feat(team): role name/slug, shifts tab, and scanner outline icons

[iDorgham]

Summary

• Give each role a spaced display name and a stable slug, with seed/API/UI updates and a Prisma migration.
• Add a Shifts tab in Settings → Team, make Assign Gates always-visible (not hover-only), and polish settings chrome.
• Replace scanner emoji with outline Lucide icons; include PIN keypad / first-login password change that landed with this work.

Type of change

• feat — New feature
• fix — Bug fix
• perf — Performance improvement
• refactor — Code refactor (no behaviour change)
• chore — Tooling, deps, CI
• docs — Documentation only
• security — Security fix

Plan reference

Plan: settings/team polish + scanner icon pass (not a numbered Active plan phase)

Checklist

Code

• Follows conventional commit format (feat(scope): description)
• No hardcoded secrets, API keys, or credentials
• No console.log left in production code
• RTL / Arabic locale tested (if UI changes)

Tests

• New tests added for new behaviour
• All existing tests pass (pnpm preflight)
• No test snapshots blindly updated

Database

• If schema.prisma changed → migrations added (mustChangePassword, Role.slug)
• Local prisma migrate deploy / db execute still needs a reachable Postgres (localhost:5432 was down during implementation)

Env & Config

• New env vars added to scripts/check-env.js manifest
• New env vars documented in .env.example

Release

• CHANGELOG updated (auto via post-commit hook, or pnpm docs:changelog add)
• Breaking changes noted below (if any)

Breaking changes

Role matching now uses slug (ORG_ADMIN, SCHOOL_TEACHER). Display names may contain spaces. Apply both Prisma migrations before deploying:

• 20260814230000_add_user_must_change_password
• 20260815120000_add_role_slug

Screenshots / recordings

Settings → Team: Members / Invitations / Roles / Gate Access / Shifts / Activity. Role editor shows Name + Slug. Scanner bottom nav and overlays use outline icons only.

Test plan

• Apply the two Prisma migrations against a reachable database, then run pnpm exec tsx src/seed-roles.ts from packages/db
• Settings → Team: create/edit a role with a spaced name and confirm slug auto-fills (e.g. School Teacher → SCHOOL_TEACHER)
• Open the Shifts tab; edit an assignment via the always-visible Edit control
• Invite a member with must-change-password and complete /change-password on first login
• Scanner: confirm no emoji in nav/history/decision/PIN keypad; PIN setup (6) and unlock still work

Made with Cursor

---

Summary by cubic

Standardizes team roles around a canonical slug and spaced display name, adds a Shifts tab to Team settings, and replaces scanner emoji with outline icons. Old behavior matched roles by display name; new behavior matches by slug (for example ORG_ADMIN), and first-login flow now redirects members with must-change-password to a change-password screen.

• Review

  • Database: adds Role.slug and User.mustChangePassword with backfill and indexes; see schema.prisma and the two Prisma migrations.
  • Types and seeding: introduces role helpers in @gate-access/types (roleSlug, formatRoleLabel, visibility filters); built-in roles and seeds now use slug identifiers; UI and API use formatRoleLabel for display.
  • Settings UI: Team gets a Shifts tab and consistent headers via SettingsSectionHeader; gate assignment edit controls are always visible.
  • Auth: login returns mustChangePassword; adds /change-password route and action to complete forced password change.
  • Scanner: replaces emoji with Lucide outline icons; adds a PIN keypad component and refines secure PIN storage (DEVICE_PIN_KEY, SUPERVISOR_PIN_KEY) with tests; biometry stays in-app without device fallback; network errors include the API origin.

• Rollout

  • Apply Prisma migrations: 20260814230000_add_user_must_change_password and 20260815120000_add_role_slug.
  • Re-seed roles: run pnpm exec tsx packages/db/src/seed-roles.ts.
  • Update any configs or integrations to reference roles by slug (for example ORG_ADMIN, GATE_OPERATOR) instead of display name.
  • Flag existing members who must reset credentials by setting mustChangePassword = true; confirm redirect to /{locale}/change-password after login.

^{Written for commit 7fd0a2f. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5b26a1fd-8e5c-4197-b162-c0b2e968063b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}