THR Reference

1. Apa itu THR

THR (Todak HRMS) = Production-grade Human Resource Management System untuk Todak Holdings group. Platform multi-tenant, multi-country, multi-currency yang serve 24 organizations across Malaysia + Indonesia.

Tujuan

• Self-service HR: employee check in/out, apply leave, submit claims, tengok payslip, update profile sendiri
• Manager workflows: approve leave/claims, tengok team reports, manage org assignments (sekarang underused — tengok §11)
• HR admin: payroll batch processing, EA forms, statutory compliance (EPF/SOCSO/PCB MY + BPJS/PPh21 ID), setup leave entitlement
• System admin: users, roles, organizations, audit trail, system configuration
• Comms: internal messaging, memos dengan read receipts, notifications (in-app + email + WhatsApp)
• Documents: employee photos, contracts, certificates, payslips, company policies

Production URLs

Kedua-dua share Supabase database yang sama — cuma frontend yang berbeza.

Live Activity Snapshot (2026-04-21)

2. Tech Stack

Frontend

Data & Backend

Visualization & Reports

AI Layer

• OpenAI GPT-4 (openai 6.9.1) — claims form auto-fill
• Sofia AI Assistant — internal chatbot framework (dah provisioned, belum rolled out)
• Multi-AI service — abstraction layer untuk switch antara providers (multiAIService.js)
• Edge Functions: ai-intent (intent classification), sofia-multi-ai, ai-generate-view, process-document-ai

Testing (coverage minimal)

• Jest 29.7 + jsdom + React Testing Library
• Puppeteer 24.15 (capability E2E ada, tapi mostly tak guna)
• Hanya ada sikit test files: Login.test.jsx, LeaveManagementRefactor.test.jsx, staging-smoke-test.js

3. Architecture

Data Flow Pattern

4. Repository Layout

Path Aliases (vite config)

'@'         → './src'
'@modules'  → './src/modules'
'@shared'   → './src/shared'
'@core'     → './src/core'
'@hooks'    → './src/hooks'
'@payroll'  → './src/modules/payroll'
'@employees'→ './src/modules/employees'
'@claims'   → './src/modules/claims'

5. Database Overview

Project: ftbtsxlujsnobujwekwx · Region: Singapore (ap-southeast-1) · Engine: PostgreSQL 15

Table Groups (ikut domain prefix)

Top 20 Tables ikut Row Count

Postgres Extensions

6. Table Utama — Schema Detail

7. JSONB Blob Schemas

Table thr_employees pakai extensive JSONB blobs supaya schema flexible. Ni apa yang sebenarnya ada dalam setiap blob (verified dari production data):

personal_info

contact_info

employment_info

compensation

bank_info

tax_info

-- Ambil employment_status (hanya dalam JSONB)
SELECT employment_info->>'employment_status' AS status FROM thr_employees;

-- Filter ikut JSONB key
SELECT * FROM thr_employees
WHERE employment_info->>'employment_status' = 'active';

-- Update JSONB key
UPDATE thr_employees
SET employment_info = jsonb_set(employment_info, '{hire_date}', '"2026-01-15"');

-- Search nested
SELECT * FROM thr_employees
WHERE personal_info @> '{"gender": "male"}';

8. Views & RPCs

Notable Views (26 total)

RPCs / Functions (255 total — business logic pilihan)

Employee Lifecycle

• archive_employee(id, reason) · restore_archived_employee(id)
• create_employee_in_organization(...) — auto-mint employee_no ikut format org
• can_delete_employee(id)
• calculate_profile_completion(id) — return percentage + missing fields
• sync_users_with_employees() · link_auth_user_to_employee() · manually_link_auth_users()
• search_employees_flexible(query) — full-text employee search across name/email/phone/dll
• get_current_employee() — resolve auth.uid() → employee row

Access / Permissions

• is_super_admin() · is_super_admin_simple()
• is_org_admin(org) · is_hr_in_organization(org)
• can_user_access_employee(id) · can_user_update_employee(id)
• get_user_accessible_orgs() → uuid[]
• get_user_data_scope()
• check_user_capability(capability)
• admin_can_access_org(org_id)
• suggest_access_level_strategy(employee_id)
• update_access_level_by_email(email, level) / _by_email_and_org

Attendance

• get_attendance_today() · get_organization_attendance_today(org)
• get_attendance_summary(emp, start, end)
• get_attendance_status(employee_id)
• get_pending_checkouts() — fed masuk cron auto-checkout
• calculate_work_hours(in, out)

Leave (tambahan kepada WhatsApp variants — tengok §22)

• initialize_employee_leave_balances_by_org / _ctk / initialize_leave_balances_smart
• update_org_leave_balances() / _fixed
• sync_leave_balance_to_json · refresh_leave_balances_json
• get_leaves_for_payroll(period)

Claims

• generate_claim_number / set_claim_number / generate_claim_no
• get_claims_for_payroll(period)
• mark_claims_as_paid(batch_id) → int

Payroll & Tax

• calculate_pcb_simple(monthly_salary) → numeric — Malaysia PCB tax
• generate_batch_no() — auto batch numbering
• calculate_asset_depreciation → numeric (untuk asset claims)
• format_currency(amount, currency) · get_exchange_rate(from, to, date)

Notifications

• create_notification_from_template · mark_notification_read · get_unread_notification_count
• notify_claim_submission · notify_claim_status_update
• notify_leave_application · notify_leave_status_change/update
• notify_payroll_ready · notify_announcement · notify_new_message
• queue_memo_email (2 overloads) · track_email_read

Audit & Maintenance

• audit_log(table, record_id, action, ...) — generic writer
• Trigger fns: audit_employee_changes, audit_organization_changes, audit_claims_changes, audit_payroll_changes
• cleanup_activity_logs() · archive_old_audit_records()
• create_activity_log_partition / drop_old_activity_log_partitions
• search_audit_trail(query, filters)
• log_activity(module, action, target)

Team / Org

• get_team_members(manager_id) · get_team_count
• update_reporting_structure
• search_leadership_by_org
• delete_organization_cascade(org_id) / _with_cleanup
• auto_assign_organization · trigger assign_position_organization
• validate_employee_organization_correct/prefix

Dashboard / Misc

• get_employee_dashboard_stats(employee_id) → json
• check_expiring_documents()
• refresh_materialized_view(name)
• Meta helpers: exec_sql, list_tables, get_all_tables, get_policies_for_table, get_policy_definition, get_table_relationships

9. Storage Buckets

10. Authentication Flow

Methods yang Disupport

• ✅ Google OAuth (primary — semua 245 users ada provider_id dari Google)
• ✅ Email + password (Supabase native)
• ✅ Magic link (Supabase native)
• ❌ Takde SAML/SSO custom integrations

Login Flow

Session Management

• Token storage: Supabase JWT dalam localStorage
• Auto-refresh: enabled (autoRefreshToken: true)
• State sync: onAuthStateChange() trigger re-render
• Inactivity timeout: hook useInactivityTimeout() (auto-logout lepas idle)
• Custom claims: TAK digunakan — access_level hidup dalam DB row, bukan JWT

Auth Hooks

Auth Metadata Inspection

Semua 245 auth.users ada structure yang identical (Google OAuth populated):

11. Roles & Permissions

Access Level System (numeric 0-8 + special 70/80)

Macam Mana Permissions Di-check

1. Frontend (UI gating)

// Inline checks (paling biasa)
if (empData.access_level >= 7) { showHRAdminMenu() }
if (empData.access_level === 8) { showSystemAdminMenu() }

// Context provider
<AccessLevelProvider>
  <Routes>
    <Route path="/payroll" element={
      <RequireLevel min={7}>...</RequireLevel>
    } />
  </Routes>
</AccessLevelProvider>

2. Backend (DB SECURITY DEFINER functions)

SELECT is_super_admin();              -- bool (level 8)
SELECT is_hr_in_organization(:org);   -- bool (level 7+ assigned)
SELECT get_user_accessible_orgs();    -- uuid[]
SELECT can_user_access_employee(:id); -- bool (RBAC check)

3. Org-scoping untuk HR Admin (Level 7)

HR Admins nampak hanya orgs yang assigned. Table mapping:

thr_admin_org_assignments
├── admin_user_id (auth.users.id)
├── employee_id    (thr_employees.id)
├── organization_id
├── assigned_by
├── is_active
└── notes

Service: hrOrganizationService.getChangeRequestScope() return { canViewAll: boolean, organizationIds: string[] }. Digunakan dalam 19+ files.

Note: Bug lepas Dec 2025 — nama column salah employee_id vs admin_user_id menyebabkan HR Admins hilang access. Sudah dibetulkan dalam hrOrganizationService.

Approval Workflows

Leave Application Flow

Claims Flow

12. Multi-Tenancy

Organization Structure

24 organizations — Todak Holdings group companies. Semua is_active=true.

Semua Organizations Aktif

Macam Mana Tenants Isolate Data

• Discriminator: column organization_id atas thr_employees + kebanyakan thr_* tables
• Per-org config: work hours, shifts, attendance selfie requirement, employee_no format prefix, overtime rules, currency — semua hidup sebagai columns atas thr_organizations
• Multi-org employee: M:N support via thr_employee_organizations (510 rows) — employees boleh belong to multiple orgs
• Per-org leave types: overrides via thr_leave_entitlements
• Filtering: Frontend services filter ikut organization_id; backend functions macam get_user_accessible_orgs() return scoped lists

13. Row Level Security Status

Tables Tanpa RLS (yang sensitive)

Tables dengan RLS Policies Paling Banyak

Apa Maksudnya Dalam Practice

• Frontend guna VITE_SUPABASE_PUBLISHABLE_KEY (anon-style, respect RLS)
• Kalau RLS OFF atas satu table → mana-mana authenticated user boleh baca semua benda
• Filtering di application-layer je jadi barrier (dan maknanya bug UI boleh leak data)
• Edge Functions / Netlify Functions guna service-role key → bypass semua RLS regardless

14. Security Posture (Honest Assessment)

Yang Kuat

• ✅ OAuth-only effective auth — Google handle MFA, password rotation
• ✅ HTTPS everywhere — Netlify TLS, Supabase TLS
• ✅ Secrets management — env vars, takde secrets dalam repo
• ✅ Audit trail — extensive logging via 4 audit systems
• ✅ Security headers — X-Frame-Options DENY, XSS-Protection, dll. dalam netlify.toml
• ✅ Inactivity timeout — auto-logout via useInactivityTimeout
• ✅ Org-scoped HR Admin — proper data partitioning di application level

Yang Lemah

• 🔴 RLS disabled kat key tables (employees, attendance, leave) — tengok §13
• 🔴 Service-role key ada DB-wide access — satu leak = total exposure
• 🟡 Takde MFA enforcement untuk non-Google logins (email/password path)
• 🟡 Takde tenant claim dalam JWT — multi-tenancy purely app-layer
• 🟡 Staging share prod DB — schema migrations affect kedua-dua
• 🟡 Cron embed service JWT inline — rotation kena edit cron commands
• 🟡 Test orgs dalam production (TORG, PT_TEST_ID) bercampur dengan data sebenar
• 🟢 Nginx basic auth password dalam CLAUDE.md memory (lan/lan1q2w3e — untuk CCC, bukan THR)

Actions yang Disyorkan

1. Enable RLS atas critical tables — start dengan thr_employees, thr_attendance, thr_leave_applications
2. Asingkan Supabase project untuk staging — isolate dari production
3. Rotate service-role JWT dalam cron jobs — guna Supabase Vault
4. Padam test orgs dari production (TORG, PT_TEST_ID)
5. Tambah MFA enforcement untuk super admin accounts
6. Audit log retention policy — sekarang takde automatic pruning untuk activity_logs (11k+ rows makin membesar)

15. Semua Routes

16. Modules Breakdown

Located dalam /src/modules/ — 11 modules:

17. Service Layer

Located dalam /src/shared/services/ — 37+ business logic services. Frontend components call services, services call Supabase.

Core Services

Leave & Attendance

Communications

AI Layer (multi-provider)

Agent Routing System

Infrastructure

18. Attendance — Deep Dive

Macam Mana Check-In Berfungsi

Auto-Checkout (cron)

• Schedule: Setiap 15 minit (*/15 * * * *)
• Job name: auto-checkout-every-15min
• Action: POST ke /functions/v1/auto-checkout
• Logic: Call get_pending_checkouts(), apply auto_checkout_time org

Selfie Cleanup (cron)

• Schedule: Setiap hari 02:00 (0 2 * * *)
• Job name: cleanup-attendance-selfies-daily
• Action: POST ke /functions/v1/cleanup-attendance-selfies

Stats — Activity Pattern

~55-60 check-ins per weekday — hanya ~10% daripada 612 employees. Menandakan usage terhad kepada specific orgs (kemungkinan TCSB, TASB).

19. Leave Management

Leave Types (10 seeded)

Approval Workflow

Year-End Processing

Edge Function leave-year-end handle annual carryover. Service: leaveYearEndService.js.

Stats

• Total applications (lifetime): 11
• Dalam 14 hari lepas: 1 (2026-04-08)
• Leave balances tracked: 1,761 rows (per employee × per leave type)
• Leave entitlements configured: 181

20. Claims (Expense Reimbursement)

Features

• AI-assisted form fill — OpenAI GPT-4 baca receipt, suggest fields
• Multi-currency — original_amount + original_currency + exchange_rate
• Receipt upload — ke claim-receipts bucket
• Auto-numbering — trigger trg_generate_claim_number generate CLM-{org}-{seq}
• Approval chain — employee → manager → finance
• Payroll integration — get_claims_for_payroll(period) + mark_claims_as_paid(batch_id)

Stats

• Total claims: 3 (usage sangat rendah)
• Claims dalam 14 hari lepas: 0
• Claim items: 0

21. Payroll & Statutory

Multi-Country Statutory Calculations

Payroll Tables

EA Form Generation (Malaysia)

• Service: eaFormService.js
• Guna pdf-lib untuk fill official EA form template
• Per-employee, per-tax-year

Indonesia Payroll

• Service: indonesianPayrollService.js
• Hanya 15 ID employees tapi full infrastructure dah ready
• PPh21 calculation, PTKP allowances

Payslip Output

• PDF generation: jsPDF + jspdf-autotable
• Simpan dalam payslips bucket (sekarang 0 files — generated on-demand)
• Self-service view: /my-payroll (Level 0)

22. WhatsApp Bot Integration

WhatsApp RPC Functions

Lookups: phone numbers kemungkinan resolve ke thr_employees via field JSONB contact_info->>'phone'.

Architecture

23. Internationalization

Bahasa yang Disupport

• 🇬🇧 English (en) — default
• 🇮🇩 Indonesian (id)
• ❌ Bahasa Malaysia (BM sekarang tak disupport walaupun user base utama Malaysian — biasanya fall back ke English)

Setup

• Library: i18next 25.7 + react-i18next 16.5
• Detection: Browser preference → localStorage thr_language override
• Loading: i18next-http-backend (lazy load JSON per namespace dari /public/locales/)

Namespaces (per file JSON bahasa)

Usage Pattern

const { t } = useTranslation(['namespace', 'common']);
<Button>{t('namespace:submit_button_label')}</Button>

24. Notifications & Email

Multi-Channel Delivery

Anti-Spam Architecture (4-layer dedup)

1. Frontend dedupe — UI elak double-submit
2. Service dedupe — service layer check recent sends
3. UNIQUE INDEX — DB constraint atas (recipient, content_hash, date)
4. Upsert ignoreDuplicates — safety net terakhir

Incident lepas (Dec 2025): Multi-org employee dapat 10+ duplicate memo emails. Fixed dengan tambah keempat-empat layers.

Email Queue

Notification Triggers

• notify_claim_submission · notify_claim_status_update
• notify_leave_application · notify_leave_status_change/update
• notify_payroll_ready
• notify_announcement · notify_new_message
• queue_memo_email (2 overloads)

25. Sofia AI Assistant

Sofia Tables (semua kosong)

• sofia_conversations — chat history
• sofia_analytics — usage tracking
• sofia_knowledge_base — RAG content
• sofia_document_queue — doc ingestion
• sofia_learning_queue — feedback loop

Edge Functions Ready

• sofia-multi-ai — multi-model chat
• ai-intent — classify user intent
• ai-generate-view — AI-generated UI views
• process-document-ai — doc analysis

Frontend Services Ready

• enhancedSofiaService.js
• sofiaDataService.js
• sofiaInsightsService.js
• sofiaKnowledgeService.js
• thrSystemKnowledge.js (AI context)

Future Capability

Extension pgvector 0.8 dah installed → ready untuk semantic search atas knowledge base bila launched nanti.

26. ATLAS Module (Future)

Planned Structure

• components/ — UI components berkaitan Asset
• pages/ — Asset management pages (AssetDashboard, AssetInventory, dll.)
• services/ — Asset API services
• hooks/ — React hooks specific untuk Asset
• utils/ — Utility functions Asset

Current State

// /src/modules/atlas/index.js
export const ATLAS_MODULE_READY = false;

// Future exports will include:
// export { default as AssetDashboard } from './pages/AssetDashboard';
// export { default as AssetInventory } from './pages/AssetInventory';
// export * from './services/assetService';

Integration Rules (dari README)

1. Letak semua code specific ATLAS dalam module ni
2. Guna shared services untuk authentication
3. Communicate dengan THR modules via events/services
4. JANGAN import terus dari feature modules lain

Future scope kemungkinan: laptop/equipment tracking, asset depreciation (function calculate_asset_depreciation dah wujud dalam DB).

27. Netlify Functions

Located kat /netlify/functions/ — Node.js serverless functions:

Kenapa Netlify Functions vs Edge Functions?

• Netlify Functions — Node.js, cold start lebih panjang, libs lebih banyak. Guna untuk endpoints yang browser-facing.
• Edge Functions (Supabase) — Deno, lebih laju, run dekat dengan DB. Guna untuk cron/background tasks.

28. Edge Functions (Supabase)

Located kat /supabase/functions/ — Deno/TypeScript:

Invocation

• Cron: via pg_cron + pg_net HTTP POST
• Manual: POST https://ftbtsxlujsnobujwekwx.supabase.co/functions/v1/<name>
• Auth: Service role JWT dalam Authorization header

29. Database Triggers & Cron Jobs

Cron Jobs (pg_cron)

Important Triggers (~60 total atas public tables)

Audit (auto-write ke thr_audit_trail)

• audit_claims_changes atas thr_claims (INSERT/UPDATE/DELETE)
• audit_employee_changes atas thr_employees
• audit_organization_changes atas thr_organizations
• audit_department_changes atas thr_departments
• audit_position_changes atas thr_positions
• audit_payroll_changes atas thr_payroll_transactions

Auto-numbering

• trg_generate_claim_number atas thr_claims
• trigger_set_memo_number atas thr_memos

Notifications (DUPLICATES! ⚠️)

• trigger_notify_claim_submission · _status_update
• trg_notify_leave_application + trigger_notify_leave_application ⚠️ (duplicate!)
• trg_notify_leave_status_change + trigger_notify_leave_status_update ⚠️
• trigger_notify_payroll_ready
• trigger_notify_announcement
• create_message_notification atas thr_messages

Sync / Validation

• sync_active_status_trigger atas thr_employees
• trg_update_profile_completion atas thr_employees
• validate_organization_assignment atas thr_employees
• trigger_assign_position_organization atas thr_positions (auto-fill org)
• update_employee_photo_url_trigger atas thr_employee_photos (sync URL balik ke thr_employees)
• update_conversation_on_message atas thr_messages

30. Audit Trails (4 systems yang overlap)

thr_audit_trail (paling detail)

• table_name, record_id, action (INSERT/UPDATE/DELETE)
• user_id, employee_id, organization_id
• old_values (jsonb), new_values (jsonb), changed_fields (text[])
• module, severity, description, metadata (jsonb)
• ip_address, user_agent, session_id, request_id

Maintenance Functions

• cleanup_activity_logs() → int — prune rows lama
• archive_old_audit_records() → int — pindah ke archive
• create_activity_log_partition() · drop_old_activity_log_partitions()
• search_audit_trail(query, filters)

31. Deployment

Build & Deploy

Environment Variables yang Diperlukan

Netlify Config (netlify.toml)

• Security headers: X-Frame-Options DENY, X-XSS-Protection, X-Content-Type-Options nosniff
• Cache: Hashed assets — 1 tahun, HTML — never
• SPA fallback: Semua non-asset routes → /index.html (untuk client-side routing)
• Functions: 7 Netlify Functions (Node.js)

Branch Strategy

• main → Production (thr.todak.io)
• staging → Staging (staging-thr.netlify.app)
• Kedua-dua share Supabase database yang sama — takde DB isolation

Local Development

# Clone
git clone https://github.com/broneotodak/THR.git
cd THR

# Install
npm ci

# Setup .env (copy .env.example)
cp .env.example .env
# Isi VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, VITE_GOOGLE_CLIENT_ID

# Run dev server
npm run dev   # → http://localhost:5173

32. Live Activity Stats (30 hari lepas)

Database Activity

User Login Activity

Daily Active Users (7 hari)

Data Date Ranges

• thr_attendance: 2025-12-14 → 2026-04-21 (~4 bulan live)
• thr_audit_trail: 2025-10-31 → 2026-04-21
• thr_employees record paling lama: 2025-07-13
• thr_leave_applications: 2025-12-24 → 2026-04-08
• thr_email_queue write terakhir: 2026-03-18 (idle 30+ hari)

33. Common Code Recipes

Ambil Employee Record User Semasa

import { supabase } from '@/core/lib/supabase';

const { data: { user } } = await supabase.auth.getUser();
const { data: employee } = await supabase
  .from('thr_employees')
  .select('*, organization:thr_organizations(*)')
  .eq('auth_user_id', user.id)
  .single();

Check User Permission Level

// ❌ SALAH — baca dari JSONB
const level = employee.employment_info?.access_level;

// ✅ BETUL — baca dari column
const level = employee.access_level;
if (level >= 7) { /* HR Admin */ }

HR Admin: Dapatkan Orgs yang Accessible

import hrOrganizationService from '@shared/services/hrOrganizationService';

const scope = await hrOrganizationService.getChangeRequestScope(userId);
// { canViewAll: false, organizationIds: ['uuid1', 'uuid2'] }

if (scope.canViewAll) {
  query = query;  // takde filter — super admin
} else {
  query = query.in('organization_id', scope.organizationIds);
}

Apply Leave (dengan semua required fields)

const { data, error } = await supabase
  .from('thr_leave_applications')
  .insert({
    employee_id: employee.id,
    organization_id: employee.organization_id,
    leave_type: 'AL',  // ✅ string, BUKAN leave_type_id
    start_date: '2026-05-01',
    end_date: '2026-05-03',
    total_days: 3,
    reason: 'Family vacation',
    reporting_to_id: employee.reporting_to_id,
    status: 'pending'
  });

Submit Claim dengan Receipt

// 1. Upload receipt
const fileName = `${employee.id}/${Date.now()}.jpg`;
await supabase.storage
  .from('claim-receipts')
  .upload(fileName, file);

const { data: { publicUrl } } = supabase.storage
  .from('claim-receipts')
  .getPublicUrl(fileName);

// 2. Create claim (claim_no auto-generated oleh trigger)
await supabase.from('thr_claims').insert({
  employee_id: employee.id,
  claim_type: 'meal',
  claim_date: '2026-04-20',
  amount: 45.50,
  currency: 'MYR',
  receipt_url: publicUrl,
  status: 'pending',
  submitted_by: user.id
});

Check In Attendance

// Dapatkan geolocation
const position = await new Promise((resolve, reject) => {
  navigator.geolocation.getCurrentPosition(resolve, reject, {
    timeout: 10000
  });
});

// Capture selfie (kalau perlu)
let selfiePath = null;
if (org.require_attendance_selfie) {
  const selfieFile = await captureSelfie();  // camera logic ko
  selfiePath = `${employee.id}/${Date.now()}.jpg`;
  await supabase.storage
    .from('attendance-selfies')
    .upload(selfiePath, selfieFile);
}

// Insert attendance
await supabase.from('thr_attendance').insert({
  employee_id: employee.id,
  organization_id: employee.organization_id,
  date: new Date().toISOString().split('T')[0],
  check_in: new Date().toISOString(),
  check_in_latitude: position.coords.latitude,
  check_in_longitude: position.coords.longitude,
  check_in_selfie_path: selfiePath,
  check_in_method: 'web'
});

Dapatkan Attendance Hari Ni

// Guna view (dah denormalized)
const { data } = await supabase
  .from('thr_attendance_today')
  .select('*');

// Atau RPC untuk org-scoped
const { data } = await supabase
  .rpc('get_organization_attendance_today', { org_id: orgId });

Real-Time Subscription (messages)

const channel = supabase
  .channel('messages-channel')
  .on('postgres_changes', {
    event: 'INSERT',
    schema: 'public',
    table: 'thr_messages',
    filter: `conversation_id=eq.${conversationId}`
  }, (payload) => {
    setMessages(prev => [...prev, payload.new]);
  })
  .subscribe();

return () => supabase.removeChannel(channel);

34. Known Issues & Pending Work

Code TODOs

Incidents Lepas (dari CLAUDE.md)

Pending Backlog

Critical Coding Rules (dari CLAUDE.md)

35. Future Roadmap (Inferred dari Codebase)

Dah Dalam Progress

• Shifts management — baru ditambah: thr_organizations.shifts_enabled, shifts jsonb, default_shift_id, thr_employees.assigned_shift_id
• ntfy push notifications — dah provisioned: thr_employees.ntfy_topic, push_notifications_enabled
• Sofia AI assistant — dah built tapi belum launched

Planned (placeholder modules)

• ATLAS Module — asset management (depreciation function dah wujud)
• Career Development — UI separa siap dalam CareerDevelopment.jsx

Next Steps yang Disyorkan

1. Security — Enable RLS atas critical tables, asingkan staging DB, rotate service JWT
2. Roll out manager tier — assign Levels 4-6 kepada managers sebenar (sekarang kosong)
3. Siasat adoption — usage claims/leave sangat rendah, cari friction points
4. Consolidate audit — pilih satu audit table canonical, deprecate yang lain
5. Email queue debug — cari kenapa takde emails sejak 2026-03-18
6. Launch Sofia AI — infrastructure ready, populate knowledge base
7. Tambah BM i18n — user base utama adalah Malaysian
8. Mobile app — sekarang web-only je, attendance check-in akan lebih baik dengan native app
9. WhatsApp self-service — RPCs dah ada, expose lebih banyak kepada OpenClaw bot

Integration Opportunities

• Google Workspace (sekarang connected via GAM7 kat lan-claude VPS) — auto-provision/deprovision Workspace accounts masa hire/resign
• Drive integration — auto-backup employee documents ke Workspace Drive
• Calendar sync — push leave yang approved ke Workspace Calendar
• Gmail audit — monitor sensitive email patterns