diff --git a/decisoes-front.md b/decisoes-front.md deleted file mode 100644 index 1ad6215..0000000 --- a/decisoes-front.md +++ /dev/null @@ -1,50 +0,0 @@ -# US-12.2 - Access the console and view scoped content navigation - -## Problema - -O manager logava no console mas nao via os itens de navegacao de conteudo (Organizations, Projects, Languages, Phases, Map) na sidebar. Alem disso, quando o scoping nao existia no backend, qualquer usuario autenticado via todos os dados do sistema. - -## Decisoes - -1. **Nenhuma alteracao de codigo no frontend**: A sidebar ja implementa a logica `(isPlatformAdmin || isManager)` para exibir os itens de conteudo (implementado na US-12.1). O `AuthContext` ja expoe `isManager`, `managedOrgIds` e `managedOrgId`. Nenhum arquivo frontend foi modificado. - -2. **Scoping delegado ao backend**: As paginas de listagem (`OrganizationsPage`, `LanguagesPage`, `PhasesPage`, `ProjectsPage`, `MapPage`) chamam os endpoints de listagem sem filtros. O backend (US-11.6) aplica o scoping automaticamente baseado no role do usuario. O frontend renderiza o que a API retorna. - -3. **Empty states ja existentes**: Todas as paginas de listagem ja possuem tratamento de empty state. Quando o backend retorna arrays vazios (usuario sem organizacoes), o frontend exibe a mensagem adequada sem necessidade de alteracao. - -4. **Problema original era de dados, nao de codigo**: O usuario `manager3@test.com` estava cadastrado na organizacao com `role: "member"` ao inves de `role: "manager"`. Apos a promocao via `PATCH /api/organizations/{org_id}/members/{user_id}` (US-11.3), o endpoint `my-managed-orgs` retornou os dados corretos e a sidebar passou a exibir os itens de conteudo. - -## Solucao Implementada - -### Frontend - -Nenhum arquivo modificado. A implementacao existente (US-12.1) ja cobre todos os criterios de aceitacao: - -- `src/contexts/AuthContext.tsx`: Expoe `isManager`, `managedOrgIds`, `managedOrgId`. -- `src/components/layout/Sidebar.tsx`: Condicional `(isPlatformAdmin || isManager)` para content nav items. `isPlatformAdmin` para admin nav items. -- `src/App.tsx`: `AdminRoute` wrapper para rotas de Users e Manage Apps. - -### Backend - -Todo o scoping foi implementado na US-11.6 (ver `decisoes-back.md`). - -## Verificacao - -| Criterio | Status | -|---|---| -| Managers veem Organizations, Projects, Languages, Phases, Map | PASS | -| Dados sao escopados para as organizacoes gerenciadas | PASS (backend US-11.6) | -| Users e Manage Apps ficam ocultos para managers | PASS | -| Sidebar reflete o role do usuario | PASS | -| Manager sem organizacao ve secoes vazias | PASS | - -## Commits - -Nenhum commit de frontend necessario para esta US. O scoping e inteiramente resolvido no backend (US-11.6). - -A unica alteracao documental foi: - -### `docs(us): update US-12.2 with full scoping requirements` - -Arquivos: -- `context/US-FRONT-BACK-ENGLISH.md` diff --git a/pr-us-12-5.md b/pr-us-12-5.md deleted file mode 100644 index 91d0ddf..0000000 --- a/pr-us-12-5.md +++ /dev/null @@ -1,27 +0,0 @@ -# [US-12.5 / OBT-234] Remove the Organizations section from the console - -## Summary -The 2026-07 rule change removes organizations from the console (role management moved to the project Access tab). This deletes the Organizations sidebar item, routes and page components so organizations are neither used nor reachable in the console. `orgsAPI` is kept because it is still used by the project Access tab and the admin dashboard. - -## Changes - -### 1. Remove the Organizations navigation entry -`src/components/layout/Sidebar.tsx` — drop the `Organizations` item from `contentNavItems` and its now-unused `Building2` icon import. - -### 2. Remove the routes and page imports -`src/App.tsx` — remove the `/app/organizations` and `/app/organizations/:orgId` routes and the `OrganizationsPage` / `OrganizationDetailPage` imports. Unknown organization paths now fall through to the existing NotFound (404) page. - -### 3. Delete the page components -Delete `src/components/pages/OrganizationsPage.tsx` and `src/components/pages/OrganizationDetailPage.tsx` (deletion, not commented out). - -### 4. Keep orgsAPI -`src/services/api.ts` `orgsAPI` is left intact — still used by `ProjectAccessTab.tsx` (grant-organization dropdown) and `dashboard/AdminDashboard.tsx` (org count). - -## Type of Change -- [x] Refactor (removal of a section) -- [x] Behavior change (Organizations is no longer reachable in the console) - -## Testing -- `npm run typecheck`, `npm run lint`, `npm run build` — pass, no dead imports. -- Navigating to `/app/organizations` resolves to the 404 page. -- The project Access tab and admin dashboard still load (they keep using `orgsAPI`). diff --git a/pr-us-12-6.md b/pr-us-12-6.md deleted file mode 100644 index 1dca1f3..0000000 --- a/pr-us-12-6.md +++ /dev/null @@ -1,24 +0,0 @@ -# [US-12.6 / OBT-235] Deny console access to users who are neither platform admin nor manager - -## Summary -`AppShell` only redirected unauthenticated users, so any authenticated user (including plain members) could load the console. This gates the whole `/app` subtree so only platform admins and managers reach console content; everyone else sees an Access Denied page. Backend counterpart: US-11.8. - -## Changes - -### 1. Gate the console shell -`src/components/layout/AppShell.tsx` — after the authentication check, deny users where `!isPlatformAdmin && !isManager` by rendering the Access Denied page instead of the shell. `isLoading` and the unauthenticated `/login` redirect are unchanged. - -### 2. Add a logout variant to the Access Denied page -`src/components/pages/AccessDeniedPage.tsx` — new `variant="logout"` that offers a Sign out action instead of the "Go to Dashboard" link, so a fully denied user is not looped back into the gated shell. - -## Type of Change -- [x] Feature (route/shell-level access control) -- [x] Behavior change (plain members can no longer load the console) - -## Testing -- `npm run typecheck` and `npm run build` — pass. -- Log in as a plain member (no admin, no managed org/project) — the console shows Access Denied with a Sign out action. -- Platform admins and managers load the console normally. -- Unauthenticated users are still redirected to `/login`. - -> Note: consumes `isManager` from `AuthContext`. Combined with US-12.9 (project-based `isManager`), a project-only manager is correctly allowed. diff --git a/pr-us-12-8.md b/pr-us-12-8.md deleted file mode 100644 index 44194cb..0000000 --- a/pr-us-12-8.md +++ /dev/null @@ -1,19 +0,0 @@ -# [US-12.8 / OBT-238] Restrict project Access role changes to platform admins - -## Summary -On the project Access tab, the per-user Role selector was interactive for everyone. This makes it editable only by platform admins; other users (including managers) see the role as read-only text. The backend is the source of truth (US-11.9). - -## Changes - -### 1. Gate the role selector on platform admin -`src/components/pages/ProjectAccessTab.tsx` — `ProjectAccessTab` reads `isPlatformAdmin` from `useAuth()` and passes it to `UserAccessSection`. The per-user Role `