Phase 4 abgeschlossen: Personalakten, Dokumente, Beteiligte, Verknüpfungen
Die Dokumentebene aus docs/13 ist gebaut, additiv: Document, DocumentSection und DocumentSectionVersion neben Case, CaseSection und CaseEntry. Ein Dokument hängt an einer Fallakte, an einer Personalakte oder an nichts, höchstens an einem — gesichert durch eine CHECK-Bedingung. Es gibt kein DELETE; eine Zurücknahme lässt einen Grabstein stehen, der auch für den Admin zu ist. Eine neue Dokumentart ist damit ein Datensatz, kein Deployment. Im Seed stehen vier: vermerk, vorfallsbericht, sonderarbeitsvertrag (mehrseitiger Vertragstext mit Platzhaltern und Unterschriftenzeilen) und bussgeld. Zwei Umbenennungen, beide von Hand migriert, damit die vorhandenen Zeilen und Zählerstände stehen bleiben: - CaseTemplate -> DocumentTemplate, plus uses[] und layout - CaseCounter -> NumberSeries, ein Nummernkreis je Präfix für Aktenzeichen und Dokumentnummern Die Regeln für Abschnitte stehen jetzt einmal in lib/sections/render.ts und gelten für Fallakten und Dokumente gleichermaßen. Die Frage aus docs/13, ob CaseSection langfristig in die Dokumentebene wandert, ist damit verneint und begründet. Rückverweise auf der Personalakte laufen durch visibleCaseWhere, die Zahl daneben entsteht aus dem gefilterten Ergebnis. Auch die Rollengruppe verschwindet mit, sonst verriete "Betroffener" ohne Eintrag die Ermittlung. Die eigene Personalakte ist keine Ausnahme von der Freigabestufe. Vier neue Rechte: document.create, .edit, .finalize, .retract. Das letzte steht bei den zurückgehaltenen, es greift in Geschriebenes ein. 91 Tests im Web-Paket, 15 in der Datenbank, 28 e2e. Größte Route 118 kB gegen das Budget von 120 kB — die Luft wird knapp. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Harlekin
co-authored by
Claude Opus 5
Claude Opus 5
parent
f5769ca58a
commit
d65cc95eb2
@@ -24,7 +24,7 @@ export async function savePolicy(input: unknown): Promise<PolicyResult> {
|
||||
const user = await requirePermissionForAction('admin')
|
||||
|
||||
const parsed = schema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
const before = await db.appSetting.findUnique({ where: { id: 1 } })
|
||||
|
||||
|
||||
@@ -36,13 +36,13 @@ export async function saveTemplate(input: unknown): Promise<TemplateResult> {
|
||||
const erste = parsed.error.issues[0]
|
||||
return {
|
||||
ok: false,
|
||||
error: erste ? `${erste.path.join('.')}: ${erste.message}` : de.case.errors.default!,
|
||||
error: erste ? `${erste.path.join('.')}: ${erste.message}` : de.actionErrors.default!,
|
||||
}
|
||||
}
|
||||
|
||||
const { key, fields, ...rest } = parsed.data
|
||||
|
||||
const neueste = await db.caseTemplate.findFirst({
|
||||
const neueste = await db.documentTemplate.findFirst({
|
||||
where: { key },
|
||||
orderBy: { version: 'desc' },
|
||||
select: { version: true },
|
||||
@@ -51,9 +51,9 @@ export async function saveTemplate(input: unknown): Promise<TemplateResult> {
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
// Ältere Versionen bleiben stehen, aber nur die neueste ist auswählbar.
|
||||
await tx.caseTemplate.updateMany({ where: { key }, data: { isActive: false } })
|
||||
await tx.documentTemplate.updateMany({ where: { key }, data: { isActive: false } })
|
||||
|
||||
await tx.caseTemplate.create({
|
||||
await tx.documentTemplate.create({
|
||||
data: {
|
||||
key,
|
||||
version,
|
||||
@@ -68,7 +68,7 @@ export async function saveTemplate(input: unknown): Promise<TemplateResult> {
|
||||
await writeAudit(tx, {
|
||||
actorId: user.id,
|
||||
action: 'roles.update',
|
||||
targetType: 'CaseTemplate',
|
||||
targetType: 'DocumentTemplate',
|
||||
targetId: `${key}:${version}`,
|
||||
clearanceAtTime: user.permissions.clearanceLevel,
|
||||
meta: { key, version, fieldCount: fields.length },
|
||||
|
||||
@@ -11,7 +11,7 @@ export default async function TemplateAdminPage() {
|
||||
await requirePermission('template.manage')
|
||||
|
||||
// Je Schlüssel die neueste Version; ältere bleiben für bestehende Akten stehen.
|
||||
const vorlagen = await db.caseTemplate.findMany({
|
||||
const vorlagen = await db.documentTemplate.findMany({
|
||||
orderBy: [{ key: 'asc' }, { version: 'desc' }],
|
||||
distinct: ['key'],
|
||||
})
|
||||
|
||||
@@ -0,0 +1,162 @@
|
||||
'use client'
|
||||
|
||||
import { useState, useTransition } from 'react'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import {
|
||||
finalizeDocumentAction,
|
||||
reclassifyDocumentAction,
|
||||
retractDocumentAction,
|
||||
} from '../actions'
|
||||
|
||||
/**
|
||||
* Ausfertigen, Zurückziehen, Umklassifizieren.
|
||||
*
|
||||
* Wie beim Fall bewusst **nicht** optimistisch: alle drei sind folgenreich.
|
||||
* Das Ausfertigen fragt nach, das Zurückziehen verlangt eine Begründung — es
|
||||
* gibt kein Löschen, der Grabstein bleibt stehen.
|
||||
*/
|
||||
export function DocumentActions({
|
||||
documentNumber,
|
||||
classification,
|
||||
canFinalize,
|
||||
canRetract,
|
||||
canReclassify,
|
||||
levels,
|
||||
}: {
|
||||
documentNumber: string
|
||||
classification: number
|
||||
canFinalize: boolean
|
||||
canRetract: boolean
|
||||
canReclassify: boolean
|
||||
levels: { level: number; name: string }[]
|
||||
}) {
|
||||
const [reason, setReason] = useState('')
|
||||
const [retracting, setRetracting] = useState(false)
|
||||
const [nextLevel, setNextLevel] = useState(classification)
|
||||
const [levelReason, setLevelReason] = useState('')
|
||||
const [error, setError] = useState<string | null>(null)
|
||||
const [pending, startTransition] = useTransition()
|
||||
|
||||
if (!canFinalize && !canRetract && !canReclassify) return null
|
||||
|
||||
const lowering = nextLevel < classification
|
||||
|
||||
function run(action: () => Promise<{ ok: boolean; error?: string }>) {
|
||||
setError(null)
|
||||
startTransition(async () => {
|
||||
const result = await action()
|
||||
if (!result.ok) setError(result.error ?? de.actionErrors.default!)
|
||||
else setRetracting(false)
|
||||
})
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="mt-6 flex flex-wrap gap-x-10 gap-y-5 border-t border-line pt-5 text-xs">
|
||||
{canFinalize ? (
|
||||
<div>
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending}
|
||||
onClick={() => {
|
||||
if (!confirm(de.document.finalizeHint)) return
|
||||
run(() => finalizeDocumentAction({ documentNumber }))
|
||||
}}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
|
||||
>
|
||||
{de.document.finalize}
|
||||
</button>
|
||||
</div>
|
||||
) : null}
|
||||
|
||||
{canReclassify ? (
|
||||
<div>
|
||||
<p className="font-condensed text-text-dim">{de.document.reclassify}</p>
|
||||
<div className="mt-1.5 flex flex-wrap items-center gap-2">
|
||||
<select
|
||||
value={nextLevel}
|
||||
onChange={(event) => setNextLevel(Number(event.target.value))}
|
||||
aria-label={de.clearance.classification}
|
||||
className="border border-line bg-raised px-2 py-1"
|
||||
>
|
||||
{levels.map((level) => (
|
||||
<option key={level.level} value={level.level}>
|
||||
{level.level} · {level.name}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending || nextLevel === classification}
|
||||
onClick={() =>
|
||||
run(() =>
|
||||
reclassifyDocumentAction({
|
||||
documentNumber,
|
||||
to: nextLevel,
|
||||
reason: levelReason,
|
||||
}),
|
||||
)
|
||||
}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-accent disabled:text-text-dim"
|
||||
>
|
||||
{de.common.save}
|
||||
</button>
|
||||
</div>
|
||||
{lowering ? (
|
||||
<textarea
|
||||
value={levelReason}
|
||||
onChange={(event) => setLevelReason(event.target.value)}
|
||||
rows={2}
|
||||
placeholder={de.case.reclassifyReason}
|
||||
aria-label={de.case.reclassifyReason}
|
||||
className="mt-2 block w-full max-w-sm border border-line bg-raised px-3 py-2 text-2xs"
|
||||
/>
|
||||
) : null}
|
||||
</div>
|
||||
) : null}
|
||||
|
||||
{canRetract ? (
|
||||
<div>
|
||||
{retracting ? (
|
||||
<div>
|
||||
<textarea
|
||||
value={reason}
|
||||
onChange={(event) => setReason(event.target.value)}
|
||||
rows={2}
|
||||
placeholder={de.document.retractReason}
|
||||
aria-label={de.document.retractReason}
|
||||
className="block w-full max-w-sm border border-line bg-raised px-3 py-2 text-2xs"
|
||||
/>
|
||||
<div className="mt-2 flex gap-3">
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending || reason.trim().length < 10}
|
||||
onClick={() => run(() => retractDocumentAction({ documentNumber, reason }))}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-stamp-4 disabled:text-text-dim"
|
||||
>
|
||||
{de.document.retract}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setRetracting(false)}
|
||||
className="font-condensed text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
) : (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setRetracting(true)}
|
||||
className="font-condensed text-text-dim"
|
||||
>
|
||||
{de.document.retract}
|
||||
</button>
|
||||
)}
|
||||
</div>
|
||||
) : null}
|
||||
|
||||
{error ? <p className="w-full font-condensed text-2xs text-stamp-4">{error}</p> : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
import { Skeleton, SkeletonLine } from '@/components/Skeleton'
|
||||
|
||||
export default function Loading() {
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<div className="pl-3">
|
||||
<Skeleton className="h-[0.9rem]" width="9rem" />
|
||||
<div className="mt-2">
|
||||
<Skeleton className="h-[1.6rem]" width="20rem" />
|
||||
</div>
|
||||
<div className="mt-3 flex gap-8">
|
||||
<Skeleton className="h-[0.8rem]" width="6rem" />
|
||||
<Skeleton className="h-[0.8rem]" width="7rem" />
|
||||
</div>
|
||||
</div>
|
||||
<div className="mt-10 space-y-6">
|
||||
<SkeletonLine width="10rem" />
|
||||
<SkeletonLine />
|
||||
<SkeletonLine width="12rem" />
|
||||
<SkeletonLine />
|
||||
</div>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,194 @@
|
||||
import type { Metadata } from 'next'
|
||||
import { Suspense } from 'react'
|
||||
import Link from 'next/link'
|
||||
import { notFound } from 'next/navigation'
|
||||
import { db } from '@/lib/db'
|
||||
import { requireUser } from '@/lib/auth/current'
|
||||
import { recordRead, READ_AUDIT_FROM_LEVEL } from '@/lib/audit'
|
||||
import { loadDocumentSections, loadVisibleDocument } from '@/lib/documents/service'
|
||||
import {
|
||||
canEditDocument,
|
||||
canFinalizeDocument,
|
||||
canRetractDocument,
|
||||
} from '@/lib/access/documentWrite'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { StampMark, classificationEdgeStyle } from '@/components/StampMark'
|
||||
import { SkeletonLine } from '@/components/Skeleton'
|
||||
import { Sections } from '@/components/sections/Sections'
|
||||
import { saveDocumentSectionAction } from '../actions'
|
||||
import { DocumentActions } from './DocumentActions'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
export async function generateMetadata({
|
||||
params,
|
||||
}: {
|
||||
params: Promise<{ documentNumber: string }>
|
||||
}): Promise<Metadata> {
|
||||
const { documentNumber } = await params
|
||||
return { title: documentNumber }
|
||||
}
|
||||
|
||||
async function Body({
|
||||
document,
|
||||
permissions,
|
||||
canEdit,
|
||||
}: {
|
||||
document: { id: string; templateId: string; documentNumber: string }
|
||||
permissions: EffectivePermissions
|
||||
canEdit: boolean
|
||||
}) {
|
||||
const sections = await loadDocumentSections(permissions, document)
|
||||
return (
|
||||
<Sections
|
||||
scope={`dokument:${document.documentNumber}`}
|
||||
save={saveDocumentSectionAction.bind(null, document.documentNumber)}
|
||||
sections={sections}
|
||||
canEdit={canEdit}
|
||||
/>
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Ein Dokument.
|
||||
*
|
||||
* Dieselbe Darstellung trägt einen Vorfallsbericht und einen mehrseitigen
|
||||
* Vertrag: was sie unterscheidet, steht in der Vorlage, nicht hier.
|
||||
* Siehe docs/13-entscheidungen.md.
|
||||
*/
|
||||
export default async function DocumentPage({
|
||||
params,
|
||||
}: {
|
||||
params: Promise<{ documentNumber: string }>
|
||||
}) {
|
||||
const user = await requireUser()
|
||||
const { documentNumber } = await params
|
||||
|
||||
const doc = await loadVisibleDocument(user.permissions, documentNumber)
|
||||
// Kein Zugriff heisst 404, nicht 403.
|
||||
if (!doc) notFound()
|
||||
|
||||
if (doc.classification >= READ_AUDIT_FROM_LEVEL) {
|
||||
recordRead({
|
||||
actorId: user.id,
|
||||
action: 'document.read',
|
||||
targetType: 'Document',
|
||||
targetId: doc.id,
|
||||
clearanceAtTime: user.permissions.clearanceLevel,
|
||||
meta: { documentNumber: doc.documentNumber, classification: doc.classification },
|
||||
})
|
||||
}
|
||||
|
||||
const [levels, besitzer, verfasser] = await Promise.all([
|
||||
db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
|
||||
doc.caseId
|
||||
? db.case.findUnique({ where: { id: doc.caseId }, select: { caseNumber: true, title: true } })
|
||||
: doc.personnelFileId
|
||||
? db.personnelFile.findUnique({
|
||||
where: { id: doc.personnelFileId },
|
||||
select: { id: true, displayName: true },
|
||||
})
|
||||
: Promise.resolve(null),
|
||||
db.user.findMany({
|
||||
where: {
|
||||
id: {
|
||||
in: [doc.createdById, doc.finalizedById, doc.retractedById].filter(
|
||||
(id): id is string => id !== null,
|
||||
),
|
||||
},
|
||||
},
|
||||
select: { id: true, displayName: true },
|
||||
}),
|
||||
])
|
||||
|
||||
const level = levels.find((l) => l.level === doc.classification)
|
||||
const nameOf = new Map(verfasser.map((v) => [v.id, v.displayName]))
|
||||
const canEdit = canEditDocument(user.permissions, doc).ok
|
||||
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<header className="pl-3" style={classificationEdgeStyle(doc.classification)}>
|
||||
<div className="flex flex-wrap items-baseline gap-x-4 gap-y-2">
|
||||
<span className="font-mono text-xs text-text-dim">{doc.documentNumber}</span>
|
||||
<StampMark level={doc.classification} name={level?.name ?? de.common.unknown} />
|
||||
</div>
|
||||
<h1 className="mt-2 font-condensed">{doc.title}</h1>
|
||||
|
||||
<dl className="mt-3 flex flex-wrap gap-x-8 gap-y-1 text-xs text-text-dim">
|
||||
<div className="flex gap-2">
|
||||
<dt className="font-condensed">{de.case.status}</dt>
|
||||
<dd>{de.document.statusNames[doc.status] ?? doc.status}</dd>
|
||||
</div>
|
||||
<div className="flex gap-2">
|
||||
<dt className="font-condensed">{de.document.kind}</dt>
|
||||
<dd>{doc.templateKey}</dd>
|
||||
</div>
|
||||
<div className="flex gap-2">
|
||||
<dt className="font-condensed">{de.case.createdBy}</dt>
|
||||
<dd>{nameOf.get(doc.createdById) ?? doc.createdById}</dd>
|
||||
</div>
|
||||
</dl>
|
||||
|
||||
{besitzer ? (
|
||||
<p className="mt-2 text-xs">
|
||||
{'caseNumber' in besitzer ? (
|
||||
<Link href={`/faelle/${besitzer.caseNumber}`}>
|
||||
{de.document.ownerCase} · {besitzer.title}
|
||||
</Link>
|
||||
) : (
|
||||
<Link href={`/personalakten/${besitzer.id}`}>
|
||||
{de.document.ownerPersonnel} · {besitzer.displayName}
|
||||
</Link>
|
||||
)}
|
||||
</p>
|
||||
) : (
|
||||
<p className="mt-2 text-xs text-text-dim">{de.document.ownerNone}</p>
|
||||
)}
|
||||
|
||||
{doc.retractedAt ? (
|
||||
<p className="mt-3 border-l-(length:--spacing-edge) border-stamp-4 pl-3 text-sm text-text-dim">
|
||||
{de.document.retracted(
|
||||
doc.retractedAt.toLocaleDateString('de-DE'),
|
||||
nameOf.get(doc.retractedById ?? '') ?? doc.retractedById ?? de.common.unknown,
|
||||
doc.retractionReason ?? '',
|
||||
)}
|
||||
</p>
|
||||
) : doc.finalizedAt ? (
|
||||
<p className="mt-3 font-condensed text-2xs text-text-dim">
|
||||
{de.document.finalized(
|
||||
doc.finalizedAt.toLocaleDateString('de-DE'),
|
||||
nameOf.get(doc.finalizedById ?? '') ?? doc.finalizedById ?? de.common.unknown,
|
||||
)}
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
<DocumentActions
|
||||
documentNumber={doc.documentNumber}
|
||||
classification={doc.classification}
|
||||
canFinalize={canFinalizeDocument(user.permissions, doc).ok}
|
||||
canRetract={canRetractDocument(user.permissions, doc).ok}
|
||||
canReclassify={canEdit}
|
||||
levels={levels
|
||||
.filter((l) => l.level <= user.permissions.clearanceLevel)
|
||||
.map((l) => ({ level: l.level, name: l.name }))}
|
||||
/>
|
||||
</header>
|
||||
|
||||
<section className="mt-10">
|
||||
<Suspense
|
||||
fallback={
|
||||
<div className="space-y-6">
|
||||
<SkeletonLine width="10rem" />
|
||||
<SkeletonLine />
|
||||
<SkeletonLine width="12rem" />
|
||||
<SkeletonLine />
|
||||
</div>
|
||||
}
|
||||
>
|
||||
<Body document={doc} permissions={user.permissions} canEdit={canEdit} />
|
||||
</Suspense>
|
||||
</section>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
'use server'
|
||||
|
||||
import { revalidatePath } from 'next/cache'
|
||||
import { redirect } from 'next/navigation'
|
||||
import { z } from 'zod'
|
||||
import { requireUser } from '@/lib/auth/current'
|
||||
import { AccessError, ConflictError } from '@/lib/errors'
|
||||
import {
|
||||
createDocument,
|
||||
finalizeDocument,
|
||||
reclassifyDocument,
|
||||
retractDocument,
|
||||
saveDocumentSection,
|
||||
type Owner,
|
||||
} from '@/lib/documents/service'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import type { SaveSectionResult } from '@/components/sections/types'
|
||||
|
||||
export type ActionResult = { ok: true } | { ok: false; error: string }
|
||||
|
||||
function toMessage(error: unknown): string {
|
||||
if (error instanceof AccessError) {
|
||||
return de.actionErrors[error.code] ?? de.actionErrors.default!
|
||||
}
|
||||
console.error('[dokumente] unerwartet', error)
|
||||
return de.actionErrors.default!
|
||||
}
|
||||
|
||||
const createSchema = z.object({
|
||||
templateKey: z.string().min(1),
|
||||
title: z.string().max(200).optional(),
|
||||
classification: z.coerce.number().int().min(0).max(5),
|
||||
caseNumber: z.string().max(60).optional(),
|
||||
personnelFileId: z.string().max(64).optional(),
|
||||
})
|
||||
|
||||
export async function createDocumentAction(
|
||||
_prev: ActionResult | null,
|
||||
formData: FormData,
|
||||
): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = createSchema.safeParse(Object.fromEntries(formData))
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
const owner: Owner = parsed.data.caseNumber
|
||||
? { kind: 'case', caseNumber: parsed.data.caseNumber }
|
||||
: parsed.data.personnelFileId
|
||||
? { kind: 'personnel', personnelFileId: parsed.data.personnelFileId }
|
||||
: { kind: 'standalone' }
|
||||
|
||||
let documentNumber: string
|
||||
try {
|
||||
const created = await createDocument(user.permissions, {
|
||||
templateKey: parsed.data.templateKey,
|
||||
title: parsed.data.title,
|
||||
classification: parsed.data.classification,
|
||||
owner,
|
||||
})
|
||||
documentNumber = created.documentNumber
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
|
||||
redirect(`/dokumente/${documentNumber}`)
|
||||
}
|
||||
|
||||
const sectionSchema = z.object({
|
||||
fieldKey: z.string().min(1),
|
||||
value: z.unknown(),
|
||||
baseVersion: z.coerce.number().int().min(0),
|
||||
minClearance: z.coerce.number().int().min(0).max(5).optional(),
|
||||
})
|
||||
|
||||
/** Das Dokument kommt gebunden herein, siehe `.bind`. */
|
||||
export async function saveDocumentSectionAction(
|
||||
documentNumber: string,
|
||||
input: unknown,
|
||||
): Promise<SaveSectionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = sectionSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, conflict: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
const { version } = await saveDocumentSection(user.permissions, {
|
||||
documentNumber,
|
||||
...parsed.data,
|
||||
})
|
||||
revalidatePath(`/dokumente/${documentNumber}`)
|
||||
return { ok: true, version }
|
||||
} catch (error) {
|
||||
if (error instanceof ConflictError) {
|
||||
return {
|
||||
ok: false,
|
||||
conflict: true,
|
||||
current: { value: error.current.value, version: error.current.version },
|
||||
}
|
||||
}
|
||||
return { ok: false, conflict: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const numberSchema = z.object({ documentNumber: z.string().min(1) })
|
||||
|
||||
export async function finalizeDocumentAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = numberSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await finalizeDocument(user.permissions, parsed.data.documentNumber)
|
||||
revalidatePath(`/dokumente/${parsed.data.documentNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const retractSchema = numberSchema.extend({ reason: z.string().min(10).max(2000) })
|
||||
|
||||
export async function retractDocumentAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = retractSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors['reason-required']! }
|
||||
|
||||
try {
|
||||
await retractDocument(user.permissions, parsed.data.documentNumber, parsed.data.reason)
|
||||
revalidatePath(`/dokumente/${parsed.data.documentNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const reclassifySchema = numberSchema.extend({
|
||||
to: z.coerce.number().int().min(0).max(5),
|
||||
reason: z.string().max(2000).optional(),
|
||||
})
|
||||
|
||||
export async function reclassifyDocumentAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = reclassifySchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await reclassifyDocument(
|
||||
user.permissions,
|
||||
parsed.data.documentNumber,
|
||||
parsed.data.to,
|
||||
parsed.data.reason,
|
||||
)
|
||||
revalidatePath(`/dokumente/${parsed.data.documentNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
@@ -38,7 +38,7 @@ export function CaseActions({
|
||||
setError(null)
|
||||
startTransition(async () => {
|
||||
const result = await action()
|
||||
if (!result.ok) setError(result.error ?? de.case.errors.default!)
|
||||
if (!result.ok) setError(result.error ?? de.actionErrors.default!)
|
||||
})
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,152 @@
|
||||
'use client'
|
||||
|
||||
import { useState, useTransition } from 'react'
|
||||
import Link from 'next/link'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { LINK_KINDS } from '@/lib/cases/terms'
|
||||
import { linkCasesAction, unlinkCasesAction } from '../actions'
|
||||
import { classificationEdgeStyle } from '@/components/StampMark'
|
||||
|
||||
type Verknuepfung = {
|
||||
kind: string
|
||||
direction: 'in' | 'out'
|
||||
other: { id: string; caseNumber: string; title: string; status: string; classification: number }
|
||||
}
|
||||
|
||||
/**
|
||||
* Verknüpfungen zwischen Akten.
|
||||
*
|
||||
* Lösen ohne Bestätigungsdialog: eine Verknüpfung ist umkehrbar, sie lässt
|
||||
* sich in zwei Klicks neu ziehen. Siehe docs/09-performance-und-ux.md.
|
||||
*/
|
||||
export function CaseLinks({
|
||||
caseNumber,
|
||||
links,
|
||||
canEdit,
|
||||
}: {
|
||||
caseNumber: string
|
||||
links: Verknuepfung[]
|
||||
canEdit: boolean
|
||||
}) {
|
||||
const [open, setOpen] = useState(false)
|
||||
const [target, setTarget] = useState('')
|
||||
const [kind, setKind] = useState<string>('RELATED')
|
||||
const [error, setError] = useState<string | null>(null)
|
||||
const [pending, startTransition] = useTransition()
|
||||
|
||||
return (
|
||||
<div>
|
||||
{links.length === 0 ? (
|
||||
<p className="text-text-dim">{de.link.empty}</p>
|
||||
) : (
|
||||
<ul className="border-t border-line">
|
||||
{links.map((link) => (
|
||||
<li
|
||||
key={`${link.direction}:${link.kind}:${link.other.id}`}
|
||||
className="flex flex-wrap items-baseline gap-x-4 gap-y-1 border-b border-line py-2 pl-3"
|
||||
style={classificationEdgeStyle(link.other.classification)}
|
||||
>
|
||||
<span className="font-condensed text-2xs text-text-dim">
|
||||
{(link.direction === 'in' ? de.link.incoming : de.link.kinds)[link.kind] ??
|
||||
link.kind}
|
||||
</span>
|
||||
<Link
|
||||
href={`/faelle/${link.other.caseNumber}`}
|
||||
prefetch
|
||||
className="font-mono text-xs text-text-dim"
|
||||
>
|
||||
{link.other.caseNumber}
|
||||
</Link>
|
||||
<span className="grow text-sm">{link.other.title}</span>
|
||||
{canEdit ? (
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending}
|
||||
onClick={() =>
|
||||
startTransition(async () => {
|
||||
const result = await unlinkCasesAction({
|
||||
fromCaseNumber: caseNumber,
|
||||
toCaseNumber: link.other.caseNumber,
|
||||
kind: link.kind,
|
||||
})
|
||||
if (!result.ok) setError(result.error)
|
||||
})
|
||||
}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.link.remove}
|
||||
</button>
|
||||
) : null}
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
|
||||
{error ? <p className="mt-2 font-condensed text-2xs text-stamp-4">{error}</p> : null}
|
||||
|
||||
{canEdit ? (
|
||||
open ? (
|
||||
<div className="mt-4 flex flex-wrap items-center gap-2">
|
||||
<select
|
||||
value={kind}
|
||||
onChange={(event) => setKind(event.target.value)}
|
||||
aria-label={de.link.kind}
|
||||
className="border border-line bg-raised px-2 py-1 text-2xs"
|
||||
>
|
||||
{LINK_KINDS.map((value) => (
|
||||
<option key={value} value={value}>
|
||||
{de.link.kinds[value] ?? value}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
<input
|
||||
value={target}
|
||||
onChange={(event) => setTarget(event.target.value)}
|
||||
placeholder={de.link.target}
|
||||
aria-label={de.link.target}
|
||||
className="border border-line bg-raised px-2 py-1 font-mono text-2xs"
|
||||
/>
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending || target.trim() === ''}
|
||||
onClick={() =>
|
||||
startTransition(async () => {
|
||||
setError(null)
|
||||
const result = await linkCasesAction({
|
||||
fromCaseNumber: caseNumber,
|
||||
toCaseNumber: target.trim(),
|
||||
kind,
|
||||
})
|
||||
if (result.ok) {
|
||||
setTarget('')
|
||||
setOpen(false)
|
||||
} else {
|
||||
setError(result.error)
|
||||
}
|
||||
})
|
||||
}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
|
||||
>
|
||||
{de.link.add}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(false)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
) : (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(true)}
|
||||
className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
|
||||
>
|
||||
{de.link.add}
|
||||
</button>
|
||||
)
|
||||
) : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -39,7 +39,7 @@ export function EntryActions({
|
||||
setMode('idle')
|
||||
setReason('')
|
||||
} else {
|
||||
setError(result.error ?? de.case.errors.default!)
|
||||
setError(result.error ?? de.actionErrors.default!)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
@@ -0,0 +1,180 @@
|
||||
'use client'
|
||||
|
||||
import { useState, useTransition } from 'react'
|
||||
import Link from 'next/link'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { PARTICIPANT_ROLES } from '@/lib/cases/terms'
|
||||
import { addParticipantAction, removeParticipantAction } from '../actions'
|
||||
|
||||
type Beteiligter = {
|
||||
id: string
|
||||
role: string
|
||||
userId: string | null
|
||||
displayName: string | null
|
||||
personnelFileId: string | null
|
||||
}
|
||||
|
||||
/**
|
||||
* Beteiligte einer Akte.
|
||||
*
|
||||
* Der Hinweis über dem Formular ist wichtig und steht deshalb dort und nicht
|
||||
* in einer Hilfeseite: wer hier eingetragen wird, liest die Akte unabhängig
|
||||
* von seiner Freigabestufe.
|
||||
*/
|
||||
export function Participants({
|
||||
caseNumber,
|
||||
participants,
|
||||
canEdit,
|
||||
members,
|
||||
files,
|
||||
}: {
|
||||
caseNumber: string
|
||||
participants: Beteiligter[]
|
||||
canEdit: boolean
|
||||
members: { id: string; displayName: string }[]
|
||||
files: { id: string; displayName: string }[]
|
||||
}) {
|
||||
const [open, setOpen] = useState(false)
|
||||
const [role, setRole] = useState<string>('INVESTIGATOR')
|
||||
const [target, setTarget] = useState('')
|
||||
const [error, setError] = useState<string | null>(null)
|
||||
const [pending, startTransition] = useTransition()
|
||||
|
||||
function add() {
|
||||
if (!target) return
|
||||
setError(null)
|
||||
const [art, id] = target.split(':')
|
||||
startTransition(async () => {
|
||||
const result = await addParticipantAction({
|
||||
caseNumber,
|
||||
role,
|
||||
...(art === 'user' ? { userId: id } : { personnelFileId: id }),
|
||||
})
|
||||
if (result.ok) {
|
||||
setTarget('')
|
||||
setOpen(false)
|
||||
} else {
|
||||
setError(result.error)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
return (
|
||||
<div>
|
||||
{participants.length === 0 ? (
|
||||
<p className="text-text-dim">{de.participant.empty}</p>
|
||||
) : (
|
||||
<ul className="border-t border-line">
|
||||
{participants.map((person) => (
|
||||
<li
|
||||
key={person.id}
|
||||
className="flex flex-wrap items-baseline gap-x-4 gap-y-1 border-b border-line py-2"
|
||||
>
|
||||
<span className="font-condensed text-2xs text-text-dim">
|
||||
{de.participant.roles[person.role] ?? person.role}
|
||||
</span>
|
||||
<span className="grow text-sm">
|
||||
{person.personnelFileId ? (
|
||||
<Link href={`/personalakten/${person.personnelFileId}`}>
|
||||
{person.displayName ?? de.common.unknown}
|
||||
</Link>
|
||||
) : (
|
||||
(person.displayName ?? de.common.unknown)
|
||||
)}
|
||||
</span>
|
||||
{canEdit ? (
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending}
|
||||
onClick={() =>
|
||||
startTransition(async () => {
|
||||
const result = await removeParticipantAction({
|
||||
caseNumber,
|
||||
participantId: person.id,
|
||||
})
|
||||
if (!result.ok) setError(result.error)
|
||||
})
|
||||
}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.participant.remove}
|
||||
</button>
|
||||
) : null}
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
|
||||
{error ? <p className="mt-2 font-condensed text-2xs text-stamp-4">{error}</p> : null}
|
||||
|
||||
{canEdit ? (
|
||||
open ? (
|
||||
<div className="mt-4 border border-line p-3">
|
||||
<p className="max-w-(--container-measure) text-2xs text-text-dim">
|
||||
{de.participant.hint}
|
||||
</p>
|
||||
<div className="mt-3 flex flex-wrap items-center gap-2">
|
||||
<select
|
||||
value={role}
|
||||
onChange={(event) => setRole(event.target.value)}
|
||||
aria-label={de.participant.role}
|
||||
className="border border-line bg-raised px-2 py-1 text-2xs"
|
||||
>
|
||||
{PARTICIPANT_ROLES.map((value) => (
|
||||
<option key={value} value={value}>
|
||||
{de.participant.roles[value] ?? value}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
<select
|
||||
value={target}
|
||||
onChange={(event) => setTarget(event.target.value)}
|
||||
aria-label={de.participant.person}
|
||||
className="border border-line bg-raised px-2 py-1 text-2xs"
|
||||
>
|
||||
<option value="">—</option>
|
||||
<optgroup label={de.participant.pickUser}>
|
||||
{members.map((member) => (
|
||||
<option key={member.id} value={`user:${member.id}`}>
|
||||
{member.displayName}
|
||||
</option>
|
||||
))}
|
||||
</optgroup>
|
||||
<optgroup label={de.participant.pickPersonnel}>
|
||||
{files.map((file) => (
|
||||
<option key={file.id} value={`file:${file.id}`}>
|
||||
{file.displayName}
|
||||
</option>
|
||||
))}
|
||||
</optgroup>
|
||||
</select>
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending || !target}
|
||||
onClick={add}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
|
||||
>
|
||||
{de.participant.add}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(false)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
) : (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(true)}
|
||||
className="mt-4 border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
|
||||
>
|
||||
{de.participant.add}
|
||||
</button>
|
||||
)
|
||||
) : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -10,11 +10,20 @@ import { de } from '@/lib/i18n/de'
|
||||
import { StampMark, classificationEdgeStyle } from '@/components/StampMark'
|
||||
import { SkeletonLine } from '@/components/Skeleton'
|
||||
import { EntryComposer } from './EntryComposer'
|
||||
import { Sections } from './Sections'
|
||||
import { Sections } from '@/components/sections/Sections'
|
||||
import { saveSectionAction } from './sectionActions'
|
||||
import { loadSections } from '@/lib/cases/sectionService'
|
||||
import { canEditCase } from '@/lib/access/caseWrite'
|
||||
import { CaseActions } from './CaseActions'
|
||||
import { EntryActions } from './EntryActions'
|
||||
import { Participants } from './Participants'
|
||||
import { CaseLinks } from './CaseLinks'
|
||||
import { listParticipants } from '@/lib/cases/participants'
|
||||
import { listLinks } from '@/lib/cases/links'
|
||||
import { listDocuments, listTemplatesFor } from '@/lib/documents/service'
|
||||
import { visiblePersonnelWhere } from '@/lib/access/personnelFilter'
|
||||
import { DocumentList } from '@/components/documents/DocumentList'
|
||||
import { NewDocument } from '@/components/documents/NewDocument'
|
||||
import { allowedTargets, type CaseStatusName } from '@/lib/cases/lifecycle'
|
||||
import { evaluateEntryEdit, canRetract } from '@/lib/cases/entryPolicy'
|
||||
import Link from 'next/link'
|
||||
@@ -132,6 +141,87 @@ async function Timeline({
|
||||
)
|
||||
}
|
||||
|
||||
/**
|
||||
* Beteiligte, Verknüpfungen und Dokumente hängen in einer gemeinsamen
|
||||
* Suspense-Grenze: drei kleine Abfragen, die zusammen einen Block ergeben.
|
||||
* Getrennt zu streamen liesse den Kasten dreimal springen.
|
||||
*/
|
||||
async function Relations({
|
||||
akte,
|
||||
permissions,
|
||||
canEdit,
|
||||
}: {
|
||||
akte: { id: string; caseNumber: string; classification: number }
|
||||
permissions: EffectivePermissions
|
||||
canEdit: boolean
|
||||
}) {
|
||||
const [participants, links, documents, templates, levels, members, files] = await Promise.all([
|
||||
listParticipants(permissions, akte.id),
|
||||
listLinks(permissions, akte.id),
|
||||
listDocuments(permissions, { caseId: akte.id }),
|
||||
canEdit ? listTemplatesFor('CASE_DOCUMENT') : Promise.resolve([]),
|
||||
db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
|
||||
canEdit
|
||||
? db.user.findMany({
|
||||
orderBy: { displayName: 'asc' },
|
||||
take: 200,
|
||||
select: { id: true, displayName: true },
|
||||
})
|
||||
: Promise.resolve([]),
|
||||
// Nur Personalakten, die der Eintragende sehen darf, und nur, wenn er sie
|
||||
// überhaupt lesen darf: sonst verriete die Auswahlliste ihre Existenz.
|
||||
canEdit && (permissions.isAdmin || permissions.permissions.has('personnel.read'))
|
||||
? db.personnelFile.findMany({
|
||||
where: visiblePersonnelWhere(permissions),
|
||||
orderBy: { displayName: 'asc' },
|
||||
take: 200,
|
||||
select: { id: true, displayName: true },
|
||||
})
|
||||
: Promise.resolve([]),
|
||||
])
|
||||
|
||||
const levelName = new Map(levels.map((l) => [l.level, l.name]))
|
||||
|
||||
return (
|
||||
<div className="grid gap-10 md:grid-cols-2">
|
||||
<section>
|
||||
<h2 className="font-condensed">{de.participant.heading}</h2>
|
||||
<div className="mt-4">
|
||||
<Participants
|
||||
caseNumber={akte.caseNumber}
|
||||
participants={participants}
|
||||
canEdit={canEdit}
|
||||
members={members}
|
||||
files={files}
|
||||
/>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<h2 className="font-condensed">{de.link.heading}</h2>
|
||||
<div className="mt-4">
|
||||
<CaseLinks caseNumber={akte.caseNumber} links={links} canEdit={canEdit} />
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="md:col-span-2">
|
||||
<h2 className="font-condensed">{de.document.heading}</h2>
|
||||
<div className="mt-4 space-y-4">
|
||||
<DocumentList documents={documents} levelName={levelName} />
|
||||
{canEdit ? (
|
||||
<NewDocument
|
||||
templates={templates}
|
||||
levels={levels.filter((l) => l.level <= permissions.clearanceLevel)}
|
||||
defaultLevel={Math.min(akte.classification, permissions.clearanceLevel)}
|
||||
caseNumber={akte.caseNumber}
|
||||
/>
|
||||
) : null}
|
||||
</div>
|
||||
</section>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
async function SectionBlock({
|
||||
caseId,
|
||||
caseNumber,
|
||||
@@ -146,7 +236,14 @@ async function SectionBlock({
|
||||
canEdit: boolean
|
||||
}) {
|
||||
const sections = await loadSections(permissions, caseId, templateId)
|
||||
return <Sections caseNumber={caseNumber} sections={sections} canEdit={canEdit} />
|
||||
return (
|
||||
<Sections
|
||||
scope={`fall:${caseNumber}`}
|
||||
save={saveSectionAction.bind(null, caseNumber)}
|
||||
sections={sections}
|
||||
canEdit={canEdit}
|
||||
/>
|
||||
)
|
||||
}
|
||||
|
||||
export default async function CasePage({
|
||||
@@ -236,7 +333,30 @@ export default async function CasePage({
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<nav className="mt-10 flex gap-4 border-b border-line pb-2 font-condensed text-xs">
|
||||
<div className="mt-12">
|
||||
<Suspense
|
||||
fallback={
|
||||
<div className="grid gap-10 md:grid-cols-2">
|
||||
<div className="space-y-3">
|
||||
<SkeletonLine width="8rem" />
|
||||
<SkeletonLine width="70%" />
|
||||
</div>
|
||||
<div className="space-y-3">
|
||||
<SkeletonLine width="9rem" />
|
||||
<SkeletonLine width="65%" />
|
||||
</div>
|
||||
</div>
|
||||
}
|
||||
>
|
||||
<Relations
|
||||
akte={akte}
|
||||
permissions={user.permissions}
|
||||
canEdit={canEditCase(user.permissions, akte).ok}
|
||||
/>
|
||||
</Suspense>
|
||||
</div>
|
||||
|
||||
<nav className="mt-12 flex gap-4 border-b border-line pb-2 font-condensed text-xs">
|
||||
<span className="text-text-dim">{de.case.timeline}</span>
|
||||
<Link href={`/faelle/${akte.caseNumber}/aenderungen`}>{de.case.changes}</Link>
|
||||
</nav>
|
||||
|
||||
@@ -3,32 +3,30 @@
|
||||
import { revalidatePath } from 'next/cache'
|
||||
import { z } from 'zod'
|
||||
import { requireUser } from '@/lib/auth/current'
|
||||
import { AccessError } from '@/lib/cases/service'
|
||||
import { ConflictError, saveSection } from '@/lib/cases/sectionService'
|
||||
import { AccessError, ConflictError } from '@/lib/errors'
|
||||
import { saveSection } from '@/lib/cases/sectionService'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import type { SaveSectionResult } from '@/components/sections/types'
|
||||
|
||||
const schema = z.object({
|
||||
caseNumber: z.string().min(1),
|
||||
fieldKey: z.string().min(1),
|
||||
value: z.unknown(),
|
||||
baseVersion: z.coerce.number().int().min(0),
|
||||
minClearance: z.coerce.number().int().min(0).max(5).optional(),
|
||||
})
|
||||
|
||||
export type SaveSectionResult =
|
||||
| { ok: true; version: number }
|
||||
/** Kein stilles Überschreiben: die fremde Fassung kommt mit zurück. */
|
||||
| { ok: false; conflict: true; current: { value: unknown; version: number } }
|
||||
| { ok: false; conflict: false; error: string }
|
||||
|
||||
export async function saveSectionAction(input: unknown): Promise<SaveSectionResult> {
|
||||
/** Die Akte kommt gebunden herein, siehe `saveSectionAction.bind`. */
|
||||
export async function saveSectionAction(
|
||||
caseNumber: string,
|
||||
input: unknown,
|
||||
): Promise<SaveSectionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = schema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, conflict: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, conflict: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
const { version } = await saveSection(user.permissions, parsed.data)
|
||||
revalidatePath(`/faelle/${parsed.data.caseNumber}`)
|
||||
const { version } = await saveSection(user.permissions, { caseNumber, ...parsed.data })
|
||||
revalidatePath(`/faelle/${caseNumber}`)
|
||||
return { ok: true, version }
|
||||
} catch (error) {
|
||||
if (error instanceof ConflictError) {
|
||||
@@ -39,9 +37,13 @@ export async function saveSectionAction(input: unknown): Promise<SaveSectionResu
|
||||
}
|
||||
}
|
||||
if (error instanceof AccessError) {
|
||||
return { ok: false, conflict: false, error: de.case.errors[error.code] ?? de.case.errors.default! }
|
||||
return {
|
||||
ok: false,
|
||||
conflict: false,
|
||||
error: de.actionErrors[error.code] ?? de.actionErrors.default!,
|
||||
}
|
||||
}
|
||||
console.error('[abschnitt] unerwartet', error)
|
||||
return { ok: false, conflict: false, error: de.case.errors.default! }
|
||||
return { ok: false, conflict: false, error: de.actionErrors.default! }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -6,16 +6,19 @@ import { z } from 'zod'
|
||||
import { requireUser } from '@/lib/auth/current'
|
||||
import { AccessError, addEntry, changeStatus, createCase, reclassify } from '@/lib/cases/service'
|
||||
import { editEntry, restoreEntry, retractEntry } from '@/lib/cases/entryService'
|
||||
import { addParticipant, removeParticipant } from '@/lib/cases/participants'
|
||||
import { linkCases, unlinkCases } from '@/lib/cases/links'
|
||||
import { LINK_KINDS, PARTICIPANT_ROLES } from '@/lib/cases/terms'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
|
||||
export type ActionResult = { ok: true } | { ok: false; error: string }
|
||||
|
||||
function toMessage(error: unknown): string {
|
||||
if (error instanceof AccessError) {
|
||||
return de.case.errors[error.code] ?? de.case.errors.default!
|
||||
return de.actionErrors[error.code] ?? de.actionErrors.default!
|
||||
}
|
||||
console.error('[faelle] unerwartet', error)
|
||||
return de.case.errors.default!
|
||||
return de.actionErrors.default!
|
||||
}
|
||||
|
||||
const createSchema = z.object({
|
||||
@@ -41,7 +44,7 @@ export async function createCaseAction(
|
||||
classification: formData.get('classification'),
|
||||
templateKey: formData.get('templateKey'),
|
||||
})
|
||||
if (!parsed.success) return { error: de.case.errors.default! }
|
||||
if (!parsed.success) return { error: de.actionErrors.default! }
|
||||
|
||||
let caseNumber: string
|
||||
try {
|
||||
@@ -66,7 +69,7 @@ const entrySchema = z.object({
|
||||
export async function addEntryAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = entrySchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await addEntry(user.permissions, parsed.data)
|
||||
@@ -88,7 +91,7 @@ const statusSchema = z.object({
|
||||
export async function changeStatusAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = statusSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await changeStatus(user.permissions, parsed.data)
|
||||
@@ -110,7 +113,7 @@ const reclassifySchema = z.object({
|
||||
export async function reclassifyAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = reclassifySchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await reclassify(user.permissions, parsed.data)
|
||||
@@ -134,7 +137,7 @@ const editSchema = z.object({
|
||||
export async function editEntryAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = editSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.case.errors.default! }
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await editEntry(user.permissions, parsed.data)
|
||||
@@ -181,3 +184,81 @@ export async function restoreEntryAction(input: unknown): Promise<ActionResult>
|
||||
revalidatePath(`/faelle/${parsed.data.caseNumber}`)
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Beteiligte und Verknüpfungen
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
const participantSchema = z.object({
|
||||
caseNumber: z.string().min(1),
|
||||
role: z.enum(PARTICIPANT_ROLES),
|
||||
userId: z.string().max(64).optional(),
|
||||
personnelFileId: z.string().max(64).optional(),
|
||||
})
|
||||
|
||||
export async function addParticipantAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = participantSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors['participant-target']! }
|
||||
|
||||
try {
|
||||
await addParticipant(user.permissions, parsed.data)
|
||||
revalidatePath(`/faelle/${parsed.data.caseNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const removeParticipantSchema = z.object({
|
||||
caseNumber: z.string().min(1),
|
||||
participantId: z.string().min(1),
|
||||
})
|
||||
|
||||
export async function removeParticipantAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = removeParticipantSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await removeParticipant(user.permissions, parsed.data)
|
||||
revalidatePath(`/faelle/${parsed.data.caseNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const linkSchema = z.object({
|
||||
fromCaseNumber: z.string().min(1),
|
||||
toCaseNumber: z.string().min(1),
|
||||
kind: z.enum(LINK_KINDS),
|
||||
})
|
||||
|
||||
export async function linkCasesAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = linkSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await linkCases(user.permissions, parsed.data)
|
||||
revalidatePath(`/faelle/${parsed.data.fromCaseNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
export async function unlinkCasesAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = linkSchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await unlinkCases(user.permissions, parsed.data)
|
||||
revalidatePath(`/faelle/${parsed.data.fromCaseNumber}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -11,8 +11,9 @@ export default async function NewCasePage() {
|
||||
const user = await requirePermission('case.create')
|
||||
|
||||
const [templates, levels] = await Promise.all([
|
||||
db.caseTemplate.findMany({
|
||||
where: { isActive: true },
|
||||
db.documentTemplate.findMany({
|
||||
// Nur Fallarten. Eine Vorlage für Dokumente legt keine Akte an.
|
||||
where: { isActive: true, uses: { has: 'CASE' } },
|
||||
orderBy: [{ key: 'asc' }, { version: 'desc' }],
|
||||
distinct: ['key'],
|
||||
select: { key: true, name: true },
|
||||
|
||||
@@ -22,6 +22,9 @@ export default async function AppLayout({ children }: { children: React.ReactNod
|
||||
<nav className="flex gap-4 font-condensed text-xs">
|
||||
<Link href="/uebersicht">{de.nav.dashboard}</Link>
|
||||
<Link href="/faelle">{de.nav.cases}</Link>
|
||||
{user.permissions.isAdmin || user.permissions.permissions.has('personnel.read') ? (
|
||||
<Link href="/personalakten">{de.nav.personnel}</Link>
|
||||
) : null}
|
||||
{user.permissions.isAdmin || user.permissions.permissions.has('roles.manage') ? (
|
||||
<>
|
||||
<Link href="/admin/rollen">{de.nav.admin}</Link>
|
||||
|
||||
@@ -0,0 +1,266 @@
|
||||
'use client'
|
||||
|
||||
import { useActionState, useState, useTransition } from 'react'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import {
|
||||
reclassifyPersonnelAction,
|
||||
updatePersonnelAction,
|
||||
type ActionResult,
|
||||
} from '../actions'
|
||||
|
||||
type File = {
|
||||
id: string
|
||||
displayName: string
|
||||
serviceNumber: string | null
|
||||
rank: string | null
|
||||
department: string | null
|
||||
status: string | null
|
||||
note: string | null
|
||||
classification: number
|
||||
userId: string | null
|
||||
}
|
||||
|
||||
/**
|
||||
* Kopfdaten einer Personalakte: lesen und ändern in derselben Ansicht.
|
||||
*
|
||||
* Die Klassifizierung steht bewusst getrennt. Sie ändert, wer die Akte
|
||||
* überhaupt sieht, und eine Herabstufung braucht eine Begründung — das gehört
|
||||
* nicht in dasselbe Formular wie eine Korrektur der Dienstnummer.
|
||||
*/
|
||||
export function PersonnelHead({
|
||||
file,
|
||||
canEdit,
|
||||
levels,
|
||||
}: {
|
||||
file: File
|
||||
canEdit: boolean
|
||||
levels: { level: number; name: string }[]
|
||||
}) {
|
||||
const [editing, setEditing] = useState(false)
|
||||
const [state, action, pending] = useActionState<ActionResult | null, FormData>(
|
||||
updatePersonnelAction,
|
||||
null,
|
||||
)
|
||||
|
||||
if (!editing) {
|
||||
return (
|
||||
<div>
|
||||
<dl className="grid gap-x-8 gap-y-2 text-sm sm:grid-cols-2">
|
||||
<Zeile label={de.personnel.serviceNumber} value={file.serviceNumber} mono />
|
||||
<Zeile label={de.personnel.rank} value={file.rank} />
|
||||
<Zeile label={de.personnel.department} value={file.department} />
|
||||
<Zeile label={de.personnel.status} value={file.status} />
|
||||
<Zeile
|
||||
label={de.personnel.linkedAccount}
|
||||
value={file.userId ? file.userId : de.personnel.noAccount}
|
||||
mono={Boolean(file.userId)}
|
||||
/>
|
||||
</dl>
|
||||
|
||||
{file.note ? (
|
||||
<p className="mt-4 max-w-(--container-measure) border-l-(length:--spacing-edge) border-line pl-3 text-sm whitespace-pre-wrap">
|
||||
{file.note}
|
||||
</p>
|
||||
) : null}
|
||||
|
||||
{canEdit ? (
|
||||
<div className="mt-4 flex flex-wrap items-center gap-4">
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setEditing(true)}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
|
||||
>
|
||||
{de.personnel.edit}
|
||||
</button>
|
||||
<Reclassify id={file.id} current={file.classification} levels={levels} />
|
||||
</div>
|
||||
) : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
return (
|
||||
<form
|
||||
action={action}
|
||||
onSubmit={() => setEditing(false)}
|
||||
className="max-w-(--container-measure) space-y-4"
|
||||
>
|
||||
<input type="hidden" name="id" value={file.id} />
|
||||
<Feld id="displayName" label={de.personnel.name} defaultValue={file.displayName} required />
|
||||
<div className="grid gap-4 sm:grid-cols-2">
|
||||
<Feld
|
||||
id="serviceNumber"
|
||||
label={de.personnel.serviceNumber}
|
||||
defaultValue={file.serviceNumber}
|
||||
/>
|
||||
<Feld id="rank" label={de.personnel.rank} defaultValue={file.rank} />
|
||||
<Feld id="department" label={de.personnel.department} defaultValue={file.department} />
|
||||
<Feld id="status" label={de.personnel.status} defaultValue={file.status} />
|
||||
</div>
|
||||
<div>
|
||||
<label htmlFor="note" className="font-condensed text-2xs text-text-dim">
|
||||
{de.personnel.note}
|
||||
</label>
|
||||
<textarea
|
||||
id="note"
|
||||
name="note"
|
||||
rows={3}
|
||||
defaultValue={file.note ?? ''}
|
||||
className="mt-1 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
</div>
|
||||
|
||||
{state && !state.ok ? (
|
||||
<p className="font-condensed text-2xs text-stamp-4">{state.error}</p>
|
||||
) : null}
|
||||
|
||||
<div className="flex gap-3">
|
||||
<button
|
||||
type="submit"
|
||||
disabled={pending}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
|
||||
>
|
||||
{pending ? de.common.loading : de.common.save}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setEditing(false)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
)
|
||||
}
|
||||
|
||||
function Reclassify({
|
||||
id,
|
||||
current,
|
||||
levels,
|
||||
}: {
|
||||
id: string
|
||||
current: number
|
||||
levels: { level: number; name: string }[]
|
||||
}) {
|
||||
const [open, setOpen] = useState(false)
|
||||
const [to, setTo] = useState(current)
|
||||
const [reason, setReason] = useState('')
|
||||
const [error, setError] = useState<string | null>(null)
|
||||
const [pending, startTransition] = useTransition()
|
||||
|
||||
const lowering = to < current
|
||||
|
||||
if (!open) {
|
||||
return (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(true)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.personnel.reclassify}
|
||||
</button>
|
||||
)
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="w-full border border-line p-3">
|
||||
<div className="flex flex-wrap items-center gap-3">
|
||||
<select
|
||||
value={to}
|
||||
onChange={(event) => setTo(Number(event.target.value))}
|
||||
aria-label={de.clearance.classification}
|
||||
className="border border-line bg-raised px-2 py-1 text-2xs"
|
||||
>
|
||||
{levels.map((level) => (
|
||||
<option key={level.level} value={level.level}>
|
||||
{level.level} · {level.name}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
<button
|
||||
type="button"
|
||||
disabled={pending || to === current}
|
||||
onClick={() =>
|
||||
startTransition(async () => {
|
||||
const result = await reclassifyPersonnelAction({ id, to, reason })
|
||||
if (result.ok) setOpen(false)
|
||||
else setError(result.error)
|
||||
})
|
||||
}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
|
||||
>
|
||||
{de.common.save}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(false)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
|
||||
{/* Nur die Herabstufung braucht eine Begründung: sie macht die Akte für
|
||||
Leute sichtbar, die sie vorher nicht sehen durften. */}
|
||||
{lowering ? (
|
||||
<textarea
|
||||
value={reason}
|
||||
onChange={(event) => setReason(event.target.value)}
|
||||
rows={2}
|
||||
placeholder={de.case.reclassifyReason}
|
||||
aria-label={de.case.reclassifyReason}
|
||||
className="mt-2 block w-full border border-line bg-raised px-3 py-2 text-2xs"
|
||||
/>
|
||||
) : null}
|
||||
|
||||
{error ? <p className="mt-2 font-condensed text-2xs text-stamp-4">{error}</p> : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function Zeile({
|
||||
label,
|
||||
value,
|
||||
mono,
|
||||
}: {
|
||||
label: string
|
||||
value: string | null
|
||||
mono?: boolean
|
||||
}) {
|
||||
return (
|
||||
<div className="flex gap-3">
|
||||
<dt className="font-condensed text-xs text-text-dim">{label}</dt>
|
||||
<dd className={mono ? 'font-mono text-xs' : ''}>{value || '—'}</dd>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
function Feld({
|
||||
id,
|
||||
label,
|
||||
defaultValue,
|
||||
required,
|
||||
}: {
|
||||
id: string
|
||||
label: string
|
||||
defaultValue?: string | null
|
||||
required?: boolean
|
||||
}) {
|
||||
return (
|
||||
<div>
|
||||
<label htmlFor={id} className="font-condensed text-2xs text-text-dim">
|
||||
{label}
|
||||
</label>
|
||||
<input
|
||||
id={id}
|
||||
name={id}
|
||||
required={required}
|
||||
minLength={required ? 2 : undefined}
|
||||
maxLength={120}
|
||||
defaultValue={defaultValue ?? ''}
|
||||
className="mt-1 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
import { Skeleton, SkeletonLine } from '@/components/Skeleton'
|
||||
|
||||
export default function Loading() {
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<div className="pl-3">
|
||||
<Skeleton className="h-[0.9rem]" width="8rem" />
|
||||
<div className="mt-2">
|
||||
<Skeleton className="h-[1.6rem]" width="18rem" />
|
||||
</div>
|
||||
</div>
|
||||
<div className="mt-8 space-y-3">
|
||||
<Skeleton className="h-[1.1rem]" width="7rem" />
|
||||
<SkeletonLine width="60%" />
|
||||
<SkeletonLine width="45%" />
|
||||
</div>
|
||||
<div className="mt-10 space-y-3">
|
||||
<Skeleton className="h-[1.1rem]" width="9rem" />
|
||||
<SkeletonLine width="70%" />
|
||||
</div>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,188 @@
|
||||
import type { Metadata } from 'next'
|
||||
import { Suspense } from 'react'
|
||||
import Link from 'next/link'
|
||||
import { notFound } from 'next/navigation'
|
||||
import { db } from '@/lib/db'
|
||||
import { requirePermission } from '@/lib/auth/current'
|
||||
import { recordRead, READ_AUDIT_FROM_LEVEL } from '@/lib/audit'
|
||||
import { loadBacklinks, loadVisiblePersonnelFile } from '@/lib/personnel/service'
|
||||
import { listDocuments, listTemplatesFor } from '@/lib/documents/service'
|
||||
import { canWritePersonnel } from '@/lib/access/documentWrite'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { StampMark, classificationEdgeStyle } from '@/components/StampMark'
|
||||
import { SkeletonLine } from '@/components/Skeleton'
|
||||
import { DocumentList } from '@/components/documents/DocumentList'
|
||||
import { NewDocument } from '@/components/documents/NewDocument'
|
||||
import { PersonnelHead } from './PersonnelHead'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
export async function generateMetadata({
|
||||
params,
|
||||
}: {
|
||||
params: Promise<{ id: string }>
|
||||
}): Promise<Metadata> {
|
||||
const user = await requirePermission('personnel.read')
|
||||
const { id } = await params
|
||||
const akte = await loadVisiblePersonnelFile(user.permissions, id)
|
||||
return { title: akte?.displayName ?? de.personnel.one }
|
||||
}
|
||||
|
||||
/**
|
||||
* Rückverweise: die Fälle, in denen diese Person vorkommt.
|
||||
*
|
||||
* Streamt in einer eigenen Suspense-Grenze nach, weil die Abfrage über die
|
||||
* Sichtbarkeitsprüfung der Fallakten läuft und damit die teuerste auf dieser
|
||||
* Seite ist. Die Kopfdaten stehen währenddessen schon.
|
||||
*/
|
||||
async function Backlinks({
|
||||
file,
|
||||
permissions,
|
||||
}: {
|
||||
file: { id: string; userId: string | null }
|
||||
permissions: EffectivePermissions
|
||||
}) {
|
||||
const { total, byRole } = await loadBacklinks(permissions, file)
|
||||
|
||||
if (total === 0) {
|
||||
return <p className="text-text-dim">{de.personnel.backlinksEmpty}</p>
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="space-y-6">
|
||||
{byRole.map(({ role, eintraege }) => (
|
||||
<div key={role}>
|
||||
<h3 className="font-condensed text-xs text-text-dim">
|
||||
{de.participant.roles[role] ?? role}
|
||||
</h3>
|
||||
<ul className="mt-2 border-t border-line">
|
||||
{eintraege.map(({ case: akte }) => (
|
||||
<li key={`${role}:${akte.id}`} className="border-b border-line">
|
||||
<Link
|
||||
href={`/faelle/${akte.caseNumber}`}
|
||||
prefetch
|
||||
className="flex flex-wrap items-baseline gap-x-4 gap-y-1 py-2 pl-3 text-text no-underline"
|
||||
style={classificationEdgeStyle(akte.classification)}
|
||||
>
|
||||
<span className="font-mono text-xs text-text-dim">{akte.caseNumber}</span>
|
||||
<span className="grow">{akte.title}</span>
|
||||
<span className="font-condensed text-2xs text-text-dim">
|
||||
{de.case.statusNames[akte.status]}
|
||||
</span>
|
||||
</Link>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
async function Documents({
|
||||
file,
|
||||
permissions,
|
||||
canEdit,
|
||||
}: {
|
||||
file: { id: string; classification: number }
|
||||
permissions: EffectivePermissions
|
||||
canEdit: boolean
|
||||
}) {
|
||||
const [documents, templates, levels] = await Promise.all([
|
||||
listDocuments(permissions, { personnelFileId: file.id }),
|
||||
canEdit ? listTemplatesFor('PERSON_DOCUMENT') : Promise.resolve([]),
|
||||
db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
|
||||
])
|
||||
|
||||
return (
|
||||
<div className="space-y-4">
|
||||
<DocumentList
|
||||
documents={documents}
|
||||
levelName={new Map(levels.map((l) => [l.level, l.name]))}
|
||||
/>
|
||||
{canEdit ? (
|
||||
<NewDocument
|
||||
templates={templates}
|
||||
levels={levels.filter((l) => l.level <= permissions.clearanceLevel)}
|
||||
defaultLevel={Math.min(file.classification, permissions.clearanceLevel)}
|
||||
personnelFileId={file.id}
|
||||
/>
|
||||
) : null}
|
||||
</div>
|
||||
)
|
||||
}
|
||||
|
||||
export default async function PersonnelPage({ params }: { params: Promise<{ id: string }> }) {
|
||||
const user = await requirePermission('personnel.read')
|
||||
const { id } = await params
|
||||
|
||||
const akte = await loadVisiblePersonnelFile(user.permissions, id)
|
||||
// Kein Zugriff heisst 404, nicht 403: die Existenz ist selbst eine Information.
|
||||
if (!akte) notFound()
|
||||
|
||||
// Harte Regel 3: jeder Lesezugriff ab Stufe 3 wird protokolliert.
|
||||
if (akte.classification >= READ_AUDIT_FROM_LEVEL) {
|
||||
recordRead({
|
||||
actorId: user.id,
|
||||
action: 'personnel.read',
|
||||
targetType: 'PersonnelFile',
|
||||
targetId: akte.id,
|
||||
clearanceAtTime: user.permissions.clearanceLevel,
|
||||
meta: { displayName: akte.displayName, classification: akte.classification },
|
||||
})
|
||||
}
|
||||
|
||||
const levels = await db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } })
|
||||
const level = levels.find((l) => l.level === akte.classification)
|
||||
const canEdit = canWritePersonnel(user.permissions, akte.classification).ok
|
||||
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<header className="pl-3" style={classificationEdgeStyle(akte.classification)}>
|
||||
<div className="flex flex-wrap items-baseline gap-x-4 gap-y-2">
|
||||
<span className="font-condensed text-xs text-text-dim">{de.personnel.one}</span>
|
||||
<StampMark level={akte.classification} name={level?.name ?? de.common.unknown} />
|
||||
</div>
|
||||
<h1 className="mt-2 font-condensed">{akte.displayName}</h1>
|
||||
</header>
|
||||
|
||||
<section className="mt-8">
|
||||
<h2 className="font-condensed">{de.personnel.headData}</h2>
|
||||
<div className="mt-4">
|
||||
<PersonnelHead
|
||||
file={akte}
|
||||
canEdit={canEdit}
|
||||
levels={levels.filter((l) => l.level <= user.permissions.clearanceLevel)}
|
||||
/>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="mt-10">
|
||||
<h2 className="font-condensed">{de.document.heading}</h2>
|
||||
<div className="mt-4">
|
||||
<Suspense fallback={<SkeletonLine width="60%" />}>
|
||||
<Documents file={akte} permissions={user.permissions} canEdit={canEdit} />
|
||||
</Suspense>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<section className="mt-10">
|
||||
<h2 className="font-condensed">{de.personnel.backlinks}</h2>
|
||||
<div className="mt-4">
|
||||
<Suspense
|
||||
fallback={
|
||||
<div className="space-y-3">
|
||||
<SkeletonLine width="8rem" />
|
||||
<SkeletonLine width="70%" />
|
||||
<SkeletonLine width="55%" />
|
||||
</div>
|
||||
}
|
||||
>
|
||||
<Backlinks file={akte} permissions={user.permissions} />
|
||||
</Suspense>
|
||||
</div>
|
||||
</section>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,103 @@
|
||||
'use server'
|
||||
|
||||
import { revalidatePath } from 'next/cache'
|
||||
import { redirect } from 'next/navigation'
|
||||
import { z } from 'zod'
|
||||
import { requireUser } from '@/lib/auth/current'
|
||||
import { AccessError } from '@/lib/errors'
|
||||
import {
|
||||
createPersonnelFile,
|
||||
reclassifyPersonnelFile,
|
||||
updatePersonnelFile,
|
||||
} from '@/lib/personnel/service'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
|
||||
export type ActionResult = { ok: true } | { ok: false; error: string }
|
||||
|
||||
function toMessage(error: unknown): string {
|
||||
if (error instanceof AccessError) {
|
||||
return de.actionErrors[error.code] ?? de.actionErrors.default!
|
||||
}
|
||||
console.error('[personalakten] unerwartet', error)
|
||||
return de.actionErrors.default!
|
||||
}
|
||||
|
||||
const kopfdaten = {
|
||||
displayName: z.string().min(2).max(120),
|
||||
serviceNumber: z.string().max(60).optional(),
|
||||
rank: z.string().max(60).optional(),
|
||||
department: z.string().max(60).optional(),
|
||||
status: z.string().max(60).optional(),
|
||||
note: z.string().max(2000).optional(),
|
||||
}
|
||||
|
||||
const createSchema = z.object({
|
||||
...kopfdaten,
|
||||
userId: z.string().max(64).optional(),
|
||||
classification: z.coerce.number().int().min(0).max(5),
|
||||
})
|
||||
|
||||
export async function createPersonnelAction(
|
||||
_prev: ActionResult | null,
|
||||
formData: FormData,
|
||||
): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = createSchema.safeParse(Object.fromEntries(formData))
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors['name-required']! }
|
||||
|
||||
let id: string
|
||||
try {
|
||||
const created = await createPersonnelFile(user.permissions, parsed.data)
|
||||
id = created.id
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
|
||||
// Nach dem Anlegen direkt in die Akte, nicht zurück in die Liste.
|
||||
redirect(`/personalakten/${id}`)
|
||||
}
|
||||
|
||||
const updateSchema = z.object({ id: z.string().min(1), ...kopfdaten })
|
||||
|
||||
export async function updatePersonnelAction(
|
||||
_prev: ActionResult | null,
|
||||
formData: FormData,
|
||||
): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = updateSchema.safeParse(Object.fromEntries(formData))
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors['name-required']! }
|
||||
|
||||
try {
|
||||
const { id, ...rest } = parsed.data
|
||||
await updatePersonnelFile(user.permissions, id, rest)
|
||||
revalidatePath(`/personalakten/${id}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
|
||||
const reclassifySchema = z.object({
|
||||
id: z.string().min(1),
|
||||
to: z.coerce.number().int().min(0).max(5),
|
||||
reason: z.string().max(2000).optional(),
|
||||
})
|
||||
|
||||
export async function reclassifyPersonnelAction(input: unknown): Promise<ActionResult> {
|
||||
const user = await requireUser()
|
||||
const parsed = reclassifySchema.safeParse(input)
|
||||
if (!parsed.success) return { ok: false, error: de.actionErrors.default! }
|
||||
|
||||
try {
|
||||
await reclassifyPersonnelFile(
|
||||
user.permissions,
|
||||
parsed.data.id,
|
||||
parsed.data.to,
|
||||
parsed.data.reason,
|
||||
)
|
||||
revalidatePath(`/personalakten/${parsed.data.id}`)
|
||||
return { ok: true }
|
||||
} catch (error) {
|
||||
return { ok: false, error: toMessage(error) }
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,19 @@
|
||||
import { Skeleton, SkeletonLine } from '@/components/Skeleton'
|
||||
|
||||
export default function Loading() {
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<Skeleton className="h-[1.5rem]" width="12rem" />
|
||||
<div className="mt-4">
|
||||
<Skeleton className="h-[2.4rem]" width="24rem" />
|
||||
</div>
|
||||
<div className="mt-6 border-t border-line">
|
||||
{Array.from({ length: 8 }, (_, index) => (
|
||||
<div key={index} className="border-b border-line py-3 pl-3">
|
||||
<SkeletonLine width={`${45 + ((index * 11) % 40)}%`} />
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,131 @@
|
||||
'use client'
|
||||
|
||||
import { useActionState } from 'react'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { createPersonnelAction, type ActionResult } from '../actions'
|
||||
|
||||
/**
|
||||
* Neue Personalakte.
|
||||
*
|
||||
* Das Discord-Konto ist **optional**. Personen ohne Konto — Zeugen, ehemalige
|
||||
* Mitarbeiter, Externe — brauchen genauso eine Akte, und ihr Name ist dann das
|
||||
* einzige, was sie identifiziert.
|
||||
*/
|
||||
export function NewPersonnelForm({
|
||||
members,
|
||||
levels,
|
||||
defaultLevel,
|
||||
}: {
|
||||
members: { id: string; displayName: string }[]
|
||||
levels: { level: number; name: string }[]
|
||||
defaultLevel: number
|
||||
}) {
|
||||
const [state, action, pending] = useActionState<ActionResult | null, FormData>(
|
||||
createPersonnelAction,
|
||||
null,
|
||||
)
|
||||
|
||||
return (
|
||||
<form action={action} className="mt-6 space-y-5">
|
||||
<Feld id="displayName" label={de.personnel.name} required minLength={2} />
|
||||
|
||||
<div>
|
||||
<label htmlFor="userId" className="font-condensed text-xs text-text-dim">
|
||||
{de.personnel.linkedAccount}
|
||||
</label>
|
||||
<select
|
||||
id="userId"
|
||||
name="userId"
|
||||
defaultValue=""
|
||||
className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
>
|
||||
<option value="">{de.personnel.noAccount}</option>
|
||||
{members.map((member) => (
|
||||
<option key={member.id} value={member.id}>
|
||||
{member.displayName}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
</div>
|
||||
|
||||
<div className="grid gap-5 sm:grid-cols-2">
|
||||
<Feld id="serviceNumber" label={de.personnel.serviceNumber} />
|
||||
<Feld id="rank" label={de.personnel.rank} />
|
||||
<Feld id="department" label={de.personnel.department} />
|
||||
<Feld id="status" label={de.personnel.status} />
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label htmlFor="note" className="font-condensed text-xs text-text-dim">
|
||||
{de.personnel.note}
|
||||
</label>
|
||||
<textarea
|
||||
id="note"
|
||||
name="note"
|
||||
rows={3}
|
||||
className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
<p className="mt-1 text-2xs text-text-dim">{de.personnel.noteHelp}</p>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label htmlFor="classification" className="font-condensed text-xs text-text-dim">
|
||||
{de.clearance.classification}
|
||||
</label>
|
||||
{/* Die Auswahl zeigt nur, was erlaubt ist. Geprüft wird trotzdem serverseitig. */}
|
||||
<select
|
||||
id="classification"
|
||||
name="classification"
|
||||
defaultValue={defaultLevel}
|
||||
className="mt-1.5 block border border-line bg-raised px-3 py-2 text-sm"
|
||||
>
|
||||
{levels.map((level) => (
|
||||
<option key={level.level} value={level.level}>
|
||||
{level.level} · {level.name}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
</div>
|
||||
|
||||
{state && !state.ok ? (
|
||||
<p className="font-condensed text-2xs text-stamp-4">{state.error}</p>
|
||||
) : null}
|
||||
|
||||
<button
|
||||
type="submit"
|
||||
disabled={pending}
|
||||
className="border border-line bg-raised px-4 py-2 font-condensed text-sm text-accent disabled:text-text-dim"
|
||||
>
|
||||
{pending ? de.common.loading : de.personnel.create}
|
||||
</button>
|
||||
</form>
|
||||
)
|
||||
}
|
||||
|
||||
function Feld({
|
||||
id,
|
||||
label,
|
||||
required,
|
||||
minLength,
|
||||
}: {
|
||||
id: string
|
||||
label: string
|
||||
required?: boolean
|
||||
minLength?: number
|
||||
}) {
|
||||
return (
|
||||
<div>
|
||||
<label htmlFor={id} className="font-condensed text-xs text-text-dim">
|
||||
{label}
|
||||
</label>
|
||||
<input
|
||||
id={id}
|
||||
name={id}
|
||||
required={required}
|
||||
minLength={minLength}
|
||||
maxLength={120}
|
||||
className="mt-1.5 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
import type { Metadata } from 'next'
|
||||
import { db } from '@/lib/db'
|
||||
import { requirePermission } from '@/lib/auth/current'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { NewPersonnelForm } from './NewPersonnelForm'
|
||||
|
||||
export const metadata: Metadata = { title: de.personnel.createTitle }
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
export default async function NewPersonnelPage() {
|
||||
const user = await requirePermission('personnel.edit')
|
||||
|
||||
const [levels, members] = await Promise.all([
|
||||
db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
|
||||
// Nur Konten, für die es noch keine Akte gibt: zwei Akten zu einer Person
|
||||
// wären zwei Wahrheiten.
|
||||
db.user.findMany({
|
||||
where: { personnelFiles: { none: {} } },
|
||||
orderBy: { displayName: 'asc' },
|
||||
take: 200,
|
||||
select: { id: true, displayName: true },
|
||||
}),
|
||||
])
|
||||
|
||||
return (
|
||||
<main className="mx-auto max-w-(--container-measure) px-6 py-10">
|
||||
<h1 className="font-condensed">{de.personnel.createTitle}</h1>
|
||||
<p className="mt-2 max-w-(--container-measure) text-sm text-text-dim">
|
||||
{de.personnel.createHint}
|
||||
</p>
|
||||
<NewPersonnelForm
|
||||
members={members}
|
||||
levels={levels.filter((level) => level.level <= user.permissions.clearanceLevel)}
|
||||
defaultLevel={Math.min(1, user.permissions.clearanceLevel)}
|
||||
/>
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
import type { Metadata } from 'next'
|
||||
import Link from 'next/link'
|
||||
import { db } from '@/lib/db'
|
||||
import { requirePermission } from '@/lib/auth/current'
|
||||
import { listPersonnelFiles } from '@/lib/personnel/service'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { StampMark, classificationEdgeStyle } from '@/components/StampMark'
|
||||
|
||||
export const metadata: Metadata = { title: de.personnel.listHeading }
|
||||
export const dynamic = 'force-dynamic'
|
||||
|
||||
/**
|
||||
* Liste der Personalakten.
|
||||
*
|
||||
* Wie bei den Fallakten: Suche, Sichtbarkeit und Zählung laufen über dieselbe
|
||||
* Abfrage. Eine Akte über der Stufe des Lesers taucht weder auf noch in der
|
||||
* Zahl daneben.
|
||||
*/
|
||||
export default async function PersonnelListPage({
|
||||
searchParams,
|
||||
}: {
|
||||
searchParams: Promise<{ q?: string }>
|
||||
}) {
|
||||
// Ohne das Recht gibt es die Seite nicht — 404, nicht 403.
|
||||
const user = await requirePermission('personnel.read')
|
||||
const { q } = await searchParams
|
||||
|
||||
const [{ files, total }, levels] = await Promise.all([
|
||||
listPersonnelFiles(user.permissions, { query: q }),
|
||||
db.clearanceLevelConfig.findMany({ orderBy: { level: 'asc' } }),
|
||||
])
|
||||
const levelName = new Map(levels.map((l) => [l.level, l.name]))
|
||||
const darfAnlegen =
|
||||
user.permissions.isAdmin || user.permissions.permissions.has('personnel.edit')
|
||||
|
||||
return (
|
||||
<main className="mx-auto max-w-5xl px-6 py-10">
|
||||
<div className="flex flex-wrap items-baseline justify-between gap-4">
|
||||
<h1 className="font-condensed">{de.personnel.listHeading}</h1>
|
||||
<span className="font-mono text-xs text-text-dim">{de.personnel.countLabel(total)}</span>
|
||||
</div>
|
||||
|
||||
<form method="get" className="mt-4 flex flex-wrap items-center gap-3">
|
||||
<input
|
||||
type="search"
|
||||
name="q"
|
||||
defaultValue={q ?? ''}
|
||||
placeholder={de.personnel.search}
|
||||
aria-label={de.personnel.search}
|
||||
className="w-full max-w-sm border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
{darfAnlegen ? (
|
||||
<Link href="/personalakten/neu" className="ml-auto font-condensed text-xs">
|
||||
{de.personnel.create}
|
||||
</Link>
|
||||
) : null}
|
||||
</form>
|
||||
|
||||
{files.length === 0 ? (
|
||||
<p className="mt-10 text-text-dim">
|
||||
{q ? de.personnel.emptySearch : de.personnel.empty}
|
||||
</p>
|
||||
) : (
|
||||
<ul className="mt-6 border-t border-line">
|
||||
{files.map((akte) => (
|
||||
<li key={akte.id} className="border-b border-line">
|
||||
<Link
|
||||
href={`/personalakten/${akte.id}`}
|
||||
prefetch
|
||||
className="flex flex-wrap items-baseline gap-x-4 gap-y-1 py-3 pl-3 text-text no-underline"
|
||||
style={classificationEdgeStyle(akte.classification)}
|
||||
>
|
||||
<span className="grow">{akte.displayName}</span>
|
||||
{akte.serviceNumber ? (
|
||||
<span className="font-mono text-xs text-text-dim">{akte.serviceNumber}</span>
|
||||
) : null}
|
||||
{akte.rank ? (
|
||||
<span className="font-condensed text-2xs text-text-dim">{akte.rank}</span>
|
||||
) : null}
|
||||
<StampMark
|
||||
level={akte.classification}
|
||||
name={levelName.get(akte.classification) ?? de.common.unknown}
|
||||
/>
|
||||
</Link>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)}
|
||||
</main>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,60 @@
|
||||
import Link from 'next/link'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { StampMark, classificationEdgeStyle } from '@/components/StampMark'
|
||||
|
||||
type Eintrag = {
|
||||
id: string
|
||||
documentNumber: string
|
||||
title: string
|
||||
status: string
|
||||
layout: string
|
||||
classification: number
|
||||
createdAt: Date
|
||||
retractedAt: Date | null
|
||||
}
|
||||
|
||||
/**
|
||||
* Dokumente eines Besitzers. Die Liste ist bereits gefiltert — was hier
|
||||
* ankommt, darf der Leser sehen. Kein Ausblenden im Client.
|
||||
*/
|
||||
export function DocumentList({
|
||||
documents,
|
||||
levelName,
|
||||
}: {
|
||||
documents: Eintrag[]
|
||||
levelName: Map<number, string>
|
||||
}) {
|
||||
if (documents.length === 0) {
|
||||
return <p className="text-text-dim">{de.document.empty}</p>
|
||||
}
|
||||
|
||||
return (
|
||||
<ul className="border-t border-line">
|
||||
{documents.map((doc) => (
|
||||
<li key={doc.id} className="border-b border-line">
|
||||
<Link
|
||||
href={`/dokumente/${doc.documentNumber}`}
|
||||
prefetch
|
||||
className="flex flex-wrap items-baseline gap-x-4 gap-y-1 py-3 pl-3 text-text no-underline"
|
||||
style={classificationEdgeStyle(doc.classification)}
|
||||
>
|
||||
<span className="font-mono text-xs text-text-dim">{doc.documentNumber}</span>
|
||||
<span className={`grow ${doc.retractedAt ? 'line-through text-text-dim' : ''}`}>
|
||||
{doc.title}
|
||||
</span>
|
||||
<span className="font-condensed text-2xs text-text-dim">
|
||||
{de.document.layoutNames[doc.layout] ?? doc.layout}
|
||||
</span>
|
||||
<span className="font-condensed text-2xs text-text-dim">
|
||||
{de.document.statusNames[doc.status] ?? doc.status}
|
||||
</span>
|
||||
<StampMark
|
||||
level={doc.classification}
|
||||
name={levelName.get(doc.classification) ?? de.common.unknown}
|
||||
/>
|
||||
</Link>
|
||||
</li>
|
||||
))}
|
||||
</ul>
|
||||
)
|
||||
}
|
||||
@@ -0,0 +1,130 @@
|
||||
'use client'
|
||||
|
||||
import { useActionState, useState } from 'react'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { createDocumentAction, type ActionResult } from '@/app/(app)/dokumente/actions'
|
||||
|
||||
/**
|
||||
* Dokument anlegen, an einer Fallakte oder an einer Personalakte.
|
||||
*
|
||||
* Die Vorlagenliste kommt vom Server und enthält nur, was an dieser Stelle
|
||||
* erlaubt ist. Geprüft wird das trotzdem noch einmal beim Anlegen — die
|
||||
* Auswahl im Formular ist eine Bequemlichkeit, keine Sicherung.
|
||||
*/
|
||||
export function NewDocument({
|
||||
templates,
|
||||
levels,
|
||||
defaultLevel,
|
||||
caseNumber,
|
||||
personnelFileId,
|
||||
}: {
|
||||
templates: { key: string; name: string; description: string | null; layout: string }[]
|
||||
levels: { level: number; name: string }[]
|
||||
defaultLevel: number
|
||||
caseNumber?: string
|
||||
personnelFileId?: string
|
||||
}) {
|
||||
const [open, setOpen] = useState(false)
|
||||
const [state, action, pending] = useActionState<ActionResult | null, FormData>(
|
||||
createDocumentAction,
|
||||
null,
|
||||
)
|
||||
|
||||
if (templates.length === 0) return null
|
||||
|
||||
if (!open) {
|
||||
return (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(true)}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent"
|
||||
>
|
||||
{de.document.create}
|
||||
</button>
|
||||
)
|
||||
}
|
||||
|
||||
return (
|
||||
<form action={action} className="border border-line p-4">
|
||||
{caseNumber ? <input type="hidden" name="caseNumber" value={caseNumber} /> : null}
|
||||
{personnelFileId ? (
|
||||
<input type="hidden" name="personnelFileId" value={personnelFileId} />
|
||||
) : null}
|
||||
|
||||
<p className="font-condensed text-xs text-text-dim">{de.document.createTitle}</p>
|
||||
|
||||
<div className="mt-3 grid gap-4 sm:grid-cols-2">
|
||||
<div>
|
||||
<label htmlFor="templateKey" className="font-condensed text-2xs text-text-dim">
|
||||
{de.document.kind}
|
||||
</label>
|
||||
<select
|
||||
id="templateKey"
|
||||
name="templateKey"
|
||||
required
|
||||
className="mt-1 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
>
|
||||
{templates.map((template) => (
|
||||
<option key={template.key} value={template.key}>
|
||||
{template.name}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
</div>
|
||||
|
||||
<div>
|
||||
<label htmlFor="classification" className="font-condensed text-2xs text-text-dim">
|
||||
{de.clearance.classification}
|
||||
</label>
|
||||
<select
|
||||
id="classification"
|
||||
name="classification"
|
||||
defaultValue={defaultLevel}
|
||||
className="mt-1 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
>
|
||||
{levels.map((level) => (
|
||||
<option key={level.level} value={level.level}>
|
||||
{level.level} · {level.name}
|
||||
</option>
|
||||
))}
|
||||
</select>
|
||||
</div>
|
||||
|
||||
<div className="sm:col-span-2">
|
||||
<label htmlFor="doc-title" className="font-condensed text-2xs text-text-dim">
|
||||
{de.document.title}
|
||||
</label>
|
||||
<input
|
||||
id="doc-title"
|
||||
name="title"
|
||||
maxLength={200}
|
||||
className="mt-1 block w-full border border-line bg-raised px-3 py-2 text-sm"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<p className="mt-2 text-2xs text-text-dim">{de.document.createHint}</p>
|
||||
|
||||
{state && !state.ok ? (
|
||||
<p className="mt-2 font-condensed text-2xs text-stamp-4">{state.error}</p>
|
||||
) : null}
|
||||
|
||||
<div className="mt-3 flex gap-3">
|
||||
<button
|
||||
type="submit"
|
||||
disabled={pending}
|
||||
className="border border-line bg-raised px-3 py-1 font-condensed text-2xs text-accent disabled:text-text-dim"
|
||||
>
|
||||
{pending ? de.common.loading : de.document.create}
|
||||
</button>
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setOpen(false)}
|
||||
className="font-condensed text-2xs text-text-dim"
|
||||
>
|
||||
{de.common.cancel}
|
||||
</button>
|
||||
</div>
|
||||
</form>
|
||||
)
|
||||
}
|
||||
+9
-6
@@ -2,10 +2,13 @@
|
||||
|
||||
import { useEffect, useRef, useState, useTransition } from 'react'
|
||||
import { de } from '@/lib/i18n/de'
|
||||
import { saveSectionAction } from './sectionActions'
|
||||
import type { SaveSection } from './types'
|
||||
|
||||
type Props = {
|
||||
caseNumber: string
|
||||
/** Wohin gespeichert wird — gebundene Server Action der Akte oder des Dokuments. */
|
||||
save: SaveSection
|
||||
/** Eindeutig je Besitzer, damit Entwürfe zweier Akten sich nicht mischen. */
|
||||
scope: string
|
||||
fieldKey: string
|
||||
label: string
|
||||
type: string
|
||||
@@ -20,7 +23,8 @@ type Props = {
|
||||
const AUTOSAVE_MS = 2000
|
||||
|
||||
/**
|
||||
* Ein Abschnitt zum Bearbeiten.
|
||||
* Ein Abschnitt zum Bearbeiten. Trägt einen Fallabschnitt genauso wie ein
|
||||
* Feld eines Dokuments — wohin gespeichert wird, kommt von außen.
|
||||
*
|
||||
* Entwürfe werden alle zwei Sekunden **lokal** gesichert, damit ein
|
||||
* versehentlicher Tab-Wechsel keinen Text kostet. Gespeichert wird erst auf
|
||||
@@ -31,7 +35,7 @@ const AUTOSAVE_MS = 2000
|
||||
* stilles Überschreiben, sondern beide Fassungen nebeneinander.
|
||||
*/
|
||||
export function SectionEditor(props: Props) {
|
||||
const speicherSchluessel = `afis:abschnitt:${props.caseNumber}:${props.fieldKey}`
|
||||
const speicherSchluessel = `afis:abschnitt:${props.scope}:${props.fieldKey}`
|
||||
const [value, setValue] = useState(() => normalise(props.initialValue, props.type))
|
||||
const [version, setVersion] = useState(props.initialVersion)
|
||||
const [conflict, setConflict] = useState<{ value: unknown; version: number } | null>(null)
|
||||
@@ -71,8 +75,7 @@ export function SectionEditor(props: Props) {
|
||||
function submit(override?: unknown, baseVersion = version) {
|
||||
setError(null)
|
||||
startTransition(async () => {
|
||||
const result = await saveSectionAction({
|
||||
caseNumber: props.caseNumber,
|
||||
const result = await props.save({
|
||||
fieldKey: props.fieldKey,
|
||||
value: override ?? parse(value, props.type),
|
||||
baseVersion,
|
||||
+15
-7
@@ -2,21 +2,25 @@ import { de } from '@/lib/i18n/de'
|
||||
import { fillPlaceholders, isInputField } from '@/lib/templates/fields'
|
||||
import { RedactedText } from '@/components/Redacted'
|
||||
import { SectionEditor } from './SectionEditor'
|
||||
import type { RenderedSection } from '@/lib/cases/sectionService'
|
||||
import type { SaveSection } from './types'
|
||||
import type { RenderedSection } from '@/lib/sections/render'
|
||||
|
||||
/**
|
||||
* Abschnitte einer Fallakte: der aktuelle Sachstand, aus der Vorlage erzeugt.
|
||||
* Ausgefüllte Vorlage: der Sachstand einer Fallakte oder der Inhalt eines
|
||||
* Dokuments. Beide sind dasselbe Gebilde, deshalb dieselbe Darstellung.
|
||||
*
|
||||
* Feste Textbausteine der Vorlage werden gerendert, nicht bearbeitet — ihre
|
||||
* Platzhalter ziehen die Werte der Eingabefelder. Damit trägt dieselbe
|
||||
* Darstellung ein Formular und einen Vertragstext.
|
||||
*/
|
||||
export function Sections({
|
||||
caseNumber,
|
||||
scope,
|
||||
save,
|
||||
sections,
|
||||
canEdit,
|
||||
}: {
|
||||
caseNumber: string
|
||||
scope: string
|
||||
save: SaveSection
|
||||
sections: RenderedSection[]
|
||||
canEdit: boolean
|
||||
}) {
|
||||
@@ -40,7 +44,9 @@ export function Sections({
|
||||
return (
|
||||
<div key={field.key} className="pt-8">
|
||||
<div className="w-64 border-t border-line" />
|
||||
<p className="mt-1 text-2xs text-text-dim">{field.label}</p>
|
||||
<p className="mt-1 text-2xs text-text-dim">
|
||||
{fillPlaceholders(field.label, werte)}
|
||||
</p>
|
||||
</div>
|
||||
)
|
||||
}
|
||||
@@ -80,7 +86,8 @@ export function Sections({
|
||||
<RedactedText segments={section.segments} />
|
||||
{canEdit ? (
|
||||
<SectionEditor
|
||||
caseNumber={caseNumber}
|
||||
save={save}
|
||||
scope={scope}
|
||||
fieldKey={field.key}
|
||||
label={field.label}
|
||||
type={field.type}
|
||||
@@ -94,7 +101,8 @@ export function Sections({
|
||||
</div>
|
||||
) : (
|
||||
<SectionEditor
|
||||
caseNumber={caseNumber}
|
||||
save={save}
|
||||
scope={scope}
|
||||
fieldKey={field.key}
|
||||
label={field.label}
|
||||
type={field.type}
|
||||
@@ -0,0 +1,16 @@
|
||||
/**
|
||||
* Ergebnis eines Abschnitt-Speicherns. Steht hier und nicht in der Server
|
||||
* Action, damit der Client den Typ importieren kann, ohne die Action selbst
|
||||
* ins Bündel zu ziehen.
|
||||
*/
|
||||
export type SaveSectionResult =
|
||||
| { ok: true; version: number }
|
||||
/** Kein stilles Überschreiben: die fremde Fassung kommt mit zurück. */
|
||||
| { ok: false; conflict: true; current: { value: unknown; version: number } }
|
||||
| { ok: false; conflict: false; error: string }
|
||||
|
||||
export type SaveSection = (input: {
|
||||
fieldKey: string
|
||||
value: unknown
|
||||
baseVersion: number
|
||||
}) => Promise<SaveSectionResult>
|
||||
+11
-1
@@ -27,7 +27,17 @@ test('Startseite fuehrt Nichtangemeldete zur Anmeldung', async ({ page }) => {
|
||||
})
|
||||
|
||||
test.describe('Geschuetzte Bereiche', () => {
|
||||
for (const pfad of ['/uebersicht', '/faelle', '/faelle/neu', '/admin/rollen', '/admin/system']) {
|
||||
const geschuetzt = [
|
||||
'/uebersicht',
|
||||
'/faelle',
|
||||
'/faelle/neu',
|
||||
'/personalakten',
|
||||
'/personalakten/neu',
|
||||
'/dokumente/AfiS-2026-0001',
|
||||
'/admin/rollen',
|
||||
'/admin/system',
|
||||
]
|
||||
for (const pfad of geschuetzt) {
|
||||
test(`${pfad} ist ohne Anmeldung nicht erreichbar`, async ({ page }) => {
|
||||
await page.goto(pfad)
|
||||
await expect(page).toHaveURL(/\/anmelden$/)
|
||||
|
||||
@@ -0,0 +1,113 @@
|
||||
import type { EffectivePermissions, Permission } from '@/lib/auth/permissions'
|
||||
import type { WriteCheck } from '@/lib/access/caseWrite'
|
||||
|
||||
/**
|
||||
* Schreibgrenzen für Personalakten und Dokumente.
|
||||
*
|
||||
* Dieselbe Bauform wie `caseWrite.ts`: reine Funktionen, die auch dann greifen,
|
||||
* wenn die Oberfläche einen Knopf versehentlich stehen lässt. Jede Server
|
||||
* Action ruft sie auf, nicht nur die, die den Knopf zeichnet.
|
||||
*/
|
||||
|
||||
/** Status, in denen ein Dokument nicht mehr verändert wird. */
|
||||
export const READ_ONLY_DOCUMENT_STATUS = ['RETRACTED'] as const
|
||||
|
||||
function requirePermission(p: EffectivePermissions, permission: Permission): WriteCheck {
|
||||
if (p.isAdmin || p.permissions.has(permission)) return { ok: true }
|
||||
return { ok: false, reason: 'no-permission', permission }
|
||||
}
|
||||
|
||||
/**
|
||||
* Darf dieser Nutzer eine Personalakte mit dieser Klassifizierung anlegen oder
|
||||
* auf diese Stufe heben? Wie bei der Fallakte: nie über der eigenen Stufe.
|
||||
*/
|
||||
export function canWritePersonnel(
|
||||
p: EffectivePermissions,
|
||||
classification: number,
|
||||
): WriteCheck {
|
||||
const permitted = requirePermission(p, 'personnel.edit')
|
||||
if (!permitted.ok) return permitted
|
||||
if (classification > p.clearanceLevel && !p.isAdmin) {
|
||||
return { ok: false, reason: 'clearance-too-low', required: classification }
|
||||
}
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
/**
|
||||
* Darf dieser Nutzer ein Dokument mit dieser Klassifizierung anlegen?
|
||||
*
|
||||
* Der Besitzer ist vorher schon durch die Sichtbarkeitsprüfung gelaufen — was
|
||||
* man nicht sieht, kann man nicht bestücken.
|
||||
*/
|
||||
export function canCreateDocument(
|
||||
p: EffectivePermissions,
|
||||
classification: number,
|
||||
): WriteCheck {
|
||||
const permitted = requirePermission(p, 'document.create')
|
||||
if (!permitted.ok) return permitted
|
||||
if (classification > p.clearanceLevel) {
|
||||
return { ok: false, reason: 'clearance-too-low', required: classification }
|
||||
}
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
/**
|
||||
* Darf dieser Nutzer dieses Dokument ändern?
|
||||
*
|
||||
* Ein zurückgezogenes Dokument ist endgültig schreibgeschützt, auch für
|
||||
* Admins: es steht als Grabstein und darf nicht nachträglich zu etwas anderem
|
||||
* werden. Ein ausgefertigtes Dokument zu ändern setzt dasselbe Recht voraus,
|
||||
* das die Ausfertigung erlaubt hat.
|
||||
*/
|
||||
export function canEditDocument(
|
||||
p: EffectivePermissions,
|
||||
target: { status: string; classification: number },
|
||||
): WriteCheck {
|
||||
if ((READ_ONLY_DOCUMENT_STATUS as readonly string[]).includes(target.status)) {
|
||||
return { ok: false, reason: 'read-only', status: target.status }
|
||||
}
|
||||
|
||||
const permitted = requirePermission(p, 'document.edit')
|
||||
if (!permitted.ok) return permitted
|
||||
|
||||
if (target.classification > p.clearanceLevel && !p.isAdmin) {
|
||||
return { ok: false, reason: 'clearance-too-low', required: target.classification }
|
||||
}
|
||||
|
||||
if (target.status === 'FINAL') {
|
||||
const final = requirePermission(p, 'document.finalize')
|
||||
if (!final.ok) return { ok: false, reason: 'closed' }
|
||||
}
|
||||
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
/** Ausfertigen: aus einem Entwurf wird ein gültiges Dokument. */
|
||||
export function canFinalizeDocument(
|
||||
p: EffectivePermissions,
|
||||
target: { status: string; classification: number },
|
||||
): WriteCheck {
|
||||
if (target.status !== 'DRAFT') return { ok: false, reason: 'read-only', status: target.status }
|
||||
const permitted = requirePermission(p, 'document.finalize')
|
||||
if (!permitted.ok) return permitted
|
||||
if (target.classification > p.clearanceLevel && !p.isAdmin) {
|
||||
return { ok: false, reason: 'clearance-too-low', required: target.classification }
|
||||
}
|
||||
return { ok: true }
|
||||
}
|
||||
|
||||
/** Zurückziehen. Löschen gibt es nicht, der Grabstein bleibt stehen. */
|
||||
export function canRetractDocument(
|
||||
p: EffectivePermissions,
|
||||
target: { status: string; classification: number },
|
||||
): WriteCheck {
|
||||
if (target.status === 'RETRACTED') {
|
||||
return { ok: false, reason: 'read-only', status: target.status }
|
||||
}
|
||||
const permitted = requirePermission(p, 'document.retract')
|
||||
if (!permitted.ok) return permitted
|
||||
if (target.classification > p.clearanceLevel && !p.isAdmin) {
|
||||
return { ok: false, reason: 'clearance-too-low', required: target.classification }
|
||||
}
|
||||
return { ok: true }
|
||||
}
|
||||
@@ -0,0 +1,68 @@
|
||||
import type { Prisma } from '@afis/db'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
|
||||
/**
|
||||
* Where-Fragmente für Personalakten und Dokumente.
|
||||
*
|
||||
* Wie bei den Fallakten gilt: **die Prüfung wird nie in JavaScript
|
||||
* nachgelagert.** Trefferzahlen, Rückverweise und Paginierung laufen über
|
||||
* dieselbe Abfrage. Siehe docs/03-auth-und-rechte.md.
|
||||
*/
|
||||
|
||||
/**
|
||||
* Personalakten, die ein Nutzer lesen darf.
|
||||
*
|
||||
* Anders als bei der Fallakte gibt es hier keinen „Beteiligten": eine
|
||||
* Personalakte hat keine Ermittlergruppe. Es zählt allein die Freigabestufe.
|
||||
*
|
||||
* Auch die eigene Akte ist keine Ausnahme. Das ist bewusst so: eine Beurteilung
|
||||
* auf Stufe 4 über einen Mitarbeiter der Stufe 1 wäre sonst genau für den
|
||||
* einen Menschen lesbar, vor dem sie geschützt werden soll.
|
||||
*/
|
||||
export function visiblePersonnelWhere(p: EffectivePermissions): Prisma.PersonnelFileWhereInput {
|
||||
if (p.isAdmin) return {}
|
||||
return { classification: { lte: p.clearanceLevel } }
|
||||
}
|
||||
|
||||
/**
|
||||
* Dokumente, die ein Nutzer lesen darf.
|
||||
*
|
||||
* Zwei Bedingungen, beide müssen zutreffen:
|
||||
*
|
||||
* 1. **Der Besitzer muss lesbar sein.** Ein Vertrag an einer Personalakte der
|
||||
* Stufe 4 bleibt verborgen, auch wenn der Vertrag selbst Stufe 1 trägt —
|
||||
* sonst verriete die Dokumentenliste die Existenz der Person.
|
||||
* 2. **Das Dokument selbst muss lesbar sein.** Innerhalb einer sichtbaren
|
||||
* Akte kann ein einzelnes Dokument höher klassifiziert sein.
|
||||
*
|
||||
* Wer an der besitzenden Fallakte beteiligt ist, liest ihre Dokumente
|
||||
* unabhängig von seiner Stufe — das ist derselbe ausnahmsweise Zugang wie beim
|
||||
* Verlauf, siehe docs/03-auth-und-rechte.md. Für Dokumente an einer
|
||||
* Personalakte und für Dokumente ohne Besitzer gibt es diesen Weg nicht.
|
||||
*/
|
||||
export function visibleDocumentWhere(p: EffectivePermissions): Prisma.DocumentWhereInput {
|
||||
const besitzerLesbar: Prisma.DocumentWhereInput = {
|
||||
OR: [
|
||||
{ case: { is: visibleCaseWhere(p) } },
|
||||
{ personnelFile: { is: visiblePersonnelWhere(p) } },
|
||||
// Ohne Besitzer, etwa ein Bußgeldbescheid: dann entscheidet allein die
|
||||
// Klassifizierung des Dokuments.
|
||||
{ AND: [{ caseId: null }, { personnelFileId: null }] },
|
||||
],
|
||||
}
|
||||
|
||||
if (p.isAdmin) return besitzerLesbar
|
||||
|
||||
return {
|
||||
AND: [
|
||||
besitzerLesbar,
|
||||
{
|
||||
OR: [
|
||||
{ classification: { lte: p.clearanceLevel } },
|
||||
{ case: { is: { participants: { some: { userId: p.userId } } } } },
|
||||
],
|
||||
},
|
||||
],
|
||||
}
|
||||
}
|
||||
@@ -24,6 +24,20 @@ export type AuditAction =
|
||||
| 'entry.edit'
|
||||
| 'entry.retract'
|
||||
| 'entry.restore'
|
||||
| 'case.participant.add'
|
||||
| 'case.participant.remove'
|
||||
| 'case.link'
|
||||
| 'case.unlink'
|
||||
| 'personnel.read'
|
||||
| 'personnel.create'
|
||||
| 'personnel.update'
|
||||
| 'personnel.reclassify'
|
||||
| 'document.read'
|
||||
| 'document.create'
|
||||
| 'document.update'
|
||||
| 'document.finalize'
|
||||
| 'document.retract'
|
||||
| 'document.reclassify'
|
||||
| 'roles.update'
|
||||
| 'export.pdf'
|
||||
|
||||
|
||||
@@ -17,6 +17,10 @@ export const PERMISSIONS = [
|
||||
'entry.retract',
|
||||
'personnel.read',
|
||||
'personnel.edit',
|
||||
'document.create',
|
||||
'document.edit',
|
||||
'document.finalize',
|
||||
'document.retract',
|
||||
'template.manage',
|
||||
'roles.manage',
|
||||
'audit.read',
|
||||
@@ -34,6 +38,7 @@ export const OPT_IN_PERMISSIONS: readonly Permission[] = [
|
||||
'entry.edit_own',
|
||||
'entry.edit_any',
|
||||
'entry.retract',
|
||||
'document.retract',
|
||||
]
|
||||
|
||||
export function isPermission(value: string): value is Permission {
|
||||
|
||||
@@ -0,0 +1,128 @@
|
||||
import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import { canEditCase } from '@/lib/access/caseWrite'
|
||||
import { AccessError, must } from '@/lib/errors'
|
||||
import { loadVisibleCase } from '@/lib/cases/service'
|
||||
import type { LinkKindName } from '@/lib/cases/terms'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Verknüpfungen zwischen Akten.
|
||||
*
|
||||
* Die Richtung trägt Bedeutung: `SUCCESSOR` und `MERGED_INTO` sagen etwas
|
||||
* anderes, je nachdem, von welcher Seite man liest. `RELATED` ist symmetrisch.
|
||||
*
|
||||
* Beide Seiten laufen durch die Sichtbarkeitsprüfung. Eine Akte, die der Leser
|
||||
* nicht sehen darf, taucht auch als Verknüpfung nicht auf — sonst verriete die
|
||||
* Gegenseite ihre Existenz. Das gilt in **beide** Richtungen, deshalb wird der
|
||||
* Filter zweimal angewandt.
|
||||
*/
|
||||
|
||||
const AKTE = {
|
||||
id: true,
|
||||
caseNumber: true,
|
||||
title: true,
|
||||
status: true,
|
||||
classification: true,
|
||||
updatedAt: true,
|
||||
} as const
|
||||
|
||||
/** Alle Verknüpfungen einer Akte, aus beiden Richtungen, gefiltert. */
|
||||
export async function listLinks(p: EffectivePermissions, caseId: string) {
|
||||
const sichtbar = visibleCaseWhere(p)
|
||||
|
||||
const [hinaus, herein] = await Promise.all([
|
||||
db.caseLink.findMany({
|
||||
where: { AND: [{ fromId: caseId }, { to: { is: sichtbar } }] },
|
||||
select: { kind: true, createdAt: true, to: { select: AKTE } },
|
||||
orderBy: { createdAt: 'desc' },
|
||||
}),
|
||||
db.caseLink.findMany({
|
||||
where: { AND: [{ toId: caseId }, { from: { is: sichtbar } }] },
|
||||
select: { kind: true, createdAt: true, from: { select: AKTE } },
|
||||
orderBy: { createdAt: 'desc' },
|
||||
}),
|
||||
])
|
||||
|
||||
return [
|
||||
...hinaus.map((link) => ({
|
||||
kind: link.kind,
|
||||
direction: 'out' as const,
|
||||
other: link.to,
|
||||
createdAt: link.createdAt,
|
||||
})),
|
||||
...herein.map((link) => ({
|
||||
kind: link.kind,
|
||||
direction: 'in' as const,
|
||||
other: link.from,
|
||||
createdAt: link.createdAt,
|
||||
})),
|
||||
]
|
||||
}
|
||||
|
||||
export async function linkCases(
|
||||
p: EffectivePermissions,
|
||||
input: { fromCaseNumber: string; toCaseNumber: string; kind: LinkKindName },
|
||||
): Promise<void> {
|
||||
const from = await loadVisibleCase(p, input.fromCaseNumber)
|
||||
if (!from) throw new AccessError('not-found')
|
||||
must(canEditCase(p, from))
|
||||
|
||||
const to = await loadVisibleCase(p, input.toCaseNumber.trim())
|
||||
if (!to) throw new AccessError('not-found')
|
||||
if (to.id === from.id) throw new AccessError('link-self')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.caseLink.upsert({
|
||||
where: { fromId_toId_kind: { fromId: from.id, toId: to.id, kind: input.kind } },
|
||||
create: { fromId: from.id, toId: to.id, kind: input.kind, createdById: p.userId },
|
||||
update: {},
|
||||
})
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'case.link',
|
||||
targetType: 'Case',
|
||||
targetId: from.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { from: from.caseNumber, to: to.caseNumber, kind: input.kind },
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Verknüpfung lösen. Umkehrbar und deshalb ohne Bestätigungsdialog, siehe
|
||||
* docs/09-performance-und-ux.md. Das Protokoll behält sie.
|
||||
*/
|
||||
export async function unlinkCases(
|
||||
p: EffectivePermissions,
|
||||
input: { fromCaseNumber: string; toCaseNumber: string; kind: LinkKindName },
|
||||
): Promise<void> {
|
||||
const from = await loadVisibleCase(p, input.fromCaseNumber)
|
||||
if (!from) throw new AccessError('not-found')
|
||||
must(canEditCase(p, from))
|
||||
|
||||
const to = await loadVisibleCase(p, input.toCaseNumber)
|
||||
if (!to) throw new AccessError('not-found')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.caseLink.deleteMany({
|
||||
where: {
|
||||
OR: [
|
||||
{ fromId: from.id, toId: to.id, kind: input.kind },
|
||||
{ fromId: to.id, toId: from.id, kind: input.kind },
|
||||
],
|
||||
},
|
||||
})
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'case.unlink',
|
||||
targetType: 'Case',
|
||||
targetId: from.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { from: from.caseNumber, to: to.caseNumber, kind: input.kind },
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,183 @@
|
||||
import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import { visiblePersonnelWhere } from '@/lib/access/personnelFilter'
|
||||
import { canEditCase } from '@/lib/access/caseWrite'
|
||||
import { AccessError, must } from '@/lib/errors'
|
||||
import { loadVisibleCase } from '@/lib/cases/service'
|
||||
import type { ParticipantRoleName } from '@/lib/cases/terms'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Beteiligte einer Akte.
|
||||
*
|
||||
* Zwei Dinge zugleich: eine fachliche Angabe („wer ist Zeuge") und der Weg zum
|
||||
* **ausnahmsweisen Zugang**. Wer als Beteiligter eingetragen ist, liest die
|
||||
* Akte unabhängig von seiner Freigabestufe. Das ist der vorgesehene Weg,
|
||||
* jemanden gezielt hinzuzuziehen, ohne ihm allgemein eine höhere Stufe zu
|
||||
* geben. Es setzt `case.edit` voraus und wird protokolliert.
|
||||
* Siehe docs/03-auth-und-rechte.md.
|
||||
*/
|
||||
|
||||
export async function listParticipants(p: EffectivePermissions, caseId: string) {
|
||||
const rows = await db.caseParticipant.findMany({
|
||||
where: { AND: [{ caseId }, { case: { is: visibleCaseWhere(p) } }] },
|
||||
orderBy: { createdAt: 'asc' },
|
||||
select: {
|
||||
id: true,
|
||||
role: true,
|
||||
createdAt: true,
|
||||
addedById: true,
|
||||
user: { select: { id: true, displayName: true } },
|
||||
// Die Personalakte kommt nur mit, wenn der Leser sie sehen darf. Sonst
|
||||
// steht der Name da, aber der Verweis führt ins Leere — das ist richtig
|
||||
// so: der Beteiligte ist Teil der Akte, seine Personalakte nicht.
|
||||
personnelFile: { select: { id: true, displayName: true } },
|
||||
},
|
||||
})
|
||||
|
||||
const sichtbareAkten = new Set(
|
||||
(
|
||||
await db.personnelFile.findMany({
|
||||
where: {
|
||||
AND: [
|
||||
visiblePersonnelWhere(p),
|
||||
{
|
||||
id: {
|
||||
in: rows.flatMap((row) => (row.personnelFile ? [row.personnelFile.id] : [])),
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
select: { id: true },
|
||||
})
|
||||
).map((row) => row.id),
|
||||
)
|
||||
|
||||
return rows.map((row) => ({
|
||||
id: row.id,
|
||||
role: row.role,
|
||||
createdAt: row.createdAt,
|
||||
userId: row.user?.id ?? null,
|
||||
displayName: row.user?.displayName ?? row.personnelFile?.displayName ?? null,
|
||||
personnelFileId:
|
||||
row.personnelFile && sichtbareAkten.has(row.personnelFile.id) ? row.personnelFile.id : null,
|
||||
}))
|
||||
}
|
||||
|
||||
/**
|
||||
* Trägt einen Beteiligten ein. Entweder ein Discord-Konto oder eine
|
||||
* Personalakte, nicht beides und nicht keins.
|
||||
*/
|
||||
export async function addParticipant(
|
||||
p: EffectivePermissions,
|
||||
input: {
|
||||
caseNumber: string
|
||||
role: ParticipantRoleName
|
||||
userId?: string | null
|
||||
personnelFileId?: string | null
|
||||
},
|
||||
): Promise<{ id: string }> {
|
||||
const target = await loadVisibleCase(p, input.caseNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
must(canEditCase(p, target))
|
||||
|
||||
const userId = input.userId || null
|
||||
const personnelFileId = input.personnelFileId || null
|
||||
if ((userId === null) === (personnelFileId === null)) throw new AccessError('participant-target')
|
||||
|
||||
if (userId) {
|
||||
const vorhanden = await db.user.findUnique({ where: { id: userId }, select: { id: true } })
|
||||
if (!vorhanden) throw new AccessError('not-found')
|
||||
}
|
||||
if (personnelFileId) {
|
||||
// Eine Personalakte, die der Eintragende nicht sehen darf, kann er auch
|
||||
// nicht als Beteiligte setzen — sonst verrät ihm die Fehlermeldung ihre
|
||||
// Existenz.
|
||||
const akte = await db.personnelFile.findFirst({
|
||||
where: { AND: [visiblePersonnelWhere(p), { id: personnelFileId }] },
|
||||
select: { id: true },
|
||||
})
|
||||
if (!akte) throw new AccessError('not-found')
|
||||
}
|
||||
|
||||
const bereitsDa = await db.caseParticipant.findFirst({
|
||||
where: { caseId: target.id, role: input.role, userId, personnelFileId },
|
||||
select: { id: true },
|
||||
})
|
||||
if (bereitsDa) return bereitsDa
|
||||
|
||||
return db.$transaction(async (tx) => {
|
||||
const created = await tx.caseParticipant.create({
|
||||
data: { caseId: target.id, role: input.role, userId, personnelFileId, addedById: p.userId },
|
||||
select: { id: true },
|
||||
})
|
||||
|
||||
// Sichtbar im Verlauf, nicht nur im Protokoll: dass jemand Zugang zu einer
|
||||
// Akte bekommt, geht alle an, die die Akte lesen.
|
||||
await tx.caseEntry.create({
|
||||
data: {
|
||||
id: crypto.randomUUID(),
|
||||
caseId: target.id,
|
||||
type: 'SYSTEM',
|
||||
body: `Beteiligte eingetragen: ${input.role}`,
|
||||
authorId: p.userId,
|
||||
minClearance: 0,
|
||||
},
|
||||
})
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'case.participant.add',
|
||||
targetType: 'CaseParticipant',
|
||||
targetId: created.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
caseNumber: target.caseNumber,
|
||||
role: input.role,
|
||||
userId: userId ?? undefined,
|
||||
personnelFileId: personnelFileId ?? undefined,
|
||||
},
|
||||
})
|
||||
|
||||
return created
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Entfernt einen Beteiligten. Anders als ein Verlaufseintrag ist das keine
|
||||
* Aussage über den Sachverhalt, sondern eine Zuständigkeit — sie darf
|
||||
* verschwinden. Das Protokoll behält sie.
|
||||
*/
|
||||
export async function removeParticipant(
|
||||
p: EffectivePermissions,
|
||||
input: { caseNumber: string; participantId: string },
|
||||
): Promise<void> {
|
||||
const target = await loadVisibleCase(p, input.caseNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
must(canEditCase(p, target))
|
||||
|
||||
const teilnehmer = await db.caseParticipant.findFirst({
|
||||
where: { id: input.participantId, caseId: target.id },
|
||||
select: { id: true, role: true, userId: true, personnelFileId: true },
|
||||
})
|
||||
if (!teilnehmer) throw new AccessError('not-found')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.caseParticipant.delete({ where: { id: teilnehmer.id } })
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'case.participant.remove',
|
||||
targetType: 'CaseParticipant',
|
||||
targetId: teilnehmer.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
caseNumber: target.caseNumber,
|
||||
role: teilnehmer.role,
|
||||
userId: teilnehmer.userId ?? undefined,
|
||||
personnelFileId: teilnehmer.personnelFileId ?? undefined,
|
||||
},
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -1,97 +1,44 @@
|
||||
import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { canEditCase } from '@/lib/access/caseWrite'
|
||||
import { AccessError, loadVisibleCase } from '@/lib/cases/service'
|
||||
import { isInputField, type TemplateField } from '@/lib/templates/fields'
|
||||
import { loadVisibleCase } from '@/lib/cases/service'
|
||||
import { AccessError } from '@/lib/errors'
|
||||
import { parseTemplateFields } from '@/lib/templates/schema'
|
||||
import { redactForLevel, type Segment } from '@/lib/redaction'
|
||||
import {
|
||||
asJson,
|
||||
planSectionSave,
|
||||
renderSections,
|
||||
type RenderedSection,
|
||||
} from '@/lib/sections/render'
|
||||
import type { TemplateField } from '@/lib/templates/fields'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
import type { Prisma } from '@afis/db'
|
||||
|
||||
/**
|
||||
* Abschnitte einer Fallakte: der aktuelle Sachstand, aus der Vorlage erzeugt
|
||||
* und je Feld versioniert. Siehe docs/05-akten-und-vorlagen.md.
|
||||
*
|
||||
* Die Regeln stehen in `lib/sections/render.ts`, weil Dokumente dieselben
|
||||
* haben. Hier steht nur, welche Tabelle gelesen und geschrieben wird.
|
||||
*/
|
||||
|
||||
/** Was ein Leser sieht, dessen Stufe für ein Feld nicht reicht. */
|
||||
export type Placeholder = { redacted: true; requiredLevel: number }
|
||||
|
||||
export type RenderedSection = {
|
||||
fieldKey: string
|
||||
field: TemplateField
|
||||
version: number
|
||||
updatedAt: Date | null
|
||||
updatedById: string | null
|
||||
} & (
|
||||
| { visible: true; value: unknown; segments: Segment[] | null }
|
||||
| { visible: false; value: Placeholder }
|
||||
)
|
||||
|
||||
/**
|
||||
* Prisma trennt „Feld nicht setzen" von „JSON null". Ein leerer Abschnitt ist
|
||||
* inhaltlich JSON null, nicht das Fehlen des Feldes.
|
||||
*/
|
||||
function asJson(value: unknown): Prisma.InputJsonValue {
|
||||
return (value ?? null) as Prisma.InputJsonValue
|
||||
}
|
||||
export type { RenderedSection, Placeholder } from '@/lib/sections/render'
|
||||
export { ConflictError } from '@/lib/errors'
|
||||
|
||||
export function templateFields(raw: unknown): TemplateField[] {
|
||||
return parseTemplateFields(raw)
|
||||
}
|
||||
|
||||
/**
|
||||
* Lädt die Abschnitte einer Akte und wendet dabei die Stufe des Lesers an.
|
||||
*
|
||||
* Felder über seiner Stufe werden **serverseitig** durch einen Platzhalter
|
||||
* ersetzt. Der echte Wert verlässt den Server nicht — nie im Client
|
||||
* ausblenden. Dasselbe gilt für Schwärzungen im Fliesstext, die als Segmente
|
||||
* zurückkommen.
|
||||
*/
|
||||
export async function loadSections(
|
||||
p: EffectivePermissions,
|
||||
caseId: string,
|
||||
templateId: string,
|
||||
): Promise<RenderedSection[]> {
|
||||
const [template, rows] = await Promise.all([
|
||||
db.caseTemplate.findUnique({ where: { id: templateId }, select: { fields: true } }),
|
||||
db.documentTemplate.findUnique({ where: { id: templateId }, select: { fields: true } }),
|
||||
db.caseSection.findMany({ where: { caseId } }),
|
||||
])
|
||||
|
||||
const fields = templateFields(template?.fields)
|
||||
const byKey = new Map(rows.map((row) => [row.fieldKey, row]))
|
||||
|
||||
return fields.map((field): RenderedSection => {
|
||||
const row = byKey.get(field.key)
|
||||
const required = Math.max(field.minClearance ?? 0, row?.minClearance ?? 0)
|
||||
const common = {
|
||||
fieldKey: field.key,
|
||||
field,
|
||||
version: row?.currentVersion ?? 0,
|
||||
updatedAt: row?.updatedAt ?? null,
|
||||
updatedById: row?.updatedById ?? null,
|
||||
}
|
||||
|
||||
if (!p.isAdmin && required > p.clearanceLevel) {
|
||||
return { ...common, visible: false, value: { redacted: true, requiredLevel: required } }
|
||||
}
|
||||
|
||||
const value = row?.value ?? null
|
||||
const segments =
|
||||
isInputField(field) && field.type === 'longtext' && typeof value === 'string'
|
||||
? redactForLevel(value, p.clearanceLevel)
|
||||
: null
|
||||
|
||||
return { ...common, visible: true, value, segments }
|
||||
})
|
||||
}
|
||||
|
||||
export class ConflictError extends Error {
|
||||
constructor(
|
||||
readonly current: { value: unknown; version: number; updatedById: string | null },
|
||||
) {
|
||||
super('conflict')
|
||||
this.name = 'ConflictError'
|
||||
}
|
||||
return renderSections(templateFields(template?.fields), rows, p)
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -99,7 +46,6 @@ export class ConflictError extends Error {
|
||||
*
|
||||
* Der Client schickt die Version mit, die er geladen hat. Weicht sie ab, gibt
|
||||
* es kein stilles Überschreiben, sondern einen Konflikt mit beiden Fassungen.
|
||||
* Siehe docs/05-akten-und-vorlagen.md.
|
||||
*/
|
||||
export async function saveSection(
|
||||
p: EffectivePermissions,
|
||||
@@ -118,32 +64,24 @@ export async function saveSection(
|
||||
const check = canEditCase(p, target)
|
||||
if (!check.ok) throw new AccessError(check.reason)
|
||||
|
||||
const template = await db.caseTemplate.findUnique({
|
||||
const template = await db.documentTemplate.findUnique({
|
||||
where: { id: target.templateId },
|
||||
select: { fields: true },
|
||||
})
|
||||
const field = templateFields(template?.fields).find((f) => f.key === input.fieldKey)
|
||||
if (!field || !isInputField(field)) throw new AccessError('field-unknown')
|
||||
if (!field) throw new AccessError('field-unknown')
|
||||
|
||||
const existing = await db.caseSection.findUnique({
|
||||
where: { caseId_fieldKey: { caseId: target.id, fieldKey: input.fieldKey } },
|
||||
})
|
||||
|
||||
const required = Math.max(field.minClearance ?? 0, existing?.minClearance ?? 0)
|
||||
if (!p.isAdmin && required > p.clearanceLevel) throw new AccessError('clearance-too-low')
|
||||
|
||||
const nextClearance = input.minClearance ?? existing?.minClearance ?? field.minClearance ?? 0
|
||||
if (nextClearance > p.clearanceLevel && !p.isAdmin) throw new AccessError('clearance-too-low')
|
||||
|
||||
if ((existing?.currentVersion ?? 0) !== input.baseVersion) {
|
||||
throw new ConflictError({
|
||||
value: existing?.value ?? null,
|
||||
version: existing?.currentVersion ?? 0,
|
||||
updatedById: existing?.updatedById ?? null,
|
||||
})
|
||||
}
|
||||
|
||||
const nextVersion = (existing?.currentVersion ?? 0) + 1
|
||||
const { nextClearance, nextVersion } = planSectionSave({
|
||||
p,
|
||||
field,
|
||||
existing,
|
||||
baseVersion: input.baseVersion,
|
||||
minClearance: input.minClearance,
|
||||
})
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
if (existing) {
|
||||
|
||||
@@ -2,8 +2,9 @@ import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import { canCreateCase, canEditCase, canReclassify } from '@/lib/access/caseWrite'
|
||||
import { nextCaseNumber } from '@/lib/cases/caseNumber'
|
||||
import { nextNumber } from '@/lib/numbering'
|
||||
import { findTransition, type CaseStatusName } from '@/lib/cases/lifecycle'
|
||||
import { AccessError, must } from '@/lib/errors'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
@@ -14,16 +15,7 @@ import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
* und geben zurück. Die Regeln stehen an genau einer Stelle.
|
||||
*/
|
||||
|
||||
export class AccessError extends Error {
|
||||
constructor(readonly code: string) {
|
||||
super(code)
|
||||
this.name = 'AccessError'
|
||||
}
|
||||
}
|
||||
|
||||
function must(check: { ok: boolean; reason?: string }): void {
|
||||
if (!check.ok) throw new AccessError(check.reason ?? 'denied')
|
||||
}
|
||||
export { AccessError } from '@/lib/errors'
|
||||
|
||||
/** Lädt eine Akte, sofern der Nutzer sie sehen darf. Sonst `null` — nie 403. */
|
||||
export async function loadVisibleCase(p: EffectivePermissions, caseNumber: string) {
|
||||
@@ -53,7 +45,7 @@ export async function createCase(
|
||||
): Promise<{ caseNumber: string; id: string }> {
|
||||
must(canCreateCase(p, input.classification))
|
||||
|
||||
const template = await db.caseTemplate.findFirst({
|
||||
const template = await db.documentTemplate.findFirst({
|
||||
where: { key: input.templateKey, isActive: true },
|
||||
orderBy: { version: 'desc' },
|
||||
select: { id: true, key: true, numberPrefix: true, numberPadding: true },
|
||||
@@ -62,7 +54,7 @@ export async function createCase(
|
||||
|
||||
return db.$transaction(async (tx) => {
|
||||
// Das Muster kommt aus der Vorlage, jede Fallart hat ihren Nummernkreis.
|
||||
const caseNumber = await nextCaseNumber(tx, {
|
||||
const caseNumber = await nextNumber(tx, {
|
||||
prefix: template.numberPrefix,
|
||||
padding: template.numberPadding,
|
||||
})
|
||||
@@ -263,7 +255,7 @@ export async function reclassify(
|
||||
|
||||
/** Felder mit `requiredToClose`, die noch leer sind. Kommt mit Phase 3 zum Tragen. */
|
||||
async function missingRequiredSections(caseId: string, templateId: string): Promise<string[]> {
|
||||
const template = await db.caseTemplate.findUnique({
|
||||
const template = await db.documentTemplate.findUnique({
|
||||
where: { id: templateId },
|
||||
select: { fields: true },
|
||||
})
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
/**
|
||||
* Feste Wertelisten der Akte — Rollen der Beteiligten und Arten der
|
||||
* Verknüpfung.
|
||||
*
|
||||
* **Ohne Abhängigkeiten.** Diese Datei wird auch im Client geladen, und die
|
||||
* Dienstmodule daneben ziehen den Datenbankclient nach sich. Denselben Schnitt
|
||||
* hat `lib/templates/fields.ts` gegenüber `schema.ts`, aus demselben Grund:
|
||||
* das Bündelbudget aus docs/09-performance-und-ux.md.
|
||||
*
|
||||
* Die Übersetzungen stehen in `lib/i18n/de.ts`, nicht hier: diese Namen sind
|
||||
* Datenbankwerte.
|
||||
*/
|
||||
|
||||
export const PARTICIPANT_ROLES = [
|
||||
'LEAD',
|
||||
'INVESTIGATOR',
|
||||
'WITNESS',
|
||||
'SUBJECT',
|
||||
'OBSERVER',
|
||||
] as const
|
||||
|
||||
export type ParticipantRoleName = (typeof PARTICIPANT_ROLES)[number]
|
||||
|
||||
export function isParticipantRole(value: string): value is ParticipantRoleName {
|
||||
return (PARTICIPANT_ROLES as readonly string[]).includes(value)
|
||||
}
|
||||
|
||||
export const LINK_KINDS = ['RELATED', 'SUCCESSOR', 'MERGED_INTO'] as const
|
||||
|
||||
export type LinkKindName = (typeof LINK_KINDS)[number]
|
||||
|
||||
export function isLinkKind(value: string): value is LinkKindName {
|
||||
return (LINK_KINDS as readonly string[]).includes(value)
|
||||
}
|
||||
@@ -0,0 +1,452 @@
|
||||
import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { visibleDocumentWhere, visiblePersonnelWhere } from '@/lib/access/personnelFilter'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import {
|
||||
canCreateDocument,
|
||||
canEditDocument,
|
||||
canFinalizeDocument,
|
||||
canRetractDocument,
|
||||
canWritePersonnel,
|
||||
} from '@/lib/access/documentWrite'
|
||||
import { canEditCase } from '@/lib/access/caseWrite'
|
||||
import { AccessError, must } from '@/lib/errors'
|
||||
import { nextNumber } from '@/lib/numbering'
|
||||
import { parseTemplateFields } from '@/lib/templates/schema'
|
||||
import { asJson, planSectionSave, renderSections, type RenderedSection } from '@/lib/sections/render'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
import type { Prisma } from '@afis/db'
|
||||
|
||||
/**
|
||||
* Dokumente. Eine Ausfertigung aus einer Vorlage — Vorfallsbericht,
|
||||
* Sonderarbeitsvertrag, Bußgeldbescheid — an einer Fallakte, an einer
|
||||
* Personalakte oder für sich stehend.
|
||||
*
|
||||
* Eine neue Dokumentart braucht hier keine Zeile: sie ist eine Vorlage mit
|
||||
* passendem `uses`. Siehe docs/13-entscheidungen.md.
|
||||
*/
|
||||
|
||||
export type TemplateUse = 'CASE' | 'CASE_DOCUMENT' | 'PERSON_DOCUMENT' | 'STANDALONE'
|
||||
|
||||
/** Wo soll das Dokument hängen? Genau eine der drei Formen. */
|
||||
export type Owner =
|
||||
| { kind: 'case'; caseNumber: string }
|
||||
| { kind: 'personnel'; personnelFileId: string }
|
||||
| { kind: 'standalone' }
|
||||
|
||||
const KOPFDATEN = {
|
||||
id: true,
|
||||
documentNumber: true,
|
||||
title: true,
|
||||
templateId: true,
|
||||
templateKey: true,
|
||||
templateVersion: true,
|
||||
layout: true,
|
||||
status: true,
|
||||
classification: true,
|
||||
caseId: true,
|
||||
personnelFileId: true,
|
||||
createdById: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
finalizedAt: true,
|
||||
finalizedById: true,
|
||||
retractedAt: true,
|
||||
retractedById: true,
|
||||
retractionReason: true,
|
||||
} satisfies Prisma.DocumentSelect
|
||||
|
||||
/** Die aktiven Vorlagen, die an dieser Stelle verwendet werden dürfen. */
|
||||
export async function listTemplatesFor(use: TemplateUse) {
|
||||
const rows = await db.documentTemplate.findMany({
|
||||
where: { isActive: true, uses: { has: use } },
|
||||
orderBy: [{ key: 'asc' }, { version: 'desc' }],
|
||||
select: { id: true, key: true, version: true, name: true, description: true, layout: true },
|
||||
})
|
||||
// Nur die jeweils höchste Version je Schlüssel. Ältere Versionen bleiben
|
||||
// bestehen, weil Dokumente sich ihre merken, aber neu angelegt wird stets
|
||||
// mit der aktuellen.
|
||||
const gesehen = new Set<string>()
|
||||
return rows.filter((row) => (gesehen.has(row.key) ? false : (gesehen.add(row.key), true)))
|
||||
}
|
||||
|
||||
export async function loadVisibleDocument(p: EffectivePermissions, documentNumber: string) {
|
||||
return db.document.findFirst({
|
||||
where: { AND: [visibleDocumentWhere(p), { documentNumber }] },
|
||||
select: KOPFDATEN,
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Die Dokumente eines Besitzers. Der Filter steckt in der Abfrage: ein
|
||||
* Dokument über der Stufe des Lesers taucht weder auf noch in der Zählung.
|
||||
*/
|
||||
export async function listDocuments(
|
||||
p: EffectivePermissions,
|
||||
owner: { caseId: string } | { personnelFileId: string },
|
||||
) {
|
||||
const wo: Prisma.DocumentWhereInput =
|
||||
'caseId' in owner ? { caseId: owner.caseId } : { personnelFileId: owner.personnelFileId }
|
||||
|
||||
return db.document.findMany({
|
||||
where: { AND: [visibleDocumentWhere(p), wo] },
|
||||
orderBy: { createdAt: 'desc' },
|
||||
take: 100,
|
||||
select: KOPFDATEN,
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Legt ein Dokument an.
|
||||
*
|
||||
* Reihenfolge der Prüfungen, jede einzeln nötig:
|
||||
* 1. Die Vorlage muss an dieser Stelle erlaubt sein (`uses`).
|
||||
* 2. Der Besitzer muss sichtbar **und** beschreibbar sein.
|
||||
* 3. Der Nutzer braucht `document.create` und die Stufe.
|
||||
*/
|
||||
export async function createDocument(
|
||||
p: EffectivePermissions,
|
||||
input: { templateKey: string; title?: string; classification: number; owner: Owner },
|
||||
): Promise<{ documentNumber: string; id: string }> {
|
||||
const use: TemplateUse =
|
||||
input.owner.kind === 'case'
|
||||
? 'CASE_DOCUMENT'
|
||||
: input.owner.kind === 'personnel'
|
||||
? 'PERSON_DOCUMENT'
|
||||
: 'STANDALONE'
|
||||
|
||||
const template = await db.documentTemplate.findFirst({
|
||||
where: { key: input.templateKey, isActive: true, uses: { has: use } },
|
||||
orderBy: { version: 'desc' },
|
||||
select: {
|
||||
id: true,
|
||||
key: true,
|
||||
version: true,
|
||||
name: true,
|
||||
layout: true,
|
||||
numberPrefix: true,
|
||||
numberPadding: true,
|
||||
},
|
||||
})
|
||||
if (!template) throw new AccessError('template-missing')
|
||||
|
||||
must(canCreateDocument(p, input.classification))
|
||||
|
||||
let caseId: string | null = null
|
||||
let personnelFileId: string | null = null
|
||||
let caseNumber: string | null = null
|
||||
|
||||
if (input.owner.kind === 'case') {
|
||||
const akte = await db.case.findFirst({
|
||||
where: { AND: [visibleCaseWhere(p), { caseNumber: input.owner.caseNumber }] },
|
||||
select: { id: true, caseNumber: true, status: true, classification: true },
|
||||
})
|
||||
if (!akte) throw new AccessError('not-found')
|
||||
must(canEditCase(p, akte, 'entry.create'))
|
||||
caseId = akte.id
|
||||
caseNumber = akte.caseNumber
|
||||
} else if (input.owner.kind === 'personnel') {
|
||||
const akte = await db.personnelFile.findFirst({
|
||||
where: { AND: [visiblePersonnelWhere(p), { id: input.owner.personnelFileId }] },
|
||||
select: { id: true, classification: true },
|
||||
})
|
||||
if (!akte) throw new AccessError('not-found')
|
||||
must(canWritePersonnel(p, akte.classification))
|
||||
personnelFileId = akte.id
|
||||
}
|
||||
|
||||
const titel = input.title?.trim() || template.name
|
||||
|
||||
return db.$transaction(async (tx) => {
|
||||
const documentNumber = await nextNumber(tx, {
|
||||
prefix: template.numberPrefix,
|
||||
padding: template.numberPadding,
|
||||
})
|
||||
|
||||
const created = await tx.document.create({
|
||||
data: {
|
||||
documentNumber,
|
||||
title: titel,
|
||||
templateId: template.id,
|
||||
templateKey: template.key,
|
||||
templateVersion: template.version,
|
||||
// Kopie, kein Verweis: ein späterer Umbau der Vorlage darf das
|
||||
// Aussehen eines ausgefertigten Dokuments nicht verändern.
|
||||
layout: template.layout,
|
||||
classification: input.classification,
|
||||
caseId,
|
||||
personnelFileId,
|
||||
createdById: p.userId,
|
||||
},
|
||||
select: { id: true, documentNumber: true },
|
||||
})
|
||||
|
||||
// Ein Dokument in einer Fallakte gehört in ihren Verlauf, sonst entsteht
|
||||
// es unsichtbar neben der Chronologie.
|
||||
if (caseId) {
|
||||
await tx.caseEntry.create({
|
||||
data: {
|
||||
id: crypto.randomUUID(),
|
||||
caseId,
|
||||
type: 'SYSTEM',
|
||||
body: `Dokument ${created.documentNumber} angelegt: ${titel}`,
|
||||
authorId: p.userId,
|
||||
minClearance: 0,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'document.create',
|
||||
targetType: 'Document',
|
||||
targetId: created.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
documentNumber: created.documentNumber,
|
||||
templateKey: template.key,
|
||||
classification: input.classification,
|
||||
caseNumber: caseNumber ?? undefined,
|
||||
personnelFileId: personnelFileId ?? undefined,
|
||||
},
|
||||
})
|
||||
|
||||
return created
|
||||
})
|
||||
}
|
||||
|
||||
/** Die Abschnitte eines Dokuments, mit der Stufe des Lesers angewendet. */
|
||||
export async function loadDocumentSections(
|
||||
p: EffectivePermissions,
|
||||
document: { id: string; templateId: string },
|
||||
): Promise<RenderedSection[]> {
|
||||
const [template, rows] = await Promise.all([
|
||||
db.documentTemplate.findUnique({
|
||||
where: { id: document.templateId },
|
||||
select: { fields: true },
|
||||
}),
|
||||
db.documentSection.findMany({ where: { documentId: document.id } }),
|
||||
])
|
||||
|
||||
return renderSections(parseTemplateFields(template?.fields), rows, p)
|
||||
}
|
||||
|
||||
export async function saveDocumentSection(
|
||||
p: EffectivePermissions,
|
||||
input: {
|
||||
documentNumber: string
|
||||
fieldKey: string
|
||||
value: unknown
|
||||
baseVersion: number
|
||||
minClearance?: number
|
||||
},
|
||||
): Promise<{ version: number }> {
|
||||
const target = await loadVisibleDocument(p, input.documentNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
|
||||
const check = canEditDocument(p, target)
|
||||
if (!check.ok) throw new AccessError(check.reason)
|
||||
|
||||
const template = await db.documentTemplate.findUnique({
|
||||
where: { id: target.templateId },
|
||||
select: { fields: true },
|
||||
})
|
||||
const field = parseTemplateFields(template?.fields).find((f) => f.key === input.fieldKey)
|
||||
if (!field) throw new AccessError('field-unknown')
|
||||
|
||||
const existing = await db.documentSection.findUnique({
|
||||
where: { documentId_fieldKey: { documentId: target.id, fieldKey: input.fieldKey } },
|
||||
})
|
||||
|
||||
const { nextClearance, nextVersion } = planSectionSave({
|
||||
p,
|
||||
field,
|
||||
existing,
|
||||
baseVersion: input.baseVersion,
|
||||
minClearance: input.minClearance,
|
||||
})
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
if (existing) {
|
||||
await tx.documentSectionVersion.create({
|
||||
data: {
|
||||
sectionId: existing.id,
|
||||
version: existing.currentVersion,
|
||||
value: asJson(existing.value),
|
||||
authorId: existing.updatedById,
|
||||
},
|
||||
})
|
||||
await tx.documentSection.update({
|
||||
where: { id: existing.id },
|
||||
data: {
|
||||
value: asJson(input.value),
|
||||
currentVersion: nextVersion,
|
||||
updatedById: p.userId,
|
||||
minClearance: nextClearance,
|
||||
},
|
||||
})
|
||||
} else {
|
||||
await tx.documentSection.create({
|
||||
data: {
|
||||
documentId: target.id,
|
||||
fieldKey: input.fieldKey,
|
||||
value: asJson(input.value),
|
||||
currentVersion: 1,
|
||||
updatedById: p.userId,
|
||||
minClearance: nextClearance,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
// Sonst bliebe `updatedAt` des Dokuments auf dem Anlagezeitpunkt stehen.
|
||||
await tx.document.update({ where: { id: target.id }, data: { updatedAt: new Date() } })
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'document.update',
|
||||
targetType: 'DocumentSection',
|
||||
targetId: `${target.id}:${input.fieldKey}`,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
documentNumber: target.documentNumber,
|
||||
fieldKey: input.fieldKey,
|
||||
version: nextVersion,
|
||||
minClearance: nextClearance,
|
||||
},
|
||||
})
|
||||
})
|
||||
|
||||
return { version: nextVersion }
|
||||
}
|
||||
|
||||
/**
|
||||
* Ausfertigen. Aus dem Entwurf wird ein gültiges Dokument; wer es danach noch
|
||||
* ändern will, braucht dasselbe Recht erneut.
|
||||
*/
|
||||
export async function finalizeDocument(
|
||||
p: EffectivePermissions,
|
||||
documentNumber: string,
|
||||
): Promise<void> {
|
||||
const target = await loadVisibleDocument(p, documentNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
must(canFinalizeDocument(p, target))
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.document.update({
|
||||
where: { id: target.id },
|
||||
data: { status: 'FINAL', finalizedAt: new Date(), finalizedById: p.userId },
|
||||
})
|
||||
|
||||
if (target.caseId) {
|
||||
await tx.caseEntry.create({
|
||||
data: {
|
||||
id: crypto.randomUUID(),
|
||||
caseId: target.caseId,
|
||||
type: 'SYSTEM',
|
||||
body: `Dokument ${target.documentNumber} ausgefertigt`,
|
||||
authorId: p.userId,
|
||||
minClearance: 0,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'document.finalize',
|
||||
targetType: 'Document',
|
||||
targetId: target.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { documentNumber: target.documentNumber },
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Zurückziehen. Es gibt kein Löschen: das Dokument bleibt als Grabstein
|
||||
* stehen, mit Datum, Person und Begründung. Siehe CLAUDE.md, harte Regel 2.
|
||||
*/
|
||||
export async function retractDocument(
|
||||
p: EffectivePermissions,
|
||||
documentNumber: string,
|
||||
reason: string,
|
||||
): Promise<void> {
|
||||
const target = await loadVisibleDocument(p, documentNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
must(canRetractDocument(p, target))
|
||||
|
||||
const begruendung = reason.trim()
|
||||
if (begruendung.length < 10) throw new AccessError('reason-required')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.document.update({
|
||||
where: { id: target.id },
|
||||
data: {
|
||||
status: 'RETRACTED',
|
||||
retractedAt: new Date(),
|
||||
retractedById: p.userId,
|
||||
retractionReason: begruendung,
|
||||
},
|
||||
})
|
||||
|
||||
if (target.caseId) {
|
||||
await tx.caseEntry.create({
|
||||
data: {
|
||||
id: crypto.randomUUID(),
|
||||
caseId: target.caseId,
|
||||
type: 'SYSTEM',
|
||||
body: `Dokument ${target.documentNumber} zurückgezogen. Begründung: ${begruendung}`,
|
||||
authorId: p.userId,
|
||||
minClearance: 0,
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'document.retract',
|
||||
targetType: 'Document',
|
||||
targetId: target.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { documentNumber: target.documentNumber, reason: begruendung },
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/** Klassifizierung eines Dokuments ändern, mit denselben Regeln wie beim Fall. */
|
||||
export async function reclassifyDocument(
|
||||
p: EffectivePermissions,
|
||||
documentNumber: string,
|
||||
to: number,
|
||||
reason?: string,
|
||||
): Promise<void> {
|
||||
const target = await loadVisibleDocument(p, documentNumber)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
if (target.classification === to) return
|
||||
if (to < 0 || to > 5) throw new AccessError('clearance-too-low')
|
||||
if (to > p.clearanceLevel && !p.isAdmin) {
|
||||
throw new AccessError('clearance-too-low')
|
||||
}
|
||||
must(canEditDocument(p, target))
|
||||
|
||||
const lowering = to < target.classification
|
||||
const begruendung = reason?.trim() ?? ''
|
||||
if (lowering && begruendung.length < 10) throw new AccessError('reason-required')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.document.update({ where: { id: target.id }, data: { classification: to } })
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'document.reclassify',
|
||||
targetType: 'Document',
|
||||
targetId: target.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
documentNumber: target.documentNumber,
|
||||
from: target.classification,
|
||||
to,
|
||||
lowering,
|
||||
reason: begruendung || undefined,
|
||||
},
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
/**
|
||||
* Fehler, die bis in die Oberfläche durchgereicht werden.
|
||||
*
|
||||
* `code` ist ein Schlüssel in `de.actionErrors`, kein Text: die Meldung wird
|
||||
* erst am Rand übersetzt. Ein Fehler, den der Nutzer nicht sehen darf, kommt
|
||||
* gar nicht erst hier an — fehlender Zugriff endet in 404, nicht in 403.
|
||||
*/
|
||||
export class AccessError extends Error {
|
||||
constructor(readonly code: string) {
|
||||
super(code)
|
||||
this.name = 'AccessError'
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Kein stilles Überschreiben: die fremde Fassung kommt mit zurück, damit der
|
||||
* Nutzer beide sieht und entscheidet. Siehe docs/05-akten-und-vorlagen.md.
|
||||
*/
|
||||
export class ConflictError extends Error {
|
||||
constructor(
|
||||
readonly current: { value: unknown; version: number; updatedById: string | null },
|
||||
) {
|
||||
super('conflict')
|
||||
this.name = 'ConflictError'
|
||||
}
|
||||
}
|
||||
|
||||
export function must(check: { ok: boolean; reason?: string }): void {
|
||||
if (!check.ok) throw new AccessError(check.reason ?? 'denied')
|
||||
}
|
||||
+116
-12
@@ -155,18 +155,6 @@ export const de = {
|
||||
entryPlaceholder: 'Was ist passiert?',
|
||||
saving: 'Wird gespeichert',
|
||||
unsaved: 'Nicht gespeichert',
|
||||
errors: {
|
||||
'not-found': 'Die Akte gibt es nicht, oder du darfst sie nicht sehen.',
|
||||
'clearance-too-low': 'Deine Freigabestufe reicht dafür nicht.',
|
||||
'no-permission': 'Dir fehlt das nötige Recht.',
|
||||
'read-only': 'Die Akte ist schreibgeschützt.',
|
||||
closed: 'Die Akte ist abgeschlossen. Änderungen brauchen ein eigenes Recht.',
|
||||
'reason-required': 'Begründung nötig, mindestens 10 Zeichen.',
|
||||
'transition-invalid': 'Dieser Statuswechsel ist nicht vorgesehen.',
|
||||
'sections-incomplete': 'Es fehlen Pflichtangaben für den Abschluss.',
|
||||
'template-missing': 'Für diese Fallart gibt es keine Vorlage.',
|
||||
default: 'Nicht gespeichert. Erneut versuchen.',
|
||||
} as Record<string, string>,
|
||||
statusNames: {
|
||||
DRAFT: 'Entwurf',
|
||||
OPEN: 'Offen',
|
||||
@@ -237,10 +225,104 @@ export const de = {
|
||||
personnel: {
|
||||
one: 'Personalakte',
|
||||
many: 'Personalakten',
|
||||
listHeading: 'Personalakten',
|
||||
name: 'Name',
|
||||
serviceNumber: 'Dienstnummer',
|
||||
rank: 'Dienstgrad',
|
||||
department: 'Abteilung',
|
||||
status: 'Status',
|
||||
note: 'Anmerkung',
|
||||
noteHelp: 'Steht im Kopf der Akte, etwa "kein Discord-Konto, Aktenlage aus 2025".',
|
||||
linkedAccount: 'Discord-Konto',
|
||||
noAccount: 'Ohne Discord-Konto',
|
||||
empty: 'Noch keine Personalakte. Erste Personalakte anlegen.',
|
||||
emptySearch: 'Kein Treffer. Anderen Begriff versuchen.',
|
||||
create: 'Personalakte anlegen',
|
||||
createTitle: 'Neue Personalakte',
|
||||
createHint:
|
||||
'Auch für Personen ohne Discord-Konto: Zeugen, ehemalige Mitarbeiter, Aktenlage von außen.',
|
||||
search: 'Name, Dienstnummer oder Dienstgrad',
|
||||
countLabel: (n: number) => (n === 1 ? '1 Personalakte' : `${n} Personalakten`),
|
||||
edit: 'Kopfdaten ändern',
|
||||
reclassify: 'Klassifizierung ändern',
|
||||
headData: 'Kopfdaten',
|
||||
backlinks: 'Fälle mit dieser Person',
|
||||
backlinksEmpty: 'Diese Person kommt in keinem Fall vor, den du sehen darfst.',
|
||||
backlinksCount: (n: number) => (n === 1 ? '1 Fall' : `${n} Fälle`),
|
||||
},
|
||||
|
||||
participant: {
|
||||
heading: 'Beteiligte',
|
||||
empty: 'Noch niemand eingetragen.',
|
||||
add: 'Beteiligte eintragen',
|
||||
remove: 'Entfernen',
|
||||
role: 'Rolle',
|
||||
person: 'Person',
|
||||
pickUser: 'Mitglied',
|
||||
pickPersonnel: 'Personalakte',
|
||||
hint:
|
||||
'Wer hier steht, liest die Akte unabhängig von seiner Freigabestufe. Das ist der Weg, jemanden ausnahmsweise hinzuzuziehen.',
|
||||
roles: {
|
||||
LEAD: 'Ermittlungsführung',
|
||||
INVESTIGATOR: 'Ermittler',
|
||||
WITNESS: 'Zeuge',
|
||||
SUBJECT: 'Betroffener',
|
||||
OBSERVER: 'Beobachter',
|
||||
} as Record<string, string>,
|
||||
},
|
||||
|
||||
link: {
|
||||
heading: 'Verknüpfungen',
|
||||
empty: 'Keine Verknüpfung.',
|
||||
add: 'Akte verknüpfen',
|
||||
remove: 'Verknüpfung lösen',
|
||||
target: 'Aktenzeichen',
|
||||
kind: 'Art',
|
||||
kinds: {
|
||||
RELATED: 'Verwandt',
|
||||
SUCCESSOR: 'Nachfolger',
|
||||
MERGED_INTO: 'Zusammengeführt in',
|
||||
} as Record<string, string>,
|
||||
incoming: {
|
||||
RELATED: 'Verwandt',
|
||||
SUCCESSOR: 'Vorgänger',
|
||||
MERGED_INTO: 'Zusammengeführt aus',
|
||||
} as Record<string, string>,
|
||||
},
|
||||
|
||||
document: {
|
||||
one: 'Dokument',
|
||||
many: 'Dokumente',
|
||||
number: 'Dokumentnummer',
|
||||
title: 'Titel',
|
||||
kind: 'Dokumentart',
|
||||
heading: 'Dokumente',
|
||||
empty: 'Noch kein Dokument.',
|
||||
create: 'Dokument anlegen',
|
||||
createTitle: 'Neues Dokument',
|
||||
createHint: 'Die Vorlage bestimmt Aufbau und Aussehen. Der Titel lässt sich später ändern.',
|
||||
open: 'Öffnen',
|
||||
finalize: 'Ausfertigen',
|
||||
finalizeHint: 'Danach sind Änderungen nur noch mit eigenem Recht möglich.',
|
||||
retract: 'Zurückziehen',
|
||||
retractReason: 'Begründung der Zurücknahme',
|
||||
reclassify: 'Klassifizierung ändern',
|
||||
retracted: (date: string, person: string, reason: string) =>
|
||||
`Dokument zurückgezogen am ${date} durch ${person} · Begründung: ${reason}`,
|
||||
finalized: (date: string, person: string) => `Ausgefertigt am ${date} durch ${person}`,
|
||||
ownerCase: 'Zur Fallakte',
|
||||
ownerPersonnel: 'Zur Personalakte',
|
||||
ownerNone: 'Ohne Besitzer',
|
||||
statusNames: {
|
||||
DRAFT: 'Entwurf',
|
||||
FINAL: 'Ausgefertigt',
|
||||
RETRACTED: 'Zurückgezogen',
|
||||
} as Record<string, string>,
|
||||
layoutNames: {
|
||||
FORM: 'Formular',
|
||||
PROSE: 'Vertragstext',
|
||||
NOTE: 'Vermerk',
|
||||
} as Record<string, string>,
|
||||
},
|
||||
|
||||
common: {
|
||||
@@ -253,6 +335,28 @@ export const de = {
|
||||
unknown: 'Unbekannt',
|
||||
},
|
||||
|
||||
/**
|
||||
* Meldungen zu abgelehnten Aktionen. Der Schlüssel ist der `code` eines
|
||||
* `AccessError`, siehe lib/errors.ts. Gilt für Fallakten, Personalakten und
|
||||
* Dokumente gleichermaßen — die Regeln sind dieselben.
|
||||
*/
|
||||
actionErrors: {
|
||||
'not-found': 'Die Akte gibt es nicht, oder du darfst sie nicht sehen.',
|
||||
'clearance-too-low': 'Deine Freigabestufe reicht dafür nicht.',
|
||||
'no-permission': 'Dir fehlt das nötige Recht.',
|
||||
'read-only': 'Der Datensatz ist schreibgeschützt.',
|
||||
closed: 'Der Vorgang ist abgeschlossen. Änderungen brauchen ein eigenes Recht.',
|
||||
'reason-required': 'Begründung nötig, mindestens 10 Zeichen.',
|
||||
'transition-invalid': 'Dieser Statuswechsel ist nicht vorgesehen.',
|
||||
'sections-incomplete': 'Es fehlen Pflichtangaben für den Abschluss.',
|
||||
'template-missing': 'Dafür gibt es keine Vorlage.',
|
||||
'field-unknown': 'Dieses Feld gehört nicht zur Vorlage.',
|
||||
'name-required': 'Ein Name mit mindestens zwei Zeichen ist nötig.',
|
||||
'participant-target': 'Entweder ein Discord-Konto oder eine Personalakte, nicht beides.',
|
||||
'link-self': 'Eine Akte lässt sich nicht mit sich selbst verknüpfen.',
|
||||
default: 'Nicht gespeichert. Erneut versuchen.',
|
||||
} as Record<string, string>,
|
||||
|
||||
errors: {
|
||||
notFound: {
|
||||
title: 'Nicht gefunden',
|
||||
|
||||
@@ -1,15 +1,21 @@
|
||||
import type { Prisma } from '@afis/db'
|
||||
|
||||
/**
|
||||
* Aktenzeichen. Das Muster gehört zur Vorlage, nicht ins Programm: die
|
||||
* Abteilung führt gewachsene Präfixe wie `AKT-PA-2026-62843` neben dem
|
||||
* `AfiS-2026-0042` aus dem Glossar. Siehe docs/13-entscheidungen.md.
|
||||
* Geschäftsnummern: Aktenzeichen und Dokumentnummern.
|
||||
*
|
||||
* Das Muster gehört zur Vorlage, nicht ins Programm: die Abteilung führt
|
||||
* gewachsene Präfixe wie `AKT-PA-2026-62843` neben dem `AfiS-2026-0042` aus
|
||||
* dem Glossar. Siehe docs/13-entscheidungen.md.
|
||||
*
|
||||
* Fallakten und Dokumente teilen sich denselben Zähler. Sie kollidieren nicht,
|
||||
* weil das Präfix Teil des Schlüssels ist: eine Fallart und eine Dokumentart
|
||||
* mit demselben Präfix laufen bewusst in einem Nummernkreis.
|
||||
*/
|
||||
export type NumberPattern = { prefix: string; padding: number }
|
||||
|
||||
export const DEFAULT_PATTERN: NumberPattern = { prefix: 'AfiS', padding: 4 }
|
||||
|
||||
export function formatCaseNumber(
|
||||
export function formatNumber(
|
||||
year: number,
|
||||
number: number,
|
||||
pattern: NumberPattern = DEFAULT_PATTERN,
|
||||
@@ -24,7 +30,7 @@ export function formatCaseNumber(
|
||||
*/
|
||||
const PATTERN = /^([A-Za-z][A-Za-z0-9-]*)-(\d{4})-(\d+)$/
|
||||
|
||||
export function parseCaseNumber(
|
||||
export function parseNumber(
|
||||
value: string,
|
||||
): { prefix: string; year: number; number: number } | null {
|
||||
const match = PATTERN.exec(value.trim())
|
||||
@@ -36,30 +42,30 @@ export function parseCaseNumber(
|
||||
export const CASE_NUMBER_GLOBAL = /\b[A-Za-z][A-Za-z0-9-]*-\d{4}-\d{3,8}\b/g
|
||||
|
||||
/**
|
||||
* Vergibt das nächste Aktenzeichen im Nummernkreis dieses Präfixes und Jahres.
|
||||
* Vergibt die nächste Nummer im Nummernkreis dieses Präfixes und Jahres.
|
||||
*
|
||||
* `INSERT … ON CONFLICT DO UPDATE` sperrt die Zeile für die Dauer der
|
||||
* Transaktion. Zwei gleichzeitige Anlagen warten dadurch aufeinander, statt
|
||||
* dieselbe Nummer zu ziehen. Läuft in **derselben** Transaktion wie das
|
||||
* Anlegen des Falls, siehe docs/04-datenmodell.md.
|
||||
*/
|
||||
export async function nextCaseNumber(
|
||||
export async function nextNumber(
|
||||
tx: Prisma.TransactionClient,
|
||||
pattern: NumberPattern = DEFAULT_PATTERN,
|
||||
year = new Date().getFullYear(),
|
||||
): Promise<string> {
|
||||
const rows = await tx.$queryRaw<{ lastNumber: number }[]>`
|
||||
INSERT INTO "CaseCounter" ("prefix", "year", "lastNumber")
|
||||
INSERT INTO "NumberSeries" ("prefix", "year", "lastNumber")
|
||||
VALUES (${pattern.prefix}, ${year}, 1)
|
||||
ON CONFLICT ("prefix", "year") DO UPDATE
|
||||
SET "lastNumber" = "CaseCounter"."lastNumber" + 1
|
||||
SET "lastNumber" = "NumberSeries"."lastNumber" + 1
|
||||
RETURNING "lastNumber"
|
||||
`
|
||||
|
||||
const lastNumber = rows[0]?.lastNumber
|
||||
if (lastNumber === undefined) {
|
||||
throw new Error('Aktenzeichen konnte nicht vergeben werden')
|
||||
throw new Error('Nummer konnte nicht vergeben werden')
|
||||
}
|
||||
|
||||
return formatCaseNumber(year, lastNumber, pattern)
|
||||
return formatNumber(year, lastNumber, pattern)
|
||||
}
|
||||
@@ -0,0 +1,267 @@
|
||||
import { db } from '@/lib/db'
|
||||
import { writeAudit } from '@/lib/audit'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import { visiblePersonnelWhere } from '@/lib/access/personnelFilter'
|
||||
import { canWritePersonnel } from '@/lib/access/documentWrite'
|
||||
import { AccessError, must } from '@/lib/errors'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
import type { Prisma } from '@afis/db'
|
||||
|
||||
/**
|
||||
* Personalakten. Eine Akte zu einer Person, auch zu einer **ohne
|
||||
* Discord-Konto**: Zeugen, ehemalige Mitarbeiter und Personen, über die
|
||||
* lediglich Aktenlage besteht, brauchen einen Platz.
|
||||
*
|
||||
* Die Rückverweise sind der heikelste Teil. Siehe `loadBacklinks`.
|
||||
*/
|
||||
|
||||
const KOPFDATEN = {
|
||||
id: true,
|
||||
userId: true,
|
||||
displayName: true,
|
||||
serviceNumber: true,
|
||||
rank: true,
|
||||
department: true,
|
||||
status: true,
|
||||
note: true,
|
||||
classification: true,
|
||||
createdById: true,
|
||||
createdAt: true,
|
||||
updatedAt: true,
|
||||
} satisfies Prisma.PersonnelFileSelect
|
||||
|
||||
export async function loadVisiblePersonnelFile(p: EffectivePermissions, id: string) {
|
||||
return db.personnelFile.findFirst({
|
||||
where: { AND: [visiblePersonnelWhere(p), { id }] },
|
||||
select: KOPFDATEN,
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Liste der Personalakten. Suchbegriff und Zählung laufen durch dieselbe
|
||||
* Abfrage wie die Sichtbarkeit, damit sich aus einer Trefferzahl nichts über
|
||||
* verborgene Akten ableiten lässt.
|
||||
*/
|
||||
export async function listPersonnelFiles(
|
||||
p: EffectivePermissions,
|
||||
options: { query?: string; take?: number } = {},
|
||||
) {
|
||||
const begriff = options.query?.trim()
|
||||
const where: Prisma.PersonnelFileWhereInput = {
|
||||
AND: [
|
||||
visiblePersonnelWhere(p),
|
||||
...(begriff
|
||||
? [
|
||||
{
|
||||
OR: [
|
||||
{ displayName: { contains: begriff, mode: 'insensitive' as const } },
|
||||
{ serviceNumber: { contains: begriff, mode: 'insensitive' as const } },
|
||||
{ rank: { contains: begriff, mode: 'insensitive' as const } },
|
||||
],
|
||||
},
|
||||
]
|
||||
: []),
|
||||
],
|
||||
}
|
||||
|
||||
const [files, total] = await Promise.all([
|
||||
db.personnelFile.findMany({
|
||||
where,
|
||||
orderBy: [{ displayName: 'asc' }],
|
||||
take: options.take ?? 50,
|
||||
select: KOPFDATEN,
|
||||
}),
|
||||
db.personnelFile.count({ where }),
|
||||
])
|
||||
|
||||
return { files, total }
|
||||
}
|
||||
|
||||
export async function createPersonnelFile(
|
||||
p: EffectivePermissions,
|
||||
input: {
|
||||
displayName: string
|
||||
userId?: string | null
|
||||
serviceNumber?: string | null
|
||||
rank?: string | null
|
||||
department?: string | null
|
||||
status?: string | null
|
||||
note?: string | null
|
||||
classification: number
|
||||
},
|
||||
): Promise<{ id: string }> {
|
||||
must(canWritePersonnel(p, input.classification))
|
||||
|
||||
const name = input.displayName.trim()
|
||||
if (name.length < 2) throw new AccessError('name-required')
|
||||
|
||||
return db.$transaction(async (tx) => {
|
||||
const created = await tx.personnelFile.create({
|
||||
data: {
|
||||
displayName: name,
|
||||
userId: input.userId || null,
|
||||
serviceNumber: input.serviceNumber?.trim() || null,
|
||||
rank: input.rank?.trim() || null,
|
||||
department: input.department?.trim() || null,
|
||||
status: input.status?.trim() || null,
|
||||
note: input.note?.trim() || null,
|
||||
classification: input.classification,
|
||||
createdById: p.userId,
|
||||
},
|
||||
select: { id: true },
|
||||
})
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'personnel.create',
|
||||
targetType: 'PersonnelFile',
|
||||
targetId: created.id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { displayName: name, classification: input.classification },
|
||||
})
|
||||
|
||||
return created
|
||||
})
|
||||
}
|
||||
|
||||
/** Kopfdaten ändern. Die Klassifizierung läuft über `reclassifyPersonnelFile`. */
|
||||
export async function updatePersonnelFile(
|
||||
p: EffectivePermissions,
|
||||
id: string,
|
||||
input: {
|
||||
displayName?: string
|
||||
serviceNumber?: string | null
|
||||
rank?: string | null
|
||||
department?: string | null
|
||||
status?: string | null
|
||||
note?: string | null
|
||||
},
|
||||
): Promise<void> {
|
||||
const target = await loadVisiblePersonnelFile(p, id)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
must(canWritePersonnel(p, target.classification))
|
||||
|
||||
const name = input.displayName?.trim()
|
||||
if (name !== undefined && name.length < 2) throw new AccessError('name-required')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.personnelFile.update({
|
||||
where: { id },
|
||||
data: {
|
||||
...(name !== undefined ? { displayName: name } : {}),
|
||||
...(input.serviceNumber !== undefined
|
||||
? { serviceNumber: input.serviceNumber?.trim() || null }
|
||||
: {}),
|
||||
...(input.rank !== undefined ? { rank: input.rank?.trim() || null } : {}),
|
||||
...(input.department !== undefined
|
||||
? { department: input.department?.trim() || null }
|
||||
: {}),
|
||||
...(input.status !== undefined ? { status: input.status?.trim() || null } : {}),
|
||||
...(input.note !== undefined ? { note: input.note?.trim() || null } : {}),
|
||||
},
|
||||
})
|
||||
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'personnel.update',
|
||||
targetType: 'PersonnelFile',
|
||||
targetId: id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: { fields: Object.keys(input) },
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Klassifizierung ändern. Wie bei der Fallakte ist die Herabstufung der
|
||||
* heiklere Fall: sie macht die Akte für Leute sichtbar, die sie vorher nicht
|
||||
* sehen durften. Sie braucht eine Begründung und steht im Protokoll.
|
||||
*/
|
||||
export async function reclassifyPersonnelFile(
|
||||
p: EffectivePermissions,
|
||||
id: string,
|
||||
to: number,
|
||||
reason?: string,
|
||||
): Promise<void> {
|
||||
const target = await loadVisiblePersonnelFile(p, id)
|
||||
if (!target) throw new AccessError('not-found')
|
||||
if (target.classification === to) return
|
||||
if (to < 0 || to > 5) throw new AccessError('clearance-too-low')
|
||||
must(canWritePersonnel(p, Math.max(to, target.classification)))
|
||||
|
||||
const lowering = to < target.classification
|
||||
const begruendung = reason?.trim() ?? ''
|
||||
if (lowering && begruendung.length < 10) throw new AccessError('reason-required')
|
||||
|
||||
await db.$transaction(async (tx) => {
|
||||
await tx.personnelFile.update({ where: { id }, data: { classification: to } })
|
||||
await writeAudit(tx, {
|
||||
actorId: p.userId,
|
||||
action: 'personnel.reclassify',
|
||||
targetType: 'PersonnelFile',
|
||||
targetId: id,
|
||||
clearanceAtTime: p.clearanceLevel,
|
||||
meta: {
|
||||
from: target.classification,
|
||||
to,
|
||||
lowering,
|
||||
reason: begruendung || undefined,
|
||||
},
|
||||
})
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Rückverweise: die Fälle, in denen diese Person vorkommt, nach Rolle getrennt.
|
||||
*
|
||||
* **Diese Liste läuft durch dieselbe Sichtbarkeitsprüfung wie die Fallliste.**
|
||||
* Das ist der häufigste Ort, an dem ein Aktensystem leckt: eine Personalakte
|
||||
* der Stufe 1, auf der „3 Fälle" steht, verrät die Existenz von Ermittlungen,
|
||||
* die der Leser nicht sehen darf. Deshalb steckt der Filter in der Abfrage und
|
||||
* die Zählung entsteht aus dem gefilterten Ergebnis — nie aus einem eigenen
|
||||
* `count` ohne Filter. Siehe docs/05-akten-und-vorlagen.md, Rückverweise.
|
||||
*/
|
||||
export async function loadBacklinks(
|
||||
p: EffectivePermissions,
|
||||
file: { id: string; userId: string | null },
|
||||
) {
|
||||
const wenDieAkteMeint: Prisma.CaseParticipantWhereInput[] = [{ personnelFileId: file.id }]
|
||||
// Dieselbe Person kann über ihre Personalakte oder über ihr Discord-Konto
|
||||
// eingetragen sein. Beides zählt, sonst fehlen Fälle.
|
||||
if (file.userId) wenDieAkteMeint.push({ userId: file.userId })
|
||||
|
||||
const rows = await db.caseParticipant.findMany({
|
||||
where: {
|
||||
AND: [{ OR: wenDieAkteMeint }, { case: { is: visibleCaseWhere(p) } }],
|
||||
},
|
||||
select: {
|
||||
role: true,
|
||||
case: {
|
||||
select: {
|
||||
id: true,
|
||||
caseNumber: true,
|
||||
title: true,
|
||||
status: true,
|
||||
classification: true,
|
||||
updatedAt: true,
|
||||
},
|
||||
},
|
||||
},
|
||||
orderBy: { createdAt: 'desc' },
|
||||
take: 200,
|
||||
})
|
||||
|
||||
// Eine Person kann in einem Fall mehrere Rollen haben; jede Rolle bekommt
|
||||
// ihren Eintrag, der Fall steht dann in beiden Gruppen.
|
||||
const nachRolle = new Map<string, typeof rows>()
|
||||
for (const row of rows) {
|
||||
const gruppe = nachRolle.get(row.role) ?? []
|
||||
gruppe.push(row)
|
||||
nachRolle.set(row.role, gruppe)
|
||||
}
|
||||
|
||||
return {
|
||||
total: rows.length,
|
||||
byRole: [...nachRolle.entries()].map(([role, eintraege]) => ({ role, eintraege })),
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,123 @@
|
||||
import { isInputField, type TemplateField } from '@/lib/templates/fields'
|
||||
import { redactForLevel, type Segment } from '@/lib/redaction'
|
||||
import { AccessError, ConflictError } from '@/lib/errors'
|
||||
import type { EffectivePermissions } from '@/lib/auth/permissions'
|
||||
import type { Prisma } from '@afis/db'
|
||||
|
||||
/**
|
||||
* Abschnitte: der ausgefüllte Inhalt einer Vorlage.
|
||||
*
|
||||
* Eine Fallakte trägt sie direkt, ein Dokument ebenso. Die Regeln sind
|
||||
* dieselben, deshalb stehen sie hier einmal und nicht zweimal: welche Stufe
|
||||
* ein Feld verlangt, was ein zu niedrig eingestufter Leser bekommt, und wann
|
||||
* ein Speichern ein Konflikt ist.
|
||||
*/
|
||||
|
||||
/** Was ein Leser sieht, dessen Stufe für ein Feld nicht reicht. */
|
||||
export type Placeholder = { redacted: true; requiredLevel: number }
|
||||
|
||||
/** Die Spalten, die `CaseSection` und `DocumentSection` gemeinsam haben. */
|
||||
export type SectionRow = {
|
||||
fieldKey: string
|
||||
value: unknown
|
||||
minClearance: number
|
||||
currentVersion: number
|
||||
updatedAt: Date
|
||||
updatedById: string | null
|
||||
}
|
||||
|
||||
export type RenderedSection = {
|
||||
fieldKey: string
|
||||
field: TemplateField
|
||||
version: number
|
||||
updatedAt: Date | null
|
||||
updatedById: string | null
|
||||
} & (
|
||||
| { visible: true; value: unknown; segments: Segment[] | null }
|
||||
| { visible: false; value: Placeholder }
|
||||
)
|
||||
|
||||
/**
|
||||
* Prisma trennt „Feld nicht setzen" von „JSON null". Ein leerer Abschnitt ist
|
||||
* inhaltlich JSON null, nicht das Fehlen des Feldes.
|
||||
*/
|
||||
export function asJson(value: unknown): Prisma.InputJsonValue {
|
||||
return (value ?? null) as Prisma.InputJsonValue
|
||||
}
|
||||
|
||||
/**
|
||||
* Wendet die Stufe des Lesers auf die Abschnitte an.
|
||||
*
|
||||
* Felder über seiner Stufe werden **hier**, also serverseitig, durch einen
|
||||
* Platzhalter ersetzt. Der echte Wert verlässt den Server nicht — nie im
|
||||
* Client ausblenden. Dasselbe gilt für Schwärzungen im Fließtext, die als
|
||||
* Segmente zurückkommen.
|
||||
*/
|
||||
export function renderSections(
|
||||
fields: TemplateField[],
|
||||
rows: SectionRow[],
|
||||
p: EffectivePermissions,
|
||||
): RenderedSection[] {
|
||||
const byKey = new Map(rows.map((row) => [row.fieldKey, row]))
|
||||
|
||||
return fields.map((field): RenderedSection => {
|
||||
const row = byKey.get(field.key)
|
||||
const required = Math.max(field.minClearance ?? 0, row?.minClearance ?? 0)
|
||||
const common = {
|
||||
fieldKey: field.key,
|
||||
field,
|
||||
version: row?.currentVersion ?? 0,
|
||||
updatedAt: row?.updatedAt ?? null,
|
||||
updatedById: row?.updatedById ?? null,
|
||||
}
|
||||
|
||||
if (!p.isAdmin && required > p.clearanceLevel) {
|
||||
return { ...common, visible: false, value: { redacted: true, requiredLevel: required } }
|
||||
}
|
||||
|
||||
const value = row?.value ?? null
|
||||
const segments =
|
||||
isInputField(field) && field.type === 'longtext' && typeof value === 'string'
|
||||
? redactForLevel(value, p.clearanceLevel)
|
||||
: null
|
||||
|
||||
return { ...common, visible: true, value, segments }
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Prüft ein Speichern, bevor es geschrieben wird, und liefert die neue
|
||||
* Feldstufe und Versionsnummer.
|
||||
*
|
||||
* Wirft `AccessError`, wenn die Stufe nicht reicht, und `ConflictError`, wenn
|
||||
* der Abschnitt sich seit dem Laden verändert hat. Beides gilt für Fallakten
|
||||
* und Dokumente gleichermaßen.
|
||||
*/
|
||||
export function planSectionSave(input: {
|
||||
p: EffectivePermissions
|
||||
field: TemplateField
|
||||
existing: Pick<SectionRow, 'minClearance' | 'currentVersion' | 'value' | 'updatedById'> | null
|
||||
baseVersion: number
|
||||
minClearance?: number
|
||||
}): { nextClearance: number; nextVersion: number } {
|
||||
const { p, field, existing } = input
|
||||
|
||||
if (!isInputField(field)) throw new AccessError('field-unknown')
|
||||
|
||||
// Wer ein Feld nicht lesen darf, darf es auch nicht überschreiben.
|
||||
const required = Math.max(field.minClearance ?? 0, existing?.minClearance ?? 0)
|
||||
if (!p.isAdmin && required > p.clearanceLevel) throw new AccessError('clearance-too-low')
|
||||
|
||||
const nextClearance = input.minClearance ?? existing?.minClearance ?? field.minClearance ?? 0
|
||||
if (nextClearance > p.clearanceLevel && !p.isAdmin) throw new AccessError('clearance-too-low')
|
||||
|
||||
if ((existing?.currentVersion ?? 0) !== input.baseVersion) {
|
||||
throw new ConflictError({
|
||||
value: existing?.value ?? null,
|
||||
version: existing?.currentVersion ?? 0,
|
||||
updatedById: existing?.updatedById ?? null,
|
||||
})
|
||||
}
|
||||
|
||||
return { nextClearance, nextVersion: (existing?.currentVersion ?? 0) + 1 }
|
||||
}
|
||||
@@ -30,7 +30,7 @@ let templateId = ''
|
||||
suite('Abschnitte', () => {
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
const vorlage = await db.caseTemplate.create({
|
||||
const vorlage = await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: FELDER },
|
||||
})
|
||||
templateId = vorlage.id
|
||||
|
||||
@@ -0,0 +1,172 @@
|
||||
// @vitest-environment node
|
||||
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
||||
import { db } from '@/lib/db'
|
||||
import { createPersonnelFile } from '@/lib/personnel/service'
|
||||
import {
|
||||
createDocument,
|
||||
finalizeDocument,
|
||||
listTemplatesFor,
|
||||
loadDocumentSections,
|
||||
loadVisibleDocument,
|
||||
retractDocument,
|
||||
saveDocumentSection,
|
||||
} from '@/lib/documents/service'
|
||||
import { AccessError } from '@/lib/errors'
|
||||
import type { EffectivePermissions, Permission } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Der Weg, den ein Sonderarbeitsvertrag wirklich nimmt: Personalakte anlegen,
|
||||
* Dokument aus der Vorlage erzeugen, Felder füllen, ausfertigen, zurückziehen.
|
||||
*
|
||||
* Läuft gegen die Startvorlagen aus dem Seed. Wenn diese Prüfung bricht, ist
|
||||
* entweder die Vorlage kaputt oder die Dokumentebene.
|
||||
*/
|
||||
const url = process.env.DIRECT_DATABASE_URL ?? process.env.DATABASE_URL
|
||||
const suite = url ? describe : describe.skip
|
||||
|
||||
const marke = `ablauf-${Date.now()}`
|
||||
|
||||
function perms(
|
||||
userId: string,
|
||||
clearanceLevel: number,
|
||||
permissions: Permission[] = [],
|
||||
): EffectivePermissions {
|
||||
return {
|
||||
userId,
|
||||
clearanceLevel,
|
||||
permissions: new Set<Permission>(permissions),
|
||||
isAdmin: false,
|
||||
hasMembership: true,
|
||||
}
|
||||
}
|
||||
|
||||
suite('Ein Sonderarbeitsvertrag von Anfang bis Ende', () => {
|
||||
const leitung = perms(`${marke}-leitung`, 4, [
|
||||
'personnel.read',
|
||||
'personnel.edit',
|
||||
'document.create',
|
||||
'document.edit',
|
||||
'document.finalize',
|
||||
'document.retract',
|
||||
])
|
||||
const neuling = perms(`${marke}-neuling`, 1, ['personnel.read'])
|
||||
|
||||
let personalakteId = ''
|
||||
let documentNumber = ''
|
||||
|
||||
beforeAll(async () => {
|
||||
for (const p of [leitung, neuling]) {
|
||||
await db.user.create({
|
||||
data: { id: p.userId, username: p.userId, displayName: p.userId },
|
||||
})
|
||||
}
|
||||
const akte = await createPersonnelFile(leitung, {
|
||||
displayName: `${marke} Vertragspartner`,
|
||||
classification: 1,
|
||||
})
|
||||
personalakteId = akte.id
|
||||
})
|
||||
|
||||
afterAll(async () => {
|
||||
await db.$disconnect()
|
||||
})
|
||||
|
||||
it('bietet an einer Person nur die dafür vorgesehenen Vorlagen an', async () => {
|
||||
const schluessel = (await listTemplatesFor('PERSON_DOCUMENT')).map((t) => t.key)
|
||||
expect(schluessel).toContain('sonderarbeitsvertrag')
|
||||
expect(schluessel).toContain('vermerk')
|
||||
// Eine Fallart legt kein Dokument an.
|
||||
expect(schluessel).not.toContain('korruptionsverdacht')
|
||||
})
|
||||
|
||||
it('lehnt eine Vorlage ab, die an dieser Stelle nichts zu suchen hat', async () => {
|
||||
await expect(
|
||||
createDocument(leitung, {
|
||||
templateKey: 'korruptionsverdacht',
|
||||
classification: 1,
|
||||
owner: { kind: 'personnel', personnelFileId: personalakteId },
|
||||
}),
|
||||
).rejects.toThrow(AccessError)
|
||||
})
|
||||
|
||||
it('legt den Vertrag mit eigener Nummer aus dem Präfix der Vorlage an', async () => {
|
||||
const created = await createDocument(leitung, {
|
||||
templateKey: 'sonderarbeitsvertrag',
|
||||
title: 'Sonderarbeitsvertrag Testlauf',
|
||||
classification: 1,
|
||||
owner: { kind: 'personnel', personnelFileId: personalakteId },
|
||||
})
|
||||
documentNumber = created.documentNumber
|
||||
|
||||
// Das Präfix kommt aus der Vorlage, nicht aus dem Programm.
|
||||
expect(documentNumber).toMatch(/^SAV-\d{4}-\d{4}$/)
|
||||
})
|
||||
|
||||
it('ersetzt Platzhalter im festen Vertragstext aus den Eingabefeldern', async () => {
|
||||
await saveDocumentSection(leitung, {
|
||||
documentNumber,
|
||||
fieldKey: 'vertragspartner',
|
||||
value: 'Dr. Vogt',
|
||||
baseVersion: 0,
|
||||
})
|
||||
|
||||
const doc = await loadVisibleDocument(leitung, documentNumber)
|
||||
const sections = await loadDocumentSections(leitung, doc!)
|
||||
|
||||
const eingabe = sections.find((s) => s.fieldKey === 'vertragspartner')
|
||||
expect(eingabe?.visible && eingabe.value).toBe('Dr. Vogt')
|
||||
|
||||
// Der Textbaustein selbst bleibt roh; ersetzt wird beim Rendern, damit
|
||||
// eine spätere Korrektur des Namens überall durchschlägt.
|
||||
const praeambel = sections.find((s) => s.fieldKey === 'praeambel')
|
||||
expect(praeambel?.field.type).toBe('paragraph')
|
||||
expect((praeambel?.field as { text?: string }).text).toContain('{{vertragspartner}}')
|
||||
})
|
||||
|
||||
it('lässt einen Nutzer ohne Recht nichts daran ändern', async () => {
|
||||
await expect(
|
||||
saveDocumentSection(neuling, {
|
||||
documentNumber,
|
||||
fieldKey: 'taetigkeit',
|
||||
value: 'Fremdeingriff',
|
||||
baseVersion: 0,
|
||||
}),
|
||||
).rejects.toThrow(AccessError)
|
||||
})
|
||||
|
||||
it('macht aus dem Entwurf eine Ausfertigung und dann einen Grabstein', async () => {
|
||||
await finalizeDocument(leitung, documentNumber)
|
||||
const ausgefertigt = await loadVisibleDocument(leitung, documentNumber)
|
||||
expect(ausgefertigt?.status).toBe('FINAL')
|
||||
expect(ausgefertigt?.finalizedById).toBe(leitung.userId)
|
||||
|
||||
await retractDocument(leitung, documentNumber, 'Vertrag wurde nie unterzeichnet')
|
||||
const zurueckgezogen = await loadVisibleDocument(leitung, documentNumber)
|
||||
expect(zurueckgezogen?.status).toBe('RETRACTED')
|
||||
expect(zurueckgezogen?.retractionReason).toBe('Vertrag wurde nie unterzeichnet')
|
||||
|
||||
// Der Grabstein steht, das Dokument ist nicht verschwunden.
|
||||
expect(zurueckgezogen?.title).toBe('Sonderarbeitsvertrag Testlauf')
|
||||
|
||||
// Und er ist zu: auch die Leitung schreibt nicht mehr hinein.
|
||||
await expect(
|
||||
saveDocumentSection(leitung, {
|
||||
documentNumber,
|
||||
fieldKey: 'taetigkeit',
|
||||
value: 'Nachtrag',
|
||||
baseVersion: 0,
|
||||
}),
|
||||
).rejects.toThrow(AccessError)
|
||||
})
|
||||
|
||||
it('verlangt für die Zurücknahme eine Begründung', async () => {
|
||||
const zweiter = await createDocument(leitung, {
|
||||
templateKey: 'vermerk',
|
||||
classification: 1,
|
||||
owner: { kind: 'personnel', personnelFileId: personalakteId },
|
||||
})
|
||||
await expect(retractDocument(leitung, zweiter.documentNumber, 'kurz')).rejects.toThrow(
|
||||
AccessError,
|
||||
)
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,225 @@
|
||||
// @vitest-environment node
|
||||
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
||||
import { createPrismaClient, loadEnvFromRepoRoot, type PrismaClient } from '@afis/db'
|
||||
import { visibleDocumentWhere } from '@/lib/access/personnelFilter'
|
||||
import {
|
||||
canCreateDocument,
|
||||
canEditDocument,
|
||||
canRetractDocument,
|
||||
} from '@/lib/access/documentWrite'
|
||||
import type { EffectivePermissions, Permission } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Dokumente erben die Sichtbarkeit ihres Besitzers **und** haben eine eigene.
|
||||
* Beides muss zutreffen, sonst leckt entweder die Existenz der Akte oder der
|
||||
* Inhalt des Dokuments.
|
||||
*/
|
||||
loadEnvFromRepoRoot()
|
||||
const url = process.env.DIRECT_DATABASE_URL ?? process.env.DATABASE_URL
|
||||
const suite = url ? describe : describe.skip
|
||||
|
||||
let db: PrismaClient
|
||||
const marke = `dok-${Date.now()}`
|
||||
|
||||
function perms(
|
||||
userId: string,
|
||||
clearanceLevel: number,
|
||||
options: { isAdmin?: boolean; permissions?: Permission[] } = {},
|
||||
): EffectivePermissions {
|
||||
return {
|
||||
userId,
|
||||
clearanceLevel,
|
||||
permissions: new Set<Permission>(options.permissions ?? []),
|
||||
isAdmin: options.isAdmin ?? false,
|
||||
hasMembership: true,
|
||||
}
|
||||
}
|
||||
|
||||
suite('Sichtbarkeit von Dokumenten', () => {
|
||||
const nutzer = {
|
||||
stufe1: `${marke}-stufe1`,
|
||||
stufe4: `${marke}-stufe4`,
|
||||
beteiligt: `${marke}-beteiligt`,
|
||||
}
|
||||
const dok = {
|
||||
imOffenenFall: '',
|
||||
hochImOffenenFall: '',
|
||||
imGeheimenFall: '',
|
||||
anVerborgenerPerson: '',
|
||||
freistehend: '',
|
||||
}
|
||||
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
|
||||
const template = await db.documentTemplate.create({
|
||||
data: {
|
||||
key: `${marke}-vorlage`,
|
||||
version: 1,
|
||||
name: 'Prüfvorlage',
|
||||
fields: [],
|
||||
uses: ['CASE_DOCUMENT', 'PERSON_DOCUMENT', 'STANDALONE'],
|
||||
},
|
||||
})
|
||||
|
||||
for (const id of Object.values(nutzer)) {
|
||||
await db.user.create({ data: { id, username: id, displayName: id } })
|
||||
}
|
||||
|
||||
const gemeinsam = {
|
||||
templateId: template.id,
|
||||
templateKey: template.key,
|
||||
createdById: nutzer.stufe4,
|
||||
}
|
||||
|
||||
const offen = await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
caseNumber: `${marke}-offen`.slice(0, 40),
|
||||
title: 'Offen',
|
||||
classification: 1,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
const geheim = await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
caseNumber: `${marke}-geheim`.slice(0, 40),
|
||||
title: 'Geheim',
|
||||
classification: 4,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
await db.caseParticipant.create({
|
||||
data: { caseId: geheim.id, userId: nutzer.beteiligt, role: 'INVESTIGATOR' },
|
||||
})
|
||||
|
||||
const person = await db.personnelFile.create({
|
||||
data: { displayName: `${marke} Verborgen`, classification: 4 },
|
||||
})
|
||||
|
||||
const anlegen = async (
|
||||
nummer: string,
|
||||
classification: number,
|
||||
besitzer: { caseId?: string; personnelFileId?: string },
|
||||
) =>
|
||||
(
|
||||
await db.document.create({
|
||||
data: {
|
||||
documentNumber: `${marke}-${nummer}`,
|
||||
title: nummer,
|
||||
templateId: template.id,
|
||||
templateKey: template.key,
|
||||
templateVersion: 1,
|
||||
classification,
|
||||
createdById: nutzer.stufe4,
|
||||
...besitzer,
|
||||
},
|
||||
select: { id: true },
|
||||
})
|
||||
).id
|
||||
|
||||
dok.imOffenenFall = await anlegen('offen-niedrig', 1, { caseId: offen.id })
|
||||
dok.hochImOffenenFall = await anlegen('offen-hoch', 4, { caseId: offen.id })
|
||||
dok.imGeheimenFall = await anlegen('geheim', 1, { caseId: geheim.id })
|
||||
dok.anVerborgenerPerson = await anlegen('person', 1, { personnelFileId: person.id })
|
||||
dok.freistehend = await anlegen('frei', 1, {})
|
||||
})
|
||||
|
||||
afterAll(async () => {
|
||||
await db.$disconnect()
|
||||
})
|
||||
|
||||
async function sichtbar(p: EffectivePermissions): Promise<string[]> {
|
||||
const rows = await db.document.findMany({
|
||||
where: { AND: [visibleDocumentWhere(p), { id: { in: Object.values(dok) } }] },
|
||||
select: { id: true },
|
||||
})
|
||||
return rows.map((r) => r.id).sort()
|
||||
}
|
||||
|
||||
it('zeigt einer Stufe 1 nur, was Besitzer und Dokument zugleich erlauben', async () => {
|
||||
const p = perms(nutzer.stufe1, 1)
|
||||
const treffer = await sichtbar(p)
|
||||
|
||||
expect(treffer).toContain(dok.imOffenenFall)
|
||||
expect(treffer).toContain(dok.freistehend)
|
||||
|
||||
// Das Dokument ist zu hoch eingestuft, obwohl die Akte offen liegt.
|
||||
expect(treffer).not.toContain(dok.hochImOffenenFall)
|
||||
// Das Dokument wäre lesbar, aber die Akte darüber nicht — die
|
||||
// Dokumentenliste verriete sonst ihre Existenz.
|
||||
expect(treffer).not.toContain(dok.imGeheimenFall)
|
||||
expect(treffer).not.toContain(dok.anVerborgenerPerson)
|
||||
|
||||
const anzahl = await db.document.count({
|
||||
where: { AND: [visibleDocumentWhere(p), { id: { in: Object.values(dok) } }] },
|
||||
})
|
||||
expect(anzahl).toBe(treffer.length)
|
||||
})
|
||||
|
||||
it('lässt einen Beteiligten die Dokumente seiner Akte lesen', async () => {
|
||||
// Ausnahmsweiser Zugang gilt auch für die Dokumente der Akte, sonst wäre
|
||||
// das Hinzuziehen wirkungslos. Siehe docs/03-auth-und-rechte.md.
|
||||
const treffer = await sichtbar(perms(nutzer.beteiligt, 1))
|
||||
expect(treffer).toContain(dok.imGeheimenFall)
|
||||
// Er bleibt aber ein Stufe-1-Nutzer: an fremden Personalakten ändert das nichts.
|
||||
expect(treffer).not.toContain(dok.anVerborgenerPerson)
|
||||
})
|
||||
|
||||
it('zeigt der Stufe 4 alles', async () => {
|
||||
expect(await sichtbar(perms(nutzer.stufe4, 4))).toHaveLength(Object.values(dok).length)
|
||||
})
|
||||
})
|
||||
|
||||
describe('Schreibgrenzen für Dokumente', () => {
|
||||
const alle: Permission[] = [
|
||||
'document.create',
|
||||
'document.edit',
|
||||
'document.finalize',
|
||||
'document.retract',
|
||||
]
|
||||
|
||||
it('lässt niemanden ein Dokument über der eigenen Stufe anlegen', () => {
|
||||
const p = perms('a', 2, { permissions: alle })
|
||||
expect(canCreateDocument(p, 2).ok).toBe(true)
|
||||
expect(canCreateDocument(p, 3)).toEqual({
|
||||
ok: false,
|
||||
reason: 'clearance-too-low',
|
||||
required: 3,
|
||||
})
|
||||
})
|
||||
|
||||
it('verlangt für das Ändern eines ausgefertigten Dokuments das Ausfertigungsrecht', () => {
|
||||
const nurEdit = perms('b', 5, { permissions: ['document.edit'] })
|
||||
expect(canEditDocument(nurEdit, { status: 'DRAFT', classification: 1 }).ok).toBe(true)
|
||||
expect(canEditDocument(nurEdit, { status: 'FINAL', classification: 1 })).toEqual({
|
||||
ok: false,
|
||||
reason: 'closed',
|
||||
})
|
||||
|
||||
const mitFinalize = perms('c', 5, { permissions: ['document.edit', 'document.finalize'] })
|
||||
expect(canEditDocument(mitFinalize, { status: 'FINAL', classification: 1 }).ok).toBe(true)
|
||||
})
|
||||
|
||||
it('hält ein zurückgezogenes Dokument auch für den Admin geschlossen', () => {
|
||||
// Der Grabstein bleibt stehen, wie er ist. Sonst liesse sich ein
|
||||
// zurückgezogenes Dokument nachträglich zu etwas anderem machen.
|
||||
const admin = perms('d', 5, { isAdmin: true })
|
||||
expect(canEditDocument(admin, { status: 'RETRACTED', classification: 1 })).toEqual({
|
||||
ok: false,
|
||||
reason: 'read-only',
|
||||
status: 'RETRACTED',
|
||||
})
|
||||
expect(canRetractDocument(admin, { status: 'RETRACTED', classification: 1 }).ok).toBe(false)
|
||||
})
|
||||
|
||||
it('verlangt für das Zurückziehen ein eigenes Recht', () => {
|
||||
const ohne = perms('e', 5, { permissions: ['document.edit'] })
|
||||
expect(canRetractDocument(ohne, { status: 'FINAL', classification: 1 })).toEqual({
|
||||
ok: false,
|
||||
reason: 'no-permission',
|
||||
permission: 'document.retract',
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -33,7 +33,7 @@ let caseNumber = ''
|
||||
suite('Nachträgliche Änderungen am Verlauf', () => {
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
await db.caseTemplate.create({
|
||||
await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: [] },
|
||||
})
|
||||
for (const id of [AUTOR, FREMD]) {
|
||||
|
||||
@@ -69,9 +69,11 @@ describe('Rechte-Enum', () => {
|
||||
}
|
||||
})
|
||||
|
||||
it('haelt drei davon im Auslieferungszustand zurueck', () => {
|
||||
it('haelt die nachtraeglichen Eingriffe im Auslieferungszustand zurueck', () => {
|
||||
// Der Leiter schaltet sie bewusst frei, siehe docs/03-auth-und-rechte.md.
|
||||
// Gemeinsames Merkmal: sie greifen in bereits Geschriebenes ein.
|
||||
expect([...OPT_IN_PERMISSIONS].sort()).toEqual([
|
||||
'document.retract',
|
||||
'entry.edit_any',
|
||||
'entry.edit_own',
|
||||
'entry.retract',
|
||||
|
||||
@@ -0,0 +1,175 @@
|
||||
// @vitest-environment node
|
||||
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
||||
import { createPrismaClient, loadEnvFromRepoRoot, type PrismaClient } from '@afis/db'
|
||||
import { visiblePersonnelWhere } from '@/lib/access/personnelFilter'
|
||||
import { loadBacklinks } from '@/lib/personnel/service'
|
||||
import type { EffectivePermissions, Permission } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Rückverweise sind der häufigste Ort, an dem ein Aktensystem leckt.
|
||||
*
|
||||
* Eine Personalakte der Stufe 1, auf der „3 Fälle" steht, verrät die Existenz
|
||||
* von Ermittlungen, die der Leser nicht sehen darf — auch dann, wenn kein
|
||||
* Titel danebensteht. Deshalb prüft dieser Test nicht nur die Liste, sondern
|
||||
* ausdrücklich auch die **Zahl**. Siehe docs/05-akten-und-vorlagen.md.
|
||||
*/
|
||||
loadEnvFromRepoRoot()
|
||||
const url = process.env.DIRECT_DATABASE_URL ?? process.env.DATABASE_URL
|
||||
const suite = url ? describe : describe.skip
|
||||
|
||||
let db: PrismaClient
|
||||
const marke = `personal-${Date.now()}`
|
||||
|
||||
function perms(
|
||||
userId: string,
|
||||
clearanceLevel: number,
|
||||
options: { isAdmin?: boolean; permissions?: Permission[] } = {},
|
||||
): EffectivePermissions {
|
||||
return {
|
||||
userId,
|
||||
clearanceLevel,
|
||||
permissions: new Set<Permission>(options.permissions ?? []),
|
||||
isAdmin: options.isAdmin ?? false,
|
||||
hasMembership: true,
|
||||
}
|
||||
}
|
||||
|
||||
suite('Personalakten und Rückverweise', () => {
|
||||
const nutzer = {
|
||||
stufe1: `${marke}-stufe1`,
|
||||
stufe3: `${marke}-stufe3`,
|
||||
betroffen: `${marke}-betroffen`,
|
||||
}
|
||||
const akten = {
|
||||
offen: `${marke}-fall-offen`,
|
||||
geheim: `${marke}-fall-geheim`,
|
||||
}
|
||||
let personalakteId = ''
|
||||
let hoheAkteId = ''
|
||||
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
|
||||
const template = await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: [] },
|
||||
})
|
||||
|
||||
for (const id of Object.values(nutzer)) {
|
||||
await db.user.create({ data: { id, username: id, displayName: id } })
|
||||
}
|
||||
|
||||
const person = await db.personnelFile.create({
|
||||
data: {
|
||||
displayName: `${marke} Betroffener`,
|
||||
userId: nutzer.betroffen,
|
||||
classification: 1,
|
||||
createdById: nutzer.stufe3,
|
||||
},
|
||||
})
|
||||
personalakteId = person.id
|
||||
|
||||
const verborgen = await db.personnelFile.create({
|
||||
data: { displayName: `${marke} Verborgen`, classification: 4, createdById: nutzer.stufe3 },
|
||||
})
|
||||
hoheAkteId = verborgen.id
|
||||
|
||||
const gemeinsam = {
|
||||
templateId: template.id,
|
||||
templateKey: template.key,
|
||||
createdById: nutzer.stufe3,
|
||||
}
|
||||
|
||||
await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
id: akten.offen,
|
||||
caseNumber: `${marke}-1`.slice(0, 40),
|
||||
title: 'Für alle sichtbar',
|
||||
classification: 1,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
|
||||
await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
id: akten.geheim,
|
||||
caseNumber: `${marke}-2`.slice(0, 40),
|
||||
title: 'Nur ab Stufe 3',
|
||||
classification: 3,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
|
||||
// Dieselbe Person, einmal über die Personalakte, einmal über das Konto.
|
||||
await db.caseParticipant.createMany({
|
||||
data: [
|
||||
{ caseId: akten.offen, personnelFileId: person.id, role: 'WITNESS' },
|
||||
{ caseId: akten.geheim, personnelFileId: person.id, role: 'SUBJECT' },
|
||||
{ caseId: akten.geheim, userId: nutzer.betroffen, role: 'WITNESS' },
|
||||
],
|
||||
})
|
||||
})
|
||||
|
||||
afterAll(async () => {
|
||||
await db.$disconnect()
|
||||
})
|
||||
|
||||
it('zeigt einer Stufe 1 auf der Personalakte keinen Hinweis auf den Stufe-3-Fall', async () => {
|
||||
const { total, byRole } = await loadBacklinks(perms(nutzer.stufe1, 1), {
|
||||
id: personalakteId,
|
||||
userId: nutzer.betroffen,
|
||||
})
|
||||
|
||||
const nummern = byRole.flatMap((gruppe) => gruppe.eintraege.map((e) => e.case.id))
|
||||
expect(nummern).toContain(akten.offen)
|
||||
expect(nummern).not.toContain(akten.geheim)
|
||||
|
||||
// Die Zahl ist selbst eine Information: sie darf den verborgenen Fall
|
||||
// nicht mitzählen, auch nicht als anonymen Platzhalter.
|
||||
expect(total).toBe(1)
|
||||
|
||||
// Und die Rolle taucht gar nicht erst auf, sonst verriete "Betroffener"
|
||||
// die Existenz einer Ermittlung gegen die Person.
|
||||
expect(byRole.map((gruppe) => gruppe.role)).not.toContain('SUBJECT')
|
||||
})
|
||||
|
||||
it('zeigt einer Stufe 3 beide Fälle und beide Wege zur Person', async () => {
|
||||
const { total, byRole } = await loadBacklinks(perms(nutzer.stufe3, 3), {
|
||||
id: personalakteId,
|
||||
userId: nutzer.betroffen,
|
||||
})
|
||||
|
||||
const rollen = byRole.map((gruppe) => gruppe.role).sort()
|
||||
expect(rollen).toEqual(['SUBJECT', 'WITNESS'])
|
||||
// Drei Einträge: einer über die Personalakte im offenen Fall, zwei im
|
||||
// geheimen — über die Personalakte und über das Discord-Konto.
|
||||
expect(total).toBe(3)
|
||||
})
|
||||
|
||||
it('verbirgt eine Personalakte oberhalb der Stufe, auch in der Zählung', async () => {
|
||||
const p = perms(nutzer.stufe1, 1)
|
||||
const wo = {
|
||||
AND: [visiblePersonnelWhere(p), { id: { in: [personalakteId, hoheAkteId] } }],
|
||||
}
|
||||
|
||||
const treffer = await db.personnelFile.findMany({ where: wo, select: { id: true } })
|
||||
const anzahl = await db.personnelFile.count({ where: wo })
|
||||
|
||||
expect(treffer.map((t) => t.id)).toEqual([personalakteId])
|
||||
expect(anzahl).toBe(1)
|
||||
})
|
||||
|
||||
it('gibt dem Admin die verborgene Personalakte', async () => {
|
||||
const treffer = await db.personnelFile.findMany({
|
||||
where: {
|
||||
AND: [
|
||||
visiblePersonnelWhere(perms(nutzer.stufe1, 1, { isAdmin: true })),
|
||||
{ id: hoheAkteId },
|
||||
],
|
||||
},
|
||||
select: { id: true },
|
||||
})
|
||||
expect(treffer).toHaveLength(1)
|
||||
})
|
||||
})
|
||||
@@ -34,7 +34,7 @@ const VOLL: Permission[] = ['case.create', 'case.edit', 'case.close', 'case.reop
|
||||
suite('Schreibgrenzen der Freigabestufe', () => {
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
await db.caseTemplate.create({
|
||||
await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: [] },
|
||||
})
|
||||
for (const level of [1, 2, 4, 5]) {
|
||||
@@ -93,7 +93,7 @@ suite('Schreibgrenzen der Freigabestufe', () => {
|
||||
// Die Abteilung nutzt gewachsene Präfixe wie AKT-PA neben dem AfiS aus dem
|
||||
// Glossar. Zwei Fallarten dürfen sich dabei nicht in die Quere kommen.
|
||||
const { createCase } = await import('@/lib/cases/service')
|
||||
await db.caseTemplate.create({
|
||||
await db.documentTemplate.create({
|
||||
data: {
|
||||
key: `${marke}-personal`,
|
||||
version: 1,
|
||||
@@ -119,9 +119,9 @@ suite('Schreibgrenzen der Freigabestufe', () => {
|
||||
expect(ersteA.caseNumber).toMatch(new RegExp(`^AKT-PA-${jahr}-\\d{5}$`))
|
||||
expect(zweiteA.caseNumber).toMatch(new RegExp(`^AKT-PA-${jahr}-\\d{5}$`))
|
||||
|
||||
const { parseCaseNumber } = await import('@/lib/cases/caseNumber')
|
||||
const eins = parseCaseNumber(ersteA.caseNumber)
|
||||
const zwei = parseCaseNumber(zweiteA.caseNumber)
|
||||
const { parseNumber } = await import('@/lib/numbering')
|
||||
const eins = parseNumber(ersteA.caseNumber)
|
||||
const zwei = parseNumber(zweiteA.caseNumber)
|
||||
expect(eins?.prefix).toBe('AKT-PA')
|
||||
expect(zwei!.number).toBe(eins!.number + 1)
|
||||
|
||||
@@ -131,7 +131,7 @@ suite('Schreibgrenzen der Freigabestufe', () => {
|
||||
classification: 1,
|
||||
templateKey: `${marke}-vorlage`,
|
||||
})
|
||||
expect(parseCaseNumber(afis.caseNumber)?.prefix).toBe('AfiS')
|
||||
expect(parseNumber(afis.caseNumber)?.prefix).toBe('AfiS')
|
||||
})
|
||||
|
||||
it('gibt einer zu niedrigen Stufe nicht einmal die Existenz preis', async () => {
|
||||
|
||||
@@ -0,0 +1,158 @@
|
||||
// @vitest-environment node
|
||||
import { afterAll, beforeAll, describe, expect, it } from 'vitest'
|
||||
import { createPrismaClient, loadEnvFromRepoRoot, type PrismaClient } from '@afis/db'
|
||||
import { listLinks } from '@/lib/cases/links'
|
||||
import { listParticipants } from '@/lib/cases/participants'
|
||||
import { visibleCaseWhere } from '@/lib/access/caseFilter'
|
||||
import type { EffectivePermissions, Permission } from '@/lib/auth/permissions'
|
||||
|
||||
/**
|
||||
* Verknüpfungen zeigen in beide Richtungen. Eine Akte, die der Leser nicht
|
||||
* sehen darf, darf auch von der Gegenseite aus nicht auftauchen — sonst
|
||||
* verrät die verknüpfte Akte ihre Existenz.
|
||||
*/
|
||||
loadEnvFromRepoRoot()
|
||||
const url = process.env.DIRECT_DATABASE_URL ?? process.env.DATABASE_URL
|
||||
const suite = url ? describe : describe.skip
|
||||
|
||||
let db: PrismaClient
|
||||
const marke = `link-${Date.now()}`
|
||||
|
||||
function perms(userId: string, clearanceLevel: number): EffectivePermissions {
|
||||
return {
|
||||
userId,
|
||||
clearanceLevel,
|
||||
permissions: new Set<Permission>(),
|
||||
isAdmin: false,
|
||||
hasMembership: true,
|
||||
}
|
||||
}
|
||||
|
||||
suite('Verknüpfungen zwischen Akten', () => {
|
||||
const nutzer = { stufe1: `${marke}-stufe1`, stufe4: `${marke}-stufe4` }
|
||||
let offenId = ''
|
||||
let geheimId = ''
|
||||
let zweitOffenId = ''
|
||||
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
|
||||
const template = await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: [] },
|
||||
})
|
||||
for (const id of Object.values(nutzer)) {
|
||||
await db.user.create({ data: { id, username: id, displayName: id } })
|
||||
}
|
||||
|
||||
const gemeinsam = {
|
||||
templateId: template.id,
|
||||
templateKey: template.key,
|
||||
createdById: nutzer.stufe4,
|
||||
}
|
||||
|
||||
const offen = await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
caseNumber: `${marke}-a`.slice(0, 40),
|
||||
title: 'Offen',
|
||||
classification: 1,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
const geheim = await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
caseNumber: `${marke}-b`.slice(0, 40),
|
||||
title: 'Geheim',
|
||||
classification: 4,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
const zweitOffen = await db.case.create({
|
||||
data: {
|
||||
...gemeinsam,
|
||||
caseNumber: `${marke}-c`.slice(0, 40),
|
||||
title: 'Auch offen',
|
||||
classification: 1,
|
||||
status: 'OPEN',
|
||||
},
|
||||
})
|
||||
offenId = offen.id
|
||||
geheimId = geheim.id
|
||||
zweitOffenId = zweitOffen.id
|
||||
|
||||
await db.caseLink.createMany({
|
||||
data: [
|
||||
// Hinaus: offen -> geheim
|
||||
{ fromId: offen.id, toId: geheim.id, kind: 'RELATED', createdById: nutzer.stufe4 },
|
||||
// Herein: geheim -> offen, dieselbe Falle aus der anderen Richtung
|
||||
{ fromId: geheim.id, toId: offen.id, kind: 'SUCCESSOR', createdById: nutzer.stufe4 },
|
||||
// Unverfänglich
|
||||
{ fromId: offen.id, toId: zweitOffen.id, kind: 'RELATED', createdById: nutzer.stufe4 },
|
||||
],
|
||||
})
|
||||
})
|
||||
|
||||
afterAll(async () => {
|
||||
await db.$disconnect()
|
||||
})
|
||||
|
||||
it('verbirgt eine zu hoch eingestufte Akte in beiden Richtungen', async () => {
|
||||
const links = await listLinks(perms(nutzer.stufe1, 1), offenId)
|
||||
const ziele = links.map((link) => link.other.id)
|
||||
|
||||
expect(ziele).toContain(zweitOffenId)
|
||||
expect(ziele).not.toContain(geheimId)
|
||||
// Auch die eingehende Verknüpfung darf nicht als leerer Platzhalter stehen.
|
||||
expect(links).toHaveLength(1)
|
||||
})
|
||||
|
||||
it('zeigt der Stufe 4 beide Richtungen mit ihrer jeweiligen Bedeutung', async () => {
|
||||
const links = await listLinks(perms(nutzer.stufe4, 4), offenId)
|
||||
const richtungen = links
|
||||
.filter((link) => link.other.id === geheimId)
|
||||
.map((link) => `${link.direction}:${link.kind}`)
|
||||
.sort()
|
||||
|
||||
expect(richtungen).toEqual(['in:SUCCESSOR', 'out:RELATED'])
|
||||
})
|
||||
|
||||
it('nennt den Namen eines Beteiligten, verweist aber nur auf sichtbare Personalakten', async () => {
|
||||
const verborgen = await db.personnelFile.create({
|
||||
data: { displayName: `${marke} Verborgene Person`, classification: 4 },
|
||||
})
|
||||
await db.caseParticipant.create({
|
||||
data: { caseId: offenId, personnelFileId: verborgen.id, role: 'SUBJECT' },
|
||||
})
|
||||
|
||||
const beteiligte = await listParticipants(perms(nutzer.stufe1, 1), offenId)
|
||||
const eintrag = beteiligte.find((b) => b.displayName?.includes('Verborgene Person'))
|
||||
|
||||
// Wer die Ermittlung lesen darf, muss wissen, gegen wen sie läuft.
|
||||
expect(eintrag).toBeDefined()
|
||||
// Was darüber hinaus über die Person aktenkundig ist, bleibt zu.
|
||||
expect(eintrag?.personnelFileId).toBeNull()
|
||||
|
||||
const fuerStufe4 = await listParticipants(perms(nutzer.stufe4, 4), offenId)
|
||||
expect(
|
||||
fuerStufe4.find((b) => b.displayName?.includes('Verborgene Person'))?.personnelFileId,
|
||||
).toBe(verborgen.id)
|
||||
})
|
||||
|
||||
it('gibt einem Beteiligten Zugriff auf die Akte über seiner Stufe', async () => {
|
||||
await db.caseParticipant.create({
|
||||
data: { caseId: geheimId, userId: nutzer.stufe1, role: 'WITNESS' },
|
||||
})
|
||||
|
||||
const p = perms(nutzer.stufe1, 1)
|
||||
const treffer = await db.case.findMany({
|
||||
where: { AND: [visibleCaseWhere(p), { id: geheimId }] },
|
||||
select: { id: true },
|
||||
})
|
||||
expect(treffer).toHaveLength(1)
|
||||
|
||||
// Und damit auch auf die Verknüpfung, die vorher verborgen war.
|
||||
const links = await listLinks(p, offenId)
|
||||
expect(links.map((link) => link.other.id)).toContain(geheimId)
|
||||
})
|
||||
})
|
||||
@@ -49,7 +49,7 @@ suite('Sichtbarkeit von Akten', () => {
|
||||
beforeAll(async () => {
|
||||
db = createPrismaClient(url)
|
||||
|
||||
const template = await db.caseTemplate.create({
|
||||
const template = await db.documentTemplate.create({
|
||||
data: { key: `${marke}-vorlage`, version: 1, name: 'Prüfvorlage', fields: [] },
|
||||
})
|
||||
|
||||
|
||||
Reference in New Issue
Block a user