Legal Review Queue System
Relevant source files
The following files were used as context for generating this wiki page:
The Legal Review Queue System is an internal organizational workflow designed to ensure the ongoing professional accuracy of generated legal content. It facilitates a quarterly review cycle for various artifacts, including clause templates, regulations, disclaimers, and Terms of Service (ToS).
The system serves as a central hub for legal administrators to track review statuses, request changes, and maintain a historical record of professional oversight. Access is strictly controlled through an admin-email allowlist, ensuring that only authorized legal professionals can interact with the queue.
Sources: src/lib/legal/review-queue.ts:1-6, supabase/migrations/0015_legal_review_queue.sql:1-12, src/lib/legal/review.ts:1-4
System Architecture
The system follows a tiered architecture consisting of a PostgreSQL database for persistence, a server-side service layer for business logic and security, and a React-based administrative dashboard.
Core Components and Data Flow
- Database Layer: Utilizes a Supabase/PostgreSQL table
legal_review_itemsto store artifact metadata and review history. - Service Layer: Implements core logic for queue management, including scheduling, status validation, and administrative authorization.
- UI Layer: A dedicated view for administrators to visualize the queue, record reviews, and add new items.
The following diagram illustrates the high-level data flow when recording a review:
Data Model
The system operates on a structured data model defined in the legal_review_items table. It includes check constraints to ensure data integrity regarding categories and statuses.
Review Item Schema
| Field | Type | Description |
|---|---|---|
id | uuid | Primary key. |
title | text | Human-readable label for the artifact. |
category | text | Type of artifact (e.g., clause_template, tos). |
content_ref | text | Stable identifier of the reviewed artifact. |
status | text | Current state: pending, approved, or changes_requested. |
reviewer | text | Email of the professional who last reviewed the item. |
notes | text | Feedback or documentation from the reviewer. |
reviewed_at | timestamptz | Timestamp of the last review action. |
next_review_at | date | Scheduled date for the next quarterly review. |
Sources: supabase/migrations/0015_legal_review_queue.sql:14-30, src/lib/legal/review.ts:13-25
Administrative Authorization
Security is managed through a combination of Supabase Row Level Security (RLS) and application-level email allowlisting.
Access Control Logic
The system uses the requireLegalAdmin function to gate all operations. This function verifies the user's session and checks their email against the LEGAL_REVIEW_ADMIN_EMAILS environment variable.
Review Scheduling and Status
Reviews are scheduled on a 3-month cycle. The system includes logic to handle date overflows (e.g., ensuring a review scheduled from November 30th lands on the last day of February).
Scheduling Logic
The nextQuarterlyReviewDate function calculates the target date by adding REVIEW_INTERVAL_MONTHS (3) to a given date and clamping the day if the target month is shorter.
export function nextQuarterlyReviewDate(from: Date = new Date()): string {
const d = new Date(Date.UTC(from.getUTCFullYear(), from.getUTCMonth(), from.getUTCDate()));
const targetMonth = d.getUTCMonth() + REVIEW_INTERVAL_MONTHS;
const candidate = new Date(Date.UTC(d.getUTCFullYear(), targetMonth, d.getUTCDate()));
if (candidate.getUTCMonth() !== ((targetMonth % 12) + 12) % 12) {
candidate.setUTCDate(0);
}
return toDayKey(candidate);
}
Sources: src/lib/legal/review.ts:34-45, src/tests/legal-review.test.ts:14-25
Status and Categories
Artifacts move through a defined lifecycle. The initial seed artifacts include the mandatory report disclaimer, liability cap, and framework-specific clauses.
| Category | Typical Content |
|---|---|
clause_template | Logic-driven protective text for frameworks (Shopify, Next.js). |
regulation | Text or summaries of laws (GDPR, CCPA). |
disclaimer | Mandatory Informational-only headers. |
tos | Contractual Terms of Service sections. |
Sources: src/lib/legal/review.ts:8-11, supabase/migrations/0015_legal_review_queue.sql:43-49
Summary
The Legal Review Queue System provides a robust internal framework for maintaining the legal integrity of Comply-Quick. By enforcing mandatory quarterly reviews and restricting access to verified legal admins, the system ensures that automated templates remain compliant with evolving regulations. The integration of administrative clients for database access, coupled with strict TypeScript validation, ensures a secure and reliable professional review workflow.