Files Changed

Security Fixes File Change .env.local Placeholder JWT secret (rotate to random value: openssl rand -base64 64) src/middleware.ts Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect) src/lib/auth.ts sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection) src/lib/avatar.ts Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars src/app/api/users/route.ts POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true src/app/api/users/[id]/route.ts DELETE restricted to super_admin; blocks self-deletion src/app/api/leads/[id]/route.ts GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range src/app/api/leads/route.ts DELETE: ownership + admin check; GET: ownership filter for non-admin users src/app/api/conversations/[id]/messages/route.ts GET/POST: verify user is a conversation_participant before access rust-ai/src/main.rs CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any) Performance Fixes File Change src/app/api/leads/route.ts Added limit (default 50), offset query params; ownership filter in SQL src/app/api/users/route.ts Added limit (default 50), offset query params src/app/api/conversations/route.ts Added LIMIT 50 src/app/api/leads/[id]/notes/route.ts Added limit (default 50), offset query params src/app/api/conversations/[id]/messages/route.ts Added limit (default 100), offset, before query params src/app/(dashboard)/chats/page.tsx Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard src/app/(dashboard)/leads/[id]/page.tsx Optimistic status update rolls back on fetch failure database/migrations/003_chat.sql Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC) Code Quality Fixes File Change src/lib/ai.ts Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions) src/lib/auth.ts bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended) src/app/login/page.tsx "Forgot password?" button now shows alert to contact admin (was no-op) src/components/users/user-form-dialog.tsx Password min 6 → 8 chars 26 silent catch {} blocks across 16 files (see below) Added console.warn("...") context messages
2026-06-23 09:45:30 +02:00
parent d891197d8b
commit 1adc4806fa
51 changed files with 1145 additions and 1052 deletions
@@ -0,0 +1,50 @@
+"use client"
+
+import { Component, type ReactNode } from "react"
+import { Button } from "@/components/ui/button"
+
+interface Props {
+  children: ReactNode
+  fallback?: ReactNode
+}
+
+interface State {
+  hasError: boolean
+  error?: Error
+}
+
+export class ErrorBoundary extends Component<Props, State> {
+  constructor(props: Props) {
+    super(props)
+    this.state = { hasError: false }
+  }
+
+  static getDerivedStateFromError(error: Error): State {
+    return { hasError: true, error }
+  }
+
+  componentDidCatch(error: Error, info: { componentStack?: string }) {
+    console.error("ErrorBoundary caught:", error, info.componentStack)
+  }
+
+  render() {
+    if (this.state.hasError) {
+      if (this.props.fallback) return this.props.fallback
+      return (
+        <div className="flex flex-col items-center justify-center h-[60vh] gap-4">
+          <h2 className="text-xl font-bold">Something went wrong</h2>
+          <p className="text-muted-foreground text-sm max-w-md text-center">
+            {this.state.error?.message || "An unexpected error occurred"}
+          </p>
+          <Button variant="outline" onClick={() => {
+            this.setState({ hasError: false, error: undefined })
+            window.location.reload()
+          }}>
+            Reload Page
+          </Button>
+        </div>
+      )
+    }
+    return this.props.children
+  }
+}