@kernhq/module-hr 0.13.2 → 0.14.1

package/src/client/components/PersonPanel.svelte

@@ -7,6 +7,7 @@ import {
   EmptyState,
   Field,
   formatDate,
+  Icon,
   Input,
   navigation,
   RightPanel,
@@ -21,6 +22,7 @@ import { hrKeys, isoDate } from '../query.js'
 import PersonDocumentsSection from './PersonDocumentsSection.svelte'
 import PersonJobSection from './PersonJobSection.svelte'
 import PersonSensitiveSection from './PersonSensitiveSection.svelte'
+import { personnelWithheld } from './redaction.js'
 import { explainRefusal } from './refusal.js'
 
 /**
@@ -188,8 +190,30 @@ function officeTime(timezone: string): string {
 
 const canManage = $derived(canHr('personManage'))
 const left = $derived(person?.status === 'terminated')
+
+/**
+ * Whether the server withheld this person's personnel fields from this reader.
+ *
+ * The four it nulls arrive as nulls, so an empty phone row on this panel says "no phone number" —
+ * a different and wrong fact. The record carries the answer (`personnelHidden`, set where the
+ * nulling happens), so this is a read rather than an inference; the panel then explains itself once
+ * below the list rather than once per field.
+ */
+const withheld = $derived(person ? personnelWithheld(person) : false)
+/**
+ * And only where something on *this* panel is actually blank because of it. The two are the same
+ * thing while the client and the server agree about the reader's keys; tying the sentence to what
+ * is on screen means a disagreement leaves a stale sentence over nothing rather than over a value
+ * the reader can plainly see.
+ */
+const hiddenHere = $derived(withheld && (!person?.phone || !person?.hiredOn))
 </script>
 
+{#snippet hiddenValue()}
+  <!-- A value in its own right, not an absence: the row stays, and says what it is. -->
+  <span class="withheld"><Icon name="eye-off" size={12} strokeWidth={1.8} />{t('person_hidden')}</span>
+{/snippet}
+
 {#snippet footerActions()}
   <div class="actions">
     <!-- Disabled with the reason beside it, not hidden: the button was there a moment ago, and a
@@ -225,7 +249,7 @@ const left = $derived(person?.status === 'terminated')
       </div>
     </div>
 
-    <dl>
+    <dl class:tight={hiddenHere}>
       {#if resolution?.primaryOfficeName}
         <dt>{t('office')}</dt>
         <dd>{resolution.primaryOfficeName}</dd>
@@ -241,13 +265,22 @@ const left = $derived(person?.status === 'terminated')
         <dt>{t('employee_no')}</dt>
         <dd>{person.employeeNo}</dd>
       {/if}
-      {#if person.hiredOn}
+      <!--
+        Two of the four fields the server redacts. A withheld one keeps its row and is marked, so
+        that "we are not showing you this" cannot be read as "there is nothing here"; one that is
+        merely empty keeps the behaviour it had, and drops out of the list.
+      -->
+      {#if person.hiredOn || withheld}
         <dt>{t('started')}</dt>
-        <dd>{formatDate(`${person.hiredOn}T00:00:00`)}</dd>
+        <dd>
+          {#if person.hiredOn}{formatDate(`${person.hiredOn}T00:00:00`)}{:else}{@render hiddenValue()}{/if}
+        </dd>
       {/if}
-      {#if person.phone}
+      {#if person.phone || withheld}
         <dt>{t('phone')}</dt>
-        <dd>{person.phone}</dd>
+        <dd>
+          {#if person.phone}{person.phone}{:else}{@render hiddenValue()}{/if}
+        </dd>
       {/if}
       {#if resolution?.orgUnitPath}
         <dt>{t('department')}</dt>
@@ -259,6 +292,14 @@ const left = $derived(person?.status === 'terminated')
       {/if}
     </dl>
 
+    <!--
+      Once for the panel, never once per field. The same sentence beside every marked row is a
+      lecture; the marks say *which* fields, and this says why, once, under all of them.
+    -->
+    {#if hiddenHere}
+      <p class="hint">{t('person_hidden_hint')}</p>
+    {/if}
+
     <Badge tone={person.status === 'active' ? 'active' : person.status === 'on_leave' ? 'upcoming' : 'grey'}
       >{person.status === 'active'
         ? t('status_active')
@@ -389,6 +430,11 @@ dl {
   gap: 8px 16px;
   margin: 0 0 16px;
 }
+/* The sentence below the list belongs to it, so the list gives up its own gap to keep them one
+   block rather than two things that happen to follow each other. */
+dl.tight {
+  margin-block-end: 8px;
+}
 dt {
   color: var(--kern-ink-500);
   font-size: 12px;
@@ -396,6 +442,21 @@ dt {
 dd {
   margin: 0;
 }
+/* A colour and a smaller size, never opacity — a faded value is unreadable whatever token it
+   names, and this one has to be read to be believed. */
+.withheld {
+  display: inline-flex;
+  align-items: center;
+  gap: 5px;
+  color: var(--kern-ink-500);
+  font-size: 12px;
+}
+.hint {
+  margin: 0 0 16px;
+  font-size: 12px;
+  line-height: 1.45;
+  color: var(--kern-ink-500);
+}
 .actions {
   display: flex;
   gap: 8px;

package/src/client/components/redaction.ts

@@ -0,0 +1,39 @@
+/**
+ * Whether the personnel fields on a card were withheld, or are genuinely empty.
+ *
+ * `HrAccessService` nulls four of them — personal email, phone, hire date, termination date — for
+ * anybody outside the reader's record scope, and nulls them **in place**: a redacted card parses as
+ * an ordinary `Person`, so a blank phone number would otherwise arrive at a screen meaning either
+ * "we are not showing you this" or "this person never gave us one". Those are two different facts
+ * about a colleague, and printing the second when the first is true is the defect this exists to
+ * stop.
+ *
+ * **The record says which, and this only reads it.** `Person.personnelHidden` is set in `forViewer`,
+ * the single place that does the nulling — so the answer comes from the code that made the decision
+ * rather than from a client re-deriving it.
+ *
+ * That matters because the client cannot re-derive it. This helper used to infer the answer from
+ * the reader's own permission keys, which works for the two extremes — somebody holding
+ * `hr.person.view_all` or `hr.person.manage` has nothing hidden, somebody holding none of the
+ * widening keys has everything but their own record hidden — and fails in the middle. A line
+ * manager or a country HR person holds `view_team` or `view_office`, and **which** people those
+ * cover is resolved on the server from the org chart: headship of a unit over an ltree subtree,
+ * headship of an office, `manager_person_id`, all as of today, across rows the directory never
+ * fetches. Inferring it would have meant a second implementation of that resolution, and "all four
+ * fields are null" is not evidence — a person really can have no personal email, no phone and no
+ * recorded hire date.
+ */
+export interface PersonnelSubject {
+  /**
+   * True when the server withheld the personnel fields on this record.
+   *
+   * Optional so a caller can pass a row that predates the field — `dev:mock` fixtures, an older
+   * cached payload — and get `false` rather than a crash. Absent means "not withheld", which is the
+   * safe direction: a screen that fails to mark a hidden field shows a blank, while one that marks
+   * an empty field asserts something false about a colleague.
+   */
+  personnelHidden?: boolean
+}
+
+/** Were this card's personnel fields withheld from the reader? */
+export const personnelWithheld = (person: PersonnelSubject): boolean => person.personnelHidden === true