClient<Database>;
+  let teamA: { id: string };
+  let teamB: { id: string };
+  const employeeIds: string[] = [];
+
+  beforeAll(async () => {
+    hrUser = await createHrUser({ active: true });
+    hrClient = await signInAs(hrUser);
+    teamA = await pickSeededTeam();
+    teamB = await pickSeededTeam(teamA.id);
+  });
+
+  afterAll(async () => {
+    for (const id of employeeIds) await deleteTestEmployee(id);
+    await deleteTestUser(hrUser);
+  });
+
+  async function freshEmployee(teamId: string): Promise<string> {
+    const id = await hireTestEmployee(hrClient, teamId);
+    employeeIds.push(id);
+    return id;
+  }
+
+  it("applies an immediate reorg now, and undo appends a compensating history row instead of deleting", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(0),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+    expect(scenarioId).toBeTruthy();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenario } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenario?.applied).toBe(true);
+    expect(scenario?.applied_at).not.toBeNull();
+
+    const { count: historyBeforeUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyBeforeUndo).toBe(1);
+
+    const { error: undoError } = await hrClient.rpc("undo_reorg", { payload: { scenario_id: scenarioId } });
+    expect(undoError).toBeNull();
+
+    const { data: revertedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(revertedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: undoneScenario } = await adminClient.from("reorg_scenarios").select("applied").eq("id", scenarioId as string).single();
+    expect(undoneScenario?.applied).toBe(false);
+
+    // The original "Reorganisation" row must still be there — undo appends
+    // a compensating entry, it never deletes (the bug the migration fixed).
+    const { count: historyAfterUndo } = await adminClient
+      .from("employee_history")
+      .select("id", { count: "exact", head: true })
+      .eq("employee_id", employeeId)
+      .eq("event_type", "Reorganisation");
+    expect(historyAfterUndo).toBe(2);
+  });
+
+  it("defers a future-dated reorg and only flips reorg_scenarios.applied once its pending change lands", async () => {
+    const employeeId = await freshEmployee(teamA.id);
+    const teamBLead = await teamLeadId(teamB.id);
+
+    const { data: scenarioId, error: applyError } = await hrClient.rpc("apply_reorg", {
+      payload: {
+        name: `Integrationstest Reorg (zukünftig) ${employeeId.slice(0, 8)}`,
+        effective_date: isoDateOffset(30),
+        moves: [{ kind: "emp", label: "Test", employee_ids: [employeeId], target_team_id: teamB.id }],
+      },
+    });
+    expect(applyError).toBeNull();
+
+    const { data: unchangedEmployee } = await adminClient.from("employees").select("team_id").eq("id", employeeId).single();
+    expect(unchangedEmployee?.team_id).toBe(teamA.id);
+
+    const { data: scenarioBefore } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioBefore?.applied).toBe(false);
+
+    const { data: pending } = await adminClient
+      .from("pending_org_changes")
+      .select("id")
+      .eq("employee_id", employeeId)
+      .eq("reorg_scenario_id", scenarioId as string)
+      .eq("status", "pending")
+      .single();
+    expect(pending).not.toBeNull();
+
+    await adminClient.from("pending_org_changes").update({ effective_date: isoDateOffset(0) }).eq("id", pending!.id);
+    const { error: cronError } = await adminClient.rpc("apply_due_pending_changes");
+    expect(cronError).toBeNull();
+
+    const { data: movedEmployee } = await adminClient.from("employees").select("team_id, manager_id").eq("id", employeeId).single();
+    expect(movedEmployee?.team_id).toBe(teamB.id);
+    expect(movedEmployee?.manager_id).toBe(teamBLead);
+
+    const { data: scenarioAfter } = await adminClient
+      .from("reorg_scenarios")
+      .select("applied, applied_at")
+      .eq("id", scenarioId as string)
+      .single();
+    expect(scenarioAfter?.applied).toBe(true);
+    expect(scenarioAfter?.applied_at).not.toBeNull();
+  });
+});

tests/unit/colors.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { actionBadgeStyle, avatarColorFor, STATUS_STYLES } from "@/lib/colors";
+
+describe("avatarColorFor", () => {
+  it("is deterministic for the same seed", () => {
+    expect(avatarColorFor("Maria Gruber")).toBe(avatarColorFor("Maria Gruber"));
+  });
+
+  it("returns a value from the fixed palette (a hex color)", () => {
+    expect(avatarColorFor("Anna Huber")).toMatch(/^#[0-9a-f]{6}$/i);
+  });
+});
+
+describe("STATUS_STYLES", () => {
+  it("has an entry for every employment status", () => {
+    expect(Object.keys(STATUS_STYLES).sort()).toEqual(["Aktiv", "Ausgetreten", "Geplant", "Karenz"].sort());
+  });
+});
+
+describe("actionBadgeStyle", () => {
+  it("maps known audit actions to their category style", () => {
+    expect(actionBadgeStyle("Austritt")).toBe(STATUS_STYLES.Ausgetreten);
+    expect(actionBadgeStyle("Neueinstellung")).toBe(STATUS_STYLES.Aktiv);
+  });
+
+  it("falls back to the brand style for an unknown action", () => {
+    expect(actionBadgeStyle("Irgendwas Unbekanntes")).toContain("bg-brand-100");
+  });
+});

tests/unit/format.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import { daysBetween, fmtAge, fmtDate, initials, tenure } from "@/lib/format";
+
+describe("fmtDate", () => {
+  it("formats an ISO date string in de-AT order", () => {
+    expect(fmtDate("2026-03-05")).toBe("05.03.2026");
+  });
+
+  it("returns an em dash for null/undefined/empty input", () => {
+    expect(fmtDate(null)).toBe("–");
+    expect(fmtDate(undefined)).toBe("–");
+    expect(fmtDate("")).toBe("–");
+  });
+
+  it("returns an em dash for an invalid date string", () => {
+    expect(fmtDate("not-a-date")).toBe("–");
+  });
+});
+
+describe("initials", () => {
+  it("uppercases the first letter of each name", () => {
+    expect(initials("maria", "gruber")).toBe("MG");
+  });
+
+  it("trims surrounding whitespace before taking the first letter", () => {
+    expect(initials("  Anna", "Huber  ")).toBe("AH");
+  });
+});
+
+describe("fmtAge", () => {
+  it("computes age correctly when the birthday has already passed this year", () => {
+    const today = new Date();
+    const birthDate = new Date(today.getFullYear() - 30, 0, 1); // Jan 1, definitely passed
+    expect(fmtAge(birthDate)).toBe(30);
+  });
+
+  it("subtracts one year when the birthday has not yet occurred this year", () => {
+    const today = new Date();
+    const future = new Date(today.getFullYear() - 30, 11, 31); // Dec 31, likely not yet passed
+    if (today.getMonth() === 11 && today.getDate() === 31) return; // skip on the one day this'd be flaky
+    expect(fmtAge(future)).toBe(29);
+  });
+});
+
+describe("tenure", () => {
+  it("formats whole years and months since entry", () => {
+    const start = new Date(2020, 0, 15);
+    const end = new Date(2023, 2, 15); // exactly 3 years, 2 months later
+    expect(tenure(start, end)).toBe("3 Jahre, 2 Monate");
+  });
+
+  it("uses singular Jahr/Monat for exactly 1", () => {
+    const start = new Date(2020, 0, 1);
+    const end = new Date(2021, 1, 1); // 1 year, 1 month
+    expect(tenure(start, end)).toBe("1 Jahr, 1 Monat");
+  });
+
+  it("falls back to 'unter 1 Monat' for less than a month", () => {
+    const start = new Date(2024, 0, 1);
+    const end = new Date(2024, 0, 15);
+    expect(tenure(start, end)).toBe("unter 1 Monat");
+  });
+
+  it("defaults the end date to today when no end date is given", () => {
+    const start = new Date();
+    expect(tenure(start)).toBe("unter 1 Monat");
+  });
+});
+
+describe("daysBetween", () => {
+  it("computes whole days between two dates", () => {
+    expect(daysBetween("2026-01-01", "2026-01-11")).toBe(10);
+  });
+
+  it("returns a negative number when the second date precedes the first", () => {
+    expect(daysBetween("2026-01-11", "2026-01-01")).toBe(-10);
+  });
+});

tests/unit/org.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { breadcrumbFor, breadcrumbLabel, type OrgMaps } from "@/lib/org";
+import type { Database } from "@/lib/supabase/types";
+
+type Division = Database["public"]["Tables"]["divisions"]["Row"];
+type Department = Database["public"]["Tables"]["departments"]["Row"];
+type Team = Database["public"]["Tables"]["teams"]["Row"];
+type Location = Database["public"]["Tables"]["locations"]["Row"];
+
+const division: Division = { id: "div-1", org_number: "20100000", name: "Produktion" };
+const department: Department = { id: "dept-1", org_number: "21100000", name: "Fertigung", division_id: "div-1" };
+const team: Team = { id: "team-1", org_number: "22010000", name: "Montage", department_id: "dept-1" };
+const location: Location = { id: "loc-1", name: "Wien-Hernals", country: "Österreich" };
+
+const orgMaps: OrgMaps = {
+  divisions: new Map([[division.id, division]]),
+  departments: new Map([[department.id, department]]),
+  teams: new Map([[team.id, team]]),
+  locations: new Map([[location.id, location]]),
+  divisionList: [division],
+  locationList: [location],
+};
+
+describe("breadcrumbFor", () => {
+  it("resolves division, department (via team), and team from ids", () => {
+    const result = breadcrumbFor(orgMaps, division.id, team.id);
+    expect(result.division?.name).toBe("Produktion");
+    expect(result.department?.name).toBe("Fertigung");
+    expect(result.team?.name).toBe("Montage");
+  });
+
+  it("has no team/department for a division head with no team (team_id null)", () => {
+    const result = breadcrumbFor(orgMaps, division.id, null);
+    expect(result.division?.name).toBe("Produktion");
+    expect(result.team).toBeUndefined();
+    expect(result.department).toBeUndefined();
+  });
+});
+
+describe("breadcrumbLabel", () => {
+  it("joins division › department › team with the SAP-OM breadcrumb separator", () => {
+    expect(breadcrumbLabel(orgMaps, division.id, team.id)).toBe("Produktion › Fertigung › Montage");
+  });
+
+  it("omits missing segments instead of producing empty separators", () => {
+    expect(breadcrumbLabel(orgMaps, division.id, null)).toBe("Produktion");
+  });
+
+  it("falls back to a dash when nothing resolves", () => {
+    expect(breadcrumbLabel(orgMaps, null, null)).toBe("–");
+  });
+});

tests/unit/reports.test.ts

@@ -0,0 +1,164 @@
+import { describe, expect, it } from "vitest";
+import {
+  aggregateReport,
+  groupKeyFor,
+  measureValue,
+  MEASURE_LABELS,
+  type Measure,
+  type OrgLookups,
+  type ReportEmployee,
+} from "@/lib/reports";
+
+function emp(overrides: Partial<ReportEmployee> = {}): ReportEmployee {
+  return {
+    id: "1",
+    first_name: "Maria",
+    last_name: "Gruber",
+    job_title: "Maschinenbediener:in",
+    division_id: "div-1",
+    team_id: "team-1",
+    location_id: "loc-1",
+    status: "Aktiv",
+    employment_type: "Vollzeit",
+    contract_type: "unbefristet",
+    entry_date: "2020-01-01",
+    exit_date: null,
+    weekly_hours: 38.5,
+    source: "Extern",
+    paygrade: "B",
+    birth_date: "1990-01-01",
+    gender: "w",
+    ...overrides,
+  };
+}
+
+const lookups: OrgLookups = {
+  divisionName: new Map([["div-1", "Produktion"]]),
+  departmentNameByTeam: new Map([["team-1", "Fertigung"]]),
+  teamName: new Map([["team-1", "Montage"]]),
+  locationName: new Map([["loc-1", "Wien-Hernals"]]),
+};
+
+describe("no salary measure in scope (consolidation §4/§8)", () => {
+  it("does not expose an avg_salary measure", () => {
+    expect(Object.keys(MEASURE_LABELS)).not.toContain("avg_salary");
+  });
+});
+
+describe("groupKeyFor", () => {
+  it("resolves division/department/team/location names via lookups", () => {
+    const e = emp();
+    expect(groupKeyFor(e, "division", lookups)).toBe("Produktion");
+    expect(groupKeyFor(e, "department", lookups)).toBe("Fertigung");
+    expect(groupKeyFor(e, "team", lookups)).toBe("Montage");
+    expect(groupKeyFor(e, "location", lookups)).toBe("Wien-Hernals");
+  });
+
+  it("falls back to a dash for department/team when the employee has no team", () => {
+    const e = emp({ team_id: null });
+    expect(groupKeyFor(e, "department", lookups)).toBe("–");
+    expect(groupKeyFor(e, "team", lookups)).toBe("–");
+  });
+
+  it("falls back to 'Unbekannt' for an unresolvable division/location id", () => {
+    const e = emp({ division_id: "ghost", location_id: "ghost" });
+    expect(groupKeyFor(e, "division", lookups)).toBe("Unbekannt");
+    expect(groupKeyFor(e, "location", lookups)).toBe("Unbekannt");
+  });
+
+  it("derives entry_year from entry_date", () => {
+    expect(groupKeyFor(emp({ entry_date: "2019-06-01" }), "entry_year", lookups)).toBe("2019");
+  });
+});
+
+describe("measureValue", () => {
+  it("returns 0 for an empty row set regardless of measure", () => {
+    expect(measureValue([], "headcount")).toBe(0);
+  });
+
+  it("counts headcount/hires/exits as row length", () => {
+    const rows = [emp(), emp({ id: "2" }), emp({ id: "3" })];
+    (["headcount", "hires", "exits"] as Measure[]).forEach((m) => expect(measureValue(rows, m)).toBe(3));
+  });
+
+  it("sums FTE as weekly_hours / 38.5", () => {
+    const rows = [emp({ weekly_hours: 38.5 }), emp({ weekly_hours: 19.25 })];
+    expect(measureValue(rows, "fte")).toBeCloseTo(1.5, 5);
+  });
+
+  it("computes parttime_rate as a percentage of Teilzeit employees", () => {
+    const rows = [
+      emp({ employment_type: "Vollzeit" }),
+      emp({ employment_type: "Teilzeit" }),
+      emp({ employment_type: "Teilzeit" }),
+      emp({ employment_type: "Teilzeit" }),
+    ];
+    expect(measureValue(rows, "parttime_rate")).toBe(75);
+  });
+
+  it("computes female_share as a percentage", () => {
+    const rows = [emp({ gender: "w" }), emp({ gender: "w" }), emp({ gender: "m" })];
+    expect(measureValue(rows, "female_share")).toBeCloseTo(66.67, 1);
+  });
+
+  it("computes avg_age from birth_date", () => {
+    const today = new Date();
+    const thirtyYearsAgo = `${today.getFullYear() - 30}-01-01`;
+    const fortyYearsAgo = `${today.getFullYear() - 40}-01-01`;
+    const rows = [emp({ birth_date: thirtyYearsAgo }), emp({ birth_date: fortyYearsAgo })];
+    expect(measureValue(rows, "avg_age")).toBeCloseTo(35, 0);
+  });
+
+  it("computes avg_tenure in years using exit_date when present (deterministic)", () => {
+    const rows = [
+      emp({ entry_date: "2020-01-01", exit_date: "2022-01-01" }), // ~2 years
+      emp({ entry_date: "2020-01-01", exit_date: "2024-01-01" }), // ~4 years
+    ];
+    expect(measureValue(rows, "avg_tenure")).toBeCloseTo(3, 0);
+  });
+});
+
+describe("aggregateReport", () => {
+  it("groups rows, sorts groups descending by value, and never includes a salary field", () => {
+    const employees = [
+      emp({ id: "1", division_id: "div-1" }),
+      emp({ id: "2", division_id: "div-1" }),
+      emp({ id: "3", division_id: "div-2" }),
+    ];
+    const multiDivisionLookups: OrgLookups = {
+      ...lookups,
+      divisionName: new Map([
+        ["div-1", "Produktion"],
+        ["div-2", "IT"],
+      ]),
+    };
+    const rows = aggregateReport(employees, "headcount", "division", null, multiDivisionLookups);
+    expect(rows[0]).toMatchObject({ key: "Produktion", value: 2, count: 2 });
+    expect(rows[1]).toMatchObject({ key: "IT", value: 1, count: 1 });
+    for (const row of rows) {
+      for (const person of row.people) {
+        expect(person).not.toHaveProperty("monthly_salary_gross");
+      }
+    }
+  });
+
+  it("caps drilldown people list source data at the full group (UI caps display, not aggregation)", () => {
+    const employees = Array.from({ length: 15 }, (_, i) => emp({ id: String(i) }));
+    const rows = aggregateReport(employees, "headcount", "division", null, lookups);
+    expect(rows[0].people).toHaveLength(15);
+  });
+
+  it("adds a split breakdown per group when a split dimension is given", () => {
+    const employees = [
+      emp({ id: "1", employment_type: "Vollzeit" }),
+      emp({ id: "2", employment_type: "Teilzeit" }),
+    ];
+    const rows = aggregateReport(employees, "headcount", "division", "employment_type", lookups);
+    expect(rows[0].split).toEqual(
+      expect.arrayContaining([
+        { key: "Vollzeit", value: 1, count: 1 },
+        { key: "Teilzeit", value: 1, count: 1 },
+      ])
+    );
+  });
+});