tracker-web

Next.js app that is both the web UI and the backend (API routes + Prisma

• Postgres) for UHAI Activity Tracker (UAT, see src/lib/branding.ts). tracker-mobile talks to this app's API over HTTPS — there is no separate backend service, by design (see ../ARCHITECTURE.md).

Layout

prisma/
  schema.prisma        # full data model (+ RefreshToken, added beyond the original design
                        # to back the rotating-refresh-token session described in §5/§11)
  seed/
    index.ts            # entry point: npm run seed -> rbac.ts then seed-from-excel.ts
    rbac.ts              # seeds Menus/Permissions/Roles (the menu-based RBAC in ARCHITECTURE.md §3)
    seed-from-excel.ts   # loads the real first tracker from the root .xlsx
src/
  app/
    (auth)/             # sign-in, sign-up
    accept-invite/      # token acceptance page (outside the auth/dashboard shells)
    (dashboard)/
      trackers/                 # tracker list + "new tracker" form
      trackers/[id]/             # tracker detail: summary dashboard, per-phase progress, activities table
      trackers/[id]/approvals/   # pending join requests (owner/admin only)
      trackers/[id]/members/     # members list + invite-by-email
      admin/systems/             # System Directory screen (Platform Admin only)
      admin/roles/               # Roles & Permissions screen (Platform Admin only)
    api/
      auth/                      # register, login, refresh, logout, Google OAuth sign-in
      trackers/[id]/memberships*, /invites, /phases, /activities, /dashboard
      activities/[id]            # PATCH (writes ActivityHistory), comments
      roles/ | menus/            # permission-matrix CRUD
      systems/                   # System Directory CRUD
      notifications/
  lib/
    auth/                 # password hashing, JWT issuance/verification, session cookies, Google OAuth
    rbac/                  # resolves a caller's Menu+PermissionAction grants, server-side checks
    trackers/              # tracker access control, dashboard aggregation
    notifications/         # in-app Notification rows + branded transactional email (Resend)
  components/              # TopNav, AvatarStack, PhaseLane, NotificationBell, etc. — the shared design system

What's built vs. what's left

Delivery-order items 1–3 from ../ARCHITECTURE.md §12 are functional end to end (manually verified): email+password and Google sign-in, the full menu-based RBAC, System Directory CRUD, Tracker/Phase/Activity CRUD with ActivityHistory on every edit, the tracker summary dashboard, the subscribe→approve flow, invite-by-email→accept, in-app notifications (the bell in the top nav), and the two load-bearing transactional emails (invite, join-decided) via src/lib/notifications/email.ts — these log to the console instead of sending when EMAIL_PROVIDER_API_KEY isn't set, so local dev works without a Resend account.

Not yet built: push notifications, Google Calendar sync, the mobile app's UI (only its Expo scaffold + branding exist), and the timeline/workload/ trend dashboard views (§12 items 5–7) — the tracker summary dashboard and per-phase progress are built; by-system/by-module, workload-by-assignee, and the burndown trend are not.

Getting started

npm install
cp .env.example .env        # fill in DATABASE_URL, JWT secrets, Google OAuth, Redis, etc.
npm run prisma:migrate
npm run seed                 # imports "Afya Maoni x GOTHOMIS Integration"
                              # from ../Afya Maoni GoTHOMIS Integration Tracker.xlsx
npm run dev

The seeded tracker owner (SEED_OWNER_EMAIL) has no password by default — it's meant to sign in with Google. To sign in with a password locally instead (e.g. without Google OAuth credentials configured), set one directly: UPDATE "User" SET "passwordHash" = ... WHERE email = '...', or sign up a fresh account and use that to explore everything except the seeded tracker (which is PRIVATE to its owner).

See ../ARCHITECTURE.md for the full system design: data model, auth & roles, the tracker join/approval flow, Google Calendar sync, and the notification system.

uhai-activity-tracker