1e644e6dfb
Keep notification-read state personal to user/company, preserve server read-only sections during staff synchronization, and respect separate order-create/edit/delete rights. Add visible mobile header session actions and a sticky logout that survives profile RPC failure; scope asynchronous profile/branding to user and workspace. Targeted browser suites and isolated SQL recovery tests passed in run 35506145405, iPhone screenshots reviewed. Full main QA remains required before production promotion. Workspace branding RPC migration is included but has NOT been applied to production Supabase; older servers retain safe owner-only fallback. No live membership/business-data repair is claimed without identifying the reported employee.
47 lines
2.6 KiB
Markdown
47 lines
2.6 KiB
Markdown
# Company employee sessions and mobile logout
|
|
|
|
## Application changes
|
|
|
|
Notification read flags now use a device-local key scoped to the authenticated
|
|
user and selected company. They do not enter the company synchronization payload.
|
|
Older remote `sunReadNotificationsV1` values are preserved, not overwritten or
|
|
removed by an employee. Read-only sections are taken from the remote snapshot
|
|
instead of uploading bootstrap defaults or empty caches as staff changes. Order
|
|
reconciliation respects the existing create/edit/delete permissions separately.
|
|
The server still enforces all permissions; no role or membership is granted.
|
|
|
|
On mobile, the main header contains labelled Profile and Logout buttons with SVG
|
|
icons. Profile also has a sticky top Logout button, including while its detail RPC
|
|
is pending or unavailable. Logout uses the existing bounded local-device sign-out
|
|
and tenant-cache preservation. Late account/company replies cannot restore stale
|
|
profile or sidebar information.
|
|
|
|
## Database change — must be deployed separately
|
|
|
|
Apply `supabase/migrations/20260920104500_workspace_sidebar_brand.sql` to the
|
|
Caterium database. It adds a membership-checked, selected-workspace sidebar RPC.
|
|
An exclusive branding assignment is associated with its owner's company only
|
|
when that company is unambiguous. Multiple owned companies need an explicit
|
|
assignment by an authorized database administrator, never a guessed name match.
|
|
Active confirmed employees of the assigned company receive the Solnce sidebar.
|
|
The old owner-only RPC remains compatible with older clients.
|
|
|
|
Publishing application assets does NOT apply SQL migrations. Until the database
|
|
migration is applied, the client safely falls back to the old owner-only RPC;
|
|
this release must not be reported as fixing employee branding on that server.
|
|
No company catalog, order, client, membership, or production account is changed
|
|
by the migration. The separate ai-staff project is outside this change.
|
|
|
|
## Verification scope
|
|
|
|
Browser scenarios use synthetic company accounts and do not access production
|
|
business data. They cover an empty employee device, pre-existing baselines,
|
|
allowed order edits with forbidden UI preferences, record-level permissions,
|
|
personal notification isolation, selected-workspace branding, old-server
|
|
compatibility, late replies, and visible mobile logout with unavailable details.
|
|
The recovery database suite checks the new RPC against actual SQL permissions.
|
|
|
|
The reported employee's actual company membership is a separate diagnosis and
|
|
requires the exact new email and an authorized server/account read. Empty UI alone
|
|
is not evidence that company orders were deleted.
|