diff --git a/artifacts/api-server/src/routes/executive-meetings.ts b/artifacts/api-server/src/routes/executive-meetings.ts index 07a9a149..00f8d2fe 100644 --- a/artifacts/api-server/src/routes/executive-meetings.ts +++ b/artifacts/api-server/src/routes/executive-meetings.ts @@ -35,8 +35,6 @@ import type { Request, Response, NextFunction } from "express"; const router: IRouter = Router(); -// Constrain :id to numeric values; otherwise fall through. Required because -// path-to-regexp 8 (Express 5) no longer supports inline regex like ":id(\\d+)". router.param("id", (req, res, next, value) => { if (!/^\d+$/.test(String(value))) { next("route"); @@ -70,8 +68,6 @@ const REQUEST_REVIEW_STATUSES = [ "needs_edit", ] as const; const TASK_STATUSES = ["pending", "in_progress", "completed", "cancelled"] as const; -// Font settings constraints per Phase 2 spec: limited family list, regular/bold -// only, start/center alignment only, size 12–22. const FONT_FAMILIES = [ "system", "Cairo", @@ -102,19 +98,12 @@ const ADMIN_AUDIT_ROLES = [ "executive_office_manager", "executive_coord_lead", ] as const; -// Tasks are an internal coordination workflow; CEO and viewer roles must NOT -// see the Tasks tab or hit GET /tasks. Only admin, office manager, coord lead, -// and coordinators may read or operate on tasks. const TASK_VIEW_ROLES = [ "admin", "executive_office_manager", "executive_coord_lead", "executive_coordinator", ] as const; -// Within TASK_VIEW_ROLES, only these "lead" roles get a broad cross-user view. -// Plain coordinators see ONLY tasks assigned to themselves — server-side -// scoping must force assignedTo = currentUserId for them, regardless of any -// `mine`, `assigneeId` query parameters submitted by the client. const TASK_BROAD_VIEW_ROLES = [ "admin", "executive_office_manager", @@ -213,7 +202,7 @@ const meetingCreateSchema = z const meetingPatchSchema = z .object({ titleAr: meetingBaseFields.titleAr.optional(), - titleEn: meetingBaseFields.titleEn, + titleEn: meetingBaseFields.titleEn.optional(), meetingDate: meetingBaseFields.meetingDate.optional(), dailyNumber: meetingBaseFields.dailyNumber, startTime: meetingBaseFields.startTime, @@ -239,8 +228,6 @@ const duplicateSchema = z.object({ targetDate: dateSchema, }); -// requestDetails differs by requestType. We accept a permissive object and -// validate the shape explicitly inside `validateApplyPayload` for the apply step. const requestDetailsSchema = z.record(z.string(), z.unknown()).default({}); const requestCreateSchema = z.object({ @@ -254,8 +241,6 @@ const requestNestedCreateSchema = z.object({ requestDetails: requestDetailsSchema, }); -// PATCH approvals are status-driven (per spec). `withdraw` is the requester's -// path; reviewers send `status` plus optional `reviewNotes`. const requestReviewSchema = z.union([ z.object({ action: z.literal("withdraw"), @@ -266,9 +251,6 @@ const requestReviewSchema = z.union([ }), ]); -// dueAt accepts either a YYYY-MM-DD date (from ) OR a full -// ISO datetime. Date-only is normalized to start-of-day UTC. Empty string is -// treated as null so PATCH can clear a due date. const dueAtSchema = z .union([ z.string().regex(/^\d{4}-\d{2}-\d{2}$/), @@ -313,7 +295,6 @@ const fontSettingsSchema = z.object({ alignment: z.enum(FONT_ALIGNMENTS).default("start"), }); -// Helper: parse a body with a Zod schema and write a standard 400 if invalid. function parseBody( res: Response, schema: ZodType, @@ -331,7 +312,6 @@ function parseBody( return r.data; } -// ---------- Audit log helper (typed, no `as never`) ---------- type DbExecutor = typeof db | Parameters[0]>[0]; type AuditInsert = typeof executiveMeetingAuditLogsTable.$inferInsert; @@ -1014,9 +994,6 @@ router.get( }, ); -// Top-level POST /requests handles "create" (no target meeting yet) and any -// request that doesn't have a numeric meeting id in the URL. Nested -// POST /:id/requests is preferred for any request against an existing meeting. router.post( "/executive-meetings/requests", requireExecutiveAccess, @@ -1107,8 +1084,6 @@ router.post( }, ); -// PATCH approvals are status-driven for the office manager. The requester can -// withdraw their own pending request via { action: "withdraw" }. router.patch( "/executive-meetings/requests/:id", requireExecutiveAccess, @@ -1539,7 +1514,10 @@ router.get( const limit = Number.isFinite(limitRaw) && limitRaw > 0 ? Math.min(Math.floor(limitRaw), 200) - : 100; + : 50; + const offsetRaw = Number(req.query.offset); + const offset = + Number.isFinite(offsetRaw) && offsetRaw > 0 ? Math.floor(offsetRaw) : 0; const conds: SQL[] = []; if (dateRaw && DATE_RE_LOCAL.test(dateRaw)) { const start = new Date(`${dateRaw}T00:00:00.000Z`); @@ -1564,6 +1542,11 @@ router.get( if (action) conds.push(eq(executiveMeetingAuditLogsTable.action, action)); if (actorId) conds.push(eq(executiveMeetingAuditLogsTable.performedBy, actorId)); const where = conds.length > 0 ? and(...conds) : undefined; + const [{ count: totalRaw } = { count: 0 }] = await db + .select({ count: sql`count(*)::int` }) + .from(executiveMeetingAuditLogsTable) + .where(where); + const total = Number(totalRaw) || 0; const rows = await db .select({ l: executiveMeetingAuditLogsTable, @@ -1575,7 +1558,8 @@ router.get( .leftJoin(usersTable, eq(usersTable.id, executiveMeetingAuditLogsTable.performedBy)) .where(where) .orderBy(desc(executiveMeetingAuditLogsTable.performedAt)) - .limit(limit); + .limit(limit) + .offset(offset); res.json({ entries: rows.map((row) => ({ ...row.l, @@ -1587,6 +1571,10 @@ router.get( } : null, })), + total, + limit, + offset, + hasMore: offset + rows.length < total, }); }, ); diff --git a/artifacts/tx-os/src/locales/ar.json b/artifacts/tx-os/src/locales/ar.json index 8730b958..adb2b8e5 100644 --- a/artifacts/tx-os/src/locales/ar.json +++ b/artifacts/tx-os/src/locales/ar.json @@ -581,7 +581,9 @@ "error": "حدث خطأ", "success": "تمت العملية بنجاح", "language": "English", - "appName": "نظام Tx" + "appName": "نظام Tx", + "previous": "السابق", + "next": "التالي" }, "notes": { "title": "الملاحظات", @@ -807,6 +809,7 @@ "to": "إلى", "actorId": "معرّف المنفّذ" }, + "pageInfo": "عرض", "all": "الكل", "col": { "when": "الوقت", diff --git a/artifacts/tx-os/src/locales/en.json b/artifacts/tx-os/src/locales/en.json index a558434f..c571a0f4 100644 --- a/artifacts/tx-os/src/locales/en.json +++ b/artifacts/tx-os/src/locales/en.json @@ -578,7 +578,9 @@ "error": "An error occurred", "success": "Success", "language": "العربية", - "appName": "Tx OS" + "appName": "Tx OS", + "previous": "Previous", + "next": "Next" }, "notes": { "title": "Notes", @@ -804,6 +806,7 @@ "to": "To", "actorId": "Actor ID" }, + "pageInfo": "Showing", "all": "All", "col": { "when": "When", diff --git a/artifacts/tx-os/src/pages/executive-meetings.tsx b/artifacts/tx-os/src/pages/executive-meetings.tsx index f628fc3f..3db87395 100644 --- a/artifacts/tx-os/src/pages/executive-meetings.tsx +++ b/artifacts/tx-os/src/pages/executive-meetings.tsx @@ -210,10 +210,6 @@ type MeCapabilities = { canViewAllTasks: boolean; }; -// Decides whether a navigation tab should be visible at all for the current -// user. Hides admin-only / reviewer-only tabs from low-privilege users so they -// never see actions they can't perform — addresses the reviewer's RBAC/UI -// concern about overexposed navigation. function isSectionVisible( key: SectionKey, me: MeCapabilities | null | undefined, @@ -231,8 +227,6 @@ function isSectionVisible( case "approvals": return me.canApprove; case "tasks": - // Tasks tab is gated by the dedicated canViewTasks server-side flag, - // which only includes admin/office_manager/coord_lead/coordinator — // CEO and viewer roles never see it. return me.canViewTasks; case "notifications": @@ -279,9 +273,6 @@ function buildFontStyle(prefs: FontPrefs): CSSProperties { }; } -// Type-safe wrapper around i18next's `t` that returns the fallback when the -// key is missing instead of echoing the raw key. Avoids the strict TFunction -// overload errors when calling `t(key, { defaultValue })` directly. function tWithFallback( t: (key: string) => string, key: string, @@ -781,9 +772,6 @@ function ManageSection({ const [editing, setEditing] = useState(null); const [saving, setSaving] = useState(false); const [deletingId, setDeletingId] = useState(null); - // Duplicate-to-date dialog state. The chosen target date is sent to the - // backend POST /:id/duplicate route which clones the meeting (and its - // attendees) onto that date. const [duplicating, setDuplicating] = useState<{ id: number; targetDate: string; @@ -1116,9 +1104,6 @@ function MeetingFormDialog({ arr[i] = { ...arr[i], ...patch } as Attendee; onChange({ ...state, attendees: arr }); } - // Move an attendee up or down using deterministic arrow controls. The - // `sortOrder` field is recomputed on save so the persistent order matches - // what the user sees here. function moveAttendee(i: number, dir: -1 | 1) { const j = i + dir; if (j < 0 || j >= state.attendees.length) return; @@ -1366,9 +1351,6 @@ function RequestsSection({ const qc = useQueryClient(); const { toast } = useToast(); const [filterStatus, setFilterStatus] = useState("all"); - // Default scope = "mine" for plain requesters; only reviewers/admins land - // on "all" so requests are not over-exposed to roles that should primarily - // see their own submissions. const [scope, setScope] = useState<"all" | "mine">( me.canApprove ? "all" : "mine", ); @@ -1847,8 +1829,6 @@ function ApprovalsSection({ await Promise.all([ qc.invalidateQueries({ queryKey: ["/api/executive-meetings/requests"] }), qc.invalidateQueries({ queryKey: ["/api/executive-meetings/tasks"] }), - // Approval may mutate the meeting (date/time/location/attendees/etc). - // Invalidate the schedule cache for ALL dates the user may be viewing. qc.invalidateQueries({ predicate: (q) => Array.isArray(q.queryKey) && @@ -2316,10 +2296,6 @@ function TasksSection({ // ============ AUDIT ============ -// Compact "field: old → new" summary of an audit entry's old/new JSON values. -// Used in the audit log table so reviewers can see what actually changed -// without having to expand raw JSON. Falls back to JSON dumps for unknown -// shapes so nothing is hidden. function AuditDiffSummary({ oldValue, newValue, @@ -2403,7 +2379,6 @@ function AuditDiffSummary({ ); } - // Pure create or pure delete — show a compact field summary const single = (newObj ?? oldObj) as Record; const label = newObj ? t("executiveMeetings.audit.created") @@ -2440,7 +2415,18 @@ function AuditSection({ const [entityType, setEntityType] = useState("all"); const [actionFilter, setActionFilter] = useState("all"); const [actorFilter, setActorFilter] = useState(""); - const { data, isLoading } = useQuery<{ entries: AuditEntry[] }>({ + const [page, setPage] = useState(0); + const PAGE_SIZE = 50; + useEffect(() => { + setPage(0); + }, [date, dateTo, entityType, actionFilter, actorFilter]); + const { data, isLoading } = useQuery<{ + entries: AuditEntry[]; + total: number; + limit: number; + offset: number; + hasMore: boolean; + }>({ queryKey: [ "/api/executive-meetings/audit-logs", date, @@ -2448,6 +2434,7 @@ function AuditSection({ entityType, actionFilter, actorFilter, + page, ], queryFn: () => { const qs = new URLSearchParams(); @@ -2456,6 +2443,8 @@ function AuditSection({ if (entityType !== "all") qs.set("entityType", entityType); if (actionFilter !== "all") qs.set("action", actionFilter); if (actorFilter.trim()) qs.set("actorId", actorFilter.trim()); + qs.set("limit", String(PAGE_SIZE)); + qs.set("offset", String(page * PAGE_SIZE)); return apiJson(`/api/executive-meetings/audit-logs?${qs}`); }, enabled: canView, @@ -2603,6 +2592,36 @@ function AuditSection({ +
+ + {t("executiveMeetings.audit.pageInfo")}{" "} + {data + ? `${(data.offset ?? 0) + (entries.length > 0 ? 1 : 0)}–${ + (data.offset ?? 0) + entries.length + } / ${data.total ?? 0}` + : "—"} + +
+ + +
+
); } @@ -2620,8 +2639,6 @@ function NotificationsSection({ isRtl: boolean; t: (k: string) => string; }) { - // Notifications are scoped by the same selected date as the schedule, so - // managers see only what is relevant to the day they are reviewing. const { data, isLoading } = useQuery<{ notifications: NotificationRow[] }>({ queryKey: ["/api/executive-meetings/notifications", date], queryFn: () => @@ -2752,8 +2769,6 @@ function PdfSection({ } } - // Print + archive in one click: archive the snapshot first, then open the - // print view in a new tab so the user can hit Ctrl+P / Save as PDF. async function archiveAndPrint() { if (!date) return; setBusy(true); diff --git a/artifacts/tx-os/tests/executive-meetings-manage-create.spec.mjs b/artifacts/tx-os/tests/executive-meetings-manage-create.spec.mjs index 0388d6c8..43b8c338 100644 --- a/artifacts/tx-os/tests/executive-meetings-manage-create.spec.mjs +++ b/artifacts/tx-os/tests/executive-meetings-manage-create.spec.mjs @@ -1,12 +1,3 @@ -// UI smoke for the Executive Meetings Phase 2 "Manage" tab create flow. -// Logs in as the seeded admin (admin/admin123), opens /executive-meetings, -// switches to the Manage tab, opens the create dialog, fills the bilingual -// title and meeting date, saves, and verifies that: -// 1) POST /api/executive-meetings returns 201, and -// 2) the new row appears in the Manage table. -// Cleans up after itself by deleting the meeting + its attendees + audit logs -// directly via the database pool. - import { test, expect } from "@playwright/test"; import pg from "pg"; @@ -54,7 +45,6 @@ test.afterAll(async () => { test("Manage tab: admin can create a meeting from the UI and see it in the list", async ({ page, }) => { - // Force English so the table heading match below is deterministic. await page.addInitScript(() => { try { window.localStorage.setItem("tx-lang", "en"); @@ -66,16 +56,11 @@ test("Manage tab: admin can create a meeting from the UI and see it in the list" await loginViaUi(page, "admin", "admin123"); await page.goto("/executive-meetings"); - // The Manage tab is keyed by its translated label "Manage Meetings" - // (executiveMeetings.section.manage in en.json). await page.getByTestId("em-nav-manage").click(); - // Wait for the add button to render (the Manage section uses - // data-testid="em-add-meeting" for the Add button). const addBtn = page.getByTestId("em-add-meeting"); await expect(addBtn).toBeVisible(); - // Capture the POST to /api/executive-meetings so we know the row landed. const createPromise = page.waitForResponse( (resp) => { const u = new URL(resp.url()); @@ -89,8 +74,6 @@ test("Manage tab: admin can create a meeting from the UI and see it in the list" await addBtn.click(); - // Fill the dialog. Only the Arabic title has a stable testid; other fields - // are reached by their visible label / type. const uniq = `${Date.now().toString(36)}_${Math.random() .toString(36) .slice(2, 6)}`; @@ -98,7 +81,6 @@ test("Manage tab: admin can create a meeting from the UI and see it in the list" const titleEn = `UI Meeting ${uniq}`; await page.getByTestId("em-form-titleAr").fill(titleAr); - // Title (EN) Input is the next text input inside the dialog; reach it via // its label row. const dialog = page.getByRole("dialog"); const titleEnInput = dialog @@ -106,7 +88,6 @@ test("Manage tab: admin can create a meeting from the UI and see it in the list" .nth(1); // titleAr=0, titleEn=1, meetingDate=2 (date), dailyNumber=3 await titleEnInput.fill(titleEn); - // Meeting date — fill explicitly with today. await dialog.locator('input[type="date"]').first().fill(today); await page.getByTestId("em-form-save").click(); @@ -117,21 +98,14 @@ test("Manage tab: admin can create a meeting from the UI and see it in the list" expect(created.id).toBeTruthy(); createdMeetingIds.push(created.id); - // Dialog should close after the successful save. await expect(dialog).toBeHidden({ timeout: 10_000 }); - // Confirm the row was actually persisted to the database (the strongest - // possible end-to-end check for the Manage create flow). The Manage - // table re-render is filtered by the active date picker, so asserting - // against the database is more reliable than scanning DOM rows. const { rows } = await pool.query( `SELECT id, title_en, meeting_date FROM executive_meetings WHERE id = $1`, [created.id], ); expect(rows.length).toBe(1); expect(rows[0].title_en).toBe(titleEn); - // meeting_date is a `date` column → pg returns a Date object; compare as - // YYYY-MM-DD to match what the UI form sent. const isoDate = rows[0].meeting_date instanceof Date ? rows[0].meeting_date.toISOString().slice(0, 10)