feat(people): People area (persons, members, admins, teams, census, linking, Capo Admin, My area)

[viganogabriele]

Builds the People area designed in the prototype. Each person has one record with independent Member, Admin and Team roles. The area also covers the census, account linking, Capo Admin and My area.

Scope

• Dashboard only. @polinetwork/backend has no People procedures yet.
  • The dashboard codes against the typed contract in src/features/people/people.contract.ts (documented in docs/people/contract.md) and parses every response with it.
  • Agent mode serves seeded sample data from people.fake.server.ts.
  • Outside agent mode the area stays hidden until the IdP grants the new people:* permissions.
• Restricted access. people:self lets volunteers without admin:access into My area. It also opens Capo Admin or their own team when their record gives them that role. Every other People procedure requires admin:access.

What's in it

People service

• Overview: role, team, campus, account and census filters.
• Person record:
  • all cards and the activity log;
  • account actions: invite, revoke, link, unlink;
  • HR notes and census answers;
  • member, admin and team actions.
• Member register: add member, change status, change number, CSV export with a confirmation first.
• Admins:
  • priority columns and four quick filters;
  • end admin role and set the Capo Admin of reference;
  • appoint, change or end a Capo Admin (requires people:appoint).
• Teams: index and team pages. Add to team, edit team fields, end membership. A Team Lead sees only their own team.
• Census: campaign list and campaign page, reminders, close campaign. A 5-step import wizard skips steps with nothing to settle.
• Linking: Needs review queue with resolve and dismiss, plus pending invites. The review count shows in the side panel.

Telegram › Capo Admin

• My groups, requests to join (approve / decline), and the admins of those groups.

Account › My area

• Census card pre-filled from last year.
• Roles, contacts, profile with "Request a correction", consents, team roster.
• First sign-in "Is this you?" match and "Ask to be added".

Shared changes

• FormDialog gains submitTone="danger".
• The shell takes a second streamed count (needsReview).
• Sign-in & security now uses its section title.
• New dev env vars: AGENT_PERMISSIONS and AGENT_PERSON, to preview other roles.
• Narrow-screen fixes, which also apply to the Telegram user detail:
  • RecordHeader and InlineAlert: below 760px their actions move to their own line.
  • KeyValueList: in containers narrower than 352px the key sits above its value.
  • SectionCard: the header action wraps under the title instead of squeezing it.

Security review (Diubii)

All eight threads are addressed. Each rule is written in docs/people/contract.md → "Backend rules", and tests/people-access.test.mjs covers the access rules.

• Capo Admin requests: approve and decline reach only requests in the caller's own Capo Admin scope.
• Unconfirmed match: until the account owner confirms the match, the account acts as a person with no record.
• CSV export: cells that spreadsheets would run as formulas are neutralized.
• Team Leads: ending a lead's membership requires people:appoint.
• admin:access: People procedures outside self-service require it.
• Input limits: input schemas bound every record, list and string. Telegram usernames follow Telegram's rules. The census import has content checks for the backend.
• Member details: number, status, fee and Microsoft 365 address require people:members:read, except on the person's own record. Everyone else sees only isMember.

Contract additions beyond the original brief

• people.admins.setCapoOfReference
• people.teams.candidates: names only, so Team Leads can add people without people:read.
• isMember on every person row.

Visual audit corrections

Tables and controls

• Table chips in Admins, Census and Overview stay within their cells. Short labels stay readable next to long ones, and the extra items open in the custom popover.
• People date fields use a custom calendar with custom month and year selectors, on desktop and mobile. Grant date/time controls use the existing calendar and time wheels on touch devices too.
• The shared calendar responds to arrow keys again. Selecting a day or pressing Escape returns focus to the field.
• The calendar grid fits 320px screens, including six-row months, with touch targets above 36px.
• Every bottom-navigation label stays readable on narrow screens: WhatsApp shows as WA below 360px. The bottom safe area sits below the bar instead of compressing it.

Phone layouts

• Person and team headers and the record alerts no longer squeeze titles at 320px.
• The import stepper stays on one line.
• Member register statuses become a Status menu.
• Capo Admin request buttons and consent badges wrap under their text.
• Census buttons stack with Confirm on top.

Copy and consistency

• Team cards put missing census answers on their own line.
• Admin cards say "No groups".
• Team tables show the course under every name.
• The My area roster shows "(you)" without breaking the avatar initials.

Verified

• pnpm check, pnpm typecheck, pnpm test and pnpm build pass. Tests: 48 passed, 3 optional integration tests skipped. The 25 existing test-registration lint warnings are unchanged.
• Every People page, Capo Admin and My area at 1440, 390 and 320px, light and dark. An automated pass reports no horizontal page scroll and no clipped text.
• Viewers checked:
  • full administrator;
  • Capo Admin (P-0098) and Team Lead (P-0034) with only people:self;
  • unconfirmed match (match:P-0131);
  • no record (none).
• No-result empty states, loading skeletons and the main dialogs: Add person, Add member, Add to team, Import, census form, Request a correction, Ask to be added.
• Custom date picker at 320x568, 320x740, 390x844 and desktop, light and dark. Month and year selection, six-row months, arrow keys, Enter, Escape and focus restoration work. The picker renders no native date or select control.
• At 320px every bottom-nav label fits; at 390px the full WhatsApp label returns.
• A regression test checks picker date values across time zones and rejects impossible days.

Not verified

• Empty states with no data at all. The sample data always has rows; the no-results states were checked instead.
• The signed-in flow without agent mode needs a development IdP client.
• The backend still has to implement the contract.

Handoff

docs/people/ has:

• the brief
• the decisions
• the contract
• plan.md, with the per-phase checklist and progress log

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ti91VKqKpduLAF376TunMn

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Diubii]

Review di sicurezza dell'area People, fatta con Claude Code. Il backend people.* non esiste ancora, quindi oggi nessun dato reale è esposto. Però people.fake.server.ts è il riferimento da cui partirà chi implementa il backend, e docs/people/contract.md non fissa alcune di queste regole. Conviene sistemarle prima che vengano copiate.

Come ho testato: ho eseguito il fake con utenti diversi (volontario con solo people:self, utente senza record, Team Lead, Capo Admin, match non confermato, people:read senza people:members:read). I casi segnati come verificato li ho riprodotti davvero, gli altri vengono dalla lettura del codice. pnpm test passa (43 ok, 3 skipped).

#	Gravità	Problema
1	🔴 Alta	Chiunque abbia people:self approva o rifiuta qualsiasi richiesta di diventare admin di un gruppo Telegram
2	🟠 Media	Un match non confermato al primo accesso eredita i poteri e i dati del record
3	🟠 Media	Formula injection nell'export CSV dei membri
4	🟡 Bassa	Un Team Lead può chiudere un ruolo da lead senza people:appoint
5	🟡 Bassa	I dati da socio sono visibili con il solo people:read
6	🟡 Bassa	I middleware People non richiedono admin:access, mentre l'interfaccia sì
7	🟡 Bassa	Input senza limiti di dimensione, import controllato solo per estensione

Ho controllato e sono a posto: i link t.me/wa.me non possono cambiare dominio, non c'è dangerouslySetInnerHTML, l'agent mode funziona solo in sviluppo, i token non finiscono nel route context, l'export è in POST con no-store, l'upload in FormData passa per httpLink.

Dettagli e proposte di correzione nei commenti sulle righe.