# Employee Online Lessons Audit (Read Only)

## Role

You are a Senior Full Stack Engineer, Software Architect, QA Engineer, UX/UI Reviewer, Security Reviewer, Performance Engineer, and Product Analyst.

Your task is to perform a comprehensive READ-ONLY audit of the Employee Online Lessons module.

This is an inspection and documentation task only.

Do NOT modify any source code.
Do NOT refactor.
Do NOT generate implementation code.
Do NOT format files.
Do NOT create pull requests.
Do NOT fix any issue.

Only inspect the project and generate an audit report.

---

# Before Starting

Review and understand the project first.

Read in this priority:

1. AGENTS.md
2. docs/AI_DEVELOPMENT_GUIDE.md
3. docs/PROJECT_ARCHITECTURE.md

Then inspect the existing implementation and identify reusable patterns already used in the project.

---

# Scope

Review every file related to the Employee Online Lessons module.

Including:

- Route
- Layout
- Page
- Lesson List
- Lesson Detail
- Lesson Card
- Video Player
- YouTube Embed
- Uploaded Video
- Thumbnail
- Attachments
- Certificate Section
- Related Files
- Search
- Filters
- Pagination
- Categories
- Progress Display
- Completed Status
- Empty State
- Loading State
- Error State
- Navigation
- API
- Queries
- Mutations
- Validation
- Types
- Services
- Role Guards

---

# Functional Review

Verify all user functionality.

## Lesson List

Review:

- Lesson list loads correctly
- Pagination
- Search
- Category filter
- Sorting
- Responsive cards
- Empty state
- Loading state

---

## Lesson Detail

Verify:

- Lesson title
- Description
- Instructor
- Category
- Duration
- Upload date
- Attachments
- Certificate availability

---

## Video

Review every supported video type.

Verify:

Uploaded Video

- MP4
- WebM
- MOV if supported

YouTube

- Standard URL
- Short URL
- Embed URL

Verify:

- Video loads
- Controls work
- Fullscreen
- Responsive
- Error handling
- Fallback UI
- Black screen handling
- Missing video handling

---

## Attachments

Review:

- Image preview
- PDF preview
- Download
- Missing file message
- Unsupported file handling

---

## Progress

Verify:

- Progress display
- Completed lessons
- Remaining lessons
- Completion badge
- Progress calculation

---

## Learning History

Verify:

- Viewed lessons
- Completed lessons
- Recent lessons

---

## Dashboard Integration

Verify:

- Dashboard reflects completed lessons correctly
- Training hours update correctly if applicable

---

# Business Rule Review

Verify project requirements.

Examples:

- Employee only accesses available lessons
- Hidden lessons cannot be accessed directly
- Draft lessons are not visible
- Archived lessons are hidden
- Training hours follow project rules
- Completion status updates correctly
- Certificates appear only when allowed

Document inconsistencies.

---

# Role Review

Review Employee permissions.

Employee can:

- View lesson list
- View lesson detail
- Watch videos
- Download allowed files
- View attachments
- Search lessons
- Filter lessons

Employee cannot:

- Create lessons
- Edit lessons
- Delete lessons
- Publish lessons
- Access HRD pages
- Access Admin pages
- View hidden lessons
- Access draft lessons
- Access restricted API endpoints

Verify:

- UI permissions
- API permissions
- Route guards
- Direct URL access

---

# UI Review

Inspect:

- Overall layout
- Card consistency
- Thumbnail ratio
- Video container
- Typography
- Colors
- Icons
- Buttons
- Attachments section
- Empty state
- Loading skeleton
- Status badges
- Progress indicators
- Responsive layout

Review Desktop

Review Tablet

Review Mobile

---

# UX Review

Evaluate:

- Lesson discovery
- Navigation flow
- Search usability
- Filter usability
- Video watching experience
- Attachment accessibility
- Error clarity
- Loading feedback
- Empty state guidance

Suggest improvements only.

Do NOT implement.

---

# Accessibility Review

Review:

- Keyboard navigation
- Video controls accessibility
- Focus indicators
- Screen reader labels
- Button labels
- Alt text
- Color contrast
- Dialog accessibility
- Download accessibility

---

# Code Review

Inspect.

## Architecture

- Folder structure
- Feature separation
- Component reuse
- Shared layout
- Shared cards
- Shared video components

---

## React

Review:

- Client Components
- Server Components
- Hooks
- Memoization
- Suspense
- Unnecessary rerenders

---

## TypeScript

Inspect:

- Strong typing
- Nullable handling
- API response typing
- Validation typing
- Enums

---

## Code Quality

Review:

- Duplicate code
- Dead code
- Large components
- Import consistency
- Naming consistency
- Unused files
- Shared utilities

Do NOT modify anything.

---

# API Review

Inspect:

- Lesson query
- Lesson detail query
- Video endpoint
- Attachment endpoint
- Error handling
- Authorization
- Pagination
- Search parameters
- Filter parameters
- Cache
- Query invalidation

---

# Security Review

Inspect:

- Authentication
- Authorization
- Route guards
- API guards
- Direct lesson access
- Hidden lesson protection
- Draft lesson protection
- File download authorization
- Video authorization
- Sensitive data exposure

---

# Performance Review

Inspect:

- Lazy loading
- Video loading
- Image optimization
- Thumbnail loading
- Pagination
- React Query cache
- Suspense
- Bundle size
- Large video handling

---

# Data Validation Review

Review:

- Missing lesson title
- Missing thumbnail
- Missing description
- Missing video
- Invalid YouTube URL
- Invalid uploaded video
- Missing attachments
- Invalid duration
- Null values
- Incorrect defaults

---

# Edge Case Review

Verify:

- No lessons
- Only one lesson
- Many lessons
- Missing thumbnail
- Missing video
- Broken YouTube link
- Broken uploaded video
- Missing attachment
- Invalid PDF
- Slow network
- API failure
- Unauthorized access
- Hidden lesson via direct URL
- Archived lesson via direct URL

---

# Consistency Review

Compare against the rest of the Training System.

Verify consistency of:

- Cards
- Buttons
- Typography
- Colors
- Badges
- Loading UI
- Empty UI
- Error UI
- Tables
- Navigation
- Dialogs
- Sheets

---

# Deliverable

Create only one report.

docs/review/employee-online-lessons-audit.md

Do not modify any source code.

Do not modify existing documentation.

---

# Report Structure

# Employee Online Lessons Audit Report

## Executive Summary

Overall Status

- Excellent
- Good
- Needs Improvement
- Critical

Summary of findings.

---

## Scope Reviewed

List reviewed routes, components, APIs, services, and permissions.

---

## Functional Review

| Feature | Status | Notes |

---

## Business Rule Review

---

## Role & Permission Review

---

## UI Review

---

## UX Review

---

## Accessibility Review

---

## Code Quality Review

---

## API Review

---

## Security Review

---

## Performance Review

---

## Data Validation Review

---

## Edge Case Review

---

## Consistency Review

---

## Problems Found

Group by severity.

### Critical

### High

### Medium

### Low

For every issue include:

- Description
- File
- Component
- Severity
- Impact
- Recommendation

Do NOT fix the issue.

---

## Missing Features

List missing functionality compared to project requirements.

---

## Improvement Opportunities

Provide recommendations only.

Do NOT implement.

---

## Final Assessment

Architecture: /10

Functionality: /10

Role & Permission: /10

UI: /10

UX: /10

Accessibility: /10

Performance: /10

Security: /10

Maintainability: /10

Overall Score: /10

---

# Important Rules

- READ ONLY
- No source code modifications
- No implementation
- No refactoring
- No formatting
- No automatic fixes
- No pull requests
- Only generate:

docs/review/employee-online-lessons-audit.md

- Every finding must include file path, affected component, evidence where possible, severity, impact, and recommendation.
