jayjennings
c69eccb5c1
- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents. - Implement visibility rules for users based on roles (reporters, supervisors). - Create tests for incident reporting functionality to ensure correctness and reliability. - Introduce site and area management routes, including validation for area hierarchy. - Establish user management routes with role-based access control for creating and updating users. - Add setup routes for initializing the application with an organization and admin user. - Implement shared enums and schemas for consistent validation and data handling across the application. - Create a test helper for setting up an in-memory database and API client for testing. - Add TypeScript configuration for server-side code with strict type checking and module resolution.
Open SafetyLog EHS
Free, open-source accident and safety tracking for manufacturing: incident and near-miss reporting, investigations, corrective actions and (planned) OSHA record keeping.
Status: early development. The API and database are in place; the web app still shows demo data until it is connected in Phase 2. See docs/ROADMAP.md for the plan and docs/TODO.md for open items.
Getting started
Requires Node.js 22.18 or later (see .nvmrc). No database install is needed for development: the server uses embedded PostgreSQL (PGlite) stored in ./data/.
npm install
npm run db:seed # optional: demo organization, sites, users and incidents
npm run dev # web app on http://localhost:5173, API on http://localhost:3000
Demo users (after seeding): admin@example.com, manager@example.com, supervisor@example.com and reporter@example.com, all with password safetylog-demo. Without seeding, call POST /api/setup to create your organization and first admin (see docs/API.md).
Settings are read from environment variables or a .env file; see .env.example.
Running in production
cp .env.example .env # set POSTGRES_PASSWORD, and PUBLIC_URL if not localhost
docker compose up -d --build
This runs the app and PostgreSQL. The app applies database migrations on startup and serves the web app and API on port 3000. Use HTTPS (for example behind a reverse proxy) and set PUBLIC_URL to the https:// address so session cookies are marked secure.
For a very small single-machine install, the app image also runs on its own with embedded PostgreSQL: docker run -p 3000:3000 -v safetylog-data:/app/data <image>.
Scripts
| Command | What it does |
|---|---|
npm run dev |
Start the web app and API together with auto-reload |
npm start |
Start the API server (serves dist/ too when built) |
npm run build |
Production build to dist/ |
npm run lint |
Lint with Oxlint (warnings fail) |
npm run typecheck |
Type-check with TypeScript |
npm test |
Web and server tests (Vitest; server tests use an in-memory database) |
npm run db:generate |
Create a migration after changing server/db/schema.ts |
npm run db:seed |
Load demo data into an empty database |
npm run test:e2e |
End-to-end tests (Playwright, desktop and mobile). Run npx playwright install chromium once first |
npm run check |
Lint, typecheck, test and build in one go |
CI runs the same checks on every push and pull request (.gitea/workflows/ci.yml).
Project layout
src/ Web app (React)
pages/ One component per route
components/ Shared UI (layout, tables, form pieces) and shared class strings in styles.ts
lib/ Types, domain logic, demo data; no React components
index.css Tailwind import and design tokens (@theme)
server/ API (Hono on Node)
routes/ One file per resource, with its tests alongside
auth/ Passwords, sessions, permissions
db/ Drizzle schema, migrations, seed script
shared/ Enums and validation schemas used by both
e2e/ Playwright tests
docs/ Roadmap, to-do list, API reference
Styling is Tailwind CSS v4. Colors, fonts and small text sizes are defined as theme tokens in src/index.css. Fonts are bundled through Fontsource, so the app makes no third-party requests and works on isolated plant networks.
Contributing
See CONTRIBUTING.md. Everyone taking part follows our Code of Conduct.
License
GNU Affero General Public License v3.0. If you run a modified version as a network service, you must offer its source code to its users. The app's About page links to the source; set VITE_SOURCE_URL at build time to point it at your fork.