2026-04-29 14:15:25 +02:00
|
|
|
'use client';
|
|
|
|
|
|
|
|
|
|
import Link from 'next/link';
|
|
|
|
|
import { usePathname } from 'next/navigation';
|
|
|
|
|
import {
|
fix(audit): MEDIUMs sweep — mobile More-sheet, portal profile, inline override, dialog UX, ext-EOI gate
R2-M11: mobile More-sheet missing 4 destinations. Added Reservations,
Notifications, Residential, Website analytics — anyone using mobile
chrome to triage on the go can now reach those domains.
R2-M12: portal had no profile / change-password surface. New
/portal/profile page with read-only contact details + a
ChangePasswordForm component, backed by a new POST
/api/portal/auth/change-password endpoint and
changePortalPassword() service function. Audits both ok and failure
cases at warning severity. Added Profile to PortalNav.
R2-M1: portal dashboard "My Memberships" tile had no href and no
/portal/memberships route — dead-end on tap. Hidden until a
memberships page ships; the count remains in the underlying data.
R2-M7: InlineStagePicker never sent override:true so users with
interests.override_stage couldn't actually use the perm from the
inline chip — they had to fall back to the modal picker. Now the
picker auto-detects when a transition isn't legal AND the user has
override_stage, sets override:true, and supplies a default reason.
Frontend M2: hard-delete-dialog confirm stage now has a "Send a new
code" link in case the original expired before the user could enter
it. Avoids forcing a full Cancel + reopen.
Frontend M4: audit-log-list date-range validation. From > To now
shows an inline error and skips the request rather than firing an
empty-range query that surfaces "no entries found".
R2-M6: external-EOI route now requires interests.edit AND
documents.upload_signed (defense-in-depth) — uploading a signed EOI
mutates interest state, so the upload-signed perm alone shouldn't
let a custom role flip an interest.
1175/1175 vitest passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-06 22:38:59 +02:00
|
|
|
Anchor,
|
2026-05-03 16:15:37 +02:00
|
|
|
BarChart3,
|
|
|
|
|
Bell,
|
fix(audit): MEDIUMs sweep — mobile More-sheet, portal profile, inline override, dialog UX, ext-EOI gate
R2-M11: mobile More-sheet missing 4 destinations. Added Reservations,
Notifications, Residential, Website analytics — anyone using mobile
chrome to triage on the go can now reach those domains.
R2-M12: portal had no profile / change-password surface. New
/portal/profile page with read-only contact details + a
ChangePasswordForm component, backed by a new POST
/api/portal/auth/change-password endpoint and
changePortalPassword() service function. Audits both ok and failure
cases at warning severity. Added Profile to PortalNav.
R2-M1: portal dashboard "My Memberships" tile had no href and no
/portal/memberships route — dead-end on tap. Hidden until a
memberships page ships; the count remains in the underlying data.
R2-M7: InlineStagePicker never sent override:true so users with
interests.override_stage couldn't actually use the perm from the
inline chip — they had to fall back to the modal picker. Now the
picker auto-detects when a transition isn't legal AND the user has
override_stage, sets override:true, and supplies a default reason.
Frontend M2: hard-delete-dialog confirm stage now has a "Send a new
code" link in case the original expired before the user could enter
it. Avoids forcing a full Cancel + reopen.
Frontend M4: audit-log-list date-range validation. From > To now
shows an inline error and skips the request rather than firing an
empty-range query that surfaces "no entries found".
R2-M6: external-EOI route now requires interests.edit AND
documents.upload_signed (defense-in-depth) — uploading a signed EOI
mutates interest state, so the upload-signed perm alone shouldn't
let a custom role flip an interest.
1175/1175 vitest passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-06 22:38:59 +02:00
|
|
|
BellRing,
|
2026-04-29 14:15:25 +02:00
|
|
|
Bookmark,
|
2026-05-03 16:15:37 +02:00
|
|
|
Building2,
|
fix(audit): MEDIUMs sweep — mobile More-sheet, portal profile, inline override, dialog UX, ext-EOI gate
R2-M11: mobile More-sheet missing 4 destinations. Added Reservations,
Notifications, Residential, Website analytics — anyone using mobile
chrome to triage on the go can now reach those domains.
R2-M12: portal had no profile / change-password surface. New
/portal/profile page with read-only contact details + a
ChangePasswordForm component, backed by a new POST
/api/portal/auth/change-password endpoint and
changePortalPassword() service function. Audits both ok and failure
cases at warning severity. Added Profile to PortalNav.
R2-M1: portal dashboard "My Memberships" tile had no href and no
/portal/memberships route — dead-end on tap. Hidden until a
memberships page ships; the count remains in the underlying data.
R2-M7: InlineStagePicker never sent override:true so users with
interests.override_stage couldn't actually use the perm from the
inline chip — they had to fall back to the modal picker. Now the
picker auto-detects when a transition isn't legal AND the user has
override_stage, sets override:true, and supplies a default reason.
Frontend M2: hard-delete-dialog confirm stage now has a "Send a new
code" link in case the original expired before the user could enter
it. Avoids forcing a full Cancel + reopen.
Frontend M4: audit-log-list date-range validation. From > To now
shows an inline error and skips the request rather than firing an
empty-range query that surfaces "no entries found".
R2-M6: external-EOI route now requires interests.edit AND
documents.upload_signed (defense-in-depth) — uploading a signed EOI
mutates interest state, so the upload-signed perm alone shouldn't
let a custom role flip an interest.
1175/1175 vitest passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-06 22:38:59 +02:00
|
|
|
Globe,
|
|
|
|
|
Home,
|
2026-04-29 14:15:25 +02:00
|
|
|
Mail,
|
2026-05-03 16:15:37 +02:00
|
|
|
Receipt,
|
2026-04-29 14:15:25 +02:00
|
|
|
Settings,
|
|
|
|
|
Shield,
|
2026-05-03 16:15:37 +02:00
|
|
|
ShieldAlert,
|
|
|
|
|
Ship,
|
2026-04-29 14:15:25 +02:00
|
|
|
} from 'lucide-react';
|
|
|
|
|
|
|
|
|
|
import {
|
|
|
|
|
Drawer,
|
|
|
|
|
DrawerContent,
|
|
|
|
|
DrawerHeader,
|
|
|
|
|
DrawerTitle,
|
|
|
|
|
DrawerClose,
|
|
|
|
|
} from '@/components/shared/drawer';
|
|
|
|
|
|
|
|
|
|
type MoreItem = {
|
|
|
|
|
label: string;
|
|
|
|
|
icon: typeof Building2;
|
|
|
|
|
segment: string;
|
|
|
|
|
};
|
|
|
|
|
|
2026-05-03 16:15:37 +02:00
|
|
|
// Order: most-likely overflow targets first. Interests is here (rather
|
|
|
|
|
// than the bottom row) to dodge the Clients-vs-Interests UX confusion;
|
|
|
|
|
// reps reach the active deals via the Interests tab on a client detail
|
|
|
|
|
// (or via the new bottom-sheet drawer). Yachts is asset-record traffic
|
|
|
|
|
// best reached contextually from inside an interest or client.
|
2026-04-29 14:15:25 +02:00
|
|
|
const MORE_ITEMS: MoreItem[] = [
|
|
|
|
|
{ label: 'Interests', icon: Bookmark, segment: 'interests' },
|
2026-05-03 16:15:37 +02:00
|
|
|
{ label: 'Yachts', icon: Ship, segment: 'yachts' },
|
|
|
|
|
{ label: 'Companies', icon: Building2, segment: 'companies' },
|
2026-04-29 14:15:25 +02:00
|
|
|
{ label: 'Expenses', icon: Receipt, segment: 'expenses' },
|
fix(ux): pass-2 audit fixes — admin grouping, Duplicates entry, header tooltips
Three small but high-leverage fixes from the second audit pass on main:
Admin index (src/app/(dashboard)/[portSlug]/admin/page.tsx):
- Grouped 21 sections into 7 categories: Access, Configuration, Content,
Data Quality, Operations, Tenancy, Integrations. Each group has a
one-line description so first-time admins can orient themselves
without reading every card.
- Added the missing Duplicates entry (links to /admin/duplicates from
the dedup-migration work) under Data Quality.
More sheet (mobile bottom-drawer nav):
- "Email" -> "Inbox". The page that opens is an email-inbox surface
(Inbox + Accounts tabs), not a generic email composer. The previous
label was ambiguous.
Interest detail header (Won / Lost outcome buttons):
- Added title="Mark as won" / "Close as lost" so the icon-only buttons
on mobile have a tooltip on long-press / desktop hover.
- Tightened mobile padding (px-2 vs px-2.5) so the full-text desktop
labels still fit on sm+ without re-introducing a regression where a
visible mobile "Won"/"Lost" inline label crowded the right cluster
enough to push Email/Call/WhatsApp action chips into a vertical
stack.
Verification: 0 tsc errors, 926/926 vitest passing, lint clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 16:35:32 +02:00
|
|
|
{ label: 'Inbox', icon: Mail, segment: 'email' },
|
fix(audit): MEDIUMs sweep — mobile More-sheet, portal profile, inline override, dialog UX, ext-EOI gate
R2-M11: mobile More-sheet missing 4 destinations. Added Reservations,
Notifications, Residential, Website analytics — anyone using mobile
chrome to triage on the go can now reach those domains.
R2-M12: portal had no profile / change-password surface. New
/portal/profile page with read-only contact details + a
ChangePasswordForm component, backed by a new POST
/api/portal/auth/change-password endpoint and
changePortalPassword() service function. Audits both ok and failure
cases at warning severity. Added Profile to PortalNav.
R2-M1: portal dashboard "My Memberships" tile had no href and no
/portal/memberships route — dead-end on tap. Hidden until a
memberships page ships; the count remains in the underlying data.
R2-M7: InlineStagePicker never sent override:true so users with
interests.override_stage couldn't actually use the perm from the
inline chip — they had to fall back to the modal picker. Now the
picker auto-detects when a transition isn't legal AND the user has
override_stage, sets override:true, and supplies a default reason.
Frontend M2: hard-delete-dialog confirm stage now has a "Send a new
code" link in case the original expired before the user could enter
it. Avoids forcing a full Cancel + reopen.
Frontend M4: audit-log-list date-range validation. From > To now
shows an inline error and skips the request rather than firing an
empty-range query that surfaces "no entries found".
R2-M6: external-EOI route now requires interests.edit AND
documents.upload_signed (defense-in-depth) — uploading a signed EOI
mutates interest state, so the upload-signed perm alone shouldn't
let a custom role flip an interest.
1175/1175 vitest passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-06 22:38:59 +02:00
|
|
|
{ label: 'Reservations', icon: Anchor, segment: 'berth-reservations' },
|
|
|
|
|
{ label: 'Notifications', icon: BellRing, segment: 'notifications' },
|
|
|
|
|
{ label: 'Residential', icon: Home, segment: 'residential/clients' },
|
|
|
|
|
{ label: 'Website analytics', icon: Globe, segment: 'website-analytics' },
|
2026-04-29 14:15:25 +02:00
|
|
|
{ label: 'Alerts', icon: ShieldAlert, segment: 'alerts' },
|
|
|
|
|
{ label: 'Reports', icon: BarChart3, segment: 'reports' },
|
|
|
|
|
{ label: 'Reminders', icon: Bell, segment: 'reminders' },
|
|
|
|
|
{ label: 'Settings', icon: Settings, segment: 'settings' },
|
|
|
|
|
{ label: 'Admin', icon: Shield, segment: 'admin' },
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
export function MoreSheet({
|
|
|
|
|
open,
|
|
|
|
|
onOpenChange,
|
|
|
|
|
}: {
|
|
|
|
|
open: boolean;
|
|
|
|
|
onOpenChange: (next: boolean) => void;
|
|
|
|
|
}) {
|
|
|
|
|
const pathname = usePathname();
|
|
|
|
|
const portSlug = pathname.split('/').filter(Boolean)[0] ?? 'port-nimara';
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
<Drawer open={open} onOpenChange={onOpenChange}>
|
|
|
|
|
<DrawerContent>
|
|
|
|
|
<DrawerHeader>
|
|
|
|
|
<DrawerTitle>More</DrawerTitle>
|
|
|
|
|
</DrawerHeader>
|
2026-05-06 15:16:33 +02:00
|
|
|
<ul className="grid grid-cols-3 gap-2 px-3 pb-4">
|
2026-04-29 14:15:25 +02:00
|
|
|
{MORE_ITEMS.map((item) => {
|
|
|
|
|
const Icon = item.icon;
|
|
|
|
|
return (
|
|
|
|
|
<li key={item.segment}>
|
|
|
|
|
<DrawerClose asChild>
|
|
|
|
|
<Link
|
|
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
|
|
|
href={`/${portSlug}/${item.segment}` as any}
|
2026-05-06 15:16:33 +02:00
|
|
|
// min-h-[88px] guarantees a 44pt vertical touch target
|
|
|
|
|
// (Apple HIG); icon + label centered. The grid gap is
|
|
|
|
|
// 8px so each cell still has clearance from neighbours.
|
|
|
|
|
className="flex min-h-[88px] flex-col items-center justify-center gap-1.5 rounded-md py-3 px-2 text-xs text-foreground hover:bg-accent active:bg-accent/80"
|
2026-04-29 14:15:25 +02:00
|
|
|
>
|
2026-05-06 15:16:33 +02:00
|
|
|
<Icon className="size-7 text-muted-foreground" aria-hidden />
|
2026-04-29 14:15:25 +02:00
|
|
|
<span className="font-medium">{item.label}</span>
|
|
|
|
|
</Link>
|
|
|
|
|
</DrawerClose>
|
|
|
|
|
</li>
|
|
|
|
|
);
|
|
|
|
|
})}
|
|
|
|
|
</ul>
|
|
|
|
|
</DrawerContent>
|
|
|
|
|
</Drawer>
|
|
|
|
|
);
|
|
|
|
|
}
|