Phase 1 — Day One View · Training Dashboard

Live data

Numbers below are queried from your Salesforce sandbox using your own session (no service account). What you see is bounded by your sharing rules and FLS — exactly what you'd see in a Salesforce report.

Updated

—

Required Training Complete

—

loading…

—

Filter: Required__c = TRUE

Overdue Items

—

required, past due date

ACTION

Filter: !Credential_Issued__c && Due_Date__c < TODAY

Expiring in 90 Days

—

certifications

PLAN

Filter: Expiry_Date__c <= TODAY+90

People with Overdue

—

distinct contacts

FOLLOW UP

From overdue-contacts endpoint

Training Throughput

Assigned Completed

Last 12 months — by CreatedDate vs Completion_Date__c

Top Overdue Contacts

People with the most past-due items

Contact	Account	Overdue	Max Days
loading…

Expiring Soon

Next 60 days · sorted earliest first

—

Training	Contact	Expires
loading…

Notes on this live view

Each query runs as you via Salesforce OAuth — sharing rules and FLS apply.
If you sign out in Salesforce, the next refresh here will bounce you back to login.

Steps to ship this phase

Add three fields to Training__c:
- Framework__c picklist (CMMC L1/L2/L3, ISO 9001, ISO 27001, HR — Cyber Awareness, etc.)
- Required__c checkbox (TRUE for compliance training, FALSE for optional/electives)
- Account__c formula = CASESAFEID(Contact__r.AccountId) (lets reports group by partner without a cross-object filter)
Backfill Framework__c + Required__c on existing records (one-time script, can be Apex anonymous)
Deploy a permission set granting FLS on the new fields to anyone using the dashboard. Salesforce no longer auto-grants FLS, even to Sysadmin profile.
Decide native vs external delivery:
- Native: 4 reports + 1 Lightning dashboard. ~70% fidelity vs the mockup; ships in a day.
- External (this site): 4 SOQL endpoints in a Lambda + a Connected App with OAuth Authorization Code + PKCE. Higher fidelity, no service account, ~1 week.
For the external path: store the OAuth client_id / client_secret + cookie encryption key in AWS Secrets Manager, not env vars.
Wire CloudFront so /auth/* and /api/* route to API Gateway → Lambda; everything else to S3.