Evaluation — Contact Book (WeWeb + Xano)

1. Xano — `contacts` Data Table

Table has all required columns: id, workspace_id, full_name, email, phone, company, title, status, notes, created_by, created_at
id: auto-increment or UUID, primary key
workspace_id: integer or UUID FK pointing to workspaces
email: text, NOT NULL
phone: text, nullable
status: text, with a valid values list: 'active', 'inactive', 'prospect'
created_by: FK to users (auth.user or equivalent)
created_at: timestamp with default now()
Unique constraint (or equivalent validation) on (workspace_id, email) — duplicate email blocked in same workspace
Index on (workspace_id, status)

2. Xano — Reusable Function: `check_workspace_permission`

Function exists as a reusable Xano function (not duplicated inside each endpoint)
Accepts: workspace_id, user_id, required_role
Returns the membership record if user has required role or higher, raises error if not
Role hierarchy respected: member satisfies member; editor satisfies editor+member; admin satisfies all; owner satisfies all
Raises a 403-equivalent error with a clear message if permission check fails
Does NOT contain its own auth token validation — that is the calling endpoint's responsibility

3. Xano — Endpoint: List Contacts (GET)

Auth token validated as first step (before any DB query)
Calls check_workspace_permission with the workspace_id and the authenticated user
Query filters by workspace_id (contacts from other workspaces cannot be returned)
Supports ?search= parameter — filters by full_name OR email OR company contains — DB-side query
Supports ?status= parameter — filters by status
Supports ?sort_by= and ?sort_dir= — sorts result from DB
Pagination: accepts ?page= and ?per_page= parameters
Returns: { data: [...], total: N, page: N, per_page: N }
Error format: { "code": "ERROR_CODE", "message": "..." }

4. Xano — Endpoint: Get Contact (GET by ID)

Auth validated first
Workspace membership verified via check_workspace_permission
Returns 404-equivalent error if contact not found
Returns 403-equivalent error if contact belongs to a different workspace
Returns full contact object on success

5. Xano — Endpoint: Create Contact (POST)

Auth validated first
check_workspace_permission called with required role (member or above)
Validation: full_name — required, not blank
Validation: email — required, valid email format
Validation: phone — optional; if provided, validated as E.164 format (+[digits])
Validation: status — must be one of 'active', 'inactive', 'prospect'
After all input validation: workspace membership check (not before)
After permission check: duplicate email check within workspace — returns distinct error code DUPLICATE
created_by set from auth token (not from request body)
workspace_id set from path or validated context (not trusted from body alone)
Returns created contact object on success

6. Xano — Endpoint: Update Contact (PUT/PATCH by ID)

Auth validated first
check_workspace_permission called
Validates contact belongs to caller's workspace (cannot edit contacts from another workspace)
Input validation same as create (full_name, email format, phone E.164, status enum)
Duplicate email check excludes the current contact's ID (editing email to same value must not error)
Returns updated contact object on success

7. Xano — Endpoint: Delete Contact (DELETE by ID)

Auth validated first
check_workspace_permission called — requires admin or owner role (not member)
Validates contact belongs to caller's workspace
Deletes the contact record
Returns success response (200 with message or 204)

8. WeWeb — List Page

Page URL: /workspaces/{id}/contacts
Contacts fetched from Xano list endpoint — not hardcoded
Search input: value sent to Xano endpoint as ?search= — not filtered in WeWeb
Status filter: value sent to Xano as ?status=
Sort controls: sort_by and sort_dir sent to Xano
URL state: ?search=, ?status=, ?sort_by=, ?sort_dir=, ?page= all in URL — page is shareable
Pagination: correct page shown on load from URL param
Pagination resets to page 1 when search or filter changes
Active filter chips shown — clicking removes that filter
Loading state: skeleton rows shown while fetching
Empty state: "No contacts found." shown
Error state: error message + retry shown
"Add Contact" button visible to all members
Edit/Delete buttons visible only to admin/owner

9. WeWeb — Add/Edit Modal

Single shared WeWeb component for both Add and Edit
Edit pre-fills all fields with current contact values
full_name required — error shown if blank
email required — validated format, error shown if invalid
phone optional — if filled, E.164 error shown if invalid format
status dropdown with only valid options
Duplicate email: shown as field error below email input (not a toast)
Submit calls correct Xano endpoint (POST for create, PUT/PATCH for edit)
Submit button shows loading state during API call
Submit button disabled while loading
On success: modal closes, list refreshes, "Contact added." / "Contact updated." toast shown
API field errors (from Xano VALIDATION_ERROR) shown per field — not as a generic banner

10. Delete

Delete button visible to admin/owner only
Confirmation: "Delete [Full Name]?" — name displayed in dialog
Confirm button shows loading state
On success: contact removed from list, "Contact deleted." toast shown
On error: error message shown, contact stays in list

11. Standards Compliance

No hardcoded hex colors in WeWeb — all from global tokens
No hardcoded spacing values — all from global tokens
Auth token via WeWeb auth plugin — not from localStorage manually
All URL filter/sort/page state preserved in query params
No silent failures — all Xano errors surfaced in UI
Every async action shows loading state
Mobile layout tested at 375px and 768px