#393 Share The Remaining Authorization Scope Copies In Application Actions

[b-at-neu]

Closes #393

Summary

• Consolidates the two hand-rolled manager-scoping clauses in prisma/actions/applications.ts into a shared lib/auth/scopes.ts, alongside the file-private buildBaseWhere that used to live in prisma/data/applications.ts.
• Expresses the draft vs withdrawn distinction as a 'listable' | 'reviewable' argument on the shared builder, instead of each caller patching a post-spread status: { notIn: [...] }.
• Replaces the as casts on /applications search params with a zod schema.

Changes

• lib/auth/scopes.ts (new) — buildReviewablePositionWhere, buildApplicationScopeWhere (typed Omit<Prisma.ApplicationWhereInput, 'status'> so a caller's status filter can never overwrite the manager scoping), and buildApplicationWhere(user, 'listable' | 'reviewable').
• prisma/data/applications.ts — dropped buildBaseWhere and the two post-spread withdrawn patches; getApplicationForReview, getApplications, getApplicationsTotal use buildApplicationWhere(user, 'listable'); getApplicationStatusCounts, getRecentApplications use buildApplicationWhere(reviewer, 'reviewable'); getReviewablePositions uses buildReviewablePositionWhere.
• prisma/actions/applications.ts — updateApplicationStatus / updateApplicationStatuses lose their admin/manager ternaries and the "Merge, don't overwrite" comments in favor of the shared builders; dropped the now-unused PUBLISHED_POSITION_WHERE / NON_REVIEWABLE_APPLICATION_STATUSES imports.
• lib/constants.ts / lib/types.ts — added APPLICATION_SORT_FIELDS / APPLICATION_SORT_DIRECTIONS as the single source for the sort unions and the page's zod enums.
• app/(main)/(auth)/applications/page.tsx — a searchParamsSchema (zod) replaces the as casts, the typeof === 'string' checks, and the VALID_SORT_* arrays; every field is .optional().catch(undefined) so an unparseable or repeated (string[]) value is dropped without discarding the rest or throwing during render.
• tests/db/authorization.test.ts — new coverage for the action-side position scoping (draft/soft-deleted position, withdrawn application) and the listable/reviewable split on the data side.

No behavior change: the scoping semantics, the two actions' { error } copy, and the page's happy-path rendering are identical to before.

Testing plan

• As a manager of one position: /applications lists only that position's applications, withdrawn included, drafts excluded; the position filter offers only your positions.
• Same manager: open an application detail page, move it through two statuses — success toasts, badge updates, dashboard counts move.
• Same manager: bulk-select rows and apply a status — updated/skipped counts read as before.
• Same manager: paste the id of an application on another manager's position into /applications/<id> → 404 page.
• Same manager: attempt updateApplicationStatus/updateApplicationStatuses on an application belonging to a position they don't manage, or one that's on a draft/soft-deleted position, or one that's withdrawn → denied (throw / skipped, not a data leak).
• As an admin: the list shows both managers' applications; dashboard pipeline counts and recent activity exclude withdrawn rows.
• URL hardening on /applications: ?status=bogus, ?sort=bogus, ?sort=name:sideways, ?status=applied&status=reviewing (repeated param), ?q= (empty), a 5,000-character q — each loads the page with the bad filter ignored and the good ones applied; no error page.
• ?sort=name:asc, ?status=reviewing, ?positionId=<id>, ?userId=<id> still work, including the per-user deep link from the users table.
• npm run test (unit + db) green.

Automated checks

• npm run prettier:check — pass
• npm run eslint:check — pass
• npm run tsc:check — pass

Notes

• The third manager clause in prisma/actions/question-files.ts (getQuestionFileUrl) is deliberately left alone — it's owner-or-manager and intentionally reaches drafts/draft positions, so folding it into the reviewer scope would be a behavior change, not this ticket.
• getManagedPositions / isManager also stay as-is — management surfaces include draft positions, a different predicate despite the resemblance.
• The ENGINEERING.md §3 capability-matrix row naming the shared builder is left to a main-session PR, since .claude/ isn't writable by pipeline agents.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
aplio	Ready	Preview	Aug 19, 2026 11:21pm

[b-at-neu]

Code Review — Cycle 1 · approved

0 open