Merge remote changes from origin/main

src/app/api/dashboard/route.ts

@@ -48,7 +48,7 @@ function stageToStatus(name: string): string {
   }
 }
 
-async function fetchLeadsInRange(start: Date, end: Date) {
+async function fetchLeadsInRange(start: Date, end: Date, userId?: string, isAdmin?: boolean) {
   const result = await query(
     `SELECT l.id, l.created_at, l.company_name, l.contact_name, l.email, l.phone,
             l.notes, l.assigned_to, l.score,
@@ -59,8 +59,11 @@ async function fetchLeadsInRange(start: Date, end: Date) {
      LEFT JOIN users u ON u.id = l.assigned_to
      WHERE l.deleted_at IS NULL
        AND l.created_at >= $1 AND l.created_at <= $2
+       ${isAdmin ? "" : "AND l.assigned_to = $3"}
      ORDER BY l.created_at DESC`,
-    [start.toISOString(), end.toISOString()]
+    isAdmin
+      ? [start.toISOString(), end.toISOString()]
+      : [start.toISOString(), end.toISOString(), userId]
   )
   return result.rows.map((r: any) => ({
     ...r,
@@ -118,6 +121,8 @@ export async function GET(request: NextRequest) {
     const user = await getSessionUser()
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+
     const { searchParams } = new URL(request.url)
     const period = searchParams.get("period") || "6months"
     const yearParam = searchParams.get("year")
@@ -134,8 +139,8 @@ export async function GET(request: NextRequest) {
     }
 
     const [currentLeads, prevLeads] = await Promise.all([
-      fetchLeadsInRange(start, end),
-      fetchLeadsInRange(prevRange.start, prevRange.end),
+      fetchLeadsInRange(start, end, user.id, isAdmin),
+      fetchLeadsInRange(prevRange.start, prevRange.end, user.id, isAdmin),
     ])
 
     const currentCounts = countStatuses(currentLeads)

src/app/api/leads/[id]/notes/route.ts

@@ -3,12 +3,28 @@ import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
 import { avatarSvgUrl } from "@/lib/avatar"
 
+async function checkLeadAccess(leadId: string, userId: string): Promise<boolean> {
+  const result = await query(
+    `SELECT 1 FROM leads WHERE id = $1 AND deleted_at IS NULL
+     AND (assigned_to = $2 OR EXISTS (
+       SELECT 1 FROM user_roles ur JOIN roles r ON r.id = ur.role_id
+       WHERE ur.user_id = $2 AND r.name IN ('ADMIN', 'SUPER_ADMIN')
+     ))`,
+    [leadId, userId]
+  )
+  return result.rows.length > 0
+}
+
 export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   try {
     const user = await getSessionUser()
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    if (!await checkLeadAccess(id, user.id)) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
     const { content } = await request.json()
     if (!content?.trim()) {
       return NextResponse.json({ error: "Content is required" }, { status: 400 })
@@ -33,6 +49,9 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    if (!await checkLeadAccess(id, user.id)) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
     const { searchParams } = new URL(request.url)
     const limit = parseInt(searchParams.get("limit") || "50", 10)
     const offset = parseInt(searchParams.get("offset") || "0", 10)

src/app/api/leads/[id]/route.ts

@@ -111,6 +111,11 @@ export async function PATCH(request: NextRequest, { params }: { params: Promise<
     if (body.description !== undefined) { fields.push(`notes = $${idx++}`); values.push(body.description) }
     if (body.source !== undefined) { fields.push(`source_id = $${idx++}`); values.push(body.source) }
     if (body.assignedUserId !== undefined) {
+      const isAdmin = user.role === "admin" || user.role === "super_admin"
+      if (!isAdmin) {
+        // non-admin cannot reassign
+        return NextResponse.json({ error: "Only admins can reassign leads" }, { status: 403 })
+      }
       fields.push(`assigned_to = $${idx++}`)
       values.push(body.assignedUserId === "none" ? null : body.assignedUserId)
     }

src/app/api/leads/route.ts

@@ -123,6 +123,15 @@ export async function POST(request: NextRequest) {
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const body = await request.json()
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+
+    // Non-admin users can only assign leads to themselves; admin/super_admin can assign to anyone
+    let assignedUserId = body.assignedUserId
+    if (!isAdmin) {
+      assignedUserId = user.id
+    } else if (assignedUserId === "none" || !assignedUserId) {
+      assignedUserId = null
+    }
 
     const stageResult = await query(
       "SELECT id FROM lead_stages WHERE name = $1",
@@ -142,7 +151,7 @@ export async function POST(request: NextRequest) {
         body.description || null,
         body.source || null,
         stageId,
-        body.assignedUserId === "none" ? null : body.assignedUserId,
+        assignedUserId,
       ]
     )
 

src/app/api/notifications/route.ts

@@ -49,7 +49,8 @@ export async function POST(request: NextRequest) {
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { type, title, description, link, userId } = await request.json()
-    const targetUserId = userId || user.id
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+    const targetUserId = (userId && isAdmin) ? userId : user.id
 
     const result = await query(
       `INSERT INTO notifications (user_id, type, title, description, link)

src/app/api/settings/facebook/accounts/[id]/route.ts

@@ -0,0 +1,61 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function PATCH(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const { id } = await params
+    const body = await request.json()
+    const fields: string[] = []
+    const values: any[] = []
+    let idx = 1
+
+    if (body.isActive !== undefined) {
+      fields.push(`is_active = $${idx++}`)
+      values.push(body.isActive)
+    }
+    if (body.label !== undefined) {
+      fields.push(`label = $${idx++}`)
+      values.push(body.label.trim())
+    }
+    if (body.profilePath !== undefined) {
+      fields.push(`profile_path = $${idx++}, cookie_file = $${idx}`)
+      values.push(body.profilePath.trim())
+      values.push(`${body.profilePath.replace(/\\+$/, '')}\\cookies.sqlite`)
+      idx++
+    }
+    if (body.unflag === true) {
+      fields.push(`flagged = FALSE, flagged_at = NULL, flagged_reason = NULL, consecutive_failures = 0`)
+    }
+
+    if (fields.length === 0) {
+      return NextResponse.json({ error: "No fields to update" }, { status: 400 })
+    }
+
+    fields.push(`updated_at = NOW()`)
+    values.push(id)
+
+    await query(
+      `UPDATE facebook_accounts SET ${fields.join(", ")} WHERE id = $${idx}`,
+      values
+    )
+
+    const updated = await query(
+      `SELECT id, label, profile_path, is_active, flagged, flagged_reason,
+              consecutive_failures, updated_at
+       FROM facebook_accounts WHERE id = $1`,
+      [id]
+    )
+
+    return NextResponse.json(updated.rows[0] || { success: true })
+  } catch (error) {
+    console.error("Facebook accounts PATCH error:", error)
+    return NextResponse.json({ error: "Failed to update Facebook account" }, { status: 500 })
+  }
+}

src/app/api/settings/facebook/accounts/route.ts

@@ -0,0 +1,66 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET() {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const accounts = await query(
+      `SELECT fa.id, fa.label, fa.profile_path, fa.is_active,
+              fa.last_scrape_at, fa.last_success_at, fa.last_error_at,
+              fa.last_error_message, fa.consecutive_failures,
+              fa.flagged, fa.flagged_at, fa.flagged_reason,
+              fa.created_at, fa.updated_at,
+              COALESCE(sl.leads_found, 0) AS last_leads_found,
+              sl.success AS last_success,
+              sl.detected_flag AS last_detected_flag
+       FROM facebook_accounts fa
+       LEFT JOIN LATERAL (
+         SELECT leads_found, success, detected_flag
+         FROM facebook_scrape_logs
+         WHERE account_id = fa.id
+         ORDER BY created_at DESC
+         LIMIT 1
+       ) sl ON TRUE
+       ORDER BY fa.created_at ASC`
+    )
+
+    return NextResponse.json(accounts.rows)
+  } catch (error) {
+    console.error("Facebook accounts GET error:", error)
+    return NextResponse.json({ error: "Failed to load Facebook accounts" }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const { label, profilePath } = await request.json()
+    if (!label?.trim() || !profilePath?.trim()) {
+      return NextResponse.json({ error: "Label and profile path are required" }, { status: 400 })
+    }
+
+    const cookieFile = `${profilePath.replace(/\\+$/, '')}\\cookies.sqlite`
+    const result = await query(
+      `INSERT INTO facebook_accounts (label, profile_path, cookie_file)
+       VALUES ($1, $2, $3)
+       RETURNING id, label, profile_path, is_active, created_at`,
+      [label.trim(), profilePath.trim(), cookieFile]
+    )
+
+    return NextResponse.json(result.rows[0], { status: 201 })
+  } catch (error) {
+    console.error("Facebook accounts POST error:", error)
+    return NextResponse.json({ error: "Failed to create Facebook account" }, { status: 500 })
+  }
+}

src/app/api/settings/facebook/logs/route.ts

@@ -0,0 +1,41 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
+
+    const { searchParams } = new URL(request.url)
+    const accountId = searchParams.get("accountId")
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+
+    let sql = `SELECT sl.id, sl.account_id, fa.label AS account_label,
+                      sl.started_at, sl.completed_at, sl.success,
+                      sl.leads_found, sl.error_message, sl.detected_flag,
+                      sl.created_at
+               FROM facebook_scrape_logs sl
+               JOIN facebook_accounts fa ON fa.id = sl.account_id`
+    const params: any[] = []
+    let paramIdx = 1
+
+    if (accountId) {
+      sql += ` WHERE sl.account_id = $${paramIdx++}`
+      params.push(accountId)
+    }
+
+    sql += ` ORDER BY sl.created_at DESC LIMIT $${paramIdx++} OFFSET $${paramIdx++}`
+    params.push(limit, offset)
+
+    const result = await query(sql, params)
+    return NextResponse.json(result.rows)
+  } catch (error) {
+    console.error("Facebook scrape logs GET error:", error)
+    return NextResponse.json({ error: "Failed to load scrape logs" }, { status: 500 })
+  }
+}

src/app/api/system/monitor/route.ts

@@ -8,6 +8,9 @@ let prevTime = Date.now()
 export async function GET() {
   const sessionUser = await getSessionUser()
   if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+  if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+  }
 
   const now = Date.now()
   const elapsed = now - prevTime

src/app/api/users/avatar/route.ts

@@ -2,6 +2,9 @@ import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
 
+const ALLOWED_PREFIXES = ["data:image/png;base64,", "data:image/jpeg;base64,", "data:image/gif;base64,"]
+const MAX_AVATAR_BYTES = 2 * 1024 * 1024 // 2MB
+
 export async function POST(request: NextRequest) {
   try {
     const user = await getSessionUser()
@@ -12,6 +15,18 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Invalid avatar data" }, { status: 400 })
     }
 
+    const allowed = ALLOWED_PREFIXES.some((p) => avatar.startsWith(p))
+    if (!allowed) {
+      return NextResponse.json({ error: "Avatar must be a PNG, JPEG, or GIF data URL" }, { status: 400 })
+    }
+
+    // Approximate decoded size: base64 is ~4/3 of original
+    const base64Data = avatar.split(",")[1] || ""
+    const estimatedBytes = Math.round(base64Data.length * 0.75)
+    if (estimatedBytes > MAX_AVATAR_BYTES) {
+      return NextResponse.json({ error: "Avatar exceeds 2MB size limit" }, { status: 400 })
+    }
+
     await query(
       `UPDATE users SET avatar_url = $1 WHERE id = $2`,
       [avatar, user.id],

src/app/api/users/route.ts

@@ -7,6 +7,9 @@ export async function GET(request: NextRequest) {
   try {
     const sessionUser = await getSessionUser()
     if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const { searchParams } = new URL(request.url)
     const limit = parseInt(searchParams.get("limit") || "50", 10)

src/app/api/users/search/route.ts

@@ -7,6 +7,9 @@ export async function GET(request: NextRequest) {
   try {
     const currentUser = await getSessionUser()
     if (!currentUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (currentUser.role !== "admin" && currentUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const q = request.nextUrl.searchParams.get("q") || ""
 

src/components/layout/sidebar.tsx

@@ -18,10 +18,12 @@ import {
   PanelLeftClose,
   MessageSquare,
   Bot,
+  Facebook,
 } from "lucide-react"
 import { COMPANY_NAME } from "@/lib/constants"
 import { useUser } from "@/providers/user-provider"
 import { useNotifications } from "@/providers/notification-provider"
+import { FacebookAccountsDialog } from "@/components/settings/facebook-accounts-dialog"
 
 const navItems = [
   { href: "/dashboard", label: "Dashboard", icon: LayoutDashboard },
@@ -43,7 +45,9 @@ export function Sidebar({ collapsed, onToggle, mobileOpen, onMobileClose }: Side
   const pathname = usePathname()
   const { user } = useUser()
   const { unreadChatCount } = useNotifications()
+  const [fbDialogOpen, setFbDialogOpen] = useState(false)
   if (!user) return null
+  const isAdmin = user.role === "admin" || user.role === "super_admin"
   const initials = user.name.split(" ").map((n) => n[0]).join("")
 
   const sidebarContent = (
@@ -143,6 +147,39 @@ export function Sidebar({ collapsed, onToggle, mobileOpen, onMobileClose }: Side
             </Link>
           )
         })}
+        {isAdmin && collapsed && (
+          <TooltipProvider delayDuration={0}>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={() => setFbDialogOpen(true)}
+                  className="relative flex h-10 w-10 items-center justify-center rounded-lg transition-colors text-sidebar-foreground/60 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground"
+                >
+                  <Facebook className="h-5 w-5" />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent side="right" className="ml-2">
+                Facebook Accounts
+              </TooltipContent>
+            </Tooltip>
+          </TooltipProvider>
+        )}
+        {isAdmin && !collapsed && (
+          <button
+            onClick={() => setFbDialogOpen(true)}
+            className="flex w-full items-center gap-3 rounded-lg px-3 py-2.5 text-sm font-medium transition-colors text-sidebar-foreground/60 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground"
+          >
+            <Facebook className="h-5 w-5 shrink-0" />
+            <motion.span
+              initial={{ opacity: 0 }}
+              animate={{ opacity: 1 }}
+              exit={{ opacity: 0 }}
+              className="truncate"
+            >
+              Facebook Accounts
+            </motion.span>
+          </button>
+        )}
       </nav>
 
       {/* Collapse toggle at bottom (only in collapsed mode) */}
@@ -189,6 +226,8 @@ export function Sidebar({ collapsed, onToggle, mobileOpen, onMobileClose }: Side
         {sidebarContent}
       </aside>
 
+      <FacebookAccountsDialog open={fbDialogOpen} onOpenChange={setFbDialogOpen} />
+
       {/* Mobile sidebar overlay */}
       <AnimatePresence>
         {mobileOpen && (

src/components/settings/facebook-accounts-dialog.tsx

@@ -0,0 +1,102 @@
+"use client"
+
+import { useEffect, useState } from "react"
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from "@/components/ui/dialog"
+import { Badge } from "@/components/ui/badge"
+import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table"
+import { ShieldAlert, RefreshCw } from "lucide-react"
+import { Button } from "@/components/ui/button"
+
+interface Account {
+  id: string
+  label: string
+  is_active: boolean
+  last_scrape_at: string | null
+  last_success_at: string | null
+  last_error_at: string | null
+  consecutive_failures: number
+  flagged: boolean
+  flagged_reason: string | null
+  last_leads_found: number
+  last_success: boolean | null
+}
+
+export function FacebookAccountsDialog({ open, onOpenChange }: { open: boolean; onOpenChange: (v: boolean) => void }) {
+  const [accounts, setAccounts] = useState<Account[]>([])
+  const [loading, setLoading] = useState(false)
+
+  useEffect(() => {
+    if (open) load()
+  }, [open])
+
+  async function load() {
+    setLoading(true)
+    try {
+      const res = await fetch("/api/settings/facebook/accounts")
+      if (res.ok) {
+        setAccounts(await res.json())
+      }
+    } catch {}
+    setLoading(false)
+  }
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-2xl">
+        <DialogHeader className="flex flex-row items-center justify-between">
+          <div>
+            <DialogTitle>Facebook Accounts</DialogTitle>
+            <DialogDescription>
+              Status of Facebook profiles used for lead scraping
+            </DialogDescription>
+          </div>
+          <Button variant="ghost" size="icon" onClick={load} disabled={loading}>
+            <RefreshCw className={`h-4 w-4 ${loading ? "animate-spin" : ""}`} />
+          </Button>
+        </DialogHeader>
+
+        {loading ? (
+          <div className="text-center py-8 text-muted-foreground">Loading...</div>
+        ) : accounts.length === 0 ? (
+          <div className="text-center py-8 text-muted-foreground">No accounts configured</div>
+        ) : (
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Label</TableHead>
+                <TableHead>Status</TableHead>
+                <TableHead>Last Scrape</TableHead>
+                <TableHead>Leads</TableHead>
+                <TableHead>Failures</TableHead>
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {accounts.map((a) => (
+                <TableRow key={a.id}>
+                  <TableCell className="font-medium">{a.label}</TableCell>
+                  <TableCell>
+                    {a.flagged ? (
+                      <Badge variant="destructive" className="gap-1">
+                        <ShieldAlert className="h-3 w-3" />
+                        {a.flagged_reason || "Flagged"}
+                      </Badge>
+                    ) : a.is_active ? (
+                      <Badge variant="default" className="bg-green-600">Active</Badge>
+                    ) : (
+                      <Badge variant="secondary">Disabled</Badge>
+                    )}
+                  </TableCell>
+                  <TableCell className="text-sm text-muted-foreground">
+                    {a.last_scrape_at ? new Date(a.last_scrape_at).toLocaleString() : "Never"}
+                  </TableCell>
+                  <TableCell>{a.last_leads_found}</TableCell>
+                  <TableCell>{a.consecutive_failures}</TableCell>
+                </TableRow>
+              ))}
+            </TableBody>
+          </Table>
+        )}
+      </DialogContent>
+    </Dialog>
+  )
+}