Daily Changelog – September 23, 2025

Improvements

Removed non-functional “View as Employee” functionality from admin navbar since dedicated employee portal exists
Removed ViewRoleBanner component from layout since view role switching no longer needed
Removed ViewRoleProvider and useViewRole hook to clean up unused code
Cleaned up commented view role imports in sick-days page

Implemented whitelist security approach: employees only allowed explicit routes they need
Added comprehensive middleware protection using allowlist instead of blocklist
Protected sensitive API routes from employee access with 403 responses
Updated navigation configuration with role-based restrictions on all admin functionality
Added employee-specific navigation items and removed admin menu for employees
Preview mode respects role overrides for UI testing without granting actual access

Restored “Preview as Employee” functionality for admins to test employee experience
Preview mode shows UI changes without granting actual access to restricted data
Admins can verify what employees see before making interface changes

Fixed time display showing impossible chronological times (clock-in after clock-out) by enforcing strict UTC ISO string handling across all time clock APIs
Fixed payroll calculations to match legacy FileMaker app totals by implementing proper 30-minute lunch credit logic
Resolved variable shadowing compilation errors in time_clock_records API that were causing Heroku build failures
Fixed TypeScript error in NavbarWrapper where userRole could be undefined
Fixed unused variable warnings in middleware and entries page

Implemented 30-minute lunch credit for employees with “Break Rules” record set to Yes/Y/true/1
Applied lunch credit at day level with 2-decimal rounding to match legacy system behavior
Enhanced payroll export queries to calculate daily totals with lunch credit before weekly aggregation
Updated time display format to show 12-hour AM/PM format instead of 24-hour format on entries page