feat: implement permissions and actions management

- Add permissions logic for status options in corrective actions.
- Create tests for permissions functionality.
- Implement queries for user authentication and actions management.
- Develop Actions page to display and manage corrective actions.
- Create authentication pages for login, setup, and password reset.
- Add IncidentDetail page to view incident details and associated actions.
- Implement Settings page for user management and password changes.

server/db/schema.ts

@@ -12,6 +12,7 @@ export const rcaMethodEnum = pgEnum('rca_method', vocab.rcaMethods)
 export const rootCauseCategoryEnum = pgEnum('root_cause_category', vocab.rootCauseCategories)
 export const actionKindEnum = pgEnum('action_kind', vocab.actionKinds)
 export const actionStatusEnum = pgEnum('action_status', vocab.actionStatuses)
+export const authTokenPurposeEnum = pgEnum('auth_token_purpose', ['magic_link', 'password_reset'])
 
 const id = () => uuid().primaryKey().defaultRandom()
 const timestamptz = () => timestamp({ withTimezone: true })
@@ -62,6 +63,23 @@ export const sessions = pgTable(
   (t) => [index('sessions_user_idx').on(t.userId)],
 )
 
+/** Single-use links sent by email (magic sign-in, password reset/invite). */
+export const authTokens = pgTable(
+  'auth_tokens',
+  {
+    /** SHA-256 of the token sent in the link. */
+    id: text().primaryKey(),
+    userId: uuid()
+      .notNull()
+      .references(() => users.id, { onDelete: 'cascade' }),
+    purpose: authTokenPurposeEnum().notNull(),
+    expiresAt: timestamptz().notNull(),
+    usedAt: timestamptz(),
+    createdAt: createdAt(),
+  },
+  (t) => [index('auth_tokens_user_idx').on(t.userId)],
+)
+
 export const sites = pgTable(
   'sites',
   {
@@ -230,6 +248,8 @@ export const correctiveActions = pgTable(
     completedAt: timestamptz(),
     verifiedById: uuid().references(() => users.id, { onDelete: 'set null' }),
     verifiedAt: timestamptz(),
+    /** Date the last due/overdue reminder was emailed, so it goes out at most once a day. */
+    reminderSentOn: date({ mode: 'string' }),
     createdAt: createdAt(),
     updatedAt: updatedAt(),
   },