Add nullable Request.purchaseOrderId FK (demand-side PO
traceability) — closes out Lane A (Vendor -> License.vendorId ->
PurchaseOrder -> purchaseOrderId x3). Verified green by test-runner
(143/143 tests, tsc/lint/build clean) before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Add nullable License.purchaseOrderId FK (supply-side PO
traceability). Verified green by test-runner (139/139 tests,
tsc/lint/build clean) before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Nullable FK from License to PurchaseOrder for supply-side traceability
(which PO a license came in through), mirroring AssetItem.purchaseOrderId's
just-merged pattern exactly. Separate commit from the earlier
License.vendorId retrofit per the project's 1-commit-per-business-change
convention.
Add nullable AssetItem.purchaseOrderId FK (supply-side PO
traceability). Verified green by test-runner (131/131 tests,
tsc/lint/build clean) before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
PurchaseOrder entity: Prisma model+migration, Zod+CRUD (P2003 on both
vendorId/receivedById, receivedAt/receivedById co-nullability
refine), API routes, tests. Verified green by test-runner (127/127
tests, tsc/lint/build clean) before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Retrofit License.vendor (string) -> vendorId (FK to Vendor),
createLicense() now returns {ok,error} pattern. Verified green by
test-runner (97/97 tests, tsc/lint/build clean) before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
License.vendor (free-text string) is now vendorId, a required FK to
Vendor, per docs/asset-license-management.md's "## Vendor (chốt
2026-08-02)" spec. Mirrors the Request.employeeId string->FK precedent:
Zod validates UUID format only, Prisma's own FK constraint (P2003) is
caught at insert time and translated into a clean 400 instead of a raw
500. No License data existed yet, so this is a pure column-type
migration, no backfill needed.
Also converts createLicense() to the {ok,value}|{ok,error} result
pattern used elsewhere (createRequest, createAssetItem) instead of
returning a bare LicenseRecord promise - closes the gap flagged in
CLAUDE.md now that License has its first FK-violation error case to
handle.
Vendor entity: Prisma model+migration, Zod+CRUD, API routes, tests.
Verified green by test-runner (94/94 tests, tsc/lint/build clean)
before merge.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Stakeholder decided: createAssignment() blocks if AssetItem.status
isn't in_stock, and update routes use PATCH /api/<entity>/[id]
(applies to both Assignment and PurchaseOrder).
Co-Authored-By: Claude Sonnet 5 <[email protected]>
BA formalizes the Vendor, PurchaseOrder (absorbs Receipt), Assignment,
and AssetCategoryAttributeDef designs decided in stakeholder brainstorm
into docs/asset-license-management.md. PM sequences the resulting work
into dependency-ordered, commit-mapped tasks across 3 independent lanes
in CLAUDE.md, surfacing that AssetCategory/AssetModel/ConsumableItem
were spec'd earlier but never actually built, and flagging two open
questions (Assignment precondition on AssetItem.status; REST shape for
update operations) that need stakeholder input before Lane C starts.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
AssetCategory/AssetModel hierarchy, ConsumableItem for low-value/
consumable items, data constraints, and open questions for the
consumable request flow — decisions already confirmed with
stakeholder, spec was written but not yet committed.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
AssetCategory/AssetModel hierarchy, ConsumableItem for low-value/
consumable items, data constraints, and open questions for the
consumable request flow — decisions already confirmed with
stakeholder, spec was written but not yet committed.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
pm now asks ba back when a spec gap could change business behavior,
instead of guessing; task lists must also map cleanly onto the
existing per-commit convention (model+migration/lib/API/tests).
Stakeholder should only need to state a business goal/priority, not
pick between implementation options or break work into tasks
themselves. `ba` turns a business ask into a concrete spec grounded in
docs/asset-license-management.md, `pm` breaks that spec into an
ordered, dependency-aware sequence of feature-implementer-sized tasks.
Neither writes code or resolves business-rule ambiguity — that stays
with the stakeholder.
Also fixes code-reviewer.md/feature-implementer.md pointing at the old
../processes/asset-license-management.md path — the doc moved into
docs/ inside this repo a while ago.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
Adds a production Docker image (node:20-alpine) and an `app` service in
docker-compose.yml so the Next.js app can run as a long-lived container
instead of just build/test in ephemeral containers. Requires `apk add
openssl` before `npm ci`, otherwise Prisma silently picks the wrong query
engine binary on Alpine and only fails at runtime. Also wires
AUTH_TRUST_HOST=true, required by Auth.js when running behind the NPM
reverse proxy.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
- Trang thai hien tai: Employee entity done (model, lib, API route,
tests), Request.employee_id now a real FK to Employee - documents
the intentional behavior change (employee_id must now be a valid
UUID referencing a real Employee, not free text; non-existent
references get a 400, not a 500). Also documents the vitest
fileParallelism fix and the resulting 31/31 test count.
- Viec con do: remove Employee from the remaining-entities list.
Each test file gets its own throwaway Postgres database by mutating
process.env.DATABASE_URL in tests/setup.ts's beforeAll. That per-file
DB switch is not safe under Vitest's default parallel file execution:
timing between two files' beforeAll/query calls can interleave enough
that both end up issuing real queries against the same throwaway DB.
This was invisible before because no two test files shared tables
with a real FK between them. It became visible once Request gained a
real FK to Employee: tests/employees.test.ts and tests/requests.test.ts
started intermittently deleting/reading each other's rows (FK
violations on deleteMany, wrong row counts), reproducible on every
run. Setting fileParallelism: false makes each file run to completion
before the next starts, so the per-file throwaway DB is genuinely
private. Confirmed: 31/31 tests pass reliably under plain npm test
(previously reproducibly 4 failing).
- createRequestSchema now requires employee_id to be a UUID-format
string (was a free-text non-empty check), matching the new FK to
Employee in schema.prisma.
- createRequest() now returns a CreateRequestResult discriminated
union and catches Prisma P2003 (FK violation), returning a friendly
ok:false error instead of a raw 500 when employee_id does not
reference an existing Employee. POST /api/requests branches on
created.ok and returns 400 in that case.
- tests/requests.test.ts: every test that used to POST a fake string
employee_id (emp-1, emp-2) now creates a real Employee first via
createTestEmployee() and uses its id, since employee_id is now a
real FK. Added coverage for a syntactically invalid UUID and for a
well-formed but non-existent UUID (expects the friendly 400 from
the P2003 catch, not a raw 500) - the exact case this retrofit was
meant to protect against.
Retrofits Request.employeeId from a free-text String with no
referential integrity to a real relation: employeeId String @db.Uuid
+ employee Employee @relation(...), plus the inverse Employee.requests
back-relation field. Migration alters requests.employee_id from TEXT
to UUID with an FK constraint (drop+recreate, confirmed empty table -
no production/dev data existed to migrate).
Mirrors tests/requests.test.ts's structure and @/auth mocking
pattern. Covers: successful create (with and without managerId),
empty name/department validation failures, malformed managerId UUID,
nonexistent managerId (FK violation -> friendly 400, not a raw 500),
a self-referential manager sanity check via direct Prisma update,
list ordering, empty list, and 401-when-unauthenticated for both
routes.
POST/GET /api/employees, same thin-route pattern as
src/app/api/requests/route.ts including the auth() 401 check
(middleware.ts excludes /api from page-route gating). POST also
surfaces createEmployee()'s FK-violation translation (nonexistent
managerId) as a 400, not a raw 500.
Mirrors src/lib/requests.ts's shape: Zod schema, ValidationResult
discriminated union, CRUD via Prisma, toRecord() camelCase->snake_case
mapping. managerId is only format-checked as a UUID here; a
nonexistent managerId is caught via Prisma's P2003 FK-violation error
in createEmployee() and translated into a friendly {ok:false,error}
instead of leaking a raw Prisma error.
Employee directory entity per docs/asset-license-management.md's data
model table (id, name, department, manager). department stays a plain
String for now (not a separate Department entity). managerId is a
nullable self-relation (EmployeeManager) - top-level employees have
managerId = null.
toanhoang