teatea-pension/.trellis/tasks/07-01-nextjs-fullstack-crud-rbac-audit/implement.md

Implementation Plan

Checklist

1. Add core server modules:

   • JSON store read/write helpers.
   • Account/session/password helpers.
   • Role and permission definitions.
   • Audit logging helper.
   • Shared API response helpers.

2. Add auth APIs:

   • GET /api/auth/bootstrap
   • POST /api/auth/setup
   • POST /api/auth/login
   • POST /api/auth/logout
   • GET /api/auth/session

3. Migrate auth UI:

   • Update AuthPanel to call server APIs.
   • Update SignOutButton to call logout API.
   • Replace or bypass localStorage-only AuthGate with server session protection in the app layout.
   • Keep unauthenticated redirects and setup redirects working.

4. Add elder APIs and UI:

   • Create elder types and input validators.
   • Implement list/create/update/delete Route Handlers.
   • Replace app/(app)/app/elders/page.tsx static content with server-loaded CRUD UI.

5. Add settings/audit UI:

   • Implement settings/account, role, and audit APIs.
   • Replace app/(app)/app/settings/page.tsx static content with server-loaded tables.

6. Wire audit events:

   • Account setup/create.
   • Login/logout.
   • Elder create/update/delete.
   • Denied permission checks.

7. Verification:

   • Run pnpm lint.
   • Run pnpm type-check.
   • Run pnpm build.
   • Start dev server and manually exercise setup/login/CRUD/settings if build passes.

Files Expected to Change

• modules/auth/components/AuthPanel.tsx
• modules/auth/components/AuthGate.tsx
• modules/auth/components/SignOutButton.tsx
• app/(app)/app/layout.tsx
• app/(app)/app/elders/page.tsx
• app/(app)/app/settings/page.tsx

Files Expected to Be Created

• modules/core/server/store.ts
• modules/core/server/auth.ts
• modules/core/server/permissions.ts
• modules/core/server/audit.ts
• modules/core/server/api.ts
• modules/elders/types.ts
• modules/elders/components/EldersClient.tsx
• modules/settings/components/SettingsOverview.tsx
• app/api/auth/bootstrap/route.ts
• app/api/auth/setup/route.ts
• app/api/auth/login/route.ts
• app/api/auth/logout/route.ts
• app/api/auth/session/route.ts
• app/api/elders/route.ts
• app/api/elders/[id]/route.ts
• app/api/settings/accounts/route.ts
• app/api/settings/roles/route.ts
• app/api/audit-logs/route.ts

Validation Commands

pnpm lint
pnpm type-check
pnpm build
pnpm dev

Rollback Points

• If server auth blocks all app routes, revert only layout/AuthGate changes while keeping APIs.
• If elder CRUD UI is unstable, keep APIs and temporarily render a read-only server table.
• If file store causes build/runtime issues, move the data directory to /tmp behind the same store API for verification, then restore .data once filesystem assumptions are fixed.