mec-osh/sama-yas

Purpose and Entry Points

This is a GitHub Pages-ready Occupational Safety and Health (OSH) site for MEC’s Sama Yas project. It has three browser-delivered entry points:

• Public OSH portal: index.html, app.js

• Administrative dashboard: admin/index.html, admin/admin.js

• Risk assessment document generator: risk-assessment/index.html, risk-assessment/app.js

The application can operate as a local browser demo and is configured to connect to Supabase for shared live data.

Public OSH Portal

The public site presents bilingual English/Arabic OSH content, including RTL behavior, live man-hour and LTI-free-day calculations, safety performance, unsafe-act/condition trend data, document/news/gallery content, contacts, and anonymous safety concerns.

• index.html

• app.js

• styles.css

app.js is the primary public-page controller: it coordinates page interactions, local/demo state, public data presentation, and calculated operational indicators. Public reporting is intentionally separated from individual report records; public trend analysis exposes combined/baseline information rather than private report detail.

Admin Content and Operations Boundary

The admin prototype manages operational data that feeds public-facing sections: performance settings, safety reports, documents, news, galleries, locations, holidays, team profiles, contact content, and enquiries.

• admin/index.html

• admin/admin.js

• supabase-config.js

Admin access uses Supabase email OTP for the configured administrator. The browser client uses a publishable Supabase key; privileged writes, automatic email delivery, Microsoft Graph access, and secrets must remain behind Supabase Edge Functions or another secure backend.

Supabase Persistence and Security

Supabase is the central intended production backend for authentication, relational content/report data, Row-Level Security, and public/private Storage buckets.

• supabase/schema.sql

• supabase/security-setup.sql

• SUPABASE_SETUP.txt

Schema/setup scripts establish the core database and feature-specific additions. Root-level setup files such as TREND_ANALYSIS_SETUP.sql, TEAM_MEMBERS_SETUP.sql, and CONTACT_SECTION_SETUP.sql support incremental deployment, with corresponding versions under supabase/. Storage includes private report photos, accessed by admin export through short-lived signed URLs.

Safety Reporting and Trend Pipeline

Anonymous/public safety concerns and admin-managed safety reports form the reporting pipeline. In demo mode, entered data remains browser-local; live mode persists it to Supabase. Trend analysis combines a supplied historical baseline with newly recorded reports while retaining individual records as private.

• app.js

• admin/admin.js

• TREND_ANALYSIS_SETUP.sql

Admin export produces Excel-compatible reporting, including embedded photo thumbnails sourced from private storage. Email acknowledgements and report alerts are planned backend integrations rather than client-side direct sending.

Risk Assessment Generation

The standalone risk-assessment module loads a curated project risk-register dataset, lets users assemble and edit multiple activities, saves drafts in the browser, and generates a .docx assessment without an external document library.

• risk-assessment/risk-register-data.js

• risk-assessment/legal-references.js

• risk-assessment/docx-generator.js

Its flow is dataset selection → editable assessment state → risk/control and legal-reference enrichment → client-side Word document generation. Legal references preserve source references where available and add applicable ADOSH-SF and ALDAR references.

External Dependencies and Deployment

The runtime is static HTML/CSS/JavaScript hosted on GitHub Pages, with Supabase as the live service dependency.

• README.md

• supabase-config.js

• assets/osh-team-organization-chart.pptx

Operational integrations include Supabase Auth/Database/Storage, optional official UAE holiday data, and a future Microsoft Graph or secure mail-function integration. Direct Microsoft 365 sending is deliberately not embedded in the static site.