jayjennings
3f6dff5f24
- Add permissions logic for status options in corrective actions. - Create tests for permissions functionality. - Implement queries for user authentication and actions management. - Develop Actions page to display and manage corrective actions. - Create authentication pages for login, setup, and password reset. - Add IncidentDetail page to view incident details and associated actions. - Implement Settings page for user management and password changes.
3.4 KiB
To-do
Open items that aren't tied to a single roadmap phase. Tick them off (or delete them) as they're resolved. Phase work lives in ROADMAP.md.
Project setup
- Code of Conduct contact. CODE_OF_CONDUCT.md uses
jay@equineform.comfor now. Change it to a project alias (e.g.conduct@<project-domain>) once the project has its own domain. - Source code link. The About page links to
https://www.equineform.comfor now (default insrc/lib/config.ts, overridable withVITE_SOURCE_URL). Change it to the public git repository once one exists, and use the same URL for issue links in CONTRIBUTING.md. - CI on Gitea. Confirm Actions is enabled for the repository and a runner is registered, then check the first run of
.gitea/workflows/ci.ymlpasses. Keep the Playwright container tag in the workflow in sync with@playwright/test.
Phase 1 follow-ups
- Test against real PostgreSQL. Server tests use PGlite (PostgreSQL compiled to WebAssembly). Add a CI job with a
postgresservice container that runs the server tests against real PostgreSQL too. - Docker build in CI. Build the image in CI once a runner with Docker is available.
- Shared login rate limit. The login limiter is in memory, so it resets on restart and isn't shared between processes. Fine for one container; move it to the database before running several app instances.
Phase 2 follow-ups
- Server-side PDF (later). Decided 2026-10-06 to keep browser-generated PDFs for now: the "Print / PDF" button and print stylesheet are simpler and add no dependencies. Revisit if PDFs need to be produced automatically, e.g. attached to emails or archived on close.
- Email delivery (later). Decided 2026-10-06 that the current behavior is fine for now: without
SMTP_URL, emails print to the server log in development and are dropped (with a startup warning) in production. Later: configure SMTP for real deployments, add a "send test email" button for admins, and consider showing admins a warning in the app when email isn't set up. - Notification preferences. Everyone gets every email that applies to them. Add per-user opt-outs, and an alert-recipients setting per site.
- Edit corrective actions in the UI. The API supports changing an action's title, assignee and due date; the incident page only offers status changes and adding new actions.
- HEIC thumbnails. iPhone HEIC photos are stored and downloadable but browsers can't show them inline; convert to JPEG on upload.
- Session check console noise. Signed-out visitors see one 401 in the browser console from the session check; harmless, but a
200 { user: null }endpoint would be quieter.
Done
-
Docker verified 2026-10-06 (Docker 29.8, Compose v5.5): image builds (~315 MB),
docker compose upwith PostgreSQL 18 passes setup → sign-in → report smoke test; data and sessions survivedown/up; clean shutdown; healthcheck healthy; runs as non-root; standalone PGlite container works;Securecookie with anhttps://PUBLIC_URL; web app loads with no errors. -
Product name: Open SafetyLog EHS (decided 2026-10-06). Note: Insight Works sells a similarly named free "Safety Logbook" EHS app for Microsoft Business Central; run a USPTO trademark search before a public launch.
-
CONTRIBUTING.md and CODE_OF_CONDUCT.md (Contributor Covenant 2.1)
-
About page with source-code link (AGPL-3.0 section 13)