SiteSafety Nordic

Mobile-first PWA for Swedish construction sites and plants: workers report near-misses (tillbud), hazards and accidents in three taps; the safety organisation follows up with CAPA, weekly skyddsronder (AFS 2001:1) and AML 3:3a notices to Arbetsmiljöverket.

• Next.js 16 / React 19, Tailwind 4, shadcn components; Swedish, English and Turkish UI; light, dark and automatic theme.
• Supabase (Postgres, Storage, Auth, Realtime) when configured, otherwise an in-memory demo.
• Offline first: reports written without signal are stored in IndexedDB and sent when the radio is back.
• Critical alerts: critical incidents e-mail the safety officer via Resend, exactly once, verified server-side.

Run it

npm install
npm run dev        # http://localhost:3000 — demo mode until Supabase is configured
npm test           # vitest unit tests
npm run lint
npm run typecheck

Connect Supabase

1. Copy .env.local.example to .env.local and set NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY (or ..._ANON_KEY). Both are public values.

2. Apply the schema (tables, RLS policies, RPCs, storage bucket, realtime):

   npx supabase login
   npx supabase link --project-ref <your-project-ref>
   npx supabase db push
   npx supabase db query -f supabase/seed.sql   # optional demo sites and locations
   

   Without the CLI, paste supabase/apply-all.sql (migrations + seed in one script) into the SQL editor of the Supabase dashboard and run it. Regenerate it after editing a migration:

   node scripts/build-apply-all.mjs
   

3. Create the safety officers' accounts under Authentication → Users (email + password, or invite by e-mail). Field workers never need an account.

Security model

Role	Can
Anonymous visitor (field worker)	read sites and locations, submit a report through the submit_incident RPC, upload photos / voice notes
Signed-in user (safety officer)	read and update incidents, CAPA actions, skyddsronder and media

The dashboard and /skyddsrond redirect to /login when Supabase is configured. Media lives in the private incident-media bucket and is served through short-lived signed URLs.

Anonymous reporting: QR keys, limits and company addresses

Workers never sign in. Each company and each place has a report key; the QR code carries it (/report?k=<key>). The submit_incident RPC refuses an anonymous report without the current key of that company or place, so the form cannot be used for another company. A manager (or the owner) replaces a key in Settings / Projects and the old printed code stops working at once. The RPC also limits reports per phone, per network and per company per hour, and flags a report sent from outside the place (a flag, not a block). Signed-in people of the company report without a key. Optional: Cloudflare Turnstile (NEXT_PUBLIC_TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY).

Staff see only the places a manager ticks for them (People page); managers see their whole company. With NEXT_PUBLIC_ROOT_DOMAIN set, each company gets <slug>.<root domain> (add a wildcard domain in Vercel).

Critical-incident e-mail

Set RESEND_API_KEY, SAFETY_ALERT_RECIPIENT (comma-separated allowed), optionally RESEND_FROM and NEXT_PUBLIC_APP_URL. The browser pings /api/alerts/critical-incident after a report; the route calls the claim_incident_alert RPC, which returns the incident only if it is critical and has not been alerted before, so the e-mail can be neither forged nor duplicated.

For delivery that does not depend on the reporter's browser, add a Database Webhook in Supabase (table incidents, event INSERT, URL https://<your-app>/api/alerts/critical-incident, HTTP header x-alert-secret: <ALERT_WEBHOOK_SECRET>) and set ALERT_WEBHOOK_SECRET in the app.

Project layout

app/                 routes (report, dashboard, skyddsrond, login, api/alerts)
components/          UI: report wizard, dashboard, skyddsrond checklist, auth, shell
lib/data/            repository contract + Supabase and in-memory implementations
lib/supabase/        client/server factories, row mappers, hand-maintained DB types
lib/offline/         IndexedDB queue for reports written without a connection
lib/alerts/          critical-incident payload, parsing and e-mail template
lib/compliance/      AML 3:3a notice model and print template
supabase/            migrations, seed data, CLI config
tests/               vitest unit tests for the pure modules

PWA

public/sw.js caches the app shell (network-first for pages, cache-first for static assets) and is registered in production builds only. iOS splash screens are generated by node scripts/generate-ios-assets.mjs.