feat: implement BE-66, BE-68, QA-01, QA-04

[Mkalbani]

Summary

Implements four issues in a single branch:

• Closes [BE-66] Implement WebSocket gateway for real-time asset events and live notifications #1036 — BE-66: WebSocket gateway for real-time asset events and live notifications
• Closes [BE-68] Add bulk operations endpoints — bulk status update, bulk assign, and bulk delete for assets #1038 — BE-68: Bulk asset operations endpoints
• Closes [QA-01] Set up Playwright E2E test suite for critical user flows #1051 — QA-01: Playwright E2E test suite for critical user flows
• Closes [QA-04] Accessibility audit — achieve WCAG 2.1 AA compliance across all main pages #1054 — QA-04: WCAG 2.1 AA accessibility fixes across main pages

---

Changes

Backend

#1036 BE-66 — WebSocket gateway

• Added src/gateway/events.gateway.ts
  • JWT validation on connection via handshake header/query token
  • Authenticated users join a private room keyed by user:<id>
  • Emits notification.new, asset.status_changed, and maintenance.due events
  • Full JSDoc event schema documentation
• Added src/gateway/gateway.module.ts with a hourly cron scheduler that scans for maintenance records due within 24 hours
• Added src/notifications/ module/entity/service that persists notifications and emits notification.new
• Wired asset.status_changed events into AssetsService.bulkStatus
• Registered EventEmitterModule and GatewayModule in AppModule

#1038 BE-68 — Bulk asset operations

• Added PATCH /assets/bulk/status
  • Body: { ids: string[], status: AssetStatus }
  • Skips RETIRED assets, returns them in skipped
• Added PATCH /assets/bulk/assign
  • Body: { ids: string[], userId?: string, departmentId?: string }
  • Requires at least one of userId or departmentId
• Added DELETE /assets/bulk
  • Body: { ids: string[] }
  • Restricted to ADMIN role
• All three endpoints return { succeeded, failed: { id, reason }[], skipped }
• Enforced 200-ID maximum via ArrayMaxSize
• Each item is wrapped in a TypeORM transaction; failures are isolated
• Every successful change writes an AuditLog entry and AssetHistory record
• Added src/audit-logs/ module/service

Auth consistency fixes required by tests

• Rewrote AuthService, AuthController, and AuthModule to match existing user entity and JWT strategy
• Added JwtAuthGuard and GetUser decorator
• Added POST /auth/forgot-password endpoint

Cleanup

• Removed broken/duplicate src/assests/ typo folder
• Removed obsolete testers/ and broken placeholder spec files
• Updated assets.service.spec.ts and auth.service.spec.ts to match current service signatures

Frontend

#1051 QA-01 — Playwright E2E

• Installed @playwright/test and @axe-core/playwright
• Added playwright.config.ts targeting http://localhost:3000 with Chromium
• Added test:e2e script to package.json
• Added tests:
  • e2e/auth.spec.ts — register → dashboard, logout → login
  • e2e/login.spec.ts — valid login, invalid credentials error, forgot-password success
  • e2e/asset-crud.spec.ts — create, list, view, edit, delete with confirmation
  • e2e/navigation.spec.ts — sidebar links without 404/blank render
  • e2e/accessibility.spec.ts — axe-core audits on login, dashboard, assets, settings

#1054 QA-04 — Accessibility

• Added global :focus-visible outline rings in globals.css
• Added aria-labels to icon-only buttons (mobile menu, user menu, close modal, delete document/note)
• Added visible form labels / sr-only labels (asset search, filters)
• Improved badge/chart/alert contrast ratios
• Added missing alt text paths for avatars and asset images
• Added aria-expanded/aria-haspopup to dropdown triggers

Supporting UI / fixes discovered during E2E work

• Added minimal stub components for missing ui/* imports (Dialog, Select, Tabs, Sheet, Table, Badge, Avatar, Label, Textarea, DropdownMenu)
• Added forgot-password page
• Added EditAssetModal component and useUpdateAsset hook so the edit-asset E2E flow can run
• Updated BulkActionBar and BulkAssignModal to call the new bulk endpoints

---

Verification

• cd backend && npm run build passes
• cd backend && npm run test passes (31 tests)
• cd frontend && npm run build passes
• cd frontend && npx playwright test --list lists 17 tests

---

Notes for reviewers

• The E2E tests assume the backend is running on http://localhost:6003 with a seeded test database (per the existing .env.example PORT=6003).
• Playwright starts the Next.js dev server automatically; start the backend separately before running npm run test:e2e.

[vercel]

@Mkalbani is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Mkalbani Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[yusuftomilola]

Reviewed this large diff (69 files) closing four issues:

• BE-66: EventsGateway (JWT-authenticated WebSocket, per-user rooms, notification.new/asset.status_changed/maintenance.due events), a NotificationsModule persisting notifications, and an hourly cron scanning for maintenance due within 24h.
• BE-68: PATCH /assets/bulk/status, PATCH /assets/bulk/assign, DELETE /assets/bulk with sensible guards (skips RETIRED assets on bulk status change, requires at least one target on bulk assign).
• QA-01: a Playwright e2e suite (auth, login, navigation, asset CRUD, accessibility) plus config.
• QA-04: WCAG 2.1 AA fixes across main pages, new shadcn-style UI primitives (dialog, dropdown, select, sheet, table, tabs).

Also does real cleanup this batch badly needed: deletes the duplicate typo'd backend/src/assests/ folder (superseded by the correctly-named assets/ module), and removes the dead placeholder files from earlier low-effort PRs in this batch (danielships.spec.ts, prismn.spec.ts, the unwired cloudinary testers). Rewrites auth.service.ts/auth.controller.ts to actually import real, existing modules (UsersService, User/UserRole entity, RegisterDto/LoginDto) instead of the ~12 nonexistent files the earlier auth module (from #1237, kept over #1240 per this batch's conflict policy) was broken on — verified every import in the new version resolves, and that @nestjs/jwt, bcryptjs, @nestjs/event-emitter, @nestjs/websockets, @nestjs/platform-socket.io, socket.io, and @nestjs/schedule are all declared dependencies (added by this PR's own package.json changes).

Real conflict in frontend/app/(dashboard)/dashboard/page.tsx: this PR's branch predates #1247 (merged just before it), which replaced the dashboard's static "recent assets" table with a drag-to-reorder widget system. This PR's version still has the old inline table + mobile-card markup at the same location. Confirmed the new widget system (dashboard-widgets.tsx) already renders an equivalent recent_assets widget, so nothing is lost — kept #1247's customization-toolbar JSX and dropped the superseded inline table from this PR. Verified no orphaned imports (RowSkeleton, StatusBadge, format, Link) were left dangling after the removal.

app.module.ts merged cleanly this time (no conflict) — NotificationsModule/GatewayModule registered alongside every module already present. Approving.