feat: implement permissions and actions management

- Add permissions logic for status options in corrective actions.
- Create tests for permissions functionality.
- Implement queries for user authentication and actions management.
- Develop Actions page to display and manage corrective actions.
- Create authentication pages for login, setup, and password reset.
- Add IncidentDetail page to view incident details and associated actions.
- Implement Settings page for user management and password changes.

server/app.ts

@@ -6,19 +6,38 @@ import { loadSession } from './auth/middleware.ts'
 import type { Config } from './config.ts'
 import type { Db } from './db/client.ts'
 import type { AppEnv } from './lib/http.ts'
+import type { Notifier } from './notifications.ts'
+import { actionRoutes } from './routes/actions.ts'
+import { attachmentRoutes } from './routes/attachments.ts'
 import { authRoutes } from './routes/auth.ts'
 import { incidentRoutes } from './routes/incidents.ts'
+import { rootCauseRoutes } from './routes/root-causes.ts'
 import { setupRoutes } from './routes/setup.ts'
 import { areaRoutes, siteRoutes } from './routes/sites.ts'
+import { statsRoutes } from './routes/stats.ts'
 import { userRoutes } from './routes/users.ts'
+import type { FileStorage } from './storage.ts'
 
-export function createApp({ db, config }: { db: Db; config: Config }) {
+export interface AppDeps {
+  db: Db
+  config: Config
+  notifier: Notifier
+  storage: FileStorage
+}
+
+export function createApp({ db, config, notifier, storage }: AppDeps) {
   const app = new Hono<AppEnv>()
 
   app.use('*', secureHeaders())
-  app.use('/api/*', csrf(), async (c, next) => {
+  const publicOrigin = new URL(config.publicUrl).origin
+  // Form/multipart posts must come from our own pages. JSON requests are already protected by CORS preflight.
+  const sameSite = csrf({ origin: (origin, c) => origin === publicOrigin || origin === new URL(c.req.url).origin })
+
+  app.use('/api/*', sameSite, async (c, next) => {
     c.set('db', db)
     c.set('config', config)
+    c.set('notifier', notifier)
+    c.set('storage', storage)
     c.header('Cache-Control', 'no-store')
     await next()
   })
@@ -31,6 +50,10 @@ export function createApp({ db, config }: { db: Db; config: Config }) {
   app.route('/api/sites', siteRoutes)
   app.route('/api/areas', areaRoutes)
   app.route('/api/incidents', incidentRoutes)
+  app.route('/api/root-causes', rootCauseRoutes)
+  app.route('/api/actions', actionRoutes)
+  app.route('/api/attachments', attachmentRoutes)
+  app.route('/api/stats', statsRoutes)
   app.all('/api/*', (c) => c.json({ error: 'Not found' }, 404))
 
   app.onError((error, c) => {