feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

server/routes/incidents.test.ts

@@ -0,0 +1,134 @@
+import { eq } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { auditLog } from '../db/schema.ts'
+import { createTestContext, hoursAgo } from '../test/helpers.ts'
+
+let ctx: Awaited<ReturnType<typeof createTestContext>>
+let site: { id: string }
+let area: { id: string }
+let reporter: Awaited<ReturnType<typeof ctx.createUser>>
+let supervisor: Awaited<ReturnType<typeof ctx.createUser>>
+
+const report = (overrides: Record<string, unknown> = {}) => ({
+  title: 'Forklift reversed into pallet stack',
+  type: 'near_miss',
+  severity: 'high',
+  occurredAt: hoursAgo(2),
+  siteId: site.id,
+  ...overrides,
+})
+
+beforeAll(async () => {
+  ctx = await createTestContext()
+  site = await ctx.createSite('North Campus')
+  area = (await ctx.admin.post(`/api/sites/${site.id}/areas`, { name: 'Loading bay C' })).body.area
+  reporter = await ctx.createUser('reporter')
+  supervisor = await ctx.createUser('supervisor')
+})
+afterAll(() => ctx.close())
+
+describe('reporting', () => {
+  it('creates an incident with a sequential reference and the reporter recorded', async () => {
+    const res = await reporter.post('/api/incidents', report({ areaId: area.id, locationDetail: 'Dock door 3' }))
+    expect(res.status).toBe(201)
+    expect(res.body.incident).toMatchObject({
+      number: 1,
+      reference: 'INC-0001',
+      status: 'reported',
+      site: { id: site.id, name: 'North Campus' },
+      area: { id: area.id, name: 'Loading bay C' },
+      reporter: { id: reporter.user.id, name: 'reporter user' },
+    })
+  })
+
+  it('assigns distinct numbers to simultaneous reports', async () => {
+    const results = await Promise.all(Array.from({ length: 8 }, (_, i) => reporter.post('/api/incidents', report({ title: `Concurrent ${i}` }))))
+    const numbers = results.map((r) => r.body.incident.number)
+    expect(new Set(numbers).size).toBe(8)
+  })
+
+  it('keeps anonymous reports anonymous', async () => {
+    const res = await reporter.post('/api/incidents', report({ title: 'Blocked fire exit', anonymous: true }))
+    expect(res.body.incident).toMatchObject({ anonymous: true, reporter: null })
+  })
+
+  it('validates location and time', async () => {
+    const otherSite = await ctx.createSite('South Campus')
+    expect((await reporter.post('/api/incidents', report({ siteId: otherSite.id, areaId: area.id }))).status).toBe(400)
+    expect((await reporter.post('/api/incidents', report({ occurredAt: new Date(Date.now() + 86_400_000).toISOString() }))).status).toBe(400)
+    expect((await reporter.post('/api/incidents', report({ type: 'explosion' }))).status).toBe(400)
+  })
+
+  it('writes an audit entry', async () => {
+    const res = await reporter.post('/api/incidents', report({ title: 'Audited' }))
+    const entries = await ctx.db.select().from(auditLog).where(eq(auditLog.entityId, res.body.incident.id))
+    expect(entries).toHaveLength(1)
+    expect(entries[0]).toMatchObject({ action: 'create', actorId: reporter.user.id })
+  })
+})
+
+describe('visibility', () => {
+  it('shows reporters only their own incidents', async () => {
+    const other = await ctx.createUser('reporter', 'other-reporter@example.com')
+    const mine = await other.post('/api/incidents', report({ title: 'Only mine' }))
+    const list = await other.get('/api/incidents')
+    expect(list.body.items.map((i: { title: string }) => i.title)).toEqual(['Only mine'])
+    expect((await reporter.get(`/api/incidents/${mine.body.incident.number}`)).status).toBe(404)
+  })
+
+  it('shows supervisors every incident', async () => {
+    const list = await supervisor.get('/api/incidents?pageSize=100')
+    expect(list.body.total).toBeGreaterThan(10)
+  })
+})
+
+describe('listing', () => {
+  it('paginates newest first', async () => {
+    const page1 = await supervisor.get('/api/incidents?pageSize=3&page=1')
+    const page2 = await supervisor.get('/api/incidents?pageSize=3&page=2')
+    expect(page1.body.items).toHaveLength(3)
+    expect(page1.body.items[0].id).not.toBe(page2.body.items[0].id)
+    const times = page1.body.items.map((i: { occurredAt: string }) => i.occurredAt)
+    expect([...times].sort().reverse()).toEqual(times)
+  })
+
+  it('searches title and reference, treating % and _ literally', async () => {
+    await reporter.post('/api/incidents', report({ title: 'Oil leak under press 4', type: 'hazard', severity: 'medium' }))
+    expect((await supervisor.get('/api/incidents?q=press')).body.items[0].title).toBe('Oil leak under press 4')
+    expect((await supervisor.get('/api/incidents?q=INC-0001')).body.items[0].number).toBe(1)
+    expect((await supervisor.get('/api/incidents?q=%25')).body.total).toBe(0)
+  })
+
+  it('filters by type, severity and status', async () => {
+    const hazards = await supervisor.get('/api/incidents?type=hazard&severity=medium')
+    expect(hazards.body.items.every((i: { type: string; severity: string }) => i.type === 'hazard' && i.severity === 'medium')).toBe(true)
+    expect((await supervisor.get('/api/incidents?status=closed')).body.total).toBe(0)
+    expect((await supervisor.get('/api/incidents?status=bogus')).status).toBe(400)
+  })
+})
+
+describe('updating', () => {
+  it('lets supervisors update and close incidents, recording what changed', async () => {
+    const created = await reporter.post('/api/incidents', report({ title: 'Wet floor' }))
+    const number = created.body.incident.number
+    expect((await reporter.patch(`/api/incidents/${number}`, { status: 'closed' })).status).toBe(403)
+
+    const closed = await supervisor.patch(`/api/incidents/${number}`, { status: 'closed', severity: 'low' })
+    expect(closed.status).toBe(200)
+    expect(closed.body.incident.status).toBe('closed')
+    expect(closed.body.incident.closedAt).not.toBeNull()
+
+    const [entry] = await ctx.db.select().from(auditLog).where(eq(auditLog.action, 'update'))
+    expect(entry.changes).toMatchObject({ status: ['reported', 'closed'], severity: ['high', 'low'] })
+
+    const reopened = await supervisor.patch(`/api/incidents/${number}`, { status: 'investigation' })
+    expect(reopened.body.incident.closedAt).toBeNull()
+  })
+
+  it('clears the area when moving an incident to another site', async () => {
+    const created = await reporter.post('/api/incidents', report({ areaId: area.id }))
+    const south = await ctx.createSite('West Campus')
+    const moved = await supervisor.patch(`/api/incidents/${created.body.incident.number}`, { siteId: south.id })
+    expect(moved.body.incident).toMatchObject({ site: { id: south.id }, area: null })
+  })
+})