Dynamic report audit layer

[gilgardosh]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces a specification for an audit layer in dynamic reports, enabling per-node metadata such as status, notes, and linked documents. The proposed changes include UI indicators, a metadata management modal, and backend GraphQL schema updates. Feedback focuses on enhancing security through authorization checks on the new query, improving input validation for linked documents, and utilizing GraphQL enums for better type safety in the schema.

[gemini-code-assist]

The linkedDocumentInfo query is missing authorization directives. It should include @requiresAuth and appropriate role checks (e.g., @requiresAnyRole(roles: ["business_owner", "accountant"])) to ensure that only authorized users can resolve document information. Additionally, the resolver should verify that the requesting user has permission to access the specific document associated with the provided UUID.

[gemini-code-assist]

The auto-detection logic for the 'Add document' input is too permissive. Defaulting to type: "url" for any string that is not a valid UUID could result in invalid data being stored. It is recommended to explicitly validate the input as a valid URL (e.g., checking for a protocol prefix) and show a validation error if the input matches neither a UUID nor a valid URL format.

[gemini-code-assist]

Consider using GraphQL enum types for the status and LinkedDocument.type fields instead of String!. This provides better type safety, self-documentation in the schema, and ensures that the API strictly adheres to the allowed values defined in the Zod schema and TypeScript types.