alla-tms/plans/sprint-6-5-pre-sprint-7.md

You are a Senior Full Stack Engineer and QA Engineer.

Project: Training Management System (TMS)

Current status: Sprint 1-6 completed. Pre-UAT Readiness Review completed. Before starting Sprint 7, fix all remaining important issues.

Current task: Implement Sprint 6.5: Pre-Sprint 7 Hardening.

Important constraints:

• Do NOT add new business features.
• Do NOT change folder structure.
• Do NOT migrate ORM unless absolutely necessary.
• Do NOT rename tables or columns.
• Do NOT break existing routes.
• Reuse existing Auth.js.
• Reuse existing Drizzle ORM.
• Keep Thai UI.
• Keep responsive/mobile behavior.
• Minimal-impact changes only.

Priority 1: Notification Pagination Optimization

Problem: Notification listing currently loads all matching rows, filters in memory, then slices for pagination.

Requirements:

1. Move notification pagination to database query level.
2. Use WHERE, ORDER BY, LIMIT, OFFSET at SQL/Drizzle level.
3. Keep existing search, read/unread filter, and type filter behavior.
4. Keep ownership check:
   • organizationId
   • userId
5. Preserve unread count accuracy.
6. Preserve header notification popover behavior.
7. Do not break Notification Center page.

Files likely involved:

• src/features/notifications/server/notification-data.ts
• src/app/api/notifications/route.ts
• src/features/notifications/api/types.ts
• src/features/notifications/api/service.ts

Priority 2: Announcement Route Loading/Error Coverage

Problem: Announcement route segment does not have route-level loading.tsx and error.tsx.

Requirements:

1. Add route-level loading and error pages:
   • src/app/dashboard/announcements/loading.tsx
   • src/app/dashboard/announcements/error.tsx
   • src/app/dashboard/announcements/[id]/loading.tsx
   • src/app/dashboard/announcements/[id]/error.tsx
2. Use Thai UI.
3. Follow existing loading/error pattern from other dashboard modules.
4. Keep responsive layout.

Priority 3: RBAC Documentation Update

Problem: docs/nav-rbac.md is outdated and still references Clerk/client-side authorization.

Requirements:

1. Update docs/nav-rbac.md to reflect current architecture:
   • Auth.js
   • Server-side authorization
   • requireOrganizationAccess()
   • requireHRD()
   • requireEmployeeDashboardAccess()
   • role-based sidebar filtering
   • proxy.ts route protection
2. Remove outdated Clerk references.
3. Document:
   • Employee access
   • HRD access
   • API protection
   • direct URL protection
   • file download protection
4. Keep the document clear and suitable for maintenance.

Priority 4: Browser Smoke Test Checklist

Create a smoke test checklist for:

• Chrome
• Microsoft Edge

Test areas: Employee:

1. Login
2. View dashboard
3. Create training record
4. Upload certificate
5. Open/download certificate
6. Edit pending training record
7. Delete pending training record
8. View notification
9. View announcement

HRD:

1. Login
2. Open dashboard
3. Review pending training
4. Approve training
5. Reject training
6. Create announcement
7. Open/download announcement attachment
8. Import employee
9. Master review approve/reject
10. View audit logs
11. Export audit log CSV

Priority 5: Output Review File

Create:

docs/sprint-6-5-pre-sprint-7-hardening-review.md

The file must include:

1. Summary
2. Files Changed
3. Issues Fixed
4. Notification Pagination Optimization
5. Announcement Loading/Error Coverage
6. RBAC Documentation Update
7. Browser Smoke Test Checklist
8. Validation Result
9. Remaining Risks
10. Sprint 7 Readiness Score

Validation:

• Run typecheck
• Run lint
• Confirm no new migration is required unless changed
• Confirm existing routes still work

Return:

• Complete code changes with file paths
• Content of docs/sprint-6-5-pre-sprint-7-hardening-review.md
• Any remaining issues