-
Notifications
You must be signed in to change notification settings - Fork 176
feat: cap table, reports & overview dashboard with live data #561
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,33 @@ | ||
| import ActivitiesCard from "@/components/dashboard/overview/activities-card"; | ||
| import DonutCard from "@/components/dashboard/overview/donut-card"; | ||
| import EmptyOverview from "@/components/dashboard/overview/empty"; | ||
| import SummaryTable from "@/components/dashboard/overview/summary-table"; | ||
| import OverviewCard from "@/components/dashboard/overview/top-card"; | ||
| import { withServerComponentSession } from "@/server/auth"; | ||
| import { getOverviewData } from "@/server/overview"; | ||
| import type { Metadata } from "next"; | ||
|
|
||
| export const metadata: Metadata = { | ||
| title: "Overview", | ||
| }; | ||
|
|
||
| const OverviewPage = ({ | ||
| const OverviewPage = async ({ | ||
| params: { publicId }, | ||
| }: { | ||
| params: { publicId: string }; | ||
| }) => { | ||
| const session = await withServerComponentSession(); | ||
| const companyId = session?.user?.companyId; | ||
| const firstName = session?.user?.name?.split(" ")[0]; | ||
|
|
||
| const overview = companyId ? await getOverviewData(companyId) : null; | ||
|
|
||
| if (!overview || overview.isEmpty) { | ||
| return <EmptyOverview firstName={firstName} publicCompanyId={publicId} />; | ||
| } | ||
|
Comment on lines
+14
to
+27
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Overview page is missing RBAC gating. This route fetches and renders live cap-table-derived data without a permission check, unlike sibling dashboard routes in this PR. Add Suggested fix import EmptyOverview from "`@/components/dashboard/overview/empty`";
import SummaryTable from "`@/components/dashboard/overview/summary-table`";
import OverviewCard from "`@/components/dashboard/overview/top-card`";
+import { UnAuthorizedState } from "`@/components/ui/un-authorized-state`";
+import { serverAccessControl } from "`@/lib/rbac/access-control`";
import { withServerComponentSession } from "`@/server/auth`";
import { getOverviewData } from "`@/server/overview`";
import type { Metadata } from "next";
@@
const OverviewPage = async ({
params: { publicId },
}: {
params: { publicId: string };
}) => {
+ const { allow } = await serverAccessControl();
+ const canView = allow(true, ["stakeholder", "read"]);
+
+ if (!canView) {
+ return <UnAuthorizedState />;
+ }
+
const session = await withServerComponentSession();
const companyId = session?.user?.companyId;🤖 Prompt for AI Agents |
||
|
|
||
| return ( | ||
| <> | ||
| {/* <EmptyOverview firstName={firstName} publicCompanyId={publicCompanyId} /> */} | ||
|
|
||
| <header> | ||
| <h3 className="font-medium">Overview</h3> | ||
| <p className="text-sm text-muted-foreground"> | ||
|
|
@@ -31,17 +42,27 @@ const OverviewPage = ({ | |
| <div className="grid grid-cols-2 gap-8 md:grid-cols-2 lg:grid-cols-3"> | ||
| <OverviewCard | ||
| title="Amount raised" | ||
| amount={28000000} | ||
| amount={overview.amountRaised} | ||
| prefix="$" | ||
| /> | ||
| <OverviewCard title="Diluted shares" amount={7560010} /> | ||
| <OverviewCard title="Stakeholders" amount={28} format={false} /> | ||
| <OverviewCard | ||
| title="Diluted shares" | ||
| amount={overview.fullyDilutedShares} | ||
| /> | ||
| <OverviewCard | ||
| title="Stakeholders" | ||
| amount={overview.stakeholderCount} | ||
| format={false} | ||
| /> | ||
| </div> | ||
| </section> | ||
|
|
||
| {/* Tremor chart */} | ||
| <section className="mt-6"> | ||
| <DonutCard /> | ||
| <DonutCard | ||
| stakeholders={overview.ownershipByStakeholder} | ||
| shareClasses={overview.ownershipByShareClass} | ||
| /> | ||
| </section> | ||
| </div> | ||
|
|
||
|
|
@@ -59,7 +80,10 @@ const OverviewPage = ({ | |
| Summary of your company{`'`}s captable | ||
| </p> | ||
|
|
||
| <SummaryTable /> | ||
| <SummaryTable | ||
| rows={overview.summary} | ||
| totalRaised={overview.totalRaised} | ||
| /> | ||
| </div> | ||
| </> | ||
| ); | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| import { RBAC } from "@/lib/rbac"; | ||
| import { getPermissions } from "@/lib/rbac/access-control"; | ||
| import { getServerAuthSession } from "@/server/auth"; | ||
| import { db } from "@/server/db"; | ||
| import { REPORTS, isReportType } from "@/server/reports"; | ||
|
|
||
| export const GET = async ( | ||
| _req: Request, | ||
| { params }: { params: { type: string } }, | ||
| ) => { | ||
| const session = await getServerAuthSession(); | ||
|
|
||
| if (!session?.user?.companyId) { | ||
| return new Response("Unauthorized", { status: 401 }); | ||
| } | ||
|
|
||
| const { err, val } = await getPermissions({ db, session }); | ||
|
|
||
| if (err) { | ||
| return new Response("Forbidden", { status: 403 }); | ||
| } | ||
|
|
||
| const rbac = new RBAC(); | ||
| rbac.addPolicies({ stakeholder: { allow: ["read"] } }); | ||
| const enforced = rbac.enforce(val.permissions); | ||
|
|
||
| if (enforced.err || !enforced.val.valid) { | ||
| return new Response("Forbidden", { status: 403 }); | ||
| } | ||
|
|
||
| if (!isReportType(params.type)) { | ||
| return new Response("Not found", { status: 404 }); | ||
| } | ||
|
|
||
| const report = await REPORTS[params.type].generate(val.membership.companyId); | ||
|
|
||
| return new Response(report.body, { | ||
| headers: { | ||
| "Content-Type": report.contentType, | ||
| "Content-Disposition": `attachment; filename="${report.filename}"`, | ||
| "Cache-Control": "no-store", | ||
| }, | ||
| }); | ||
| }; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Use
Buttonas child wrapper for the link CTA.This currently nests
<Link>inside<Button>, which is invalid interactive nesting and can hurt accessibility/navigation behavior.Suggested fix
📝 Committable suggestion
🤖 Prompt for AI Agents