David/mega-plant
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
mega-plant/docs/verification/settings-users.md
Dave 2594dead84 feat: add user access and improve plant dashboard 
Add PocketBase login, first-sign-in password changes, account settings,
and user activation, reactivation and deletion with self-removal guards.
Protect application pages and APIs and keep private pages out of PWA
caches.

Resolve plant locations from site assignments and improve map controls,
profit chart views, navigation and mobile table layouts.

Validation: production build and TypeScript passed; 28 unit tests passed.
Backend access integration tests and mobile verification are documented.
2026-10-06 04:02:08 +02:00

2.8 KiB
Raw Blame History

Header and user management verification — 2026-10-05

Settings moved from the sidebar into the top-right account disclosure. Header controls now align right, the brand subtitle describes the whole app, and phones group theme/sign-out under the account control to leave space for Search.

Settings lists all regular PocketBase users, their name/email, active/inactive status and first-sign-in state. Authenticated users have equal management access. Inactivate/reactivate retains passwords and onboarding state. Deleting a user requires a UI confirmation. Server actions and service helpers reject self-disable/delete. Successful creation and management actions refresh Settings.

The private user_onboarding.disabled boolean was added to the configured PocketBase using the idempotent setup script. Existing human users were preserved. Inactive users fail app login and existing app sessions fail validation on their next request. Direct PocketBase endpoint rules remain deferred as agreed; this status controls application access.

Checks

  • npm run typecheck: passed.
  • npm test: 28 passed; 4 backend integration tests skipped in the default run, plus 2 existing PDF tests skipped because source PDFs are absent.
  • Disposable PocketBase integration run: all 4 passed. Covered pending-user inactivity, completed-user inactivity, existing token rejection, reactivation/password retention, deletion/token rejection/private-state cascade, and self-management rejection. Test users removed.
  • npm run build: passed, including TypeScript and production route generation.
  • Scoped code review: no actionable findings.
  • 18 dashboard routes at 375×812 and 768×1024: all 36 passed overflow, minimum text and tap target checks. Wide tables remained contained with sticky first columns, touch scrolling and visible affordances. Plant Register received the missing edge fade during verification.
  • Settings navigation through the account disclosure worked. Escape closed the disclosure and returned focus to its trigger.
  • Phone delete confirmation measured 343px wide, within the 375px viewport; both buttons measured 44px tall. Cancel closed it without changing the human user. UI deletion/inactivity of human accounts was not exercised.
  • Temporary viewport/device overrides cleared; browser left on Settings at its original dimensions.

Metrics: settings-users-mobile.json. Every dashboard route has screenshots at both sizes in /tmp/mega-header-review; final desktop preview is settings-preview.jpg and the phone confirmation is delete-confirmation-375.jpg.

Two minor final UI changes renamed the table heading to “Users” and prevented an earlier unrelated action error from appearing in a newly opened delete confirmation. The final build and desktop preview include these changes; the mobile dimensions and controls are unchanged.