Files Changed

Security Fixes
File	Change
.env.local	Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts	Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts	sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts	Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts	POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts	DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts	GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts	DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts	GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs	CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File	Change
src/app/api/leads/route.ts	Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/route.ts	Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts	Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx	Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx	Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql	Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File	Change
src/lib/ai.ts	Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts	bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx	"Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx	Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below)	Added console.warn("...") context messages

src/components/notes/note-form.tsx

@@ -6,12 +6,15 @@ import { Button } from "@/components/ui/button"
 import { Textarea } from "@/components/ui/textarea"
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar"
 import { Send } from "lucide-react"
+import { useUser } from "@/providers/user-provider"
 
 interface NoteFormProps {
   leadId: string
+  onNoteAdded?: () => void
 }
 
-export function NoteForm({ leadId }: NoteFormProps) {
+export function NoteForm({ leadId, onNoteAdded }: NoteFormProps) {
+  const { user } = useUser()
   const [note, setNote] = useState("")
   const [submitting, setSubmitting] = useState(false)
 
@@ -25,43 +28,53 @@ export function NoteForm({ leadId }: NoteFormProps) {
         body: JSON.stringify({ content: note }),
       })
       setNote("")
-      window.location.reload()
+      onNoteAdded?.()
     } catch {
-      // ignore
+      console.warn("Failed to add note")
     }
     setSubmitting(false)
   }
 
+  const handleKeyDown = (e: React.KeyboardEvent) => {
+    if (e.key === "Enter" && !e.shiftKey) {
+      e.preventDefault()
+      handleSubmit()
+    }
+  }
+
   return (
     <Card>
       <CardHeader>
         <CardTitle>Add Note</CardTitle>
       </CardHeader>
       <CardContent>
-        <div className="flex gap-4">
-          <Avatar className="h-10 w-10 shrink-0">
-            <AvatarImage src="https://ui-avatars.com/api/?name=Sarah+Chen&background=1d4ed8&color=fff&size=64" />
-            <AvatarFallback>SC</AvatarFallback>
-          </Avatar>
-          <div className="flex-1 space-y-3">
-            <Textarea
-              placeholder="Write a note about this lead..."
-              value={note}
-              onChange={(e) => setNote(e.target.value)}
-              className="min-h-[100px] resize-none"
-            />
-            <div className="flex justify-end">
-              <Button
-                onClick={handleSubmit}
-                disabled={!note.trim() || submitting}
-                className="gap-2"
-              >
-                <Send className="h-4 w-4" />
-                {submitting ? "Adding..." : "Add Note"}
-              </Button>
+        <form onSubmit={(e) => { e.preventDefault(); handleSubmit(); }}>
+          <div className="flex gap-4">
+            <Avatar className="h-10 w-10 shrink-0">
+              <AvatarImage src={user?.avatar || undefined} />
+              <AvatarFallback>{user?.name?.charAt(0) || "U"}</AvatarFallback>
+            </Avatar>
+            <div className="flex-1 space-y-3">
+              <Textarea
+                placeholder="Write a note about this lead..."
+                value={note}
+                onChange={(e) => setNote(e.target.value)}
+                onKeyDown={handleKeyDown}
+                className="min-h-[100px] resize-none"
+              />
+              <div className="flex justify-end">
+                <Button
+                  type="submit"
+                  disabled={!note.trim() || submitting}
+                  className="gap-2"
+                >
+                  <Send className="h-4 w-4" />
+                  {submitting ? "Adding..." : "Add Note"}
+                </Button>
+              </div>
             </div>
           </div>
-        </div>
+        </form>
       </CardContent>
     </Card>
   )