Maximilian Stubhan
8d978981b0
Positions
- Removed the "Besetzen" action, the StaffInternallyModal behind it and the
now-unreachable staffPositionInternally server action: a position is filled
through the hire process, not from the positions list. Note that
transfer_employee has no position_id at all and never touched `positions`,
so with staff_position_internally out of the UI, hire_employee is the only
thing that closes a position — a transfer into an open one leaves it open.
The RPC itself is still in the database and still covered by its tests.
SVNR
- Austrian social security numbers are now validated: ten digits, weighted
check digit mod 11, and the TTMMJJ tail cross-checked against birth_date,
which is what catches a transposed date that a valid check digit would let
through. A serial whose weighted sum lands on 11 is rejected rather than
wrapped — those are never issued.
- Applies to Austrian locations only; the German/Czech/Slovenian equivalents
have their own formats and stay free-form.
- Enforced by a trigger, not inside hire_employee/change_employee_data, for
the same reason as the assignment history: both have been redefined by
half a dozen migrations. Only a *newly written* value is checked, so a
legacy number never blocks an unrelated transfer or address change.
- The seed drew a random four-digit prefix, so its check digit was right
only by chance and every seeded Austrian row would now be rejected;
it computes the check digit properly now.
Tech stack
- next 16.2.11 closes nine advisories against 16.2.10, including a
middleware/proxy bypass in App Router apps on Turbopack — proxy.ts is this
app's entry gate. RLS remains the real boundary, so the blast radius was a
blank page rather than data, but it is a patch-level fix. Also react
19.2.8, tailwind 4.3.3, lucide-react 1.26, supabase-js/ssr, postcss.
- CI runs lint, typecheck, schema/type drift, tests and build; a second job
replays every migration onto an empty database and runs the integration
suite against it, so a migration that cannot be replayed from scratch
fails here instead of during a restore.
- scripts/check-schema-types.mjs diffs the hand-written lib/supabase/types.ts
against the migrations. Reading the SQL rather than a live database keeps
Postgres out of the fast CI job. Verified in both directions.
- vitest now runs two projects: node for logic, jsdom for components. The
first component test covers the org chart expand control, which broke
earlier this session when elementsSelectable={false} made React Flow
compute pointer-events:none for the whole node; re-introducing that prop
fails three of these tests.
- Content-Security-Policy is emitted report-only. Enforcing a policy derived
from inspection rather than from violation reports risks blanking the app;
'unsafe-inline' on script-src is required until a nonce is threaded through
proxy.ts, which is a separate change.
- Fixed supabase/seed.ts, which this session's SVNR change had broken: the
extensionless "../lib/svnr" import does not resolve under Node's ESM
loader, so the seed failed at startup.
- engines pinned to node >=22 <25, tsconfig target ES2022, and the dead
test:e2e script removed (no Playwright is installed).
57 lines
2.0 KiB
TypeScript
57 lines
2.0 KiB
TypeScript
"use server";
|
|
|
|
import { revalidatePath } from "next/cache";
|
|
import { sanitizeIlikeTerm } from "@/lib/supabase/query";
|
|
import { createClient } from "@/lib/supabase/server";
|
|
|
|
type ActionResult = { success: boolean; error?: string };
|
|
|
|
const POSITION_PATHS = ["/positions", "/orgchart", "/"];
|
|
|
|
async function callRpc(
|
|
fn: "create_position" | "delete_position",
|
|
payload: Record<string, unknown>,
|
|
revalidate: string[]
|
|
): Promise<ActionResult> {
|
|
const supabase = await createClient();
|
|
const { error } = await supabase.rpc(fn, { payload });
|
|
if (error) return { success: false, error: error.message };
|
|
for (const path of revalidate) revalidatePath(path);
|
|
return { success: true };
|
|
}
|
|
|
|
export async function createPosition(payload: {
|
|
title: string;
|
|
superior_employee_id: string;
|
|
is_lead: boolean;
|
|
team_id?: string;
|
|
valid_from: string;
|
|
}): Promise<ActionResult> {
|
|
return callRpc("create_position", payload, POSITION_PATHS);
|
|
}
|
|
|
|
export async function deletePosition(positionId: string): Promise<ActionResult> {
|
|
return callRpc("delete_position", { position_id: positionId }, POSITION_PATHS);
|
|
}
|
|
|
|
export type SuperiorSearchResult = { id: string; first_name: string; last_name: string; job_title: string; division_id: string };
|
|
|
|
// For "Position ausschreiben": superior lookup, filtered to team-leads when
|
|
// the new position is an IC role, or to division-heads/CEO when the new
|
|
// position is itself a team lead (§2).
|
|
export async function searchSuperiors(query: string, forLeadPosition: boolean): Promise<SuperiorSearchResult[]> {
|
|
const supabase = await createClient();
|
|
let q = supabase
|
|
.from("employees")
|
|
.select("id, first_name, last_name, job_title, division_id")
|
|
.eq("status", "Aktiv")
|
|
.limit(20);
|
|
q = forLeadPosition ? q.lte("org_level", 1) : q.eq("is_lead", true).eq("org_level", 2);
|
|
if (query.trim()) {
|
|
const term = sanitizeIlikeTerm(query.trim());
|
|
q = q.or(`first_name.ilike.%${term}%,last_name.ilike.%${term}%,job_title.ilike.%${term}%`);
|
|
}
|
|
const { data } = await q;
|
|
return data ?? [];
|
|
}
|