Evaluation — Task Board (WeWeb + Supabase)

1. Database Schema — tasks Table

id column: UUID, default gen_random_uuid()
workspace_id column: UUID, FK → workspaces.id, ON DELETE CASCADE
title column: text, NOT NULL
description column: text, nullable
status column: text, NOT NULL, default 'open'
priority column: text, NOT NULL, default 'medium'
assignee_id column: UUID, FK → auth.users.id, nullable, ON DELETE SET NULL
created_by column: UUID, FK → auth.users.id, ON DELETE SET NULL
due_date column: date, nullable
created_at column: timestamptz, default now()
CHECK constraint on status: IN ('open', 'in-progress', 'done', 'cancelled')
CHECK constraint on priority: IN ('low', 'medium', 'high', 'urgent')
Index on (workspace_id, status)
Index on (workspace_id, assignee_id)
Index on (workspace_id, priority, status)
Index on (workspace_id, due_date) or similar for due date queries

2. RLS Policies — tasks Table

RLS enabled on the tasks table
SELECT: workspace members can view all tasks in their workspace
INSERT: workspace members can create tasks (created_by set to auth.uid())
UPDATE: workspace members can update tasks; admin/owner can update any task
DELETE: admin/owner only can delete tasks
Policies correctly use auth.uid() and join against workspace_members
A member cannot see tasks from a workspace they do not belong to

3. RPC Function — create_task

Function named create_task
Accepts parameters: p_workspace_id, p_title, p_description, p_priority, p_assignee_id (nullable), p_due_date (nullable)
Step 1: auth check — raises exception if auth.uid() is NULL
Step 2: validates p_title is not empty or blank
Step 3: validates p_priority is one of 'low', 'medium', 'high', 'urgent'
Step 4: checks caller is a workspace member
Step 5: if p_assignee_id provided — validates the assignee is also a workspace member (not any user)
Inserts task with created_by = auth.uid(), status = 'open'
Returns json_build_object('data', row_to_json(v_task))
Exception format matches standard: 'ERROR_CODE: description'

4. RPC Function — update_task_status

Function named update_task_status
Accepts: p_workspace_id UUID, p_task_ids UUID[] (array), p_status text
Step 1: auth check — raises if not authenticated
Step 2: validates p_status is a valid status value
Step 3: checks caller is a workspace member
Updates ALL tasks in p_task_ids where workspace_id = p_workspace_id (scoped, cannot touch another workspace's tasks)
Returns count of updated tasks or success response
Single call updates multiple tasks atomically (not a loop of individual RPCs from frontend)

5. Task List Page

Page URL matches spec: /workspaces/{workspace_id}/tasks
Tasks loaded from DB — not hardcoded
Search: filters task title in DB (server-side), not client-side
Status filter: dropdown, filters DB query
Priority filter: dropdown, filters DB query
Assignee filter: dropdown populated with workspace members, filters DB query
All active filters shown as chips below the filter bar
Filter chip: clicking removes that filter and reloads results
URL state: ?search=, ?status=, ?priority=, ?assignee=, ?page= all preserved in URL
Pagination resets to page 1 when any filter changes
Loading state: skeleton task rows shown (not spinner only)
Empty state: "No tasks found." shown
Error state: error message + retry button shown
Status badge per task row: correct color/class per status value
Priority badge per task row: correct color/class per priority value
Create Task button visible to all members
Delete button visible to admin/owner only

6. Create Task Modal

Modal opens on "Create Task" click
Required fields: title, priority
Optional fields: description, assignee, due_date
Title: shows error if blank
Priority: dropdown with correct options (low/medium/high/urgent)
Assignee: dropdown populated with workspace members (not all users)
Due date: date picker
Submit calls create_task RPC (not a direct table INSERT)
Submit button shows loading state
Submit button disabled while loading
On success: modal closes, task list refreshes, "Task created." toast shown
Assignee validation error shown if returned by RPC (invalid assignee)

7. Inline Status Update

Status badge on each task row is interactive (clickable)
Clicking badge opens a dropdown or selector with valid status options
Selecting a new status calls update_task_status RPC with a single task ID
List updates to reflect new status without full page reload
Loading indicator shown on the row/badge during the update
Error shown inline if the RPC call fails

8. Bulk Status Update

Each task row has a checkbox for selection
A "Select All" checkbox selects/deselects all visible tasks
Selected count shown when ≥ 1 task is selected (e.g. "3 tasks selected")
"Apply Status" (or equivalent) button only visible when tasks are selected
Status dropdown/picker shown for bulk apply
Confirm action calls update_task_status RPC with array of selected task IDs — single RPC call (not N calls)
On success: all selected tasks update their status in the list
On success: selection is cleared
On success: toast "Status updated for X tasks." shown

9. Standards Compliance

No hardcoded colors — all from WeWeb global color tokens
No hardcoded pixel spacing — all from global spacing tokens
Collections fetched at page level
Auth token via WeWeb auth plugin
No silent failures — all RPC errors surface in UI
Every destructive or async action has a loading state
Mobile layout tested at 375px and 768px
Filter state in URL — page is shareable and bookmarkable with filters applied