Commit graph

23 commits

Author SHA1 Message Date
DJP
26c766cf43 Security hardening: fix critical auth, RBAC, and injection vulnerabilities
- C1: Add authentication to file serving route + canonical path traversal check + nosniff header
- C2: DEV_BYPASS_AUTH now only works when Entra ID credentials are not configured
- H1: Add requireAuth() + assertOrgAccess() to 9 unprotected routes (upload, feedback, annotations, color-probes, reviews)
- H2: Add org-scoping to 4 routes (automations, users, skills)
- H3: SSRF protection on webhook URLs — HTTPS only, private/internal IPs blocked
- H6: API key uses timingSafeEqual, phantom fallback removed, supports X-Org-Id header
- M1: CRON_SECRET moved from query string to Authorization Bearer header
- Extend assertOrgAccess() to support 10 model types (was 3)
- npm audit fix: 17 vulnerabilities reduced to 4
- Add SECURITY-REVIEW.md with full findings report

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 20:48:05 -04:00
Leivur Djurhuus
4149b2cf40 Switch from db push to versioned Prisma migrations
Replace 2 stale migration files with a single baseline migration
capturing the full 40+ model schema. The database was freshly reset
via clean-slate, making this the ideal time to establish migration
history. Dockerfile now runs prisma migrate deploy before app start.
Updated SETUP.md and ROADMAP.md to reference prisma migrate dev
instead of db push.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:45:36 -05:00
Leivur Djurhuus
dfa067e95f Database cleanup pre rollout 2026-04-06 14:35:56 -05:00
Leivur Djurhuus
9a10cd8063 Markup bug fixes 2026-04-06 08:53:28 -05:00
Leivur Djurhuus
95dbaef318 Add timestamped video annotations with timeline markers (A7.3)
- Add timestampSeconds and frameThumbnailUrl fields to Annotation model
- New VideoAnnotationLayer component: auto-pause on draw tool activation,
  SVG annotation overlay on paused video, time-filtered visibility,
  All/Timed toggle, timecode display in toolbar
- New VideoTimelineMarkers: orange=unresolved, green=resolved, clustered
  markers on scrub bar with click-to-seek and hover scale
- Thread timestampSeconds through validator, service, and API layers
- Feedback item cards show timestamp badges for video annotations
- VideoPlayer gains renderOverlay, timelineMarkers, pause/seek in state
- Fix "Processing" overlay shown when MP4 is available (FFmpeg fallback)
- Add revision polling when video status is "processing"
- Configure proxyClientMaxBodySize: 500mb for large video uploads
- Fix pre-existing Prisma JSON type error in upload-service.ts
- Update ROADMAP with lawn reference learnings and A7.3 progress

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 15:00:23 -05:00
Leivur Djurhuus
ec420f79d6 Fix dynamic pipeline stages: form submissions, unique constraint, and stage name resolution
Three related bugs fixed:

1. Form save buttons silently failing — valueAsNumber on empty number inputs
   produced NaN, which Zod rejected without visible errors on hidden tabs.
   Replaced with setValueAs that converts empty strings to undefined.

2. Unique constraint violation on deliverable stage creation — dynamic pipeline
   stages without matching global template slugs all fell back to
   globalTemplates[0], creating duplicate (deliverableId, templateId) pairs.
   Changed constraint from @@unique([deliverableId, templateId]) to
   @@unique([deliverableId, stageDefinitionId]).

3. Stage names showing wrong template — all UI components read
   stage.template.name exclusively, ignoring stageDefinition from the dynamic
   pipeline system. Updated 13 components, 6 services, and all relevant Prisma
   queries to prefer stageDefinition over template for display.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 12:19:00 -05:00
Leivur R. Djurhuus
bd69208a84 Eyedropper comparison added for visual review tool. Needs to be tested and finessed on workstation 2026-03-17 22:20:52 -05:00
Leivur R. Djurhuus
6f5cbc2f1f feat: add review session components and hooks
- Implemented SessionPresenter and SessionSummary components for managing review sessions.
- Created AlertDialog component for modal dialogs.
- Developed hooks for managing review sessions, including fetching, creating, updating, and deleting sessions.
- Added service functions for review session operations in the backend.
- Introduced validation schemas for review session inputs using Zod.
2026-03-17 22:20:01 -05:00
Leivur R. Djurhuus
db82eb4fed refactor: simplify feedback from 4-level severity to action item / info callout
Replace FeedbackSeverity enum (Critical/Major/Minor/Suggestion) with a
simple isActionItem boolean. Annotations default to action items (things
the artist must fix). Any item can be toggled to an info callout (context
that doesn't need action). Progress bar and carry-forward only count
action items. Screenshot paste limited to 5MB with user notification.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 22:19:31 -05:00
Leivur R. Djurhuus
05061baf26 feat: add revision history timeline (A4) and feedback checklist (A5)
A4 — Revision History Timeline:
- Collapsible right panel with vertical timeline of all revision rounds
- Each node shows thumbnail, status badge, timestamp, annotation count,
  comment summary, and decision record
- Keyboard navigation (up/down arrows), auto-scroll to active round
- Filter by rounds with feedback, "Compare from here" action
- Enriched revision data hook aggregating annotations + comments

A5 — Feedback Checklist:
- FeedbackItem model with severity (Critical/Major/Minor/Suggestion),
  status flow (Open → In Progress → Resolved → Verified), and
  carry-forward between revision rounds
- Auto-creation from annotations (non-blocking, post-transaction)
- Checklist panel in review page with progress bar, severity grouping,
  resolve-with-note flow, verify/reopen actions
- FeedbackIndicator badge on stage cards in deliverable detail page
- CRUD API routes + TanStack Query hooks
- Prisma schema additions (requires db push)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 22:19:11 -05:00
Leivur R. Djurhuus
eba5e30c98 feat: add version comparison (A2) and annotation system (A3)
A2 — Version Comparison:
- 4 comparison modes: side-by-side, A-B wipe slider, overlay with
  opacity, toggle with crossfade
- Synced zoom/pan across all modes
- Revision selectors for left/right image
- Keyboard shortcuts: 1-4 switch modes, Escape exits

A3 — Annotations:
- SVG overlay with 7 annotation types: rectangle, ellipse, arrow,
  freehand, text, pin, screenshot paste (Cmd+V)
- All annotations anchored to image coordinates (accurate at any zoom)
- Annotation model added to Prisma schema (requires db push)
- CRUD API routes at /api/revisions/[id]/annotations
- Annotations linked to comments (transactional create)
- Screenshot callouts: draggable, resizable with corner handles
- Undo/redo stack, color picker, visibility toggle
- Floating toolbar with backdrop blur

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 22:17:44 -05:00
Leivur Djurhuus
4434e24569 pipeline template fixed and now visible in settings 2026-03-17 21:19:43 -05:00
Leivur R. Djurhuus
40028b7ced feat: add pipeline stage resolver and organization access control
- Implemented `stage-resolver.ts` to unify old and new pipeline stage definitions.
- Created `org-scope.ts` for organization access verification and scoping queries.
- Added role-based permissions management in `permissions.ts` and `rbac-service.ts`.
- Introduced invitation management in `invitation-service.ts` with validation schemas.
- Developed custom field and notification rule services with respective validators.
- Established pipeline template CRUD operations in `pipeline-template-service.ts`.
- Added Zustand store for managing pipeline builder state in `pipeline-builder-store.ts`.
2026-03-14 22:43:43 -05:00
Leivur Djurhuus
5b8c09de9e feat: implement stage date override and scheduling features
- Add PATCH endpoint to handle date overrides and clear manual overrides in the stage API.
- Introduce hooks for overriding stage dates and clearing overrides.
- Enhance the stage dependency engine to allow reopening from terminal states.
- Update stage status transitions to support reopening stages.
- Implement scheduling logic to auto-schedule stages based on due dates, considering manual overrides.
- Create a new component for managing stage dates with a popover interface.
- Add database migration for new fields related to manual scheduling and schedule conflicts.
- Document the executive overview and producer guide for the HP CG Production Tracker.
2026-03-12 23:13:29 -05:00
Leivur Djurhuus
cf46a8ecd3 feat: add db:seed-team script to package.json and remove unused producer entries from seed.ts 2026-03-12 21:45:59 -05:00
Leivur Djurhuus
877bc085dd feat: Update skill names and simplify user skill mappings in seed data 2026-03-12 13:22:20 -05:00
Leivur Djurhuus
e5b398d7da feat: Implement automation event bus and rule engine
- Add event bus for dispatching automation events with handlers.
- Create rule engine to evaluate events against defined triggers.
- Introduce chat provider to interface with Claude API and Ollama fallback.
- Define tool schemas for Claude-compatible operations.
- Implement tool executor to map tool calls to service layer functions.
- Develop automation service for CRUD operations on rules and event handling.
2026-03-12 11:20:21 -05:00
Leivur Djurhuus
9d5acf1683 feat: add Smart Search Panel with semantic search capabilities
- Implemented Smart Search Panel component for enhanced project and deliverable search functionality.
- Introduced useSemanticSearch and useOllamaHealth hooks for managing search queries and AI availability.
- Developed embedding-service to generate and store vector embeddings for projects and deliverables.
- Created semantic-search-service to handle vector search, structural query detection, and LLM summarization.
- Added support for hybrid search combining structural filters and semantic queries.
- Integrated UI components for displaying search results and user interactions.
2026-03-06 16:13:36 -06:00
Leivur Djurhuus
c8f88c6ab8 feat(workload): add capacity management components and hooks
- Implemented `CapacityCell`, `CapacityDetailPopover`, and `CapacityGrid` components for displaying user workload and capacity.
- Created `UtilizationHeatmap` component to visualize team member utilization over weeks.
- Added hooks for managing skills (`useSkills`, `useCreateSkill`, `useDeleteSkill`, `useUserSkills`, `useSetUserSkill`, `useRemoveUserSkill`, `useStageSuggestions`) and workload (`useWorkload`, `useUpdateCapacity`).
- Developed services for skill management (`skill-service.ts`) and workload management (`workload-service.ts`) to interact with the database.
- Introduced logic for calculating user workload, including active assignments and capacity overload detection.
- Enhanced UI with tooltips and badges for better user experience.
2026-03-03 15:17:45 -06:00
Leivur Djurhuus
edcf31672e feat: enhance UI components and add assignment feature to deliverables
- Updated CommandItem component to use rounded-lg for better aesthetics.
- Modified DialogOverlay and DialogContent to improve backdrop and border radius.
- Changed DropdownMenuItem, DropdownMenuCheckboxItem, and DropdownMenuRadioItem to use rounded-md for consistency.
- Enhanced SelectItem with rounded-md for a more modern look.
- Updated SheetOverlay to improve backdrop styling.
- Adjusted Toaster component border radius for a more refined appearance.
- Enhanced Table component with rounded-xl and shadow for better visual hierarchy.
- Added assignment display feature in DeliverableTable and KanbanBoard components, showing assigned users with badges.
- Updated deliverable service to include assignments in the data fetching process.
- Created a new seed script for tracker data to facilitate testing and development.
2026-03-02 13:46:55 -06:00
Leivur Djurhuus
a47c6791d9 feat: add validators for PowerPoint and Word documents, and Excel recalculation script
- Implement PPTXSchemaValidator for validating PowerPoint presentation XML files against XSD schemas.
- Create RedliningValidator to check tracked changes in Word documents, ensuring proper author tracking.
- Introduce recalc.py script to recalculate Excel formulas using LibreOffice, including error handling for Excel-specific errors.
- Add UI components for collapsible sections and tabs using Radix UI.
- Implement stage validation schema using Zod for managing project stages.
2026-03-02 12:23:09 -06:00
Leivur R. Djurhuus
f34e232497 feat: add development setup guide and instructions for local environment configuration 2026-03-01 12:16:17 -06:00
Leivur R. Djurhuus
c13dc9cacc Add Prisma 7 schema with full data model and seed script
- 12 models: Organization, User, Account, Session, Project,
  Deliverable, DeliverableStage, StageAssignment, Revision,
  Comment, Notification, plus pipeline templates/dependencies
- Prisma 7 adapter pattern with @prisma/adapter-pg
- Seed script with 10 pipeline stages and dependency rules
- Environment config (.env.example)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 21:06:17 -06:00