@kernhq/module-hr 0.13.2 → 0.14.0

package/src/client/components/PersonPanel.svelte

@@ -7,6 +7,7 @@ import {
   EmptyState,
   Field,
   formatDate,
+  Icon,
   Input,
   navigation,
   RightPanel,
@@ -21,6 +22,7 @@ import { hrKeys, isoDate } from '../query.js'
 import PersonDocumentsSection from './PersonDocumentsSection.svelte'
 import PersonJobSection from './PersonJobSection.svelte'
 import PersonSensitiveSection from './PersonSensitiveSection.svelte'
+import { personnelVisibility } from './redaction.js'
 import { explainRefusal } from './refusal.js'
 
 /**
@@ -188,8 +190,30 @@ function officeTime(timezone: string): string {
 
 const canManage = $derived(canHr('personManage'))
 const left = $derived(person?.status === 'terminated')
+
+/**
+ * Whether the server withheld this person's personnel fields from this reader.
+ *
+ * The four it nulls arrive as nulls, so an empty phone row on this panel says "no phone number" —
+ * a different and wrong fact. `personnelVisibility` says which of the two it is, or says it cannot
+ * tell; only a certain `withheld` is marked, and the panel then explains itself once below the
+ * list rather than once per field.
+ */
+const withheld = $derived(person ? personnelVisibility(person) === 'withheld' : false)
+/**
+ * And only where something on *this* panel is actually blank because of it. The two are the same
+ * thing while the client and the server agree about the reader's keys; tying the sentence to what
+ * is on screen means a disagreement leaves a stale sentence over nothing rather than over a value
+ * the reader can plainly see.
+ */
+const hiddenHere = $derived(withheld && (!person?.phone || !person?.hiredOn))
 </script>
 
+{#snippet hiddenValue()}
+  <!-- A value in its own right, not an absence: the row stays, and says what it is. -->
+  <span class="withheld"><Icon name="eye-off" size={12} strokeWidth={1.8} />{t('person_hidden')}</span>
+{/snippet}
+
 {#snippet footerActions()}
   <div class="actions">
     <!-- Disabled with the reason beside it, not hidden: the button was there a moment ago, and a
@@ -225,7 +249,7 @@ const left = $derived(person?.status === 'terminated')
       </div>
     </div>
 
-    <dl>
+    <dl class:tight={hiddenHere}>
       {#if resolution?.primaryOfficeName}
         <dt>{t('office')}</dt>
         <dd>{resolution.primaryOfficeName}</dd>
@@ -241,13 +265,22 @@ const left = $derived(person?.status === 'terminated')
         <dt>{t('employee_no')}</dt>
         <dd>{person.employeeNo}</dd>
       {/if}
-      {#if person.hiredOn}
+      <!--
+        Two of the four fields the server redacts. A withheld one keeps its row and is marked, so
+        that "we are not showing you this" cannot be read as "there is nothing here"; one that is
+        merely empty keeps the behaviour it had, and drops out of the list.
+      -->
+      {#if person.hiredOn || withheld}
         <dt>{t('started')}</dt>
-        <dd>{formatDate(`${person.hiredOn}T00:00:00`)}</dd>
+        <dd>
+          {#if person.hiredOn}{formatDate(`${person.hiredOn}T00:00:00`)}{:else}{@render hiddenValue()}{/if}
+        </dd>
       {/if}
-      {#if person.phone}
+      {#if person.phone || withheld}
         <dt>{t('phone')}</dt>
-        <dd>{person.phone}</dd>
+        <dd>
+          {#if person.phone}{person.phone}{:else}{@render hiddenValue()}{/if}
+        </dd>
       {/if}
       {#if resolution?.orgUnitPath}
         <dt>{t('department')}</dt>
@@ -259,6 +292,14 @@ const left = $derived(person?.status === 'terminated')
       {/if}
     </dl>
 
+    <!--
+      Once for the panel, never once per field. The same sentence beside every marked row is a
+      lecture; the marks say *which* fields, and this says why, once, under all of them.
+    -->
+    {#if hiddenHere}
+      <p class="hint">{t('person_hidden_hint')}</p>
+    {/if}
+
     <Badge tone={person.status === 'active' ? 'active' : person.status === 'on_leave' ? 'upcoming' : 'grey'}
       >{person.status === 'active'
         ? t('status_active')
@@ -389,6 +430,11 @@ dl {
   gap: 8px 16px;
   margin: 0 0 16px;
 }
+/* The sentence below the list belongs to it, so the list gives up its own gap to keep them one
+   block rather than two things that happen to follow each other. */
+dl.tight {
+  margin-block-end: 8px;
+}
 dt {
   color: var(--kern-ink-500);
   font-size: 12px;
@@ -396,6 +442,21 @@ dt {
 dd {
   margin: 0;
 }
+/* A colour and a smaller size, never opacity — a faded value is unreadable whatever token it
+   names, and this one has to be read to be believed. */
+.withheld {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  color: var(--kern-ink-500);
+  font-size: 12px;
+}
+.hint {
+  margin: 0 0 16px;
+  font-size: 12px;
+  line-height: 1.45;
+  color: var(--kern-ink-500);
+}
 .actions {
   display: flex;
   gap: 8px;

package/src/client/components/redaction.ts

@@ -0,0 +1,51 @@
+import { session } from '@kernhq/ui'
+import { canHr, canSeeFullRecords } from '../permissions.js'
+
+/**
+ * Whether the personnel fields on a card were withheld, or are genuinely empty.
+ *
+ * `HrAccessService` nulls four of them — personal email, phone, hire date, termination date — for
+ * anybody outside the reader's record scope, and nulls them **in place**: a redacted card parses as
+ * an ordinary `Person`, so a blank phone number arrives at a screen meaning either "we are not
+ * showing you this" or "this person never gave us one". Those are two different facts about a
+ * colleague, and printing the second when the first is true is the defect this exists to stop.
+ *
+ * Nothing on the record says which it is, so this reconstructs what it can from the reader's own
+ * keys — and answers `unknown` rather than guessing where it cannot:
+ *
+ * - `full` — nothing was withheld from this reader. `hr.person.view_all` reads the workspace, and
+ *   `hr.person.manage` is unbounded for the same reason the server makes it so: the edit form is
+ *   populated from the record it saves back, so a writer handed a redacted card would blank the
+ *   fields they could not see. Everybody reads their own record besides, holding nothing at all.
+ * - `withheld` — the reader holds none of the three widening keys, so every card but their own came
+ *   back with all four nulled. Certain, and the common case: `hr.person.view` is a member default
+ *   and most colleagues hold nothing above it.
+ * - `unknown` — the reader holds `view_team` or `view_office`. **Which** people those cover is
+ *   resolved on the server from the org chart — headship of a unit or an office, direct reports, as
+ *   of today — and none of that reaches the client. A screen renders the field exactly as it
+ *   arrived rather than labelling a genuinely empty phone number "Hidden".
+ *
+ * That third answer is the hole, and it is the server's to close: one boolean set where `forViewer`
+ * already nulls the four would make every card say for itself, and every caller here collapses to
+ * reading it. Until then a manager sees no marking on the people outside their team — the same
+ * blank they see today, never a wrong sentence about it.
+ */
+export type PersonnelVisibility = 'full' | 'withheld' | 'unknown'
+
+/** Enough of a person to answer for — a directory row, a whole record, an office roster entry. */
+export interface PersonnelSubject {
+  /** The Kern account behind the record, when there is one: how a reader recognises their own. */
+  userId: string | null
+}
+
+export function personnelVisibility(person: PersonnelSubject): PersonnelVisibility {
+  // The two grants the server treats as unbounded, asked in the order it asks them.
+  if (canHr('personViewAll') || canHr('personManage')) return 'full'
+  // Identity, never a grant. Plenty of employees have no account, so a null on either side is
+  // nobody's match rather than everybody's.
+  const userId = session.user?.id
+  if (userId && person.userId === userId) return 'full'
+  // `view_all` is answered above, so what is left of that union is team-or-office scope: a set of
+  // people only the server can name.
+  return canSeeFullRecords() ? 'unknown' : 'withheld'
+}