# Phase 12 — Crew and staff management

Phase 12 adds airline-scoped employee and crew profiles, roles, aircraft-type qualifications, protected documents, training, availability, leave, rosters, flight assignments, duty records, conflict detection, and crew reporting. Rest-period checks are explicitly presented as configurable operational guidance and not regulatory certification.

## Files created

- `database/migrations/2026_07_19_000013_create_crew_management_tables.php`
- `database/seeders/CrewRolesSeeder.php`
- `app/Modules/Crew/Repositories/CrewRepository.php`
- `app/Modules/Crew/Services/CrewService.php`
- `app/Modules/Crew/Controllers/CrewController.php`
- `resources/views/crew/index.php`
- `resources/views/crew/profile.php`
- `resources/views/crew/roster.php`
- `resources/views/crew/reports.php`
- `docs/PHASE_12_IMPLEMENTATION.md`

## Files modified

- `routes/web.php`
- `database/seeders/RolesAndPermissionsSeeder.php`
- `resources/views/layouts/app.php`
- `tests/run.php`
- `README.md`

## Database migrations added

Migration `2026_07_19_000013` creates `employees`, `crew_profiles`, `crew_roles`, `crew_qualifications`, `crew_documents`, `crew_training`, `crew_availability`, `crew_leave`, `crew_rosters`, `crew_roster_entries`, `crew_flight_assignments`, `crew_duty_records`, and `crew_conflicts`.

## Security controls added

- Separate server-side permissions for profile management, rostering, assignment, qualification entry and verification, documents, duty records, and reports.
- CSRF protection on all crew mutations.
- Airline ownership and active-record validation for profiles, roles, airports, aircraft types, flights, and qualifications.
- Backend date, UTC range, status, role, employment, and duty-period validation.
- Protected document storage and permission-checked downloads with path confinement.
- Server-side blocking for overlapping assignments, unavailable crew, approved leave, training, expired medicals, expired qualifications, and aircraft-type mismatches.
- Configurable rest guidance warnings are retained in `crew_conflicts` without being represented as regulatory certification.
- Audit records and generic status history for employment, qualification verification, document verification, and roster publication changes.

## Tests performed

- PHP syntax validation across all new and modified Phase 12 PHP files.
- `php tests/run.php`: **48 passed, 0 failed**.
- Verified crew/profile creation, qualification verification, training, availability, leave, roster entry/publication, assignment and duty calculations, blocking conflicts, rest guidance warnings, audit records, protected routes, daily/weekly/monthly roster views, profile pages, and all requested reports.
- Attempted `php cli migrate:status`; the workspace still has no reachable configured MySQL connection.

## Remaining known limitations

- The rest-period calculation is operational guidance only and is not a jurisdiction-certified flight-time-limitation engine.
- Duty records are entered or confirmed by authorized users; no biometric or live crew-position tracking is included.
- Qualification and medical conflict checks depend on complete and current master data.
- Notifications are displayed through dashboard/report expiry lists; external email or SMS delivery is not configured.
- MySQL migration execution remains pending until a reachable MySQL 8 database is configured.