a7a1f8ee98
Setup wizard step 1/5 (#409). The list is a Server Component, so the visibility rule runs before anything reaches the browser and a project the user may not see is never serialised to it. The rule itself is not restated: `listVisibleProjects` loads each project's facts and asks `canViewProject` from `@/lib/projects/authz`. Writing the `domna_admin_access OR owning-org OR contractor-org` disjunction a second time in SQL would have given it two definitions free to drift, and the acceptance criteria (client sees its own, contractor sees what it is assigned to, internal sees all subject to `domna_admin_access`) fall out of the one definition instead of being re-derived. The cost is filtering in the app rather than the database, over two round trips and no N+1. That is the right trade while a project is a works programme and they number in the tens; if the table grows, the fix is a superset prefilter that still lets `canViewProject` decide, not a WHERE clause that re-implements it. Flagged in the function's own docs. Creation reuses the same guard rather than inventing a "can create" rule: `prospectiveProjectFacts` builds the facts the project *would* have, and `canManageProject` judges them. One consequence is worth knowing, and is covered by a test — `domna_admin_access` gates the `internal` role, so a Domna user creating for an organisation they are not a member of must grant that access. Without it they would be creating a project they could not then see, and the guard refuses rather than producing an orphan. The modal offers only organisations the user may pick, but the route handler re-checks the submitted one: a hidden option is not a permission. `createProjectSchema` is shared by the form (as a zodResolver) and the route handler (as the body parser), so the two cannot disagree about what a valid draft is. Empty strings from untouched inputs normalise to undefined rather than reaching the columns as "". Also updates projects-shell.cy.js. Its "renders the per-project dashboard shell" test passed only because the authz stub could never return false; with the real lib wired in, /projects/<id> is a 404 without standing on that project, so the test now asserts that instead. TESTS: the vitest unit tests pass (50, no database connection). Cypress was NOT run — this environment's DATABASE_URL points at production. The new spec is therefore unverified, and its end-to-end half, which INSERTs, is gated behind CYPRESS_ARA_PROJECTS_E2E_WRITES so it cannot fire by accident; it also needs the #407 seed migration (0274) applied, which has not been run against any database yet either. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .devcontainer | ||
| .github/workflows | ||
| .impeccable/critique | ||
| .vscode | ||
| backlog | ||
| cypress | ||
| docs | ||
| drizzle/meta | ||
| public | ||
| src | ||
| .db-env | ||
| .eslintrc.json | ||
| .gitignore | ||
| CLAUDE.md | ||
| components.json | ||
| CONTEXT.md | ||
| cypress.config.ts | ||
| devcontainer.sh | ||
| drizzle.config.ts | ||
| generate_migration.sh | ||
| migrate_to_db.sh | ||
| next.config.js | ||
| package-lock.json | ||
| package.json | ||
| postcss.config.js | ||
| PRODUCT.md | ||
| README.md | ||
| run_build.sh | ||
| run_local.sh | ||
| skills-lock.json | ||
| tailwind.config.js | ||
| tsconfig.json | ||
| vitest.config.ts | ||
This is a Next.js project bootstrapped with create-next-app.
Getting Started
When first getting set up you'll firstly want to install the existing dependencies. To do this, simply run
npm install
# or
yarn install
First, run the development server:
npm run dev
# or
yarn dev
# or
pnpm dev
Open http://localhost:3000 with your browser to see the result.
You can start editing the page by modifying app/page.tsx. The page auto-updates as you edit the file.
This project uses next/font to automatically optimize and load Inter, a custom Google Font.
Learn More
To learn more about Next.js, take a look at the following resources:
- Next.js Documentation - learn about Next.js features and API.
- Learn Next.js - an interactive Next.js tutorial.
You can check out the Next.js GitHub repository - your feedback and contributions are welcome!
Deploy on Vercel
The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.
Check out our Next.js deployment documentation for more details.
We currently have a development version, found at https://assessment-model-dev.vercel.app, and a production version at https://assessment-model.vercel.app, however the production version is missing a significant number of environmental variables, which will need to be added.
Drizzle ORM
We're using Drizzle ORM to interface with our AWS Postgres database. Documentation on getting set up can be found here
Schemas
In order to get started with Drizzle, a schema needs to be created. Schemas can be added src/app/db/schema as typescript files. See the documentation on how to set up schemas but effectively, Drizzle allows you to define schemas as typescript code, which allows for simple, type safe schema definitions.
Creating Migrations
To create a migration, a command has been set up in package.json. Simply run
npm run migration:generate
Or with yarn/pnmp accordingly.
Note, there seems to be a bug with Drizzle which is documented here.
The workaround is to open up tsconfig.json and comment out "target": "es5", and replace it with "target": "ESNext". This should hopefully only
be a temporary workaround required.
Pushing migrations
To push migrations, another command has been set up in package.json, since drizzle-kit currently does not support pushing for Postgres out of the box.
Run
npm run migration:push
Which will commit changes to the database. The database changes will be pushed to the public schema, whereas a meta record will be pushed to the __drizzle_migrations schema.
Inserting users into the database
In order to insert a user into the database, simply run
npm run create_users -- {email} {firstName}
Since we're using just the built in process arguments to read command line arguments, the ordering of arguments needs to be email address and then name
Cypress Testing Documentation
This document provides an overview of how to perform end-to-end testing using Cypress for the login functionality of the application. The testing code is based on the provided code snippets.
Prerequisites
Node.js installed on your machine Cypress installed as a dev dependency in your project
Test Execution
To execute the login tests, follow these steps:
- Run
npm run test:e2e:open
Which will open Crypress test runner
- Select the tests that you want to run. At the time of writing, only login tests have been completed
Key files
The key files that are at play for testing are documented here. Because of some issues testing next-auth and setting cookies, a custom command to set
the JWT, and avoid the functionality defined in the signIn function as defined in src/app/api/auth/[...nextauth]/route.ts
cypress/plugins/index.js is a standard file, required by cypress to journey through the Google Oauth flow
cypress/figtures/session.json is a user fixture that is used to log in a user in the login tests
cypress/support/commands.ts creates a custom login user command which sets a JWT and allows us to actually authenticate. cy.intercept only mocks the client side behaviour of the apis and therefore does not set any cookies, do this function does this manually.
Generating pre-signed urls
In our terraform stack, we have a module called s3_presignable_bucket which contains the definition for our bucket which we will use to store retrofit plan input csv's in.
We will generate a pre-signed url and then make a post request to that endpoint to store that data to s3. Part of that process is the creation of an AWS IAM role which contains
the permission set to access the bucket, rerofit-plan-inputs-<stage>. The name of this IAM role is s3_presign_role_<stage> and for our NextJS application, as it's hosted outside of AWS (for the moment), we need to generate a set of access credentials to give the application access to this bucket. The access key and secret key are automatically generated and stored in AWS secrets manager under dev/presign_frontend/access_key and dev/presign_frontend/secret_key and need to be set in the environment for the pre-sign api to store csv data to aws.