@kernhq/module-hr 0.14.0 → 0.14.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kernhq/module-hr",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Kern HR module: people, offices, org chart, calendars",
   "license": "AGPL-3.0-only",
   "type": "module",

package/src/client/components/PersonPanel.svelte

@@ -22,7 +22,7 @@ import { hrKeys, isoDate } from '../query.js'
 import PersonDocumentsSection from './PersonDocumentsSection.svelte'
 import PersonJobSection from './PersonJobSection.svelte'
 import PersonSensitiveSection from './PersonSensitiveSection.svelte'
-import { personnelVisibility } from './redaction.js'
+import { personnelWithheld } from './redaction.js'
 import { explainRefusal } from './refusal.js'
 
 /**
@@ -195,11 +195,11 @@ const left = $derived(person?.status === 'terminated')
  * Whether the server withheld this person's personnel fields from this reader.
  *
  * The four it nulls arrive as nulls, so an empty phone row on this panel says "no phone number" —
- * a different and wrong fact. `personnelVisibility` says which of the two it is, or says it cannot
- * tell; only a certain `withheld` is marked, and the panel then explains itself once below the
- * list rather than once per field.
+ * a different and wrong fact. The record carries the answer (`personnelHidden`, set where the
+ * nulling happens), so this is a read rather than an inference; the panel then explains itself once
+ * below the list rather than once per field.
  */
-const withheld = $derived(person ? personnelVisibility(person) === 'withheld' : false)
+const withheld = $derived(person ? personnelWithheld(person) : false)
 /**
  * And only where something on *this* panel is actually blank because of it. The two are the same
  * thing while the client and the server agree about the reader's keys; tying the sentence to what

package/src/client/components/redaction.ts

@@ -1,51 +1,39 @@
-import { session } from '@kernhq/ui'
-import { canHr, canSeeFullRecords } from '../permissions.js'
-
 /**
  * Whether the personnel fields on a card were withheld, or are genuinely empty.
  *
  * `HrAccessService` nulls four of them — personal email, phone, hire date, termination date — for
  * anybody outside the reader's record scope, and nulls them **in place**: a redacted card parses as
- * an ordinary `Person`, so a blank phone number arrives at a screen meaning either "we are not
- * showing you this" or "this person never gave us one". Those are two different facts about a
- * colleague, and printing the second when the first is true is the defect this exists to stop.
- *
- * Nothing on the record says which it is, so this reconstructs what it can from the reader's own
- * keys — and answers `unknown` rather than guessing where it cannot:
+ * an ordinary `Person`, so a blank phone number would otherwise arrive at a screen meaning either
+ * "we are not showing you this" or "this person never gave us one". Those are two different facts
+ * about a colleague, and printing the second when the first is true is the defect this exists to
+ * stop.
  *
- * - `full` — nothing was withheld from this reader. `hr.person.view_all` reads the workspace, and
- *   `hr.person.manage` is unbounded for the same reason the server makes it so: the edit form is
- *   populated from the record it saves back, so a writer handed a redacted card would blank the
- *   fields they could not see. Everybody reads their own record besides, holding nothing at all.
- * - `withheld` — the reader holds none of the three widening keys, so every card but their own came
- *   back with all four nulled. Certain, and the common case: `hr.person.view` is a member default
- *   and most colleagues hold nothing above it.
- * - `unknown` — the reader holds `view_team` or `view_office`. **Which** people those cover is
- *   resolved on the server from the org chart — headship of a unit or an office, direct reports, as
- *   of today — and none of that reaches the client. A screen renders the field exactly as it
- *   arrived rather than labelling a genuinely empty phone number "Hidden".
+ * **The record says which, and this only reads it.** `Person.personnelHidden` is set in `forViewer`,
+ * the single place that does the nulling — so the answer comes from the code that made the decision
+ * rather than from a client re-deriving it.
  *
- * That third answer is the hole, and it is the server's to close: one boolean set where `forViewer`
- * already nulls the four would make every card say for itself, and every caller here collapses to
- * reading it. Until then a manager sees no marking on the people outside their team — the same
- * blank they see today, never a wrong sentence about it.
+ * That matters because the client cannot re-derive it. This helper used to infer the answer from
+ * the reader's own permission keys, which works for the two extremes — somebody holding
+ * `hr.person.view_all` or `hr.person.manage` has nothing hidden, somebody holding none of the
+ * widening keys has everything but their own record hidden — and fails in the middle. A line
+ * manager or a country HR person holds `view_team` or `view_office`, and **which** people those
+ * cover is resolved on the server from the org chart: headship of a unit over an ltree subtree,
+ * headship of an office, `manager_person_id`, all as of today, across rows the directory never
+ * fetches. Inferring it would have meant a second implementation of that resolution, and "all four
+ * fields are null" is not evidence — a person really can have no personal email, no phone and no
+ * recorded hire date.
  */
-export type PersonnelVisibility = 'full' | 'withheld' | 'unknown'
-
-/** Enough of a person to answer for — a directory row, a whole record, an office roster entry. */
 export interface PersonnelSubject {
-  /** The Kern account behind the record, when there is one: how a reader recognises their own. */
-  userId: string | null
+  /**
+   * True when the server withheld the personnel fields on this record.
+   *
+   * Optional so a caller can pass a row that predates the field — `dev:mock` fixtures, an older
+   * cached payload — and get `false` rather than a crash. Absent means "not withheld", which is the
+   * safe direction: a screen that fails to mark a hidden field shows a blank, while one that marks
+   * an empty field asserts something false about a colleague.
+   */
+  personnelHidden?: boolean
 }
 
-export function personnelVisibility(person: PersonnelSubject): PersonnelVisibility {
-  // The two grants the server treats as unbounded, asked in the order it asks them.
-  if (canHr('personViewAll') || canHr('personManage')) return 'full'
-  // Identity, never a grant. Plenty of employees have no account, so a null on either side is
-  // nobody's match rather than everybody's.
-  const userId = session.user?.id
-  if (userId && person.userId === userId) return 'full'
-  // `view_all` is answered above, so what is left of that union is team-or-office scope: a set of
-  // people only the server can name.
-  return canSeeFullRecords() ? 'unknown' : 'withheld'
-}
+/** Were this card's personnel fields withheld from the reader? */
+export const personnelWithheld = (person: PersonnelSubject): boolean => person.personnelHidden === true

package/src/client/pages/DirectoryPage.svelte

@@ -25,7 +25,7 @@ import { getHrApi } from '../api-instance.js'
 import DecisionDialog from '../components/DecisionDialog.svelte'
 import PersonFormDialog from '../components/PersonFormDialog.svelte'
 import PersonPanel from '../components/PersonPanel.svelte'
-import { personnelVisibility } from '../components/redaction.js'
+import { personnelWithheld } from '../components/redaction.js'
 import { t } from '../i18n.js'
 import type { ApprovalRequest } from '../index.js'
 import { canHr, HR_CAPABILITIES } from '../permissions.js'
@@ -434,12 +434,15 @@ const started = (iso: string | null) =>
  * and it arrives here as a null like any other — so the em dash this column drew for it said
  * "never started", about everybody in the company, to every colleague without a widening key.
  *
- * `personnelVisibility` answers `unknown` for a reader whose scope only the server can resolve, and
- * an unknown row keeps the dash: a dash over an empty field is imprecise, and "Hidden" over one is
- * a lie. Both are marked once, under the table, rather than per row.
+ * The record says which it is — `personnelHidden`, set at the one place that does the nulling — so
+ * a row is marked only when the server actually withheld it, and a genuinely empty hire date keeps
+ * its dash. Marked once, under the table, rather than per row.
+ *
+ * The `!person.hiredOn` half stays deliberately: the mark only ever goes over a value that is
+ * absent, so a stale or unrecognised payload can never paint "Hidden" across data on screen.
  */
-const startWithheld = (person: { userId: string | null; hiredOn: string | null }) =>
-  !person.hiredOn && personnelVisibility(person) === 'withheld'
+const startWithheld = (person: { hiredOn: string | null; personnelHidden?: boolean }) =>
+  !person.hiredOn && personnelWithheld(person)
 
 /** Whether anything on the page is actually marked — the sentence must not outlive the marks. */
 const anyWithheld = $derived(people.some(startWithheld))

package/src/client/permissions.ts

@@ -22,19 +22,9 @@ export function canHr(permission: HrPermission): boolean {
   return session.can(HR_PERMISSIONS[permission])
 }
 
-/**
- * Whether the viewer reads the personnel record behind a directory card, for anybody but themselves.
- *
- * Not "can they open somebody else's page" — everybody can, and should. `hr.person.view` is a
- * `member` default and the directory is meant to be read. What the three widening keys decide is
- * how much of each person comes back: personal email, phone, hire date and termination date are the
- * personnel record, and the server nulls all four for anybody outside the reader's scope.
- *
- * The three do not imply one another — a country HR manager must not silently become a global one —
- * so a screen asks the union once, here. It is only a hint: which *people* fall inside a team or an
- * office is resolved on the server from the org chart, so a screen may not conclude from `true`
- * that a particular person's record is readable. Render what came back; use this to decide whether
- * a "personal details" section is worth offering at all.
- */
-export const canSeeFullRecords = (): boolean =>
-  canHr('personViewTeam') || canHr('personViewOffice') || canHr('personViewAll')
+// No union helper over the three person-visibility keys. There has been one here twice —
+// `canSeeOthers`, then `canSeeFullRecords` — and both were dead the whole time, because the question
+// a screen actually has is "was *this* record withheld", and the answer to that is on the record:
+// `Person.personnelHidden`, set by the server at the one place that does the nulling. A client-side
+// union can only say "the reader holds one of three keys somewhere", which is never enough to decide
+// what to draw over one person's phone number. See `components/redaction.ts`.