From 260131d8fd8fc51c9564ce78b92381218740b0a9 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 13:07:36 +0530
Subject: [PATCH 01/13] fix: Restrict member management actions to Owner/Admin
 roles

---
 .../(app)/[orgId]/people/all/components/MemberRow.tsx  |  8 ++++----
 .../people/all/components/PendingInvitationRow.tsx     |  5 +++--
 .../[orgId]/people/all/components/TeamMembers.tsx      | 10 ++++++++++
 .../people/all/components/TeamMembersClient.tsx        |  6 +++++-
 4 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
index 93a0ca0b7..3f7fa6384 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
@@ -43,6 +43,7 @@ interface MemberRowProps {
   member: MemberWithUser;
   onRemove: (memberId: string) => void;
   onUpdateRole: (memberId: string, roles: Role[]) => void;
+  canEdit: boolean;
 }
 
 // Helper to get initials
@@ -60,7 +61,7 @@ function getInitials(name?: string | null, email?: string | null): string {
   return '??';
 }
 
-export function MemberRow({ member, onRemove, onUpdateRole }: MemberRowProps) {
+export function MemberRow({ member, onRemove, onUpdateRole, canEdit}: MemberRowProps) {
   const params = useParams<{ orgId: string }>();
   const { orgId } = params;
 
@@ -89,7 +90,6 @@ export function MemberRow({ member, onRemove, onUpdateRole }: MemberRowProps) {
   ) as Role[];
 
   const isOwner = currentRoles.includes('owner');
-  const canEditRoles = true;
   const canRemove = !isOwner;
 
   const isEmployee = currentRoles.includes('employee');
@@ -183,7 +183,7 @@ export function MemberRow({ member, onRemove, onUpdateRole }: MemberRowProps) {
                 variant="ghost"
                 size="sm"
                 className="h-8 w-8 p-0"
-                disabled={!canEditRoles}
+                disabled={!canEdit}
               >
                 <MoreHorizontal className="h-4 w-4" />
               </Button>
@@ -199,7 +199,7 @@ export function MemberRow({ member, onRemove, onUpdateRole }: MemberRowProps) {
                 }
               }}
             >
-              {canEditRoles && (
+              {canEdit && (
                 <Dialog open={isUpdateRolesOpen} onOpenChange={handleDialogOpenChange}>
                   <DialogTrigger asChild>
                     <DropdownMenuItem
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
index 8079a0c74..0b8a69c7c 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
@@ -28,9 +28,10 @@ interface PendingInvitationRowProps {
     createdAt?: Date;
   };
   onCancel: (invitationId: string) => Promise<void>;
+  canCancel: boolean;
 }
 
-export function PendingInvitationRow({ invitation, onCancel }: PendingInvitationRowProps) {
+export function PendingInvitationRow({ invitation, onCancel, canCancel }: PendingInvitationRowProps) {
   const [isCancelDialogOpen, setIsCancelDialogOpen] = useState(false);
   const [isCancelling, setIsCancelling] = useState(false);
   const [dropdownOpen, setDropdownOpen] = useState(false);
@@ -105,7 +106,7 @@ export function PendingInvitationRow({ invitation, onCancel }: PendingInvitation
             ))}
           </div>
           <DropdownMenu open={dropdownOpen} onOpenChange={setDropdownOpen}>
-            <DropdownMenuTrigger ref={dropdownTriggerRef} asChild disabled={isCancelling}>
+            <DropdownMenuTrigger ref={dropdownTriggerRef} asChild disabled={isCancelling || !canCancel}>
               <Button variant="ghost" className="data-[state=open]:bg-muted flex h-8 w-8 p-0">
                 <MoreHorizontal className="h-4 w-4" />
                 <span className="sr-only">Open menu</span>
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
index 7e4df9538..269a704cf 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
@@ -23,6 +23,15 @@ export async function TeamMembers() {
   });
   const organizationId = session?.session.activeOrganizationId;
 
+  const currentUserMember = await db.member.findFirst({
+      where: {
+        organizationId: session?.session.activeOrganizationId,
+        userId: session?.user.id,
+      },
+    });
+
+  const canManageMembers = ['owner', 'admin'].includes(currentUserMember?.role ?? '');
+
   let members: MemberWithUser[] = [];
   let pendingInvitations: Invitation[] = [];
 
@@ -65,6 +74,7 @@ export async function TeamMembers() {
       organizationId={organizationId ?? ''}
       removeMemberAction={removeMember}
       revokeInvitationAction={revokeInvitation}
+      canManageMembers={canManageMembers}
     />
   );
 }
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
index 65e842714..dd5b8adfc 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
@@ -30,6 +30,7 @@ interface TeamMembersClientProps {
   organizationId: string;
   removeMemberAction: typeof removeMember;
   revokeInvitationAction: typeof revokeInvitation;
+  canManageMembers: boolean;
 }
 
 // Define a simplified type for merged list items
@@ -48,6 +49,7 @@ export function TeamMembersClient({
   organizationId,
   removeMemberAction,
   revokeInvitationAction,
+  canManageMembers,
 }: TeamMembersClientProps) {
   const router = useRouter();
   const [searchQuery, setSearchQuery] = useQueryState('search', parseAsString.withDefault(''));
@@ -227,7 +229,7 @@ export function TeamMembersClient({
             <SelectItem value="employee">{'Employee'}</SelectItem>
           </SelectContent>
         </Select>
-        <Button onClick={() => setIsInviteModalOpen(true)}>
+        <Button onClick={() => setIsInviteModalOpen(true)} disabled={!canManageMembers}>
           <UserPlus className="h-4 w-4" />
           {'Add User'}
         </Button>
@@ -241,6 +243,7 @@ export function TeamMembersClient({
                 member={member as MemberWithUser}
                 onRemove={handleRemoveMember}
                 onUpdateRole={handleUpdateRole}
+                canEdit={canManageMembers}
               />
             ))}
           </div>
@@ -255,6 +258,7 @@ export function TeamMembersClient({
                   key={invitation.displayId}
                   invitation={invitation as Invitation}
                   onCancel={handleCancelInvitation}
+                  canCancel={canManageMembers}
                 />
               ))}
             </div>

From 3848a656a2b9da5c990b37f3bc214e8524f687e8 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 13:51:57 +0530
Subject: [PATCH 02/13] fix: Update member role check

---
 .../[employeeId]/actions/update-employee.ts   | 46 +++++++++++++++++--
 .../components/EmployeeDetails.tsx            |  6 ++-
 2 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
index cee6a511a..a7f786d4b 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
@@ -29,7 +29,35 @@ export const updateEmployee = authActionClient
     const { employeeId, name, email, department, isActive, createdAt } = parsedInput;
 
     const organizationId = ctx.session.activeOrganizationId;
-    if (!organizationId) throw new Error(appErrors.UNAUTHORIZED.message);
+    if (!organizationId) {
+      return {
+        success: false,
+        error: {
+          code: appErrors.UNAUTHORIZED,
+          message: appErrors.UNAUTHORIZED.message,
+        },
+      };
+    }
+
+    const currentUserMember = await db.member.findFirst({
+      where: {
+        organizationId: organizationId,
+        userId: ctx.user.id,
+      },
+    });
+
+    if (
+      !currentUserMember ||
+      (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
+    ) {
+        return {
+          success: false,
+          error: {
+            code: appErrors.UNAUTHORIZED,
+            message: "You don't have permission to update members.",
+          },
+        };
+    }
 
     const member = await db.member.findUnique({
       where: {
@@ -40,7 +68,13 @@ export const updateEmployee = authActionClient
     });
 
     if (!member || !member.user) {
-      throw new Error(appErrors.NOT_FOUND.message);
+      return {
+        success: false,
+        error: {
+          code: appErrors.NOT_FOUND,
+          message: appErrors.NOT_FOUND.message,
+        },
+      };
     }
 
     const memberUpdateData: {
@@ -110,7 +144,13 @@ export const updateEmployee = authActionClient
         if (error.code === 'P2002') {
           const targetFields = error.meta?.target as string[] | undefined;
           if (targetFields?.includes('email')) {
-            throw new Error('Email address is already in use.');
+            return {
+              success: false,
+              error: {
+                code: appErrors.UNEXPECTED_ERROR,
+                message: 'Email address is already in use.',
+              },
+            };
           }
         }
       }
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
index df5cc75f0..82949af69 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
@@ -48,7 +48,11 @@ export const EmployeeDetails = ({
   });
 
   const { execute, status: actionStatus } = useAction(updateEmployee, {
-    onSuccess: () => {
+    onSuccess: (res) => {
+      if (!res?.data?.success) {
+        toast.error(res?.data?.error?.message || 'Failed to update employee details');
+        return;
+      }
       toast.success('Employee details updated successfully');
     },
     onError: (error) => {

From 1024b670e99768a7992fc1c10e3792d953d1047c Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 13:52:07 +0530
Subject: [PATCH 03/13] chore: Remove unused code

---
 .../actions/get-employee-details.ts           | 69 --------------
 .../[employeeId]/actions/update-department.ts | 80 ----------------
 .../actions/update-employee-details.ts        | 91 -------------------
 .../actions/update-employee-status.ts         | 85 -----------------
 .../components/EditableDepartment.tsx         | 63 -------------
 .../components/EditableDetails.tsx            | 23 -----
 .../components/EditableStatus.tsx             | 57 ------------
 7 files changed, 468 deletions(-)
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/get-employee-details.ts
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-department.ts
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-details.ts
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-status.ts
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDepartment.tsx
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDetails.tsx
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableStatus.tsx

diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/get-employee-details.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/get-employee-details.ts
deleted file mode 100644
index aa95073b8..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/get-employee-details.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-'use server';
-
-import { authActionClient } from '@/actions/safe-action';
-import { auth } from '@/utils/auth';
-import { db } from '@db';
-import { headers } from 'next/headers';
-import { type AppError, appErrors, employeeDetailsInputSchema } from '../types';
-
-// Type-safe action response
-export type ActionResponse<T> = Promise<
-  { success: true; data: T } | { success: false; error: AppError }
->;
-
-export const getEmployeeDetails = authActionClient
-  .inputSchema(employeeDetailsInputSchema)
-  .metadata({
-    name: 'get-employee-details',
-    track: {
-      event: 'get-employee-details',
-      channel: 'server',
-    },
-  })
-  .action(async ({ parsedInput }) => {
-    const { employeeId } = parsedInput;
-
-    const session = await auth.api.getSession({
-      headers: await headers(),
-    });
-
-    const organizationId = session?.session.activeOrganizationId;
-
-    if (!organizationId) {
-      throw new Error('Organization ID not found');
-    }
-
-    try {
-      const employee = await db.member.findUnique({
-        where: {
-          id: employeeId,
-          organizationId,
-        },
-        select: {
-          id: true,
-          department: true,
-          createdAt: true,
-          isActive: true,
-          user: true,
-        },
-      });
-
-      if (!employee) {
-        return {
-          success: false,
-          error: appErrors.NOT_FOUND.message,
-        };
-      }
-
-      return {
-        success: true,
-        data: employee,
-      };
-    } catch (error) {
-      console.error('Error fetching employee details:', error);
-      return {
-        success: false,
-        error: appErrors.UNEXPECTED_ERROR.message,
-      };
-    }
-  });
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-department.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-department.ts
deleted file mode 100644
index 13f166395..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-department.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-'use server';
-
-import { authActionClient } from '@/actions/safe-action';
-import { auth } from '@/utils/auth';
-import type { Departments } from '@db';
-import { db } from '@db';
-import { revalidatePath } from 'next/cache';
-import { headers } from 'next/headers';
-import { type AppError, appErrors, updateEmployeeDepartmentSchema } from '../types';
-
-export type ActionResponse<T = any> = Promise<
-  { success: true; data: T } | { success: false; error: AppError }
->;
-
-export const updateEmployeeDepartment = authActionClient
-  .inputSchema(updateEmployeeDepartmentSchema)
-  .metadata({
-    name: 'update-employee-department',
-    track: {
-      event: 'update-employee-department',
-      channel: 'server',
-    },
-  })
-  .action(async ({ parsedInput }): Promise<ActionResponse> => {
-    const { employeeId, department } = parsedInput;
-
-    const session = await auth.api.getSession({
-      headers: await headers(),
-    });
-
-    const organizationId = session?.session.activeOrganizationId;
-
-    if (!organizationId) {
-      return {
-        success: false,
-        error: appErrors.UNAUTHORIZED,
-      };
-    }
-
-    try {
-      const employee = await db.member.findUnique({
-        where: {
-          id: employeeId,
-          organizationId,
-        },
-      });
-
-      if (!employee) {
-        return {
-          success: false,
-          error: appErrors.NOT_FOUND,
-        };
-      }
-
-      const updatedEmployee = await db.member.update({
-        where: {
-          id: employeeId,
-          organizationId,
-        },
-        data: {
-          department: department as Departments,
-        },
-      });
-
-      // Revalidate related paths
-      revalidatePath(`/${organizationId}/people/${employeeId}`);
-      revalidatePath(`/${organizationId}/people`);
-
-      return {
-        success: true,
-        data: updatedEmployee,
-      };
-    } catch (error) {
-      console.error('Error updating employee department:', error);
-      return {
-        success: false,
-        error: appErrors.UNEXPECTED_ERROR,
-      };
-    }
-  });
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-details.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-details.ts
deleted file mode 100644
index 39e12a432..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-details.ts
+++ /dev/null
@@ -1,91 +0,0 @@
-'use server';
-
-import { authActionClient } from '@/actions/safe-action';
-import { auth } from '@/utils/auth';
-import { db } from '@db';
-import { revalidatePath } from 'next/cache';
-import { headers } from 'next/headers';
-import { z } from 'zod';
-import { appErrors } from '../types';
-
-const schema = z.object({
-  employeeId: z.string(),
-  name: z.string().min(1, 'Name is required'),
-  email: z.string().email('Invalid email address'),
-});
-
-export const updateEmployeeDetails = authActionClient
-  .inputSchema(schema)
-  .metadata({
-    name: 'update-employee-details',
-    track: {
-      event: 'update-employee-details',
-      channel: 'server',
-    },
-  })
-  .action(
-    async ({
-      parsedInput,
-    }): Promise<{ success: true; data: any } | { success: false; error: any }> => {
-      const { employeeId, name, email } = parsedInput;
-
-      const session = await auth.api.getSession({
-        headers: await headers(),
-      });
-
-      const organizationId = session?.session.activeOrganizationId;
-
-      if (!organizationId) {
-        return {
-          success: false,
-          error: appErrors.UNAUTHORIZED,
-        };
-      }
-
-      try {
-        const employee = await db.member.findUnique({
-          where: {
-            id: employeeId,
-            organizationId,
-          },
-        });
-
-        if (!employee) {
-          return {
-            success: false,
-            error: appErrors.NOT_FOUND,
-          };
-        }
-
-        const updatedEmployee = await db.member.update({
-          where: {
-            id: employeeId,
-            organizationId,
-          },
-          data: {
-            user: {
-              update: {
-                name,
-                email,
-              },
-            },
-          },
-        });
-
-        // Revalidate related paths
-        revalidatePath(`/${organizationId}/people/${employeeId}`);
-        revalidatePath(`/${organizationId}/people`);
-
-        return {
-          success: true,
-          data: updatedEmployee,
-        };
-      } catch (error) {
-        console.error('Error updating employee details:', error);
-        return {
-          success: false,
-          error: appErrors.UNEXPECTED_ERROR,
-        };
-      }
-    },
-  );
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-status.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-status.ts
deleted file mode 100644
index bde8ccf74..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee-status.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-'use server';
-
-import { authActionClient } from '@/actions/safe-action';
-import { auth } from '@/utils/auth';
-import { db } from '@db';
-import { revalidatePath } from 'next/cache';
-import { headers } from 'next/headers';
-import { z } from 'zod';
-import { appErrors } from '../types';
-
-const schema = z.object({
-  employeeId: z.string(),
-  isActive: z.boolean(),
-});
-
-export const updateEmployeeStatus = authActionClient
-  .inputSchema(schema)
-  .metadata({
-    name: 'update-employee-status',
-    track: {
-      event: 'update-employee-status',
-      channel: 'server',
-    },
-  })
-  .action(
-    async ({
-      parsedInput,
-    }): Promise<{ success: true; data: any } | { success: false; error: any }> => {
-      const { employeeId, isActive } = parsedInput;
-
-      const session = await auth.api.getSession({
-        headers: await headers(),
-      });
-
-      const organizationId = session?.session.activeOrganizationId;
-
-      if (!organizationId) {
-        return {
-          success: false,
-          error: appErrors.UNAUTHORIZED,
-        };
-      }
-
-      try {
-        const employee = await db.member.findUnique({
-          where: {
-            id: employeeId,
-            organizationId,
-          },
-        });
-
-        if (!employee) {
-          return {
-            success: false,
-            error: appErrors.NOT_FOUND,
-          };
-        }
-
-        const updatedEmployee = await db.member.update({
-          where: {
-            id: employeeId,
-            organizationId,
-          },
-          data: {
-            isActive,
-          },
-        });
-
-        // Revalidate related paths
-        revalidatePath(`/${organizationId}/people/${employeeId}`);
-        revalidatePath(`/${organizationId}/people`);
-
-        return {
-          success: true,
-          data: updatedEmployee,
-        };
-      } catch (error) {
-        console.error('Error updating employee status:', error);
-        return {
-          success: false,
-          error: appErrors.UNEXPECTED_ERROR,
-        };
-      }
-    },
-  );
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDepartment.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDepartment.tsx
deleted file mode 100644
index 2f503b158..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDepartment.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-'use client';
-
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
-import type { Departments } from '@db';
-import { useAction } from 'next-safe-action/hooks';
-import { useState } from 'react';
-import { toast } from 'sonner';
-import { updateEmployeeDepartment } from '../actions/update-department';
-
-const DEPARTMENTS = [
-  { value: 'admin', label: 'Admin' },
-  { value: 'gov', label: 'Governance' },
-  { value: 'hr', label: 'HR' },
-  { value: 'it', label: 'IT' },
-  { value: 'itsm', label: 'IT Service Management' },
-  { value: 'qms', label: 'Quality Management' },
-  { value: 'none', label: 'None' },
-];
-
-interface EditableDepartmentProps {
-  employeeId: string;
-  currentDepartment: Departments;
-  onSuccess?: () => void;
-}
-
-export function EditableDepartment({
-  employeeId,
-  currentDepartment,
-  onSuccess,
-}: EditableDepartmentProps) {
-  const [department, setDepartment] = useState(currentDepartment);
-
-  const { execute, status } = useAction(updateEmployeeDepartment, {
-    onSuccess: () => {
-      toast.success('Department updated successfully');
-      onSuccess?.();
-    },
-    onError: (error) => {
-      toast.error(error?.error?.serverError || 'Failed to update department');
-    },
-  });
-
-  const handleSave = () => {
-    execute({ employeeId, department });
-  };
-
-  return (
-    <div>
-      <Select value={department} onValueChange={(value) => setDepartment(value as Departments)}>
-        <SelectTrigger className="h-8 w-full">
-          <SelectValue placeholder="Select department" />
-        </SelectTrigger>
-        <SelectContent>
-          {DEPARTMENTS.map((dept) => (
-            <SelectItem key={dept.value} value={dept.value}>
-              {dept.label}
-            </SelectItem>
-          ))}
-        </SelectContent>
-      </Select>
-    </div>
-  );
-}
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDetails.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDetails.tsx
deleted file mode 100644
index 34b62158a..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableDetails.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-'use client';
-
-interface EditableDetailsProps {
-  employeeId: string;
-  currentName: string;
-  currentEmail: string;
-  onSuccess?: () => void;
-}
-
-export function EditableDetails({ employeeId, currentName, currentEmail }: EditableDetailsProps) {
-  return (
-    <div className="flex flex-col gap-4">
-      <div className="flex flex-col gap-1.5">
-        <span className="text-sm font-medium">Name</span>
-        <span className="text-sm">{currentName}</span>
-      </div>
-      <div className="flex flex-col gap-1.5">
-        <span className="text-sm font-medium">Email</span>
-        <span className="text-sm">{currentEmail}</span>
-      </div>
-    </div>
-  );
-}
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableStatus.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableStatus.tsx
deleted file mode 100644
index 7163c2463..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EditableStatus.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-'use client';
-
-import type { EmployeeStatusType } from '@/components/tables/people/employee-status';
-import { getEmployeeStatusFromBoolean } from '@/components/tables/people/employee-status';
-import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
-import { useAction } from 'next-safe-action/hooks';
-import { useState } from 'react';
-import { toast } from 'sonner';
-import { updateEmployeeStatus } from '../actions/update-employee-status';
-
-const STATUS_OPTIONS = [
-  { value: 'active', label: 'Active' },
-  { value: 'inactive', label: 'Inactive' },
-];
-
-interface EditableStatusProps {
-  employeeId: string;
-  currentStatus: boolean;
-  onSuccess?: () => void;
-}
-
-export function EditableStatus({ employeeId, currentStatus, onSuccess }: EditableStatusProps) {
-  const initialStatus = getEmployeeStatusFromBoolean(currentStatus);
-  const [status, setStatus] = useState<EmployeeStatusType>(initialStatus);
-
-  const { execute, status: actionStatus } = useAction(updateEmployeeStatus, {
-    onSuccess: () => {
-      toast.success('Employee status updated successfully');
-      onSuccess?.();
-    },
-    onError: (error) => {
-      toast.error(error?.error?.serverError || 'Failed to update employee status');
-    },
-  });
-
-  const handleSave = () => {
-    const isActive = status === 'active';
-    execute({ employeeId, isActive });
-  };
-
-  return (
-    <div>
-      <Select value={status} onValueChange={(value) => setStatus(value as EmployeeStatusType)}>
-        <SelectTrigger className="h-8 w-full">
-          <SelectValue placeholder="Select status" />
-        </SelectTrigger>
-        <SelectContent>
-          {STATUS_OPTIONS.map((option) => (
-            <SelectItem key={option.value} value={option.value}>
-              {option.label}
-            </SelectItem>
-          ))}
-        </SelectContent>
-      </Select>
-    </div>
-  );
-}

From 194b462fe1b46233206a52062187fa6ce5f5614a Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 14:09:36 +0530
Subject: [PATCH 04/13] fix: Validate user role for adding employee

---
 .../all/actions/addEmployeeWithoutInvite.ts   | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/addEmployeeWithoutInvite.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/addEmployeeWithoutInvite.ts
index 027701778..4ccd429b7 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/addEmployeeWithoutInvite.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/all/actions/addEmployeeWithoutInvite.ts
@@ -3,6 +3,7 @@
 import { auth } from '@/utils/auth';
 import type { Role } from '@db';
 import { db } from '@db';
+import { headers } from 'next/headers';
 
 export const addEmployeeWithoutInvite = async ({
   email,
@@ -14,6 +15,25 @@ export const addEmployeeWithoutInvite = async ({
   roles: Role[];
 }) => {
   try {
+    const session = await auth.api.getSession({ headers: await headers() });
+    if (!session?.session) {
+      throw new Error('Authentication required.');
+    }
+    const currentUserId = session.session.userId;
+    const currentUserMember = await db.member.findFirst({
+      where: {
+        organizationId: organizationId,
+        userId: currentUserId,
+      },
+    });
+
+    if (
+      !currentUserMember ||
+      (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
+    ) {
+      throw new Error("You don't have permission to add members.");
+    }
+
     let userId = '';
     const existingUser = await db.user.findUnique({
       where: {

From 2a9b769ee62d0c7ba9b0e22db927115cf7f0d63c Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 14:12:21 +0530
Subject: [PATCH 05/13] chore: Formatting

---
 .../people/[employeeId]/actions/update-employee.ts | 14 +++++++-------
 .../[orgId]/people/all/components/MemberRow.tsx    |  2 +-
 .../people/all/components/PendingInvitationRow.tsx | 12 ++++++++++--
 .../[orgId]/people/all/components/TeamMembers.tsx  | 10 +++++-----
 .../src/app/(app)/[orgId]/tasks/[taskId]/page.tsx  |  5 +----
 5 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
index a7f786d4b..d902f73ac 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/actions/update-employee.ts
@@ -50,13 +50,13 @@ export const updateEmployee = authActionClient
       !currentUserMember ||
       (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
     ) {
-        return {
-          success: false,
-          error: {
-            code: appErrors.UNAUTHORIZED,
-            message: "You don't have permission to update members.",
-          },
-        };
+      return {
+        success: false,
+        error: {
+          code: appErrors.UNAUTHORIZED,
+          message: "You don't have permission to update members.",
+        },
+      };
     }
 
     const member = await db.member.findUnique({
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
index 3f7fa6384..5528a1c27 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/MemberRow.tsx
@@ -61,7 +61,7 @@ function getInitials(name?: string | null, email?: string | null): string {
   return '??';
 }
 
-export function MemberRow({ member, onRemove, onUpdateRole, canEdit}: MemberRowProps) {
+export function MemberRow({ member, onRemove, onUpdateRole, canEdit }: MemberRowProps) {
   const params = useParams<{ orgId: string }>();
   const { orgId } = params;
 
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
index 0b8a69c7c..ff561a63d 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/PendingInvitationRow.tsx
@@ -31,7 +31,11 @@ interface PendingInvitationRowProps {
   canCancel: boolean;
 }
 
-export function PendingInvitationRow({ invitation, onCancel, canCancel }: PendingInvitationRowProps) {
+export function PendingInvitationRow({
+  invitation,
+  onCancel,
+  canCancel,
+}: PendingInvitationRowProps) {
   const [isCancelDialogOpen, setIsCancelDialogOpen] = useState(false);
   const [isCancelling, setIsCancelling] = useState(false);
   const [dropdownOpen, setDropdownOpen] = useState(false);
@@ -106,7 +110,11 @@ export function PendingInvitationRow({ invitation, onCancel, canCancel }: Pendin
             ))}
           </div>
           <DropdownMenu open={dropdownOpen} onOpenChange={setDropdownOpen}>
-            <DropdownMenuTrigger ref={dropdownTriggerRef} asChild disabled={isCancelling || !canCancel}>
+            <DropdownMenuTrigger
+              ref={dropdownTriggerRef}
+              asChild
+              disabled={isCancelling || !canCancel}
+            >
               <Button variant="ghost" className="data-[state=open]:bg-muted flex h-8 w-8 p-0">
                 <MoreHorizontal className="h-4 w-4" />
                 <span className="sr-only">Open menu</span>
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
index 269a704cf..048d9007b 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembers.tsx
@@ -24,11 +24,11 @@ export async function TeamMembers() {
   const organizationId = session?.session.activeOrganizationId;
 
   const currentUserMember = await db.member.findFirst({
-      where: {
-        organizationId: session?.session.activeOrganizationId,
-        userId: session?.user.id,
-      },
-    });
+    where: {
+      organizationId: session?.session.activeOrganizationId,
+      userId: session?.user.id,
+    },
+  });
 
   const canManageMembers = ['owner', 'admin'].includes(currentUserMember?.role ?? '');
 
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
index b2387fec8..7392ab283 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
@@ -20,10 +20,7 @@ export default async function TaskPage({
   });
   console.log('[TaskPage] Session obtained, fetching data');
 
-  const [task, members] = await Promise.all([
-    getTask(taskId, session),
-    getMembers(orgId, session),
-  ]);
+  const [task, members] = await Promise.all([getTask(taskId, session), getMembers(orgId, session)]);
 
   if (!task) {
     redirect(`/${orgId}/tasks`);

From 5c0d3e2b3a71a24dce4ae6ea9f0a916f1120e29e Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 14:30:58 +0530
Subject: [PATCH 06/13] chore: Remove unused

---
 .../people/all/actions/bulkInviteMembers.ts   | 188 ------------------
 .../people/all/actions/invalidateMembers.ts   |   8 -
 2 files changed, 196 deletions(-)
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/all/actions/bulkInviteMembers.ts
 delete mode 100644 apps/app/src/app/(app)/[orgId]/people/all/actions/invalidateMembers.ts

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/bulkInviteMembers.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/bulkInviteMembers.ts
deleted file mode 100644
index 5bda072d8..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/bulkInviteMembers.ts
+++ /dev/null
@@ -1,188 +0,0 @@
-'use server';
-
-import { auth } from '@/utils/auth'; // Import main auth
-import { authClient } from '@/utils/auth-client';
-import { revalidatePath, revalidateTag } from 'next/cache';
-import { headers } from 'next/headers'; // Import headers
-import { z } from 'zod';
-// Import common types from the new actions directory structure
-import type { ActionResponse } from '@/actions/types';
-
-// --- Schemas for Validation ---
-const emailSchema = z.string().email('Invalid email format');
-const availableRoles = ['admin', 'auditor', 'employee'] as const;
-type InviteRole = (typeof availableRoles)[number];
-const DEFAULT_ROLE: InviteRole = 'employee'; // Define default role here too
-
-const manualInviteSchema = z.object({
-  email: emailSchema,
-  role: z.enum(availableRoles),
-});
-const manualInvitesSchema = z.array(manualInviteSchema);
-
-// --- Result Type ---
-interface BulkInviteResult {
-  successfulInvites: number;
-  failedItems: {
-    input: string | { email: string; role: InviteRole };
-    error: string;
-  }[];
-}
-
-// --- Server Action (Accepts FormData) ---
-export async function bulkInviteMembers(
-  formData: FormData,
-): Promise<ActionResponse<BulkInviteResult>> {
-  // Manually get session and check auth
-  const session = await auth.api.getSession({ headers: await headers() });
-  if (!session?.session) {
-    return { success: false, error: 'Authentication required.' };
-  }
-  const organizationId = session.session.activeOrganizationId;
-  const userId = session.session.userId;
-
-  if (!organizationId) {
-    return { success: false, error: 'Organization not found' };
-  }
-
-  const results: BulkInviteResult = {
-    successfulInvites: 0,
-    failedItems: [],
-  };
-
-  const submissionType = formData.get('type') as string;
-
-  try {
-    if (submissionType === 'csv') {
-      const file = formData.get('csvFile') as File | null;
-      if (!file || !(file instanceof File)) {
-        return {
-          success: false,
-          error: 'CSV file not provided or invalid.',
-        };
-      }
-      if (file.size > 5 * 1024 * 1024) {
-        // 5MB check
-        return {
-          success: false,
-          error: 'CSV file size exceeds 5MB limit.',
-        };
-      }
-      if (file.type !== 'text/csv') {
-        return {
-          success: false,
-          error: 'Invalid file type. Only CSV is allowed.',
-        };
-      }
-
-      const csvText = await file.text();
-      const rows = csvText.split('\n').slice(1); // Simple split, skip header
-
-      if (rows.length === 0 || (rows.length === 1 && rows[0].trim() === '')) {
-        return {
-          success: false,
-          error: 'CSV file is empty or contains only a header.',
-        };
-      }
-
-      for (const row of rows) {
-        const trimmedRow = row.trim();
-        if (!trimmedRow) continue; // Skip empty lines
-
-        const [emailStr, roleStr] = trimmedRow.split(',').map((s) => s.trim());
-        const rowInput = `CSV Row: ${emailStr || '[missing]'}, ${roleStr || '[missing]'}`;
-
-        try {
-          // Validate email
-          const email = emailSchema.parse(emailStr);
-
-          // Validate or default role
-          let role: InviteRole = DEFAULT_ROLE; // Use defined default
-          if (roleStr) {
-            const parsedRole = z.enum(availableRoles).safeParse(roleStr.toLowerCase());
-            if (parsedRole.success) {
-              role = parsedRole.data;
-            } else {
-              throw new Error(`Invalid role specified: ${roleStr}`);
-            }
-          }
-
-          await authClient.organization.inviteMember({ email, role });
-          results.successfulInvites += 1;
-        } catch (error) {
-          console.error(`Error processing CSV row ${rowInput}:`, error);
-          results.failedItems.push({
-            input: rowInput,
-            error: error instanceof Error ? error.message : 'Processing failed',
-          });
-        }
-      }
-    } else if (submissionType === 'manual') {
-      const invitesJson = formData.get('invites') as string | null;
-      if (!invitesJson) {
-        return {
-          success: false,
-          error: 'Manual invite data not provided.',
-        };
-      }
-
-      let manualInvites: z.infer<typeof manualInvitesSchema>;
-      try {
-        manualInvites = manualInvitesSchema.parse(JSON.parse(invitesJson));
-      } catch (parseError) {
-        console.error('Error parsing manual invites JSON:', parseError);
-        // Don't include validationErrors field, just return a general error
-        return {
-          success: false,
-          error: 'Invalid format for manual invite data.',
-        };
-      }
-
-      if (manualInvites.length === 0) {
-        return {
-          success: false,
-          error: 'No manual invites submitted.',
-        };
-      }
-
-      for (const invite of manualInvites) {
-        try {
-          // Email/Role already validated by Zod parse above
-          await authClient.organization.inviteMember(invite);
-          results.successfulInvites += 1;
-        } catch (error) {
-          console.error(`Error inviting manual member ${invite.email}:`, error);
-          results.failedItems.push({
-            input: invite,
-            error: error instanceof Error ? error.message : 'Invite failed',
-          });
-        }
-      }
-    } else {
-      return { success: false, error: 'Invalid submission type.' };
-    }
-
-    // Revalidate only if changes were made
-    if (results.successfulInvites > 0) {
-      revalidatePath(`/${organizationId}/settings/users`);
-      revalidateTag(`user_${userId}`); // Use userId from manually fetched session
-    }
-
-    // Determine overall success
-    if (results.successfulInvites > 0 || results.failedItems.length === 0) {
-      return { success: true, data: results };
-    }
-    return {
-      success: false,
-      error: 'All invitations failed.',
-      data: results,
-    };
-  } catch (error) {
-    // Catch unexpected errors during processing (e.g., file reading)
-    console.error('Unexpected error in bulkInviteMembers:', error);
-    return {
-      success: false,
-      error: 'An unexpected server error occurred processing the invites.',
-    };
-  }
-}
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/invalidateMembers.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/invalidateMembers.ts
deleted file mode 100644
index da06674e6..000000000
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/invalidateMembers.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-'use server';
-
-import { revalidatePath } from 'next/cache';
-
-export async function invalidateMembers({ organizationId }: { organizationId: string }) {
-  // Ensure correct path is used for revalidation
-  return revalidatePath(`/${organizationId}/settings/users`);
-}

From 7263791df25c020cd6e0c34c809c92e19bcf0d58 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 14:31:29 +0530
Subject: [PATCH 07/13] fix: Validate user role when revoking invitation

---
 .../people/all/actions/revokeInvitation.ts    | 21 +++++++++++++++++++
 .../all/components/TeamMembersClient.tsx      |  5 +++++
 2 files changed, 26 insertions(+)

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
index 59fa6a18a..0d2282606 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
@@ -8,6 +8,7 @@ import { z } from 'zod';
 // Adjust safe-action import for colocalized structure
 import { authActionClient } from '@/actions/safe-action';
 import type { ActionResponse } from '@/actions/types';
+import { appErrors } from '../../types';
 
 const revokeInvitationSchema = z.object({
   invitationId: z.string(),
@@ -33,6 +34,26 @@ export const revokeInvitation = authActionClient
     const { invitationId } = parsedInput;
 
     try {
+      const currentUserMember = await db.member.findFirst({
+        where: {
+          organizationId: ctx.session.activeOrganizationId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (
+        !currentUserMember ||
+        (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
+      ) {
+      return {
+        success: false,
+        error: {
+          code: appErrors.UNAUTHORIZED,
+          message: "You don't have permission to revoke invitations",
+        },
+      };
+      }
+
       // Check if the invitation exists in the organization
       const invitation = await db.invitation.findFirst({
         where: {
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
index dd5b8adfc..7694027d4 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
@@ -123,7 +123,12 @@ export function TeamMembersClient({
   const handleCancelInvitation = async (invitationId: string) => {
     const result = await revokeInvitationAction({ invitationId });
     if (result?.data) {
+      if (result.data?.error) {
+        toast.error(result.data.error.message || 'Failed to cancel invitation');
+        return;
+      }
       // Success case
+      toast.success('Invitation has been cancelled');
       // Data revalidates server-side via action's revalidatePath
       router.refresh(); // Add client-side refresh as well
     } else {

From 70f544c4d1c06d1c9cf3ca43ea41f91d5e6d1830 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 14:33:25 +0530
Subject: [PATCH 08/13] chore: Formatting

---
 .../[orgId]/people/all/actions/revokeInvitation.ts | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
index 0d2282606..456f10c58 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
@@ -45,13 +45,13 @@ export const revokeInvitation = authActionClient
         !currentUserMember ||
         (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
       ) {
-      return {
-        success: false,
-        error: {
-          code: appErrors.UNAUTHORIZED,
-          message: "You don't have permission to revoke invitations",
-        },
-      };
+        return {
+          success: false,
+          error: {
+            code: appErrors.UNAUTHORIZED,
+            message: "You don't have permission to revoke invitations",
+          },
+        };
       }
 
       // Check if the invitation exists in the organization

From ec77b2fb4b605386001af047dc16404f8b3cbad3 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 15:19:56 +0530
Subject: [PATCH 09/13] fix: Type errors

---
 .../(app)/[orgId]/people/all/actions/revokeInvitation.ts    | 6 +-----
 .../[orgId]/people/all/components/TeamMembersClient.tsx     | 2 +-
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
index 456f10c58..8558f1805 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
+++ b/apps/app/src/app/(app)/[orgId]/people/all/actions/revokeInvitation.ts
@@ -8,7 +8,6 @@ import { z } from 'zod';
 // Adjust safe-action import for colocalized structure
 import { authActionClient } from '@/actions/safe-action';
 import type { ActionResponse } from '@/actions/types';
-import { appErrors } from '../../types';
 
 const revokeInvitationSchema = z.object({
   invitationId: z.string(),
@@ -47,10 +46,7 @@ export const revokeInvitation = authActionClient
       ) {
         return {
           success: false,
-          error: {
-            code: appErrors.UNAUTHORIZED,
-            message: "You don't have permission to revoke invitations",
-          },
+          error: "You don't have permission to revoke invitations",
         };
       }
 
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
index 7694027d4..7c7c34864 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/TeamMembersClient.tsx
@@ -124,7 +124,7 @@ export function TeamMembersClient({
     const result = await revokeInvitationAction({ invitationId });
     if (result?.data) {
       if (result.data?.error) {
-        toast.error(result.data.error.message || 'Failed to cancel invitation');
+        toast.error(String(result?.data?.error) || 'Failed to cancel invitation');
         return;
       }
       // Success case

From 1a2b9d28d476f030a55761e30f2b9143df70ca87 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 15:22:07 +0530
Subject: [PATCH 10/13] fix: Member edit only for owner/admin

---
 .../people/[employeeId]/components/Employee.tsx  |  4 +++-
 .../[employeeId]/components/EmployeeDetails.tsx  | 12 +++++++-----
 .../components/Fields/Department.tsx             | 15 +++++++++++++--
 .../[employeeId]/components/Fields/Email.tsx     | 16 ++++++++++++++--
 .../[employeeId]/components/Fields/JoinDate.tsx  | 10 ++++++++--
 .../[employeeId]/components/Fields/Name.tsx      | 10 ++++++++--
 .../[employeeId]/components/Fields/Status.tsx    | 15 +++++++++++++--
 .../(app)/[orgId]/people/[employeeId]/page.tsx   | 10 ++++++++++
 8 files changed, 76 insertions(+), 16 deletions(-)

diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Employee.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Employee.tsx
index 8e786a0b0..25bb950b2 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Employee.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Employee.tsx
@@ -16,6 +16,7 @@ interface EmployeeDetailsProps {
   })[];
   fleetPolicies: FleetPolicy[];
   host: Host;
+  canEdit: boolean;
 }
 
 export function Employee({
@@ -24,10 +25,11 @@ export function Employee({
   trainingVideos,
   fleetPolicies,
   host,
+  canEdit,
 }: EmployeeDetailsProps) {
   return (
     <div className="flex flex-col gap-4">
-      <EmployeeDetails employee={employee} />
+      <EmployeeDetails employee={employee} canEdit={canEdit} />
       <EmployeeTasks
         employee={employee}
         policies={policies}
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
index 82949af69..e12d1f074 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
@@ -30,10 +30,12 @@ export type EmployeeFormValues = z.infer<typeof employeeFormSchema>;
 
 export const EmployeeDetails = ({
   employee,
+  canEdit,
 }: {
   employee: Member & {
     user: User;
   };
+  canEdit: boolean;
 }) => {
   const form = useForm<EmployeeFormValues>({
     resolver: zodResolver(employeeFormSchema),
@@ -111,11 +113,11 @@ export const EmployeeDetails = ({
         <form onSubmit={form.handleSubmit(onSubmit)}>
           <CardContent className="px-0">
             <div className="grid grid-cols-1 gap-6 md:grid-cols-2">
-              <Name control={form.control} />
-              <Email control={form.control} />
-              <Department control={form.control} />
-              <Status control={form.control} />
-              <JoinDate control={form.control} />
+              <Name control={form.control} disabled={!canEdit} />
+              <Email control={form.control} disabled={true} />
+              <Department control={form.control} disabled={!canEdit} />
+              <Status control={form.control} disabled={!canEdit} />
+              <JoinDate control={form.control} disabled={!canEdit} />
             </div>
           </CardContent>
           <CardFooter className="flex justify-end border-none bg-transparent px-0 py-0 outline-hidden">
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Department.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Department.tsx
index 6bcc57493..c08004b8e 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Department.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Department.tsx
@@ -14,7 +14,13 @@ const DEPARTMENTS: { value: Departments; label: string }[] = [
   { value: 'none', label: 'None' },
 ];
 
-export const Department = ({ control }: { control: Control<EmployeeFormValues> }) => {
+export const Department = ({
+  control,
+  disabled,
+}: {
+  control: Control<EmployeeFormValues>;
+  disabled: boolean;
+}) => {
   return (
     <FormField
       control={control}
@@ -24,7 +30,12 @@ export const Department = ({ control }: { control: Control<EmployeeFormValues> }
           <FormLabel className="text-muted-foreground text-xs font-medium uppercase">
             Department
           </FormLabel>
-          <Select onValueChange={field.onChange} defaultValue={field.value} value={field.value}>
+          <Select
+            onValueChange={field.onChange}
+            defaultValue={field.value}
+            value={field.value}
+            disabled={disabled}
+          >
             <FormControl>
               <SelectTrigger className="h-10">
                 <SelectValue placeholder="Select department" />
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Email.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Email.tsx
index cf9f8803f..af31cdd29 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Email.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Email.tsx
@@ -3,7 +3,13 @@ import { Input } from '@comp/ui/input';
 import type { Control } from 'react-hook-form';
 import type { EmployeeFormValues } from '../EmployeeDetails';
 
-export const Email = ({ control }: { control: Control<EmployeeFormValues> }) => {
+export const Email = ({
+  control,
+  disabled,
+}: {
+  control: Control<EmployeeFormValues>;
+  disabled: boolean;
+}) => {
   return (
     <FormField
       control={control}
@@ -14,7 +20,13 @@ export const Email = ({ control }: { control: Control<EmployeeFormValues> }) =>
             EMAIL
           </FormLabel>
           <FormControl>
-            <Input {...field} type="email" placeholder="Employee email" className="h-10" disabled />
+            <Input
+              {...field}
+              type="email"
+              placeholder="Employee email"
+              className="h-10"
+              disabled={disabled}
+            />
           </FormControl>
           <FormMessage />
         </FormItem>
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/JoinDate.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/JoinDate.tsx
index 0c96a087d..10b8ed210 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/JoinDate.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/JoinDate.tsx
@@ -8,7 +8,13 @@ import { CalendarIcon } from 'lucide-react';
 import type { Control } from 'react-hook-form';
 import type { EmployeeFormValues } from '../EmployeeDetails';
 
-export const JoinDate = ({ control }: { control: Control<EmployeeFormValues> }) => {
+export const JoinDate = ({
+  control,
+  disabled,
+}: {
+  control: Control<EmployeeFormValues>;
+  disabled: boolean;
+}) => {
   return (
     <FormField
       control={control}
@@ -19,7 +25,7 @@ export const JoinDate = ({ control }: { control: Control<EmployeeFormValues> })
             Join Date
           </FormLabel>
           <Popover>
-            <PopoverTrigger asChild>
+            <PopoverTrigger asChild disabled={disabled}>
               <FormControl>
                 <Button
                   variant={'outline'}
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Name.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Name.tsx
index 8ddb5101a..38dc6c952 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Name.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Name.tsx
@@ -3,7 +3,13 @@ import { Input } from '@comp/ui/input';
 import type { Control } from 'react-hook-form';
 import type { EmployeeFormValues } from '../EmployeeDetails';
 
-export const Name = ({ control }: { control: Control<EmployeeFormValues> }) => {
+export const Name = ({
+  control,
+  disabled,
+}: {
+  control: Control<EmployeeFormValues>;
+  disabled: boolean;
+}) => {
   return (
     <FormField
       control={control}
@@ -14,7 +20,7 @@ export const Name = ({ control }: { control: Control<EmployeeFormValues> }) => {
             NAME
           </FormLabel>
           <FormControl>
-            <Input {...field} placeholder="Employee name" className="h-10" />
+            <Input {...field} placeholder="Employee name" className="h-10" disabled={disabled} />
           </FormControl>
           <FormMessage />
         </FormItem>
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Status.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Status.tsx
index a46d9ccbc..69c0c168d 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Status.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/Fields/Status.tsx
@@ -16,7 +16,13 @@ export const EMPLOYEE_STATUS_HEX_COLORS: Record<EmployeeStatusType, string> = {
   active: '#10b981',
 };
 
-export const Status = ({ control }: { control: Control<EmployeeFormValues> }) => {
+export const Status = ({
+  control,
+  disabled,
+}: {
+  control: Control<EmployeeFormValues>;
+  disabled: boolean;
+}) => {
   return (
     <FormField
       control={control}
@@ -26,7 +32,12 @@ export const Status = ({ control }: { control: Control<EmployeeFormValues> }) =>
           <FormLabel className="text-muted-foreground text-xs font-medium uppercase">
             Status
           </FormLabel>
-          <Select onValueChange={field.onChange} defaultValue={field.value} value={field.value}>
+          <Select
+            onValueChange={field.onChange}
+            defaultValue={field.value}
+            value={field.value}
+            disabled={disabled}
+          >
             <FormControl>
               <SelectTrigger className="h-10">
                 <SelectValue placeholder="Select status" />
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
index 859ad22fc..0659b3011 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/page.tsx
@@ -25,6 +25,15 @@ export default async function EmployeeDetailsPage({
 
   const organizationId = session?.session.activeOrganizationId;
 
+  const currentUserMember = await db.member.findFirst({
+    where: {
+      organizationId,
+      userId: session?.user.id,
+    },
+  });
+
+  const canEditMembers = ['owner', 'admin'].includes(currentUserMember?.role ?? '');
+
   if (!organizationId) {
     redirect('/');
   }
@@ -47,6 +56,7 @@ export default async function EmployeeDetailsPage({
       trainingVideos={employeeTrainingVideos}
       fleetPolicies={fleetPolicies}
       host={device}
+      canEdit={canEditMembers}
     />
   );
 }

From e98926afd4dee2dd13e7f111b08e4bcd0288670a Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 19:00:52 +0530
Subject: [PATCH 11/13] feat: Vendor delete button

---
 .../(overview)/actions/deleteVendor.ts        | 85 +++++++++++++++++++
 .../(overview)/components/VendorColumns.tsx   |  9 ++
 .../components/VendorDeleteCell.tsx           | 78 +++++++++++++++++
 3 files changed, 172 insertions(+)
 create mode 100644 apps/app/src/app/(app)/[orgId]/vendors/(overview)/actions/deleteVendor.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorDeleteCell.tsx

diff --git a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/actions/deleteVendor.ts b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/actions/deleteVendor.ts
new file mode 100644
index 000000000..51ef230c3
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/actions/deleteVendor.ts
@@ -0,0 +1,85 @@
+'use server';
+
+import { authActionClient } from '@/actions/safe-action';
+import type { ActionResponse } from '@/actions/types';
+import { db } from '@db';
+import { revalidatePath } from 'next/cache';
+import { z } from 'zod';
+
+const deleteVendorSchema = z.object({
+  vendorId: z.string(),
+});
+
+export const deleteVendor = authActionClient
+  .metadata({
+    name: 'delete-vendor',
+    track: {
+      event: 'delete_vendor',
+      channel: 'organization',
+    },
+  })
+  .inputSchema(deleteVendorSchema)
+  .action(async ({ parsedInput, ctx }): Promise<ActionResponse<{ deleted: boolean }>> => {
+    if (!ctx.session.activeOrganizationId) {
+      return {
+        success: false,
+        error: 'User does not have an active organization',
+      };
+    }
+
+    const { vendorId } = parsedInput;
+
+    try {
+      const currentUserMember = await db.member.findFirst({
+        where: {
+          organizationId: ctx.session.activeOrganizationId,
+          userId: ctx.user.id,
+        },
+      });
+
+      if (
+        !currentUserMember ||
+        (!currentUserMember.role.includes('admin') && !currentUserMember.role.includes('owner'))
+      ) {
+        return {
+          success: false,
+          error: "You don't have permission to delete vendors.",
+        };
+      }
+
+      // Verify the vendor exists within the user's organization
+      const targetVendor = await db.vendor.findFirst({
+        where: {
+          id: vendorId,
+          organizationId: ctx.session.activeOrganizationId,
+        },
+      });
+
+      if (!targetVendor) {
+        return {
+          success: false,
+          error: 'Vendor not found in this organization.',
+        };
+      }
+
+      await db.vendor.delete({
+        where: {
+          id: vendorId,
+        },
+      });
+
+      // Revalidate the path to refresh the data on the vendors page
+      revalidatePath(`/${ctx.session.activeOrganizationId}/vendors`);
+
+      return {
+        success: true,
+        data: { deleted: true },
+      };
+    } catch (error) {
+      console.error('Error deleting vendor:', error);
+      return {
+        success: false,
+        error: 'Failed to delete the vendor. Please try again.',
+      };
+    }
+  });
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorColumns.tsx b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorColumns.tsx
index a5adb287f..8e81d6ff4 100644
--- a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorColumns.tsx
+++ b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorColumns.tsx
@@ -6,6 +6,7 @@ import type { ColumnDef } from '@tanstack/react-table';
 import { UserIcon } from 'lucide-react';
 import Link from 'next/link';
 import type { GetVendorsResult } from '../data/queries';
+import { VendorDeleteCell } from './VendorDeleteCell';
 
 type VendorRow = GetVendorsResult['data'][number];
 
@@ -125,4 +126,12 @@ export const columns: ColumnDef<VendorRow>[] = [
       variant: 'select',
     },
   },
+  {
+    id: 'delete-vendor',
+    cell: ({ row }) => {
+      return <VendorDeleteCell vendor={row.original} />;
+    },
+    enableSorting: false,
+    enableHiding: false,
+  },
 ];
diff --git a/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorDeleteCell.tsx b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorDeleteCell.tsx
new file mode 100644
index 000000000..d40c9f6d6
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/vendors/(overview)/components/VendorDeleteCell.tsx
@@ -0,0 +1,78 @@
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@comp/ui/alert-dialog';
+import { Button } from '@comp/ui/button';
+import { Trash2 } from 'lucide-react';
+import * as React from 'react';
+import { toast } from 'sonner';
+import { deleteVendor } from '../actions/deleteVendor';
+import type { GetVendorsResult } from '../data/queries';
+
+type VendorRow = GetVendorsResult['data'][number];
+
+interface VendorDeleteCellProps {
+  vendor: VendorRow;
+}
+
+export const VendorDeleteCell: React.FC<VendorDeleteCellProps> = ({ vendor }) => {
+  const [isRemoveAlertOpen, setIsRemoveAlertOpen] = React.useState(false);
+  const [isDeleting, setIsDeleting] = React.useState(false);
+
+  const handleDeleteClick = async (event: React.MouseEvent<HTMLButtonElement>) => {
+    event.stopPropagation();
+    setIsDeleting(true);
+
+    const response = await deleteVendor({ vendorId: vendor.id });
+
+    if (response?.data?.success) {
+      toast.success(`Vendor "${vendor.name}" has been deleted.`);
+      setIsRemoveAlertOpen(false);
+    } else {
+      toast.error(String(response?.data?.error) || 'Failed to delete vendor.');
+    }
+
+    setIsDeleting(false);
+  };
+
+  return (
+    <>
+      <div className="flex items-center justify-center">
+        <Button
+          variant="ghost"
+          size="icon"
+          onClick={(e) => {
+            e.stopPropagation();
+            setIsRemoveAlertOpen(true);
+          }}
+        >
+          <Trash2 className="h-4 w-4" />
+          <span className="sr-only">Delete {vendor.name}</span>
+        </Button>
+      </div>
+      <AlertDialog open={isRemoveAlertOpen} onOpenChange={setIsRemoveAlertOpen}>
+        <AlertDialogContent onClick={(e) => e.stopPropagation()}>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Delete Vendor</AlertDialogTitle>
+            <AlertDialogDescription>
+              Are you sure you want to delete <strong>{vendor.name}</strong>? This action cannot be
+              undone.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Cancel</AlertDialogCancel>
+            <AlertDialogAction onClick={handleDeleteClick} disabled={isDeleting}>
+              {isDeleting ? 'Deleting...' : 'Delete'}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+    </>
+  );
+};

From bcf4434ff0513e40554e7d548d68ccfded55826f Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 19:35:48 +0530
Subject: [PATCH 12/13] feat: Add sorting options for organization list

---
 .../src/components/organization-switcher.tsx  | 37 ++++++++++++++++++-
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/apps/app/src/components/organization-switcher.tsx b/apps/app/src/components/organization-switcher.tsx
index f77315f82..b5bea0042 100644
--- a/apps/app/src/components/organization-switcher.tsx
+++ b/apps/app/src/components/organization-switcher.tsx
@@ -13,12 +13,13 @@ import {
   CommandSeparator,
 } from '@comp/ui/command';
 import { Dialog, DialogContent, DialogTitle, DialogTrigger } from '@comp/ui/dialog';
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@comp/ui/select';
 import type { Organization } from '@db';
 import { Check, ChevronsUpDown, Loader2, Plus, Search } from 'lucide-react';
 import { useAction } from 'next-safe-action/hooks';
 import { useRouter } from 'next/navigation';
 import { useQueryState } from 'nuqs';
-import { useState } from 'react';
+import { useEffect, useState } from 'react';
 
 interface OrganizationSwitcherProps {
   organizations: Organization[];
@@ -88,6 +89,27 @@ export function OrganizationSwitcher({
   const router = useRouter();
   const [isDialogOpen, setIsDialogOpen] = useState(false);
   const [pendingOrgId, setPendingOrgId] = useState<string | null>(null);
+  const [sortOrder, setSortOrder] = useState('alphabetical');
+
+  useEffect(() => {
+    const savedSortOrder = localStorage.getItem('org-sort-order');
+    if (savedSortOrder) {
+      setSortOrder(savedSortOrder);
+    }
+  }, []);
+
+  useEffect(() => {
+    localStorage.setItem('org-sort-order', sortOrder);
+  }, [sortOrder]);
+
+  const sortedOrganizations = [...organizations].sort((a, b) => {
+    if (sortOrder === 'alphabetical') {
+      return (a.name).localeCompare(b.name);
+    } else if (sortOrder === 'recent') {
+      return new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
+    }
+    return 0;
+  });
 
   const [showOrganizationSwitcher, setShowOrganizationSwitcher] = useQueryState(
     'showOrganizationSwitcher',
@@ -177,10 +199,21 @@ export function OrganizationSwitcher({
                 className="placeholder:text-muted-foreground flex h-11 w-full rounded-md border-0 bg-transparent py-3 text-sm outline-hidden focus-visible:ring-0 focus-visible:ring-offset-0 disabled:cursor-not-allowed disabled:opacity-50"
               />
             </div>
+            <div className="p-2">
+              <Select value={sortOrder} onValueChange={setSortOrder}>
+                <SelectTrigger className="w-full">
+                  <SelectValue placeholder="Sort by..." />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="alphabetical">Alphabetical</SelectItem>
+                  <SelectItem value="recent">Recently Created</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
             <CommandList>
               <CommandEmpty>No results found</CommandEmpty>
               <CommandGroup className="max-h-[300px] overflow-y-auto">
-                {organizations.map((org) => (
+                {sortedOrganizations.map((org) => (
                   <CommandItem
                     key={org.id}
                     // Search by id and name

From 3cb06d670fb288300b18214737f39c412966fd19 Mon Sep 17 00:00:00 2001
From: Dhanus <dhanus3133@gmail.com>
Date: Sat, 23 Aug 2025 20:54:44 +0530
Subject: [PATCH 13/13] feat: Update tasks on top level

---
 .../app/(app)/[orgId]/tasks/[taskId]/page.tsx |  5 +-
 .../[orgId]/tasks/actions/updateTaskStatus.ts | 68 +++++++++++++++++
 .../[orgId]/tasks/components/TaskCard.tsx     | 67 +++++++----------
 .../tasks/components/TaskStatusSelector.tsx   | 75 +++++++++++++++++++
 apps/app/src/app/(app)/[orgId]/tasks/page.tsx |  5 --
 5 files changed, 172 insertions(+), 48 deletions(-)
 create mode 100644 apps/app/src/app/(app)/[orgId]/tasks/actions/updateTaskStatus.ts
 create mode 100644 apps/app/src/app/(app)/[orgId]/tasks/components/TaskStatusSelector.tsx

diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
index b2387fec8..7392ab283 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/page.tsx
@@ -20,10 +20,7 @@ export default async function TaskPage({
   });
   console.log('[TaskPage] Session obtained, fetching data');
 
-  const [task, members] = await Promise.all([
-    getTask(taskId, session),
-    getMembers(orgId, session),
-  ]);
+  const [task, members] = await Promise.all([getTask(taskId, session), getMembers(orgId, session)]);
 
   if (!task) {
     redirect(`/${orgId}/tasks`);
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/actions/updateTaskStatus.ts b/apps/app/src/app/(app)/[orgId]/tasks/actions/updateTaskStatus.ts
new file mode 100644
index 000000000..6f88ee2ba
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/actions/updateTaskStatus.ts
@@ -0,0 +1,68 @@
+'use server';
+
+import { authActionClient } from '@/actions/safe-action';
+import { db } from '@db';
+import { revalidatePath } from 'next/cache';
+import { z } from 'zod';
+
+const updateTaskStatusSchema = z.object({
+  id: z.string(),
+  status: z.enum(['todo', 'in_progress', 'done', 'not_relevant']),
+});
+
+export const updateTaskStatusAction = authActionClient
+  .inputSchema(updateTaskStatusSchema)
+  .metadata({
+    name: 'update-task-status',
+    track: {
+      event: 'update_task_status',
+      description: 'Update Task Status from List View',
+      channel: 'server',
+    },
+  })
+  .action(async ({ parsedInput, ctx }) => {
+    const { id, status } = parsedInput;
+    const { activeOrganizationId } = ctx.session;
+
+    if (!activeOrganizationId) {
+      return {
+        success: false,
+        error: 'Not authorized',
+      };
+    }
+
+    try {
+      const task = await db.task.findUnique({
+        where: {
+          id,
+          organizationId: activeOrganizationId,
+        },
+      });
+
+      if (!task) {
+        return {
+          success: false,
+          error: 'Task not found',
+        };
+      }
+
+      // Update the task status
+      await db.task.update({
+        where: { id },
+        data: { status },
+      });
+
+      // Revalidate paths to update UI
+      revalidatePath(`/${activeOrganizationId}/tasks`);
+
+      return {
+        success: true,
+      };
+    } catch (error) {
+      console.error(error);
+      return {
+        success: false,
+        error: 'Failed to update task status',
+      };
+    }
+  });
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskCard.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskCard.tsx
index c03c04cb6..684de15d0 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskCard.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskCard.tsx
@@ -1,11 +1,11 @@
 'use client';
 
-import type { Member, Task, TaskStatus, User } from '@db';
+import type { Member, Task, User } from '@db';
 import Image from 'next/image';
 import { usePathname, useRouter } from 'next/navigation';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useDrag, useDrop } from 'react-dnd';
-import { TaskStatusIndicator } from './TaskStatusIndicator';
+import { TaskStatusSelector } from './TaskStatusSelector';
 
 // DnD Item Type identifier for tasks.
 export const ItemTypes = {
@@ -85,8 +85,6 @@ export function TaskCard({
         return;
       }
 
-      const dragIndex = item.index;
-      const hoverIndex = index;
       const clientOffset = monitor.getClientOffset();
       if (!clientOffset) return;
 
@@ -151,20 +149,6 @@ export function TaskCard({
     return members.find((m) => m.id === task.assigneeId);
   }, [task.assigneeId, members]);
 
-  // Helper to get Tailwind class for the entity type indicator dot.
-  const getEntityTypeDotClass = (entityType: 'control' | 'risk' | 'vendor'): string => {
-    switch (entityType) {
-      case 'control':
-        return 'bg-blue-500';
-      case 'risk':
-        return 'bg-red-500';
-      case 'vendor':
-        return 'bg-green-500';
-      default:
-        return 'bg-gray-500';
-    }
-  };
-
   // Navigation handler for clicking on the task card.
   const handleNavigate = () => {
     const targetPath = `${pathname}/${task.id}`;
@@ -174,9 +158,8 @@ export function TaskCard({
   return (
     <div
       ref={setRefs}
-      onClick={handleNavigate}
       className={`group relative flex w-full items-center pr-2 ${!isLast ? 'border-border border-b' : ''} ${
-        isDragging ? 'bg-muted opacity-30' : 'hover:bg-muted/50 cursor-pointer opacity-100'
+        isDragging ? 'bg-muted opacity-30' : 'hover:bg-muted/50 opacity-100'
       }`}
     >
       {/* Reorder Indicator (Solid Line) */}
@@ -203,26 +186,32 @@ export function TaskCard({
       <div className="text-muted-foreground/50 flex h-8 w-6 shrink-0 cursor-grab items-center justify-center opacity-0 transition-opacity group-hover:opacity-100">
         <span className="text-xs">::</span>
       </div>
-      <div className="mr-2 flex h-8 w-6 shrink-0 items-center justify-center">
-        <TaskStatusIndicator status={task.status as TaskStatus} />
+      <div className="mr-2 flex shrink-0 items-center justify-center">
+        <TaskStatusSelector task={task} />
       </div>
-      <span className="min-w-0 flex-grow truncate py-2 text-sm">{task.title}</span>
-      <div className="ml-auto flex shrink-0 items-center space-x-3 pl-2">
-        <span className="text-muted-foreground text-xs whitespace-nowrap">Apr 15</span>
-        <div className="bg-muted flex h-5 w-5 items-center justify-center overflow-hidden rounded-full border">
-          {assignedMember?.user?.image ? (
-            <Image
-              src={assignedMember.user.image}
-              alt={assignedMember.user.name ?? 'Assignee'}
-              width={20}
-              height={20}
-              className="object-cover"
-            />
-          ) : (
-            <span className="text-muted-foreground text-[10px]">
-              {assignedMember?.user?.name?.charAt(0) ?? '?'}
-            </span>
-          )}
+
+      <div
+        className="flex flex-grow items-center h-full min-w-0 cursor-pointer"
+        onClick={handleNavigate}
+      >
+        <span className="min-w-0 flex-grow truncate py-2 text-sm">{task.title}</span>
+        <div className="ml-auto flex shrink-0 items-center space-x-3 pl-2">
+          <span className="text-muted-foreground text-xs whitespace-nowrap">Apr 15</span>
+          <div className="bg-muted flex h-5 w-5 items-center justify-center overflow-hidden rounded-full border">
+            {assignedMember?.user?.image ? (
+              <Image
+                src={assignedMember.user.image}
+                alt={assignedMember.user.name ?? 'Assignee'}
+                width={20}
+                height={20}
+                className="object-cover"
+              />
+            ) : (
+              <span className="text-muted-foreground text-[10px]">
+                {assignedMember?.user?.name?.charAt(0) ?? '?'}
+              </span>
+            )}
+          </div>
         </div>
       </div>
     </div>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskStatusSelector.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskStatusSelector.tsx
new file mode 100644
index 000000000..77853e00b
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskStatusSelector.tsx
@@ -0,0 +1,75 @@
+'use client';
+
+import { Button } from '@comp/ui/button';
+import type { Task, TaskStatus } from '@db';
+import { useAction } from 'next-safe-action/hooks';
+import { toast } from 'sonner';
+import { PropertySelector } from '../[taskId]/components/PropertySelector';
+import { taskStatuses } from '../[taskId]/components/constants';
+import { updateTaskStatusAction } from '../actions/updateTaskStatus';
+import { TaskStatusIndicator } from './TaskStatusIndicator';
+
+interface TaskStatusSelectorProps {
+  task: Task;
+}
+
+export function TaskStatusSelector({ task }: TaskStatusSelectorProps) {
+  const { execute, status } = useAction(updateTaskStatusAction, {
+    onSuccess: (res) => {
+      if (res?.data.success) {
+        return;
+      } else {
+        console.error('Failed to update task status:', res?.data.error);
+        toast.error(`Failed to update task status: ${res?.data.error || 'Unknown error'}`);
+      }
+    },
+    onError: (error) => {
+      console.error('Failed to update task status:', error);
+      toast.error('Failed to update task status.');
+    },
+  });
+
+  const isUpdating = status === 'executing';
+
+  const handleStatusSelect = (selectedStatus: string | null) => {
+    if (selectedStatus && selectedStatus !== task.status) {
+      execute({
+        id: task.id,
+        status: selectedStatus as TaskStatus,
+      });
+    }
+  };
+
+  return (
+    <PropertySelector<TaskStatus>
+      value={task.status}
+      options={taskStatuses}
+      getKey={(status) => status}
+      renderOption={(status) => (
+        <div className="flex items-center gap-2">
+          <TaskStatusIndicator status={status} />
+          <span className="capitalize">{status.replace('_', ' ')}</span>
+        </div>
+      )}
+      onSelect={handleStatusSelect}
+      trigger={
+        <Button
+          variant="ghost"
+          size="icon"
+          className="hover:bg-muted data-[state=open]:bg-muted flex h-8 w-6 shrink-0 items-center justify-center p-0"
+          onClick={(e) => {
+            e.stopPropagation();
+          }}
+          disabled={isUpdating}
+          aria-label={`Change status for ${task.title}`}
+        >
+          <TaskStatusIndicator status={task.status as TaskStatus} />
+        </Button>
+      }
+      searchPlaceholder="Change status..."
+      emptyText="No status found."
+      contentWidth="w-48"
+      disabled={isUpdating}
+    />
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/page.tsx b/apps/app/src/app/(app)/[orgId]/tasks/page.tsx
index 67441bc66..162fd59ce 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/page.tsx
@@ -38,9 +38,6 @@ export default async function TasksPage({
 }
 
 const getTasks = async (statusParam?: string) => {
-  console.log('Fetching tasks...', {
-    statusParam,
-  });
   const session = await auth.api.getSession({
     headers: await headers(),
   });
@@ -59,7 +56,6 @@ const getTasks = async (statusParam?: string) => {
   // Filter by Status (using passed argument)
   if (typeof statusParam === 'string' && statusParam in TaskStatus) {
     whereClause.status = statusParam as TaskStatus;
-    console.log(`Filtering by status: ${whereClause.status}`);
   }
 
   const tasks = await db.task.findMany({
@@ -70,7 +66,6 @@ const getTasks = async (statusParam?: string) => {
 };
 
 const getMembersWithMetadata = async () => {
-  console.log('Fetching members...');
   const session = await auth.api.getSession({
     headers: await headers(),
   });