Moheeb Zara
86d44f6efc
Continuing the audit backlog and finishing the permissions UI. Import validation (recurring audit finding): - Added importMembersSchema / importPaymentsCsvSchema. importMembers and importPaymentsCsv now validate per row (a single bad row no longer rejects the whole file), lowercase emails, normalize dates through flexibleDateTime(), enforce tier/platform enums and positive finite amounts, and return a `skipped` count instead of silently dropping invalid rows. Permissions UI completion: - OpsAclEditor is now wired into the KB/process viewer modal (admin/board), with entity type derived from the `process` tag. Per-item Ops access control now covers secrets + KB + processes, matching "all ops facilities stuff". Left as-is with rationale in HANDOFF: /ops + /import denial paths (unreachable behind the layout gate or already a clear non-leaking denial); members-row make-area-lead shortcut (Customize -> Area leads fully covers assignment); types/database.ts + docs regen (pure hygiene, zero runtime/security impact, still tracked). 271/271 tests pass. Build clean. No migration this pass.
55 lines
1.8 KiB
TypeScript
55 lines
1.8 KiB
TypeScript
'use server'
|
|
|
|
import { revalidatePath } from 'next/cache'
|
|
import { createClient } from '@/lib/supabase/server'
|
|
import { requireMemberWithRole } from '@/lib/auth-helpers'
|
|
import { ADMIN_ROLES } from '@/lib/permissions'
|
|
import { importMembersSchema } from '@/lib/validations'
|
|
|
|
export async function importMembers(rows: unknown) {
|
|
if (!Array.isArray(rows) || rows.length === 0) {
|
|
return { error: 'No rows to import' }
|
|
}
|
|
|
|
const supabase = await createClient()
|
|
const auth = await requireMemberWithRole(supabase, ADMIN_ROLES, 'Admin access required')
|
|
if (!auth.ok) return { error: auth.error }
|
|
const { member } = auth
|
|
|
|
// Validate per row so one bad row does not reject the whole file; the
|
|
// schema lowercases email and normalizes dates via flexibleDateTime.
|
|
const rowSchema = importMembersSchema.element
|
|
const valid: Array<Record<string, unknown>> = []
|
|
let skipped = 0
|
|
for (const raw of rows) {
|
|
const r = rowSchema.safeParse(raw)
|
|
if (!r.success) { skipped++; continue }
|
|
valid.push({
|
|
space_id: member.space_id,
|
|
display_name: r.data.display_name,
|
|
email: r.data.email,
|
|
phone: r.data.phone ?? null,
|
|
tier: r.data.tier ?? 'basic',
|
|
role: 'member',
|
|
status: 'current',
|
|
approved: true,
|
|
joined_at: r.data.joined_at ?? new Date().toISOString(),
|
|
last_paid_at: r.data.last_paid_at ?? null,
|
|
has_card_access: r.data.has_card_access ?? false,
|
|
})
|
|
}
|
|
|
|
if (valid.length === 0) {
|
|
return { error: `No valid rows to import (${skipped} skipped: bad email, name, tier, or date).` }
|
|
}
|
|
|
|
const { data, error } = await supabase
|
|
.from('space_members')
|
|
.upsert(valid, { onConflict: 'space_id,email', ignoreDuplicates: false })
|
|
.select()
|
|
|
|
if (error) return { error: error.message }
|
|
revalidatePath('/members')
|
|
return { data, count: data.length, skipped }
|
|
}
|