teatea-pension/.trellis/tasks/archive/2026-07/07-01-nextjs-fullstack-crud-rbac-audit/implement.md

Implementation Plan

Checklist

1. Reconcile existing Drizzle migration state:

   • Confirm modules/core/server/schema.ts matches drizzle/ migrations.
   • Confirm modules/core/server/db.ts is the only PostgreSQL connection boundary.
   • Confirm modules/core/server/store.ts is treated as a compatibility read model only.
   • Remove task assumptions that mention JSON file writes as the target persistence layer.

2. Verify existing auth/RBAC/audit slice:

   • Confirm setup creates platform admin, organization, session, organization roles, membership, and audit log.
   • Confirm login/logout uses server APIs and the teatea_session HTTP-only cookie.
   • Confirm requirePermission logs denied permission checks.
   • Confirm roles and permissions cover facility and admission operations.

3. Finish elder CRUD on Drizzle:

   • Keep validation in modules/elders/types.ts.
   • Ensure list/create/update/delete APIs query and mutate Drizzle only.
   • Ensure elder create with bedId performs admission and bed status updates inside a transaction.
   • Ensure UI refresh and error handling remain usable.

4. Add or complete bed/admission APIs:

   • Keep GET /api/facilities/rooms and GET /api/facilities/beds Drizzle-backed.
   • Keep POST /api/admissions transactional for admit/transfer.
   • Add discharge and explicit transfer mutation support if the existing POST shape is not enough.
   • Return structured { success, reason, ... } responses for conflicts and validation failures.
   • Write audit events for admission create, transfer, discharge, and facility mutations implemented in this task.

5. Build bed/admission UI:

   • Replace "please create through API" empty states with usable controls where permission allows.
   • Add tabs or segmented navigation for overview, bed status, admission actions/history, and facility records.
   • Move admission actions into the bed/admission workspace.
   • Remove or replace the dead global top-bar "入住" button in AppShell.
   • Ensure page layout matches screenshot feedback: compact workspace header, no oversized intro block, local page actions.

6. Introduce selected Phase 2 UI affordances:

   • Add tabs to pages that combine overview and management modes.
   • Keep implementation incremental; do not attempt every sidebar module.
   • Keep user-facing copy operational and concise.

7. Add standard chart usage:

   • Decide the chart library before adding dependency. Recharts is the likely default unless a better project fit is chosen.
   • Install the library only after checking existing dependencies.
   • Replace at least one meaningful hand-built chart with a data-backed chart component.
   • Keep chart component client-only and pass serializable server data into it.

8. Replace hard-coded operational counters where data exists:

   • Dashboard bed/elder/admission counters should come from Drizzle-backed data.
   • Bed/admission workspace metrics should compute from server-loaded rooms, beds, and admissions.
   • Do not fabricate counters for modules that remain out of scope.

9. Verification:

   • Run pnpm lint.
   • Run pnpm type-check.
   • Run pnpm build.
   • Run Drizzle generation/check commands when schema changes are made.
   • Start dev server and manually exercise setup/login/elder CRUD/bed admission/transfer/discharge/settings if build passes.

Files Expected to Change

• .trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/prd.md
• .trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/design.md
• .trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/implement.md
• modules/shared/components/AppShell.tsx
• app/(app)/app/beds/page.tsx
• app/(app)/app/dashboard/page.tsx
• modules/dashboard/components/DashboardHome.tsx
• app/api/admissions/route.ts
• Potentially app/api/admissions/[id]/route.ts
• Potentially facility UI components under modules/ if the bed page is split into smaller client/server components.

Files Expected to Stay As Existing Foundations

• modules/core/server/db.ts
• modules/core/server/schema.ts
• modules/core/server/auth.ts
• modules/core/server/permissions.ts
• modules/core/server/audit.ts
• modules/core/server/api.ts
• modules/core/server/store.ts as a temporary Drizzle-backed read model.
• Existing auth route handlers unless verification finds a concrete bug.
• Existing elder route handlers unless admission or bed assignment behavior requires a narrow fix.

Dependency Notes

• Do not add oRPC or better-auth in this task.
• Do not reintroduce JSON-file persistence.
• A standard chart library may be added after dependency review. Prefer a focused dashboard dependency over a broad visualization stack.

Validation Commands

pnpm lint
pnpm type-check
pnpm build
pnpm db:generate

If schema files are changed, also validate migrations and run the migration flow against the configured development database:

pnpm db:migrate

Rollback Points

• If admission mutation UI is unstable, keep the Drizzle APIs and temporarily render a read-only admissions table.
• If discharge/transfer API design becomes too broad, implement only admission create/transfer in this slice and keep discharge as a clearly scoped follow-up.
• If chart dependency causes build or bundle issues, remove the chart component and keep the server data preparation in place.
• If tabs cause layout regressions, keep the page-local action placement and defer only the tab styling.