Security architecture upgrade + bug reporting system

Database & Security:
- Dual password storage: bcrypt (auth) + pgcrypto AES-256 (recovery)
- SUPER_ADMIN master key recovery system (master_keys table)
- Row Level Security on customers, leads, opportunities, communications, tasks
  - SALES_USER: own records only
  - ADMIN: all records
  - SUPER_ADMIN: all records (bypasses RLS)
- Immutable audit logs (DELETE/UPDATE blocked by triggers)
- New audit event types: BUG_CREATED, BUG_UPDATED, BUG_ASSIGNED,
  BUG_RESOLVED, LOGIN, LOGOUT
- Database export logging (database_export_logs table)
- Backup logging with pg_dump script (scripts/backup.ps1)
- Fixed audit constraint to allow new action types

Authentication:
- Random JWT secret generated on every dev server start
  (invalidates all prior sessions after restart)
- Session cookie is now session-only (no maxAge)
- setSessionContext() for RLS integration

Bug Reporting System:
- bug_reports table with RLS (insert by all, select/update by admin only)
- POST /api/bug-reports (any authenticated user)
- GET /api/bug-reports (admin/super_admin only)
- PATCH /api/bug-reports/:id (admin/super_admin only)
- POST /api/auth/recover (super_admin password recovery)
- Audit logging for all bug report actions

Other:
- Added 'dev' to UserRole type
- Bug report modal UI with severity selector
- Added bug report button to topbar

src/app/api/auth/login/route.ts

@@ -9,6 +9,7 @@ import {
   resetFailedAttempts,
   isAccountLocked,
   createSession,
+  setSessionContext,
 } from "@/lib/auth"
 
 export async function POST(request: NextRequest) {
@@ -106,6 +107,7 @@ export async function POST(request: NextRequest) {
     )
 
     await createSession(dbUser.id, dbUser.role_name)
+    await setSessionContext(dbUser.id, ipAddress)
 
     const user = mapDbUserToSessionUser(dbUser)
 

src/app/api/auth/recover/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from "next/server"
+import {
+  getSessionUser,
+  decryptPassword,
+  setSessionContext,
+} from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only SUPER_ADMIN can recover passwords." }, { status: 403 })
+    }
+
+    const { userId } = await request.json()
+    if (!userId) {
+      return NextResponse.json({ error: "userId is required." }, { status: 400 })
+    }
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const result = await query(
+      `SELECT id, username, email, first_name, last_name, password_encrypted
+       FROM users WHERE id = $1 AND deleted_at IS NULL`,
+      [userId]
+    )
+
+    const user = result.rows[0]
+    if (!user) {
+      return NextResponse.json({ error: "User not found." }, { status: 404 })
+    }
+
+    if (!user.password_encrypted) {
+      return NextResponse.json({ error: "No encrypted password stored for this user." }, { status: 404 })
+    }
+
+    const plaintextPassword = await decryptPassword(user.password_encrypted)
+    if (!plaintextPassword) {
+      return NextResponse.json({ error: "Failed to decrypt password. Master key may have changed." }, { status: 500 })
+    }
+
+    return NextResponse.json({
+      user: {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+        name: `${user.first_name} ${user.last_name}`,
+      },
+      password: plaintextPassword,
+    }, { status: 200 })
+  } catch (error) {
+    console.error("Password recovery error:", error)
+    return NextResponse.json({ error: "Recovery service unavailable." }, { status: 503 })
+  }
+}

src/app/api/bug-reports/[id]/route.ts

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser, setSessionContext } from "@/lib/auth"
+
+export async function PATCH(request: NextRequest, { params: routeParams }: { params: Promise<{ id: string }> }) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden. Only admins can update bug reports." }, { status: 403 })
+    }
+
+    const { id } = await routeParams
+    const { status, assigned_to, resolution_notes } = await request.json()
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const validStatuses = ["open", "in_progress", "resolved", "closed"]
+    if (status && !validStatuses.includes(status)) {
+      return NextResponse.json({ error: "Invalid status." }, { status: 400 })
+    }
+
+    const existing = await query("SELECT id, status FROM bug_reports WHERE id = $1", [id])
+    if (existing.rows.length === 0) {
+      return NextResponse.json({ error: "Bug report not found." }, { status: 404 })
+    }
+
+    const updates: string[] = []
+    const values: unknown[] = []
+    let paramIndex = 1
+
+    if (status !== undefined) {
+      updates.push(`status = $${paramIndex++}`)
+      values.push(status)
+    }
+    if (assigned_to !== undefined) {
+      updates.push(`assigned_to = $${paramIndex++}`)
+      values.push(assigned_to === "null" ? null : assigned_to)
+    }
+    if (resolution_notes !== undefined) {
+      updates.push(`resolution_notes = $${paramIndex++}`)
+      values.push(resolution_notes)
+    }
+
+    if (updates.length === 0) {
+      return NextResponse.json({ error: "No fields to update." }, { status: 400 })
+    }
+
+    updates.push(`updated_at = NOW()`)
+    values.push(id)
+
+    await query(
+      `UPDATE bug_reports SET ${updates.join(", ")} WHERE id = $${paramIndex}`,
+      values
+    )
+
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error) {
+    console.error("Error updating bug report:", error)
+    return NextResponse.json({ error: "Failed to update bug report." }, { status: 500 })
+  }
+}

src/app/api/bug-reports/route.ts

@@ -0,0 +1,118 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser } from "@/lib/auth"
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+
+    const { title, description, severity, page_url, screenshot_url } = await request.json()
+
+    if (!title || !description) {
+      return NextResponse.json({ error: "Title and description are required." }, { status: 400 })
+    }
+
+    const validSeverities = ["low", "medium", "high", "critical"]
+    if (severity && !validSeverities.includes(severity)) {
+      return NextResponse.json({ error: "Invalid severity." }, { status: 400 })
+    }
+
+    const result = await query(
+      `INSERT INTO bug_reports (reported_by, title, description, severity, page_url, screenshot_url)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING id, created_at`,
+      [sessionUser.id, title, description, severity || "medium", page_url || null, screenshot_url || null]
+    )
+
+    return NextResponse.json({
+      success: true,
+      id: result.rows[0].id,
+      created_at: result.rows[0].created_at,
+    }, { status: 201 })
+  } catch (error) {
+    console.error("Error creating bug report:", error)
+    return NextResponse.json({ error: "Failed to submit bug report." }, { status: 500 })
+  }
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden. Only admins can view bug reports." }, { status: 403 })
+    }
+
+    const { searchParams } = new URL(request.url)
+    const status = searchParams.get("status")
+    const severity = searchParams.get("severity")
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+
+    let sql = `SELECT br.id, br.title, br.description, br.severity, br.page_url,
+                      br.screenshot_url, br.status, br.resolution_notes,
+                      br.created_at, br.updated_at,
+                      reporter.id AS reporter_id,
+                      reporter.first_name AS reporter_first_name,
+                      reporter.last_name AS reporter_last_name,
+                      reporter.email AS reporter_email,
+                      assignee.id AS assignee_id,
+                      assignee.first_name AS assignee_first_name,
+                      assignee.last_name AS assignee_last_name
+               FROM bug_reports br
+               JOIN users reporter ON reporter.id = br.reported_by
+               LEFT JOIN users assignee ON assignee.id = br.assigned_to`
+    const params: unknown[] = []
+    const conditions: string[] = []
+
+    if (status) {
+      conditions.push(`br.status = $${params.length + 1}`)
+      params.push(status)
+    }
+    if (severity) {
+      conditions.push(`br.severity = $${params.length + 1}`)
+      params.push(severity)
+    }
+
+    if (conditions.length > 0) {
+      sql += " WHERE " + conditions.join(" AND ")
+    }
+
+    sql += " ORDER BY br.created_at DESC LIMIT $" + (params.length + 1) + " OFFSET $" + (params.length + 2)
+    params.push(limit, offset)
+
+    const result = await query(sql, params)
+
+    const reports = result.rows.map((row: any) => ({
+      id: row.id,
+      title: row.title,
+      description: row.description,
+      severity: row.severity,
+      page_url: row.page_url,
+      screenshot_url: row.screenshot_url,
+      status: row.status,
+      resolution_notes: row.resolution_notes,
+      created_at: row.created_at,
+      updated_at: row.updated_at,
+      reporter: {
+        id: row.reporter_id,
+        name: `${row.reporter_first_name} ${row.reporter_last_name}`,
+        email: row.reporter_email,
+      },
+      assignee: row.assignee_id ? {
+        id: row.assignee_id,
+        name: `${row.assignee_first_name} ${row.assignee_last_name}`,
+      } : null,
+    }))
+
+    return NextResponse.json({ reports }, { status: 200 })
+  } catch (error) {
+    console.error("Error fetching bug reports:", error)
+    return NextResponse.json({ error: "Failed to fetch bug reports." }, { status: 500 })
+  }
+}

src/app/api/users/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { query } from "@/lib/db"
-import { hashPassword, getSessionUser } from "@/lib/auth"
+import { hashPassword, getSessionUser, encryptPassword, setSessionContext } from "@/lib/auth"
 import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(request: NextRequest) {
@@ -63,17 +63,20 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Invalid role" }, { status: 400 })
     }
 
+    await setSessionContext(sessionUser.id)
+
     const nameParts = name.trim().split(/\s+/)
     const firstName = nameParts[0]
     const lastName = nameParts.slice(1).join(" ") || firstName
     const username = email.split("@")[0]
     const passwordHash = await hashPassword(password)
+    const passwordEncrypted = await encryptPassword(password)
 
     const result = await query(
-      `INSERT INTO users (username, email, password_hash, first_name, last_name, is_active, created_by)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)
+      `INSERT INTO users (username, email, password_hash, password_encrypted, first_name, last_name, is_active, created_by)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
        RETURNING id`,
-      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active ?? true, sessionUser.id]
+      [username.toLowerCase(), email.toLowerCase(), passwordHash, passwordEncrypted, firstName, lastName, active ?? true, sessionUser.id]
     )
 
     const roleId = (

src/components/layout/topbar.tsx

@@ -9,6 +9,7 @@ import { Input } from "@/components/ui/input";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { useUser } from "@/providers/user-provider";
 import { useNotifications } from "@/providers/notification-provider";
+import { BugReportModal } from "@/components/shared/bug-report-modal";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -27,6 +28,7 @@ import {
   LogOut,
   User,
   Settings,
+  Bug,
   CheckCheck,
   Trash2,
 } from "lucide-react";
@@ -43,6 +45,7 @@ export function Topbar({ onMenuClick }: TopbarProps) {
     useNotifications();
   const [mounted, setMounted] = useState(false);
   const [searchOpen, setSearchOpen] = useState(false);
+  const [bugModalOpen, setBugModalOpen] = useState(false);
 
   useEffect(() => {
     setMounted(true);
@@ -113,6 +116,17 @@ export function Topbar({ onMenuClick }: TopbarProps) {
           <Search className="h-5 w-5" />
         </Button>
 
+        {/* Report a Bug */}
+        <Button
+          variant="ghost"
+          size="icon"
+          onClick={() => setBugModalOpen(true)}
+          className="text-muted-foreground"
+          title="Report a Bug"
+        >
+          <Bug className="h-5 w-5" />
+        </Button>
+
         {/* Theme toggle */}
         <Button
           variant="ghost"
@@ -247,6 +261,7 @@ export function Topbar({ onMenuClick }: TopbarProps) {
           </DropdownMenuContent>
         </DropdownMenu>
       </div>
+      <BugReportModal open={bugModalOpen} onClose={() => setBugModalOpen(false)} />
     </header>
   );
 }

src/components/shared/bug-report-modal.tsx

@@ -0,0 +1,188 @@
+"use client"
+
+import { useState } from "react"
+import { motion, AnimatePresence } from "framer-motion"
+import { X, Bug, Loader2, CheckCircle } from "lucide-react"
+
+interface BugReportModalProps {
+  open: boolean
+  onClose: () => void
+}
+
+export function BugReportModal({ open, onClose }: BugReportModalProps) {
+  const [title, setTitle] = useState("")
+  const [description, setDescription] = useState("")
+  const [severity, setSeverity] = useState("medium")
+  const [loading, setLoading] = useState(false)
+  const [submitted, setSubmitted] = useState(false)
+  const [error, setError] = useState("")
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError("")
+    setLoading(true)
+
+    try {
+      const res = await fetch("/api/bug-reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          title,
+          description,
+          severity,
+          page_url: window.location.href,
+        }),
+      })
+
+      if (res.ok) {
+        setSubmitted(true)
+        setTitle("")
+        setDescription("")
+        setSeverity("medium")
+      } else {
+        const data = await res.json().catch(() => ({}))
+        setError(data.error || "Failed to submit bug report.")
+      }
+    } catch {
+      setError("Connection error. Please try again.")
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const handleClose = () => {
+    setSubmitted(false)
+    setError("")
+    onClose()
+  }
+
+  return (
+    <AnimatePresence>
+      {open && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+          <motion.div
+            initial={{ opacity: 0 }}
+            animate={{ opacity: 1 }}
+            exit={{ opacity: 0 }}
+            className="absolute inset-0 bg-black/60 backdrop-blur-sm"
+            onClick={handleClose}
+          />
+          <motion.div
+            initial={{ opacity: 0, scale: 0.95, y: 10 }}
+            animate={{ opacity: 1, scale: 1, y: 0 }}
+            exit={{ opacity: 0, scale: 0.95, y: 10 }}
+            className="relative w-full max-w-md rounded-xl border bg-white dark:bg-[#141414] p-6 shadow-2xl"
+          >
+            <button
+              onClick={handleClose}
+              className="absolute right-4 top-4 text-[#888888] hover:text-[#111111] dark:hover:text-white transition-colors"
+            >
+              <X className="h-5 w-5" />
+            </button>
+
+            {submitted ? (
+              <div className="flex flex-col items-center py-8 text-center">
+                <CheckCircle className="h-12 w-12 text-emerald-500 mb-4" />
+                <h3 className="text-lg font-semibold text-[#111111] dark:text-white mb-2">
+                  Bug Report Submitted
+                </h3>
+                <p className="text-sm text-[#666666] dark:text-[#AAAAAA]">
+                  Thank you for your report. The development team will investigate.
+                </p>
+                <button
+                  onClick={handleClose}
+                  className="mt-6 rounded-lg bg-[#CC0000] px-6 py-2 text-sm font-medium text-white hover:bg-[#AA0000] transition-colors"
+                >
+                  Done
+                </button>
+              </div>
+            ) : (
+              <>
+                <div className="flex items-center gap-3 mb-6">
+                  <div className="flex h-10 w-10 items-center justify-center rounded-lg bg-red-100 dark:bg-red-900/30">
+                    <Bug className="h-5 w-5 text-[#CC0000]" />
+                  </div>
+                  <div>
+                    <h3 className="text-lg font-semibold text-[#111111] dark:text-white">
+                      Report a Bug
+                    </h3>
+                    <p className="text-xs text-[#666666] dark:text-[#AAAAAA]">
+                      Help us improve the system
+                    </p>
+                  </div>
+                </div>
+
+                {error && (
+                  <div className="mb-4 rounded-lg bg-red-500/10 px-4 py-2 text-sm text-red-500">
+                    {error}
+                  </div>
+                )}
+
+                <form onSubmit={handleSubmit} className="space-y-4">
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Title <span className="text-[#CC0000]">*</span>
+                    </label>
+                    <input
+                      type="text"
+                      value={title}
+                      onChange={(e) => setTitle(e.target.value)}
+                      placeholder="Brief description of the issue"
+                      required
+                      className="w-full rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white placeholder-[#999999] focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    />
+                  </div>
+
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Description <span className="text-[#CC0000]">*</span>
+                    </label>
+                    <textarea
+                      value={description}
+                      onChange={(e) => setDescription(e.target.value)}
+                      placeholder="What happened? What did you expect?"
+                      rows={4}
+                      required
+                      className="w-full resize-none rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white placeholder-[#999999] focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    />
+                  </div>
+
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Severity
+                    </label>
+                    <select
+                      value={severity}
+                      onChange={(e) => setSeverity(e.target.value)}
+                      className="w-full rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    >
+                      <option value="low">Low — Minor cosmetic issue</option>
+                      <option value="medium">Medium — Affects functionality</option>
+                      <option value="high">High — Major feature broken</option>
+                      <option value="critical">Critical — System is blocked</option>
+                    </select>
+                  </div>
+
+                  <div className="rounded-lg bg-[#F5F5F5] dark:bg-[#1A1A1A] px-3 py-2">
+                    <p className="text-xs text-[#888888]">
+                      <span className="font-medium">Page:</span> {typeof window !== "undefined" ? window.location.href : ""}
+                    </p>
+                  </div>
+
+                  <button
+                    type="submit"
+                    disabled={loading}
+                    className="flex w-full items-center justify-center gap-2 rounded-lg bg-[#CC0000] px-4 py-2.5 text-sm font-medium text-white hover:bg-[#AA0000] disabled:opacity-50 transition-colors"
+                  >
+                    {loading && <Loader2 className="h-4 w-4 animate-spin" />}
+                    {loading ? "Submitting..." : "Submit Bug Report"}
+                  </button>
+                </form>
+              </>
+            )}
+          </motion.div>
+        </div>
+      )}
+    </AnimatePresence>
+  )
+}

src/lib/auth.ts

@@ -194,6 +194,27 @@ export function mapDbUserToSessionUser(
   };
 }
 
+export async function encryptPassword(password: string): Promise<string> {
+  const result = await query("SELECT encrypt_password($1) AS encrypted", [password]);
+  return result.rows[0]?.encrypted;
+}
+
+export async function decryptPassword(encrypted: string): Promise<string | null> {
+  try {
+    const result = await query("SELECT decrypt_password($1) AS decrypted", [encrypted]);
+    return result.rows[0]?.decrypted || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function setSessionContext(userId: string, ip?: string) {
+  await query("SELECT set_config('app.current_user_id', $1, true)", [userId]);
+  if (ip) {
+    await query("SELECT set_config('app.current_ip', $1, true)", [ip]);
+  }
+}
+
 export async function createSession(userId: string, role: string) {
   const token = await signToken({ userId, role });
 

src/types/index.ts

@@ -4,7 +4,7 @@ export type LeadStatus =
   | "pending"
   | "closed"
   | "ignored";
-export type UserRole = "super_admin" | "admin" | "sales";
+export type UserRole = "super_admin" | "admin" | "sales" | "dev";
 
 export interface User {
   id: string;