feat(notes): shared team notepad — server API and client panel

[mcharles-square]

What

Adds a shared team notepad: one org-wide, append-style feed of notes that every team member can read and post to, summonable from any view via a toggle in the protoFleet page header (right-side slide-in panel — the page underneath stays interactive). Authors can edit/delete their own notes (with an "edited" indicator); a moderation permission allows deleting any note.

Server — NoteService (Connect-RPC): ListNotes (keyset pagination, opaque cursor mirroring the activity log), CreateNote, UpdateNote, DeleteNote. New note table (org-scoped, soft-delete, updated_at trigger) and a domain service that trims/validates content (4096 runes), enforces author-only edit and author-or-moderator delete, and logs note.created/updated/deleted activity events under a new note category.

RBAC — three new catalog keys: note:read, note:create (add + edit/delete own), note:manage (delete any; never grants editing others' words). All built-in roles get read + create; ADMIN and SUPER_ADMIN additionally get manage. Seed migration backfills existing orgs (boot reconciliation only seeds additive built-ins at role creation — same precedent as the pool/activity seeds, except FIELD_TECH is deliberately included here since the notepad is for every member).

Client — header toggle + slide-in panel with composer, day-grouped feed (Today/Yesterday), per-author avatar colors from the extended palette, Load more pagination, and a 60s head-refresh poll while open that merges into the accumulated list without collapsing loaded pages (idle ticks return the previous array reference, so React skips the re-render). Note activity events get proper icons in the activity feed.

Why

With teams and roles in place, the org needs a lightweight shared space for operational notes ("genset maintenance at 3pm", "rack 12 PSU flaky") without leaving the app.

Decisions a reviewer should weigh

• Any-scope permission gate. EffectivePermissions.Has consults only org-scope grants for org-scoped resources, which would lock out users whose only assignment is site-scoped (e.g. FIELD_TECH @ one site). Since the notepad is an org-shared surface with no site dimension to narrow on, new *Anywhere middleware gates (backed by EffectivePermissions.HasAnywhere) pass when the caller holds the key under any assignment. This deliberately matches the client's flat-key useHasPermission gating (FlatKeys() semantics), so client visibility and server authorization agree by construction. All five permission gates now share one resolveCaller preamble (session lookup → internal-actor allowlist → fail-closed permissions fetch).
• Moderation ≠ editing. note:manage allows deleting any note but never editing one — a note's content always reflects its author's words. Ownership is enforced in the domain layer and repeated in the SQL UPDATE predicate so it can't race.
• Audit without leaking. Activity rows carry note id + content length, never content — the audit feed can't become a side channel around a deleted note.
• Edited indicator is derived (updated_at > created_at); no extra column.

Notes for reviewers

• Migrations are 000081_create_note_table and 000082_seed_note_permissions (renumbered after upstream took 000080). If your local dev DB ran an earlier cut of this branch, recreate it — golang-migrate tracks by version number and will otherwise skip upstream's 000080.
• buf lint currently fails on main for pre-existing collection.proto/device_set.proto warnings (protovalidate IGNORE_IF_ZERO_VALUE redundancy) — unrelated to this change; notes.proto lints clean.
• Site/building activity events still fall back to the Info icon (no site.* keys in the icon map) — left as is to keep this scoped; trivial follow-up if wanted.

Testing

• Server: handler gate tests (incl. the site-scoped-caller regression the any-scope gates exist for), author/moderator matrix, cursor round-trip + bad-token cases, trim/whitespace validation; domain tests for content bounds, Forbidden paths, activity events (incl. moderated metadata); DB-backed store tests for keyset pagination with created_at ties, cross-org isolation on every verb, soft-delete exclusion; authz tests for HasAnywhere (narrowing interplay + FlatKeys parity) and reconcile seed assertions. RPC contract test classifies all four procedures.
• Client: feed-hook tests (cursor accumulation, race guard, mergeHeadPage merge/dedup/drop + same-reference bail), panel tests (permission gating, composer visibility, moderation affordances, edited indicator).
• Manual smoke against the dev stack: posting/editing/deleting as different roles, moderation delete, panel polling, Load more.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1df00a91fa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Adds an org-wide “shared team notepad” feature across the stack (DB + RBAC + Connect-RPC service + ProtoFleet UI) so team members can read/post notes, edit/delete their own notes, and moderators can delete any note, with activity logging.

Changes:

• Server: introduces NoteService (List/Create/Update/Delete), note domain service + SQL store, activity category/event types, and new permission keys with seed/backfill migrations.
• Authz/middleware: adds HasAnywhere + *Anywhere permission gates to allow access based on any assignment scope (org or site) for org-shared resources.
• Client: adds header toggle + slide-in notepad panel UI, feed hook with keyset pagination + head polling merge, mutations, and activity icons.

Reviewed changes

Copilot reviewed 49 out of 55 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
server/sqlc/queries/note.sql	sqlc queries for note CRUD + keyset pagination
server/migrations/000081_create_note_table.up.sql	Creates note table, index, and updated_at trigger
server/migrations/000081_create_note_table.down.sql	Drops note trigger/index/table
server/migrations/000082_seed_note_permissions.up.sql	Seeds note permissions and backfills built-in roles
server/migrations/000082_seed_note_permissions.down.sql	Rollback for seeded note permissions
server/internal/handlers/notes/handler.go	Connect-RPC NoteService handler + cursor encode/decode
server/internal/handlers/notes/translate.go	Domain ↔ proto translation for notes
server/internal/handlers/notes/handler_test.go	Handler tests for gates, pagination token behavior, and auth rules
server/internal/handlers/middleware/permission.go	Adds resolveCaller preamble + *Anywhere permission gates
server/internal/handlers/middleware/permission_test.go	Tests for RequirePermissionAnywhere, RequireAnyPermissionAnywhere, and probe semantics
server/internal/handlers/middleware/rpc_permissions.go	Registers NoteService procedures in the RBAC contract map
server/internal/handlers/middleware/rpc_permissions_test.go	Adds NoteService to RBAC contract reflection coverage
server/internal/handlers/handlerstest/permissions.go	Adds helpers for site-scoped assignments/session info in handler tests
server/internal/domain/notes/service.go	Notepad domain rules: normalize, author-only edit, moderator delete, activity events
server/internal/domain/notes/service_test.go	Domain tests for normalization, bounds, auth rules, activity metadata, nil activity svc
server/internal/domain/notes/models/models.go	Notepad domain shapes + page size/content limits
server/internal/domain/stores/interfaces/note.go	NoteStore interface definition
server/internal/domain/stores/interfaces/mocks/mock_note_store.go	Generated mock for NoteStore
server/internal/domain/stores/sqlstores/note.go	SQL-backed NoteStore implementation using sqlc
server/internal/domain/stores/sqlstores/note_integration_test.go	DB integration tests: pagination ties, cross-org isolation, soft delete
server/internal/domain/authz/catalog.go	Adds note permission keys and resource grouping to catalog
server/internal/domain/authz/catalog_test.go	Catalog completeness/resource order tests updated for note permissions
server/internal/domain/authz/builtin.go	Adds note permissions to FIELD_TECH seed + updates description
server/internal/domain/authz/reconcile_test.go	Ensures built-in roles seed note permissions on fresh install
server/internal/domain/authz/service_test.go	Adds validateReadPairing coverage for note permission pairing
server/internal/domain/authz/effective.go	Adds EffectivePermissions.HasAnywhere union semantics
server/internal/domain/authz/effective_test.go	Tests HasAnywhere behavior + FlatKeys parity
server/internal/domain/activity/models/models.go	Adds note activity category + validation support
server/internal/domain/activity/models/models_test.go	Tests CategoryNote validity
server/cmd/fleetd/main.go	Wires note store/service/handler into the server mux
proto/notes/v1/notes.proto	Defines NoteService RPCs and message schemas/validation
server/generated/sqlc/note.sql.go	Generated sqlc output for note queries
server/generated/sqlc/models.go	Generated sqlc model for note
server/generated/sqlc/db.go	Generated sqlc prepared statement wiring for note queries
server/generated/grpc/notes/v1/notes.pb.go	Generated Go protobuf types for NoteService
server/generated/grpc/notes/v1/notesv1connect/notes.connect.go	Generated Connect-RPC bindings for NoteService
client/src/protoFleet/api/generated/notes/v1/notes_pb.ts	Generated TS protobuf types/service for NoteService
client/src/protoFleet/api/clients.ts	Adds notesClient to the API client registry
client/src/protoFleet/api/notes.ts	Client mutation helpers for create/update/delete note
client/src/protoFleet/api/useNotesFeed.ts	Feed hook: pagination + head refresh merge logic
client/src/protoFleet/api/useNotesFeed.test.ts	Tests feed pagination/merge behavior and error routing
client/src/protoFleet/features/notes/noteFormat.ts	Formatting helpers (day grouping, timestamps, avatar color hashing)
client/src/protoFleet/features/notes/index.ts	Exports NotepadPanel feature entrypoint
client/src/protoFleet/features/notes/components/NotepadPanel.tsx	Slide-in notepad panel UI + polling integration
client/src/protoFleet/features/notes/components/NotepadPanel.test.tsx	Panel tests (gating, composer visibility, affordances, empty state, load more)
client/src/protoFleet/features/notes/components/NoteComposer.tsx	Note composer with trim/length guard + submit state
client/src/protoFleet/features/notes/components/NoteCard.tsx	Note card rendering + edit/delete flows + edited indicator
client/src/protoFleet/features/activity/utils/activityIcons.tsx	Adds activity icons for note events
client/src/protoFleet/features/activity/components/ActivityTable.tsx	Minor icon alignment tweak (mt-1)
client/src/protoFleet/store/slices/uiSlice.ts	Adds ephemeral isNotepadOpen UI state + setter
client/src/protoFleet/store/hooks/useUI.ts	Adds selectors for notepad open state + setter
client/src/protoFleet/store/index.ts	Re-exports notepad UI selectors
client/src/protoFleet/components/PageHeader/PageHeader.tsx	Adds header toggle button for opening/closing notepad
client/src/protoFleet/components/PageHeader/PageHeader.test.tsx	Tests notepad toggle visibility and click behavior
client/src/protoFleet/components/AppLayout/AppLayout.tsx	Mounts NotepadPanel in the ProtoFleet layout

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (4e477bde2d91904326a03fd27ca37c43d474251c...c2302368b1e6fc3246ed9aeb128dd3c75fdde15e, exact PR three-dot diff)
• Model: gpt-5.5

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: MEDIUM

Findings

[MEDIUM] Notepad Opens With A Head-Only Fetch That Drops Pagination State

• Category: Frontend | Reliability
• Location: client/src/protoFleet/features/notes/components/NotepadPanel.tsx:54
• Description: The panel’s initial fetch is driven by usePoll({ fetchData: refreshHead, ... }). usePoll runs immediately when the panel opens, but refreshHead() only merges the first page and does not store nextPageToken or set hasMore unless the head page is empty. On a feed with more than PAGE_SIZE notes, the first open loads 25 notes but leaves hasMore=false, so the “Load more” control never appears.
• Impact: Users cannot access older notes from a normal panel open, making the shared notepad silently incomplete for larger teams. Initial load errors are also swallowed by the poll path, so a persistent failure can leave the panel spinning without surfacing the error.
• Recommendation: Use the full refresh() path for the first open, then use refreshHead() only after the initial page has loaded. Alternatively, make refreshHead() detect !hasLoaded and initialize pageToken/hasMore from response.nextPageToken.

Notes

No high-impact authentication bypass, SQL injection, command injection, network discovery, plugin boundary, pool hijack/cryptostealing, or protobuf wire-format issues were found in the reviewed diff. The new note SQL is sqlc-generated and parameterized, and server-side note authorization derives org/user identity from the authenticated session rather than client input.

---

_{Generated by Codex Security Review |
Triggered by: @mcharles-square |
Review workflow run}

[mcharles-square]

[MEDIUM] Notepad Opens With A Head-Only Fetch That Drops Pagination State — On a feed with more than PAGE_SIZE notes, the first open loads 25 notes but leaves hasMore=false, so the "Load more" control never appears. ... Initial load errors are also swallowed by the poll path.

Addressed (both halves, in 641a226 and 6acb1a6):

• refreshHead now seeds pageToken/hasMore from the response on the tick that performs the initial load — at that point the head page is the entire accumulated list, so its continuation token is the correct Load-more cursor. Later ticks still leave the cursor alone (it tracks the bottom of the accumulated list, not the head window), and an empty token still clears it. Covered by new unit tests, including one asserting a post-load tick with a continuation token does not resurrect a stale cursor.
• The error-swallowing half was fixed for the inline review feedback: refreshHead surfaces failures until the first successful load (error callout instead of an indefinite spinner) and clears the error once a tick succeeds, so the still-running poll self-heals the panel.