1e644e6dfb
Keep notification-read state personal to user/company, preserve server read-only sections during staff synchronization, and respect separate order-create/edit/delete rights. Add visible mobile header session actions and a sticky logout that survives profile RPC failure; scope asynchronous profile/branding to user and workspace. Targeted browser suites and isolated SQL recovery tests passed in run 35506145405, iPhone screenshots reviewed. Full main QA remains required before production promotion. Workspace branding RPC migration is included but has NOT been applied to production Supabase; older servers retain safe owner-only fallback. No live membership/business-data repair is claimed without identifying the reported employee.
2.6 KiB
Company employee sessions and mobile logout
Application changes
Notification read flags now use a device-local key scoped to the authenticated
user and selected company. They do not enter the company synchronization payload.
Older remote sunReadNotificationsV1 values are preserved, not overwritten or
removed by an employee. Read-only sections are taken from the remote snapshot
instead of uploading bootstrap defaults or empty caches as staff changes. Order
reconciliation respects the existing create/edit/delete permissions separately.
The server still enforces all permissions; no role or membership is granted.
On mobile, the main header contains labelled Profile and Logout buttons with SVG icons. Profile also has a sticky top Logout button, including while its detail RPC is pending or unavailable. Logout uses the existing bounded local-device sign-out and tenant-cache preservation. Late account/company replies cannot restore stale profile or sidebar information.
Database change — must be deployed separately
Apply supabase/migrations/20260920104500_workspace_sidebar_brand.sql to the
Caterium database. It adds a membership-checked, selected-workspace sidebar RPC.
An exclusive branding assignment is associated with its owner's company only
when that company is unambiguous. Multiple owned companies need an explicit
assignment by an authorized database administrator, never a guessed name match.
Active confirmed employees of the assigned company receive the Solnce sidebar.
The old owner-only RPC remains compatible with older clients.
Publishing application assets does NOT apply SQL migrations. Until the database migration is applied, the client safely falls back to the old owner-only RPC; this release must not be reported as fixing employee branding on that server. No company catalog, order, client, membership, or production account is changed by the migration. The separate ai-staff project is outside this change.
Verification scope
Browser scenarios use synthetic company accounts and do not access production business data. They cover an empty employee device, pre-existing baselines, allowed order edits with forbidden UI preferences, record-level permissions, personal notification isolation, selected-workspace branding, old-server compatibility, late replies, and visible mobile logout with unavailable details. The recovery database suite checks the new RPC against actual SQL permissions.
The reported employee's actual company membership is a separate diagnosis and requires the exact new email and an authorized server/account read. Empty UI alone is not evidence that company orders were deleted.