Files Changed

Security Fixes
File	Change
.env.local	Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts	Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts	sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts	Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts	POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts	DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts	GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts	DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts	GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs	CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File	Change
src/app/api/leads/route.ts	Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/route.ts	Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts	Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx	Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx	Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql	Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File	Change
src/lib/ai.ts	Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts	bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx	"Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx	Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below)	Added console.warn("...") context messages

src/providers/notification-provider.tsx

@@ -30,7 +30,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
           setNotifications(data.notifications)
         }
       } catch {
-        // ignore
+        console.warn("Failed to fetch notifications in notification provider")
       } finally {
         setLoading(false)
       }
@@ -51,7 +51,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
           setUnreadChatCount(total)
         }
       } catch {
-        // ignore
+        console.warn("Failed to fetch unread conversations in notification provider")
       }
     }
     fetchUnread()
@@ -83,7 +83,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
           body: JSON.stringify({ type, title, description, link }),
         })
       } catch {
-        // ignore
+        console.warn("Failed to add notification in notification provider")
       }
     },
     []
@@ -97,7 +97,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
     try {
       await fetch(`/api/notifications/${id}`, { method: "PATCH" })
     } catch {
-      // ignore
+      console.warn("Failed to mark notification as read in notification provider")
     }
   }, [])
 
@@ -106,7 +106,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
     try {
       await fetch("/api/notifications", { method: "PATCH" })
     } catch {
-      // ignore
+      console.warn("Failed to mark all notifications as read in notification provider")
     }
   }, [])
 
@@ -116,7 +116,7 @@ export function NotificationProvider({ children }: { children: ReactNode }) {
     try {
       await fetch(`/api/notifications/${id}`, { method: "DELETE" })
     } catch {
-      // ignore
+      console.warn("Failed to dismiss notification in notification provider")
     }
   }, [])
 

src/providers/user-provider.tsx

@@ -39,6 +39,7 @@ export function UserProvider({ children }: { children: ReactNode }) {
         setUser(null)
       }
     } catch {
+      console.warn("Failed to fetch user in user provider")
       setUser(null)
     } finally {
       setLoading(false)
@@ -53,7 +54,7 @@ export function UserProvider({ children }: { children: ReactNode }) {
     try {
       await fetch("/api/auth/logout", { method: "POST" })
     } catch {
-      // Proceed with client-side logout even if API fails
+      console.warn("Failed to logout in user provider")
     }
     setUser(null)
     router.push("/login")