Evaluation — Leave Requests (WeWeb + Xano)

Stack: WeWeb + Xano

Evaluator: ___________

Submission Date: ___________

Pass Threshold: 90%

How to Mark

[✓] Fully correct
[~] Partial — note the gap below the item
[✗] Missing or wrong

1. Xano — `leave_requests` Data Table

Table has all required columns: id, workspace_id, employee_id, leave_type, start_date, end_date, total_days, reason, status, reviewed_by, reviewed_at, review_notes, created_at
leave_type restricted to valid values: annual, sick, personal, unpaid
status restricted to valid values: submitted, approved, rejected, cancelled
total_days: integer, computed value (not user-supplied)
reviewed_by, reviewed_at, review_notes: nullable
created_at: timestamp with default now()
Index or filtering support on (workspace_id, employee_id, status)
Index on (workspace_id, status, created_at) for admin list ordering

2. Xano — Endpoint: Submit Leave Request (POST)

Auth validated as first step
employee_id set from auth token (not from body)
workspace_id from route param or context — not trusted from body
check_workspace_permission called (member or above)
Validation order:

[ ] leave_type — required, one of valid enum values [ ] start_date — required, must be ≥ today (past dates rejected) [ ] end_date — required, must be ≥ start_date [ ] reason — optional

total_days computed server-side as (end_date - start_date) + 1 — not from body
Overlap check: queries for any existing submitted or approved leave request for same employee that overlaps the requested dates — raises DUPLICATE or BUSINESS_RULE_VIOLATION if found
Status set to submitted automatically on creation
Returns created leave request object

3. Xano — Endpoint: My Leave Requests (GET)

Auth validated first
Returns only the authenticated user's leave requests in their workspace — cannot view others'
Supports ?status= filter
Paginated response with total count
Ordered by created_at DESC

4. Xano — Endpoint: All Leave Requests — Admin (GET)

Auth validated first
check_workspace_permission called with admin or owner required role — member role returns 403
Returns all workspace leave requests (not just caller's)
Supports ?status= filter
Supports ?employee_id= filter to view a specific employee's requests
Paginated response ordered by created_at DESC

5. Xano — Endpoint: Approve Leave (POST/PATCH)

Auth validated first
check_workspace_permission with admin/owner required — 403 for member role
Validates the leave request belongs to the same workspace (no cross-workspace access)
Validates current status is submitted — raises BUSINESS_RULE_VIOLATION if already approved/rejected/cancelled
Sets status = 'approved', reviewed_by = auth.user.id, reviewed_at = now()
Returns updated leave request

6. Xano — Endpoint: Reject Leave (POST/PATCH)

Auth validated first
check_workspace_permission with admin/owner required
Validates the leave request belongs to the same workspace
review_notes validated as required — returns error if blank
Validates current status is submitted — raises error if not
Sets status = 'rejected', reviewed_by, reviewed_at, review_notes
Returns updated leave request

7. Xano — Endpoint: Cancel Leave (POST/PATCH)

Auth validated first
check_workspace_permission (member level sufficient)
Validates the leave request belongs to the authenticated employee — cannot cancel someone else's request
Validates current status is submitted — raises error if already approved/rejected/cancelled
Sets status = 'cancelled'
Returns updated leave request

8. WeWeb — Employee: Multi-Step Submit Form

Form has 3 distinct steps: (1) Leave Type & Dates → (2) Reason → (3) Review & Submit
Step progress indicator shown with step numbers or labels
Completed steps visually marked (checkmark or different style)
"Next" button does not advance to the next step if current step has invalid input
Step 1 validation: leave_type required, start_date required and not in past, end_date ≥ start_date
Step 2: reason field (optional)
Step 3: summary of all entered data shown for review before submission
Submit calls the Xano submit endpoint
Submit button shows loading state
On success: form resets or redirects to my requests page, "Leave request submitted." toast shown
Overlap error shown as form-level error (not silent)
Past date error shown as field error on start_date field

9. WeWeb — My Requests Page

Shows only the authenticated employee's own leave requests
Status filter: filters results
Status badge: correct color/class per status value
Cancel button: visible only for submitted status requests
Cancel action: calls the cancel endpoint (not a client-side status change)
Confirmation shown before cancellation
On cancel success: status badge updates, "Request cancelled." toast shown
Loading state shown while fetching requests
Empty state: "You have no leave requests." shown
Error state: error + retry shown

10. WeWeb — Manager Page (All Requests)

Page accessible by admin/owner only — members see a 403 state ("Access denied." message), not an empty list
403 state: shown correctly when member role tries to access the page
All workspace requests shown (from all employees)
?status= and ?employee_id= filters supported and sent to Xano
Approve button: calls approve endpoint; disappears or disables after the request is approved
Reject button: opens an inline rejection reason form before calling the reject endpoint
Rejection reason: required field — cannot submit reject without it
After approve/reject: row status badge updates immediately, action buttons disappear
Loading state on approve/reject buttons during API call
Toast shown on approve or reject success

11. Standards Compliance

No hardcoded hex colors in WeWeb — all global tokens
No hardcoded pixel spacing — all global tokens
Auth token via WeWeb auth plugin only
URL state: ?status=, ?employee_id=, ?page= preserved in URL for manager page
All async actions have loading states
No silent failures
Mobile layout functional at 375px and 768px

Score Summary

Section	Total Items	✓ Pass	~ Partial	✗ Fail
1. Data Table	8
2. Submit Endpoint	13
3. My Requests Endpoint	5
4. Admin List Endpoint	6
5. Approve Endpoint	7
6. Reject Endpoint	7
7. Cancel Endpoint	6
8. Multi-Step Form	11
9. My Requests Page	10
10. Manager Page	10
11. Standards	7
Total	90

Score: ___ / 90 (___%) — Pass / Conditional / Fail

Evaluator Notes

_Record specific failures, partial items, or other observations here._