feat(survey+mqc+hardening): real Survey & MQC modules + helmet security + migration infra

[mcabico-blip]

Summary

Continues the UBI Construction Suite breadth-first build (PR #1). This session promotes Survey and MQC from stubs to real DB-backed modules, adds Helmet security headers, and wires the TypeORM migration infrastructure.

Production hardening

• Helmet — app.use(helmet()) in main.ts; all responses now get standard security headers
• TypeORM migration infra — apps/api/src/data-source.ts for the CLI + migration:generate / migration:run / migration:revert scripts added to package.json. Operator must run migration:generate against the live DB then migration:run and set DB_SYNC=false before production.

Survey module (was stub, now real)

• survey_measurement entity — station/chainage (STA 0+000 format), pay item, volume, type (cross-section / stakeout / original-ground / as-built), YYYY-MM period
• survey_cross_section entity — area at station, interval, computed volume
• survey.volumes read-model now aggregates real DB rows → feeds ManCom + Ask AI
• REST: GET /survey/volumes, GET/POST /survey/projects/:id/measurements, GET/POST /survey/projects/:id/cross-sections
• Web page /survey — volume trend chart (TrendChart), measurement table per project, measurement submit form
• Demo seed: 8 measurements for PKG-02 (PCCP 311(1)c) and PKG-05 (subbase 200)

MQC module (was stub, now real)

• DPWH minimum testing rules table for pay items 311(1)a/b/c, 200, 201, 301 → GET /mqc/rules/:payItemNo
• mqc_test entity — test type, result, cert ID, lab ref, billing ref
• mqc_pour_log entity — station, date, mix design, volume, slump mm, air content %
• mqc_material_cert entity — cert no, billing ref, StorageProvider file path
• mqc.certs read-model now pulls pending tests from DB → "blocking billing" KPI
• REST: GET/POST /mqc/projects/:id/tests|pours|certs, GET /mqc/rules/:item
• Web page /mqc — DPWH rules lookup panel, test results tab (with Stamp), pour logs tab, submit forms for both
• Demo seed: 5 test results + 2 pour logs for PKG-02 / PKG-05

Shell / routing

• /survey and /mqc routes added to App.tsx
• "Tools" group added to sidebar with Survey tools + MQC tools direct links
• Tab-switcher, badge, and field label CSS added to styles.css

Test plan

• npm run dev:api starts cleanly (helmet loaded, survey + mqc modules registered)
• npm run dev:web builds with no TS errors
• Login as ceo@ubi.ph → navigate to /survey → volume trend renders from seeded data
• Submit a new measurement → appears in the table; /api/survey/volumes updates
• Navigate to /mqc → DPWH rules for 311(1)c show (7 rules)
• Test results tab shows 2 pending (badge) + 3 passed for PKG-02
• Pour logs tab shows 2 pours; submit a new one → appears in table
• AI Insights / Ask AI still work (read-models now DB-backed)
• Check response headers include X-Content-Type-Options, X-Frame-Options (Helmet)

https://claude.ai/code/session_013K35zHH4mCqU8qHwN9Ypzg

---

Generated by Claude Code