jayjennings
c69eccb5c1
- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents. - Implement visibility rules for users based on roles (reporters, supervisors). - Create tests for incident reporting functionality to ensure correctness and reliability. - Introduce site and area management routes, including validation for area hierarchy. - Establish user management routes with role-based access control for creating and updating users. - Add setup routes for initializing the application with an organization and admin user. - Implement shared enums and schemas for consistent validation and data handling across the application. - Create a test helper for setting up an in-memory database and API client for testing. - Add TypeScript configuration for server-side code with strict type checking and module resolution.
4.6 KiB
4.6 KiB
Open SafetyLog EHS Roadmap
A free, open-source (AGPL-3.0) accident and safety tracking system for manufacturing.
This is a living document. Update it as decisions are made or scope changes.
Decisions
| Topic | Decision | Status |
|---|---|---|
| License | AGPL-3.0-only | Decided |
| Frontend | React + Vite + TypeScript, Tailwind CSS v4 | Decided |
| Backend | Node + Hono, PostgreSQL via Drizzle ORM, Zod schemas shared with the web app (shared/). Node runs the TypeScript directly (no build step for the server) |
Decided |
| Database | PostgreSQL in production; embedded PGlite for local development, tests and very small installs | Decided |
| Auth | Email + password (scrypt), server-side sessions in an http-only cookie, four roles: reporter < supervisor < safety manager < admin | Decided |
| Deployment | Self-hosted, single docker compose up (app + Postgres); file storage added with photo upload |
Decided |
| Compliance scope | US OSHA first; data model kept extensible for other regions (e.g. RIDDOR) | Proposed |
| CI | Gitea Actions (.gitea/workflows): lint, typecheck, unit tests, build, e2e |
Decided |
| Product name | Open SafetyLog EHS (replaced placeholder "IA Tracker" and the prototype's "Safesite" branding) | Decided |
Phase 0: Foundation
- AGPL-3.0 LICENSE
- Convert to TypeScript
- Split
App.jsxintopages/,components/,lib/ - Convert styling to Tailwind (remove hand-written
App.css) - Remove unused template files
- Bundle fonts locally (no Google Fonts dependency for offline/locked-down plant networks)
- CI: lint, typecheck, unit tests (Vitest), build, e2e (Playwright)
- Replace template README
- CONTRIBUTING.md and CODE_OF_CONDUCT.md
- About page with source-code link (AGPL section 13)
- Remaining setup items (name, CoC contact, final source URL, CI runner): see TODO.md
Phase 1: Backend and data model
- Database schema and first migration for all entities: Organization, Site → Area (location tree), User, Session, Incident, InjuredPerson, Attachment, Investigation, RootCause, CorrectiveAction, Comment, AuditLog, HoursWorked
- First-run setup (creates the organization and first admin)
- Email/password sign-in, sessions, change password, login rate limiting
- Role-based permissions (reporters see only their own reports)
- REST API: users, sites/areas, incidents with pagination, search, filters and gap-free sequential numbers (
INC-0001); see API.md - Audit log of every change
- Server tests (Vitest + in-memory PostgreSQL), demo seed data
- Dockerfile and
docker-compose.yml - Moved to Phase 2: magic-link sign-in and password reset by email (both need the email sending built for notifications). SSO/OIDC stays "later".
Phase 2: Core workflow (MVP)
- Connect the web app to the API: sign-in and first-run setup screens, incident list and report form using real data
- Photo upload (attachments)
- Magic-link sign-in and password reset by email
- Incident detail page: timeline, investigation, root-cause tools (5 Whys, fishbone), corrective actions (CAPA)
- Status workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role-based transitions
- "My actions" list and overdue tracking
- Email notifications: assignment, due dates, high-severity alerts
- CSV and PDF export
- Dashboard metrics computed from real data
Phase 3: Shop-floor reporting
- Installable PWA with offline queue (sync when connection returns)
- Printable QR codes per area that pre-fill the location
- Kiosk mode and anonymous reporting
- Multi-language support, Spanish first
Phase 4: Compliance (US OSHA)
- Recordability wizard; days away / restricted / transferred tracking
- OSHA 300, 300A and 301 form generation; privacy-case handling
- ITA (Injury Tracking Application) CSV export
- Hours worked per site per month; TRIR, DART and lost-time rates
Phase 5: Analytics
- Trends, location breakdown, top root causes, corrective-action closure time
- Leading vs lagging indicators; filters and saved dashboards
Phase 6: Release v1.0
- Docker images, backup and restore
- Demo instance with seed data
- Documentation site and upgrade guide
Later
Inspections and audit checklists, job safety analysis (JSA), training and certification records, management of change, SDS links, public API and webhooks.
Known prototype gaps (to be resolved in Phase 2)
- The web app still uses in-memory demo data; the API exists but isn't connected yet
- Dashboard, analytics and location figures are hardcoded
- Export, Add location, Settings, Resources, search, notifications and workspace switcher are non-functional