commit

plans/sprint-6-5-pre-sprint-7.md

@@ -0,0 +1,155 @@
+You are a Senior Full Stack Engineer and QA Engineer.
+
+Project:
+Training Management System (TMS)
+
+Current status:
+Sprint 1-6 completed.
+Pre-UAT Readiness Review completed.
+Before starting Sprint 7, fix all remaining important issues.
+
+Current task:
+Implement Sprint 6.5: Pre-Sprint 7 Hardening.
+
+Important constraints:
+
+- Do NOT add new business features.
+- Do NOT change folder structure.
+- Do NOT migrate ORM unless absolutely necessary.
+- Do NOT rename tables or columns.
+- Do NOT break existing routes.
+- Reuse existing Auth.js.
+- Reuse existing Drizzle ORM.
+- Keep Thai UI.
+- Keep responsive/mobile behavior.
+- Minimal-impact changes only.
+
+Priority 1: Notification Pagination Optimization
+
+Problem:
+Notification listing currently loads all matching rows, filters in memory, then slices for pagination.
+
+Requirements:
+
+1. Move notification pagination to database query level.
+2. Use WHERE, ORDER BY, LIMIT, OFFSET at SQL/Drizzle level.
+3. Keep existing search, read/unread filter, and type filter behavior.
+4. Keep ownership check:
+   - organizationId
+   - userId
+5. Preserve unread count accuracy.
+6. Preserve header notification popover behavior.
+7. Do not break Notification Center page.
+
+Files likely involved:
+
+- src/features/notifications/server/notification-data.ts
+- src/app/api/notifications/route.ts
+- src/features/notifications/api/types.ts
+- src/features/notifications/api/service.ts
+
+Priority 2: Announcement Route Loading/Error Coverage
+
+Problem:
+Announcement route segment does not have route-level loading.tsx and error.tsx.
+
+Requirements:
+
+1. Add route-level loading and error pages:
+   - src/app/dashboard/announcements/loading.tsx
+   - src/app/dashboard/announcements/error.tsx
+   - src/app/dashboard/announcements/[id]/loading.tsx
+   - src/app/dashboard/announcements/[id]/error.tsx
+2. Use Thai UI.
+3. Follow existing loading/error pattern from other dashboard modules.
+4. Keep responsive layout.
+
+Priority 3: RBAC Documentation Update
+
+Problem:
+docs/nav-rbac.md is outdated and still references Clerk/client-side authorization.
+
+Requirements:
+
+1. Update docs/nav-rbac.md to reflect current architecture:
+   - Auth.js
+   - Server-side authorization
+   - requireOrganizationAccess()
+   - requireHRD()
+   - requireEmployeeDashboardAccess()
+   - role-based sidebar filtering
+   - proxy.ts route protection
+2. Remove outdated Clerk references.
+3. Document:
+   - Employee access
+   - HRD access
+   - API protection
+   - direct URL protection
+   - file download protection
+4. Keep the document clear and suitable for maintenance.
+
+Priority 4: Browser Smoke Test Checklist
+
+Create a smoke test checklist for:
+
+- Chrome
+- Microsoft Edge
+
+Test areas:
+Employee:
+
+1. Login
+2. View dashboard
+3. Create training record
+4. Upload certificate
+5. Open/download certificate
+6. Edit pending training record
+7. Delete pending training record
+8. View notification
+9. View announcement
+
+HRD:
+
+1. Login
+2. Open dashboard
+3. Review pending training
+4. Approve training
+5. Reject training
+6. Create announcement
+7. Open/download announcement attachment
+8. Import employee
+9. Master review approve/reject
+10. View audit logs
+11. Export audit log CSV
+
+Priority 5: Output Review File
+
+Create:
+
+docs/sprint-6-5-pre-sprint-7-hardening-review.md
+
+The file must include:
+
+1. Summary
+2. Files Changed
+3. Issues Fixed
+4. Notification Pagination Optimization
+5. Announcement Loading/Error Coverage
+6. RBAC Documentation Update
+7. Browser Smoke Test Checklist
+8. Validation Result
+9. Remaining Risks
+10. Sprint 7 Readiness Score
+
+Validation:
+
+- Run typecheck
+- Run lint
+- Confirm no new migration is required unless changed
+- Confirm existing routes still work
+
+Return:
+
+- Complete code changes with file paths
+- Content of docs/sprint-6-5-pre-sprint-7-hardening-review.md
+- Any remaining issues