QA hardening: security RLS fixes, Flutter 3.47.5 upgrade, UI/validation fixes

Security — enforce write authorization server-side (was UI/RPC-only):
- it_service_requests RLS: block cross-office read/edit + self-approve (QA-015)
- pass_slips RLS: owner can complete but not self-approve (QA-046)
- swap_requests RLS: scope select/update to participants + admin (QA-047)
- storage: tighten it_service_attachments + task_attachments write/delete (QA-027)
- admin_user_management edge function: allow programmers to manage users (QA-016)

Fixes:
- workforce generator "uncovered shifts" false alarms (QA-043/044)
- network-map VLAN + New-location dialog validation, disabled-until-valid (QA-048)
- de-flake time-of-day-dependent dashboard metrics test (QA-045)

Toolchain:
- upgrade to Flutter 3.47.5 / Dart 3.13.4; font_awesome_flutter 11.0.0,
  flutter_quill 11.6.0, pdfrx 2.6.5; clear resulting deprecations (QA-002)

analyze clean; 139 tests pass; web build succeeds. Report + evidence in docs/qa/.

Note: also carries the in-progress Brick model cleanup already present in the
working tree. QA-001 (AI keys public in the build) is deferred by owner decision.

Co-Authored-By: claude-flow <ruv@ruv.net>

test/announcements_test.dart

@@ -1,8 +1,8 @@
 import 'dart:async';
 
 import 'package:flutter_test/flutter_test.dart';
-import 'package:tasq/models/announcement.dart';
-import 'package:tasq/models/announcement_comment.dart';
+import 'package:tasq/models/announcement.model.dart';
+import 'package:tasq/models/announcement_comment.model.dart';
 import 'package:tasq/providers/announcements_provider.dart';
 import 'package:tasq/utils/app_time.dart';
 

test/dashboard_metrics_provider_test.dart

@@ -3,19 +3,19 @@
 import 'dart:async';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:tasq/models/it_service_request.dart';
-import 'package:tasq/models/it_service_request_assignment.dart';
-import 'package:tasq/models/profile.dart';
-import 'package:tasq/models/ticket.dart';
-import 'package:tasq/models/task.dart';
+import 'package:tasq/models/it_service_request.model.dart';
+import 'package:tasq/models/it_service_request_assignment.model.dart';
+import 'package:tasq/models/profile.model.dart';
+import 'package:tasq/models/ticket.model.dart';
+import 'package:tasq/models/task.model.dart';
 import 'package:tasq/models/task_assignment.dart';
 import 'package:tasq/models/ticket_message.dart';
-import 'package:tasq/models/duty_schedule.dart';
-import 'package:tasq/models/attendance_log.dart';
+import 'package:tasq/models/duty_schedule.model.dart';
+import 'package:tasq/models/attendance_log.model.dart';
 import 'package:tasq/models/live_position.dart';
-import 'package:tasq/models/leave_of_absence.dart';
-import 'package:tasq/models/pass_slip.dart';
-import 'package:tasq/models/team.dart';
+import 'package:tasq/models/leave_of_absence.model.dart';
+import 'package:tasq/models/pass_slip.model.dart';
+import 'package:tasq/models/team.model.dart';
 import 'package:tasq/models/team_member.dart';
 import 'package:tasq/screens/dashboard/dashboard_screen.dart';
 import 'package:tasq/utils/app_time.dart';
@@ -327,10 +327,13 @@ void main() {
 
     final schedule = DutySchedule(
       id: 's2',
+      // Anchor the shift around `now` so the shift is always active when the
+      // suite runs; a hard-coded 08:00–16:00 window made this test pass only
+      // during daytime and report 'Off duty' (correctly) at night.
       userId: profile.id,
       shiftType: 'am',
-      startTime: DateTime(now.year, now.month, now.day, 8),
-      endTime: DateTime(now.year, now.month, now.day, 16),
+      startTime: now.subtract(const Duration(hours: 1)),
+      endTime: now.add(const Duration(hours: 4)),
       status: 'scheduled',
       createdAt: now,
       checkInAt: null,

test/geofence_admin_screen_test.dart

@@ -4,7 +4,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:geolocator/geolocator.dart';
 
 import 'package:tasq/models/app_settings.dart';
-import 'package:tasq/models/profile.dart';
+import 'package:tasq/models/profile.model.dart';
 import 'package:tasq/providers/profile_provider.dart';
 import 'package:tasq/providers/workforce_provider.dart';
 import 'package:tasq/providers/location_provider.dart';

test/it_job_checklist_test.dart

@@ -1,7 +1,7 @@
 import 'package:flutter_test/flutter_test.dart';
-import 'package:tasq/models/task.dart';
+import 'package:tasq/models/task.model.dart';
 import 'package:tasq/models/task_assignment.dart';
-import 'package:tasq/models/notification_item.dart';
+import 'package:tasq/models/notification_item.model.dart';
 import 'package:tasq/utils/app_time.dart';
 
 void main() {

test/layout_smoke_test.dart

@@ -5,20 +5,20 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:awesome_snackbar_content/awesome_snackbar_content.dart';
 import 'package:supabase_flutter/supabase_flutter.dart';
 
-import 'package:tasq/models/attendance_log.dart';
-import 'package:tasq/models/notification_item.dart';
-import 'package:tasq/models/office.dart';
-import 'package:tasq/models/pass_slip.dart';
-import 'package:tasq/models/profile.dart';
-import 'package:tasq/models/task.dart';
+import 'package:tasq/models/attendance_log.model.dart';
+import 'package:tasq/models/notification_item.model.dart';
+import 'package:tasq/models/office.model.dart';
+import 'package:tasq/models/pass_slip.model.dart';
+import 'package:tasq/models/profile.model.dart';
+import 'package:tasq/models/task.model.dart';
 import 'package:tasq/models/task_assignment.dart';
-import 'package:tasq/models/ticket.dart';
+import 'package:tasq/models/ticket.model.dart';
 import 'package:tasq/models/user_office.dart';
-import 'package:tasq/models/team.dart';
+import 'package:tasq/models/team.model.dart';
 import 'package:tasq/utils/app_time.dart';
 import 'package:go_router/go_router.dart';
 import 'package:tasq/models/team_member.dart';
-import 'package:tasq/models/announcement.dart';
+import 'package:tasq/models/announcement.model.dart';
 import 'package:tasq/providers/announcements_provider.dart';
 import 'package:tasq/utils/snackbar.dart' show scaffoldMessengerKey;
 import 'package:tasq/providers/attendance_provider.dart';
@@ -554,6 +554,7 @@ void main() {
       );
       await tester.pumpAndSettle();
 
+      await _pickOffice(tester);
       await tester.tap(find.text('Create'));
       await tester.pumpAndSettle();
 
@@ -597,6 +598,7 @@ void main() {
       );
       await tester.pumpAndSettle();
 
+      await _pickOffice(tester);
       await tester.tap(find.text('Create'));
       await tester.pump(); // start saving
       expect(find.byType(CircularProgressIndicator), findsOneWidget);
@@ -627,6 +629,7 @@ void main() {
       );
       await tester.pumpAndSettle();
 
+      await _pickOffice(tester);
       await tester.tap(find.text('Create'));
       await tester.pumpAndSettle();
 
@@ -678,6 +681,7 @@ void main() {
       );
       await tester.pumpAndSettle();
 
+      await _pickOffice(tester);
       await tester.tap(find.text('Create'));
       await tester.pump();
       expect(find.byType(CircularProgressIndicator), findsOneWidget);
@@ -802,7 +806,21 @@ Future<void> _pumpScreen(
 
 Future<void> _setSurfaceSize(WidgetTester tester, Size size) async {
   await tester.binding.setSurfaceSize(size);
+  // setSurfaceSize alone leaves MediaQuery at the 800x600 default; size the
+  // view too so breakpoint checks see the same width as the layout.
+  tester.view.physicalSize = size;
+  tester.view.devicePixelRatio = 1.0;
   addTearDown(() async {
     await tester.binding.setSurfaceSize(null);
+    tester.view.resetPhysicalSize();
+    tester.view.resetDevicePixelRatio();
   });
 }
+
+/// Office is required in the ticket/task create dialogs.
+Future<void> _pickOffice(WidgetTester tester) async {
+  await tester.tap(find.text('Select office…'));
+  await tester.pumpAndSettle();
+  await tester.tap(find.widgetWithText(ListTile, 'HQ').last);
+  await tester.pumpAndSettle();
+}

test/leave_stream_update_test.dart

@@ -2,8 +2,8 @@ import 'dart:async';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
-import 'package:tasq/models/leave_of_absence.dart';
-import 'package:tasq/models/profile.dart';
+import 'package:tasq/models/leave_of_absence.model.dart';
+import 'package:tasq/models/profile.model.dart';
 import 'package:tasq/screens/attendance/attendance_screen.dart';
 import 'package:tasq/providers/leave_provider.dart';
 import 'package:tasq/providers/profile_provider.dart';

test/notification_bridge_test.dart

@@ -0,0 +1,37 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tasq/models/notification_item.model.dart';
+import 'package:tasq/services/notification_bridge.dart';
+
+NotificationItem _n(String id, {DateTime? readAt}) => NotificationItem(
+  id: id,
+  userId: 'u',
+  actorId: null,
+  ticketId: null,
+  taskId: null,
+  itServiceRequestId: null,
+  messageId: null,
+  type: 'assignment',
+  createdAt: DateTime(2026),
+  readAt: readAt,
+);
+
+void main() {
+  test('first snapshot never raises a banner', () {
+    expect(newestArrival(null, [_n('b'), _n('a')]), isNull);
+  });
+
+  test('picks the newest unseen item, not the oldest', () {
+    final prev = [_n('a')];
+    final next = [_n('c'), _n('b'), _n('a')]; // newest-first
+    expect(newestArrival(prev, next)?.id, 'c');
+  });
+
+  test('ignores already-read and already-seen items', () {
+    final prev = [_n('a')];
+    expect(
+      newestArrival(prev, [_n('b', readAt: DateTime(2026)), _n('a')]),
+      isNull,
+    );
+    expect(newestArrival(prev, [_n('a')]), isNull);
+  });
+}

test/offline_sync_test.dart

@@ -86,10 +86,10 @@ void main() {
       await tester.pumpWidget(buildBanner(online: true));
       await tester.pump();
 
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
       expect(
         find.text(
-          'No internet \u2014 changes saved locally, will sync automatically',
+          'No internet \u2014 changes saved locally',
         ),
         findsNothing,
       );
@@ -99,10 +99,10 @@ void main() {
       await tester.pumpWidget(buildBanner(online: false));
       await tester.pump();
 
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
       expect(
         find.text(
-          'No internet \u2014 changes saved locally, will sync automatically',
+          'No internet \u2014 changes saved locally',
         ),
         findsOneWidget,
       );
@@ -127,12 +127,12 @@ void main() {
         ),
       );
       await tester.pump();
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
 
       // Go online — update provider state, then let AnimatedSize animate.
       container.read(isOnlineProvider.notifier).state = true;
       await tester.pumpAndSettle();
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
     });
 
     testWidgets('banner transitions from online to offline', (tester) async {
@@ -151,12 +151,12 @@ void main() {
         ),
       );
       await tester.pump();
-      expect(find.byIcon(Icons.wifi_off), findsNothing);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsNothing);
 
       // Go offline — update provider state, then let AnimatedSize animate.
       container.read(isOnlineProvider.notifier).state = false;
       await tester.pumpAndSettle();
-      expect(find.byIcon(Icons.wifi_off), findsOneWidget);
+      expect(find.byIcon(Icons.wifi_off_rounded), findsOneWidget);
     });
 
     testWidgets('child widget is always rendered regardless of connectivity',

test/profile_screen_test.dart

@@ -3,8 +3,8 @@ import 'dart:typed_data';
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
-import 'package:tasq/models/office.dart';
-import 'package:tasq/models/profile.dart';
+import 'package:tasq/models/office.model.dart';
+import 'package:tasq/models/profile.model.dart';
 import 'package:tasq/models/user_office.dart';
 import 'package:tasq/providers/profile_provider.dart';
 import 'package:tasq/providers/tickets_provider.dart';

test/searchable_multi_select_dropdown_test.dart

@@ -1,7 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_test/flutter_test.dart';
 
-import 'package:tasq/models/office.dart';
+import 'package:tasq/models/office.model.dart';
 import 'package:tasq/widgets/multi_select_picker.dart';
 
 void main() {

test/snackbar_humanize_test.dart

@@ -0,0 +1,32 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:tasq/utils/snackbar.dart';
+
+void main() {
+  test('strips exception dumps down to the message', () {
+    expect(
+      humanizeErrorText(
+        'Sign in failed: AuthApiException(message: Invalid login credentials, '
+        'statusCode: 400, code: invalid_credentials)',
+      ),
+      'Sign in failed: Invalid login credentials',
+    );
+    expect(
+      humanizeErrorText(
+        'Error: PostgrestException(message: Could not find f(a, b) in the '
+        'schema cache, code: PGRST202, details: x, hint: y)',
+      ),
+      'Error: Could not find f(a, b) in the schema cache',
+    );
+    expect(
+      humanizeErrorText('Error: Exception: Not authenticated'),
+      'Error: Not authenticated',
+    );
+  });
+
+  test('leaves plain messages alone', () {
+    expect(
+      humanizeErrorText('Event name is required'),
+      'Event name is required',
+    );
+  });
+}

test/task_assignment_section_test.dart

@@ -3,8 +3,8 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'dart:async';
 
-import 'package:tasq/models/profile.dart';
-import 'package:tasq/models/task.dart';
+import 'package:tasq/models/profile.model.dart';
+import 'package:tasq/models/task.model.dart';
 import 'package:tasq/models/task_assignment.dart';
 import 'package:tasq/providers/profile_provider.dart';
 import 'package:tasq/providers/tasks_provider.dart';

test/tasks_provider_test.dart

@@ -2,8 +2,8 @@ import 'dart:async';
 
 import 'package:flutter_test/flutter_test.dart';
 import 'package:tasq/providers/tasks_provider.dart';
-import 'package:tasq/models/task.dart';
-import 'package:tasq/models/task_activity_log.dart';
+import 'package:tasq/models/task.model.dart';
+import 'package:tasq/models/task_activity_log.model.dart';
 import 'package:tasq/utils/app_time.dart';
 
 // Minimal fake supabase client similar to integration test work,

test/teams_screen_test.dart

@@ -3,9 +3,9 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:supabase_flutter/supabase_flutter.dart';
 
-import 'package:tasq/models/office.dart';
-import 'package:tasq/models/profile.dart';
-import 'package:tasq/models/team.dart';
+import 'package:tasq/models/office.model.dart';
+import 'package:tasq/models/profile.model.dart';
+import 'package:tasq/models/team.model.dart';
 import 'package:tasq/models/team_member.dart';
 import 'package:tasq/providers/teams_provider.dart';
 import 'package:tasq/providers/profile_provider.dart';

test/user_management_screen_test.dart

@@ -3,8 +3,8 @@ import 'package:flutter_test/flutter_test.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:supabase_flutter/supabase_flutter.dart';
 
-import 'package:tasq/models/office.dart';
-import 'package:tasq/models/profile.dart';
+import 'package:tasq/models/office.model.dart';
+import 'package:tasq/models/profile.model.dart';
 import 'package:tasq/models/ticket_message.dart';
 import 'package:tasq/models/user_office.dart';
 import 'package:tasq/providers/profile_provider.dart';

test/workforce_swap_test.dart

@@ -2,10 +2,10 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:supabase_flutter/supabase_flutter.dart';
-import 'package:tasq/models/profile.dart';
-import 'package:tasq/models/duty_schedule.dart';
+import 'package:tasq/models/profile.model.dart';
+import 'package:tasq/models/duty_schedule.model.dart';
 import 'package:tasq/models/rotation_config.dart';
-import 'package:tasq/models/swap_request.dart';
+import 'package:tasq/models/swap_request.model.dart';
 import 'package:tasq/providers/rotation_config_provider.dart';
 import 'package:tasq/providers/supabase_provider.dart';
 import 'package:tasq/providers/workforce_provider.dart';