jayjennings
c69eccb5c1
- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents. - Implement visibility rules for users based on roles (reporters, supervisors). - Create tests for incident reporting functionality to ensure correctness and reliability. - Introduce site and area management routes, including validation for area hierarchy. - Establish user management routes with role-based access control for creating and updating users. - Add setup routes for initializing the application with an organization and admin user. - Implement shared enums and schemas for consistent validation and data handling across the application. - Create a test helper for setting up an in-memory database and API client for testing. - Add TypeScript configuration for server-side code with strict type checking and module resolution.
93 lines
4.6 KiB
Markdown
93 lines
4.6 KiB
Markdown
# Open SafetyLog EHS Roadmap
|
|
|
|
A free, open-source (AGPL-3.0) accident and safety tracking system for manufacturing.
|
|
|
|
This is a living document. Update it as decisions are made or scope changes.
|
|
|
|
## Decisions
|
|
|
|
| Topic | Decision | Status |
|
|
| --- | --- | --- |
|
|
| License | AGPL-3.0-only | Decided |
|
|
| Frontend | React + Vite + TypeScript, Tailwind CSS v4 | Decided |
|
|
| Backend | Node + Hono, PostgreSQL via Drizzle ORM, Zod schemas shared with the web app (`shared/`). Node runs the TypeScript directly (no build step for the server) | Decided |
|
|
| Database | PostgreSQL in production; embedded PGlite for local development, tests and very small installs | Decided |
|
|
| Auth | Email + password (scrypt), server-side sessions in an http-only cookie, four roles: reporter < supervisor < safety manager < admin | Decided |
|
|
| Deployment | Self-hosted, single `docker compose up` (app + Postgres); file storage added with photo upload | Decided |
|
|
| Compliance scope | US OSHA first; data model kept extensible for other regions (e.g. RIDDOR) | Proposed |
|
|
| CI | Gitea Actions (`.gitea/workflows`): lint, typecheck, unit tests, build, e2e | Decided |
|
|
| Product name | Open SafetyLog EHS (replaced placeholder "IA Tracker" and the prototype's "Safesite" branding) | Decided |
|
|
|
|
## Phase 0: Foundation
|
|
|
|
- [x] AGPL-3.0 LICENSE
|
|
- [x] Convert to TypeScript
|
|
- [x] Split `App.jsx` into `pages/`, `components/`, `lib/`
|
|
- [x] Convert styling to Tailwind (remove hand-written `App.css`)
|
|
- [x] Remove unused template files
|
|
- [x] Bundle fonts locally (no Google Fonts dependency for offline/locked-down plant networks)
|
|
- [x] CI: lint, typecheck, unit tests (Vitest), build, e2e (Playwright)
|
|
- [x] Replace template README
|
|
- [x] CONTRIBUTING.md and CODE_OF_CONDUCT.md
|
|
- [x] About page with source-code link (AGPL section 13)
|
|
- [ ] Remaining setup items (name, CoC contact, final source URL, CI runner): see [TODO.md](TODO.md)
|
|
|
|
## Phase 1: Backend and data model
|
|
|
|
- [x] Database schema and first migration for all entities: Organization, Site → Area (location tree), User, Session, Incident, InjuredPerson, Attachment, Investigation, RootCause, CorrectiveAction, Comment, AuditLog, HoursWorked
|
|
- [x] First-run setup (creates the organization and first admin)
|
|
- [x] Email/password sign-in, sessions, change password, login rate limiting
|
|
- [x] Role-based permissions (reporters see only their own reports)
|
|
- [x] REST API: users, sites/areas, incidents with pagination, search, filters and gap-free sequential numbers (`INC-0001`); see [API.md](API.md)
|
|
- [x] Audit log of every change
|
|
- [x] Server tests (Vitest + in-memory PostgreSQL), demo seed data
|
|
- [x] Dockerfile and `docker-compose.yml`
|
|
- Moved to Phase 2: magic-link sign-in and password reset by email (both need the email sending built for notifications). SSO/OIDC stays "later".
|
|
|
|
## Phase 2: Core workflow (MVP)
|
|
|
|
- Connect the web app to the API: sign-in and first-run setup screens, incident list and report form using real data
|
|
- Photo upload (attachments)
|
|
- Magic-link sign-in and password reset by email
|
|
- Incident detail page: timeline, investigation, root-cause tools (5 Whys, fishbone), corrective actions (CAPA)
|
|
- Status workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role-based transitions
|
|
- "My actions" list and overdue tracking
|
|
- Email notifications: assignment, due dates, high-severity alerts
|
|
- CSV and PDF export
|
|
- Dashboard metrics computed from real data
|
|
|
|
## Phase 3: Shop-floor reporting
|
|
|
|
- Installable PWA with offline queue (sync when connection returns)
|
|
- Printable QR codes per area that pre-fill the location
|
|
- Kiosk mode and anonymous reporting
|
|
- Multi-language support, Spanish first
|
|
|
|
## Phase 4: Compliance (US OSHA)
|
|
|
|
- Recordability wizard; days away / restricted / transferred tracking
|
|
- OSHA 300, 300A and 301 form generation; privacy-case handling
|
|
- ITA (Injury Tracking Application) CSV export
|
|
- Hours worked per site per month; TRIR, DART and lost-time rates
|
|
|
|
## Phase 5: Analytics
|
|
|
|
- Trends, location breakdown, top root causes, corrective-action closure time
|
|
- Leading vs lagging indicators; filters and saved dashboards
|
|
|
|
## Phase 6: Release v1.0
|
|
|
|
- Docker images, backup and restore
|
|
- Demo instance with seed data
|
|
- Documentation site and upgrade guide
|
|
|
|
## Later
|
|
|
|
Inspections and audit checklists, job safety analysis (JSA), training and certification records, management of change, SDS links, public API and webhooks.
|
|
|
|
## Known prototype gaps (to be resolved in Phase 2)
|
|
|
|
- The web app still uses in-memory demo data; the API exists but isn't connected yet
|
|
- Dashboard, analytics and location figures are hardcoded
|
|
- Export, Add location, Settings, Resources, search, notifications and workspace switcher are non-functional
|