From d1d7499e68f817c36067b6cbb614f56ab2eda1a7 Mon Sep 17 00:00:00 2001
From: Riyadh <dev@tx.local>
Date: Sun, 17 May 2026 10:07:57 +0000
Subject: [PATCH] feat(executive-meetings): grant executive_ceo mutate + audit
 + push notify (Task #561)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

User request: السماح للرئيس (executive_ceo) بإنشاء/تعديل/تأجيل/حذف
الاجتماعات، استلام إشعارات Push للتذكير، والاطلاع على سجل التدقيق —
مع إبقاء إعدادات الخطوط/الشعار حصرية على مدير المكتب التنفيذي.

Changes (3 lines added, backend-only):

1. artifacts/api-server/src/routes/executive-meetings.ts
   - Added "executive_ceo" to MUTATE_ROLES (line 120) → POST/PATCH/DELETE
     on meetings now accepted for the CEO role.
   - Added "executive_ceo" to ADMIN_AUDIT_ROLES (line 130) → /audit
     endpoint now reachable; canViewAudit=true in the bootstrap payload.
   - EM_ADMIN_ROLES intentionally untouched, so font-settings and global
     PDF brand assets remain admin + executive_office_manager only.

2. artifacts/api-server/src/lib/executive-meeting-scheduler.ts
   - Added "executive_ceo" to EM_NOTIFY_ROLES (line 18) → CEO users with
     an active Web Push subscription now receive the LEAD_MINUTES=5
     pre-meeting reminder push.

Frontend requires no changes: it gates buttons on canMutate /
canViewAudit booleans returned by the bootstrap endpoint (lines
617-619), which flip to true automatically for the CEO role.

Verification: API workflow restarted clean, scheduler started OK,
/api/executive-meetings and /alert-state respond 304/200.

NOT pushed to Gitea: Tailscale link to desktop-11cj93j is still down
from this sandbox (HTTP=000). Task #560's earlier VAPID fix
(74c9ceef) is also still pending push. Both will go up together when
the tunnel recovers, or the user can apply the same one-line edits
on the Mac and rebuild the api container.
---
 artifacts/api-server/src/lib/executive-meeting-scheduler.ts | 6 +++++-
 artifacts/api-server/src/routes/executive-meetings.ts       | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/artifacts/api-server/src/lib/executive-meeting-scheduler.ts b/artifacts/api-server/src/lib/executive-meeting-scheduler.ts
index b8241e31..8a45d09c 100644
--- a/artifacts/api-server/src/lib/executive-meeting-scheduler.ts
+++ b/artifacts/api-server/src/lib/executive-meeting-scheduler.ts
@@ -10,7 +10,11 @@ import { getUserIdsForRoleNames } from "./executive-meeting-notify";
 
 const TICK_MS = 60_000;
 const LEAD_MINUTES = 5;
-const EM_NOTIFY_ROLES = ["admin", "executive_office_manager"] as const;
+const EM_NOTIFY_ROLES = [
+  "admin",
+  "executive_ceo",
+  "executive_office_manager",
+] as const;
 
 function pad2(n: number): string {
   return String(n).padStart(2, "0");
diff --git a/artifacts/api-server/src/routes/executive-meetings.ts b/artifacts/api-server/src/routes/executive-meetings.ts
index 86ec5238..9cfc8e7f 100644
--- a/artifacts/api-server/src/routes/executive-meetings.ts
+++ b/artifacts/api-server/src/routes/executive-meetings.ts
@@ -117,12 +117,14 @@ const FONT_SIZE_MAX = 22;
 
 const MUTATE_ROLES = [
   "admin",
+  "executive_ceo",
   "executive_office_manager",
   "executive_coord_lead",
 ] as const;
 const EM_ADMIN_ROLES = ["admin", "executive_office_manager"] as const;
 const ADMIN_AUDIT_ROLES = [
   "admin",
+  "executive_ceo",
   "executive_office_manager",
   "executive_coord_lead",
 ] as const;