1adc4806fa
Security Fixes
File Change
.env.local Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File Change
src/app/api/leads/route.ts Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts Added limit (default 50), offset query params
src/app/api/conversations/route.ts Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File Change
src/lib/ai.ts Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx "Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below) Added console.warn("...") context messages
312 lines
10 KiB
TypeScript
312 lines
10 KiB
TypeScript
"use client"
|
|
|
|
import { useState, useEffect } from "react"
|
|
import { useForm } from "react-hook-form"
|
|
import { zodResolver } from "@hookform/resolvers/zod"
|
|
import * as z from "zod"
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
} from "@/components/ui/dialog"
|
|
import { Button } from "@/components/ui/button"
|
|
import {
|
|
Form,
|
|
FormControl,
|
|
FormField,
|
|
FormItem,
|
|
FormLabel,
|
|
FormMessage,
|
|
} from "@/components/ui/form"
|
|
import { Input } from "@/components/ui/input"
|
|
import { Textarea } from "@/components/ui/textarea"
|
|
import {
|
|
Select,
|
|
SelectContent,
|
|
SelectItem,
|
|
SelectTrigger,
|
|
SelectValue,
|
|
} from "@/components/ui/select"
|
|
import { Lead, LeadStatus, User } from "@/types"
|
|
import { LEAD_SOURCES, LEAD_STATUSES } from "@/lib/constants"
|
|
import { useNotifications } from "@/providers/notification-provider"
|
|
|
|
const leadFormSchema = z.object({
|
|
companyName: z.string().min(1, "Company name is required"),
|
|
contactName: z.string().min(1, "Contact name is required"),
|
|
email: z.string().email("Invalid email address"),
|
|
phone: z.string().optional(),
|
|
source: z.string().optional(),
|
|
description: z.string().optional(),
|
|
status: z.string(),
|
|
assignedUserId: z.string().optional(),
|
|
})
|
|
|
|
type LeadFormValues = z.infer<typeof leadFormSchema>
|
|
|
|
interface LeadFormDialogProps {
|
|
open: boolean
|
|
onOpenChange: (open: boolean) => void
|
|
lead?: Lead | null
|
|
onSuccess?: () => void
|
|
}
|
|
|
|
export function LeadFormDialog({ open, onOpenChange, lead, onSuccess }: LeadFormDialogProps) {
|
|
const isEditing = !!lead
|
|
const { addNotification } = useNotifications()
|
|
const [users, setUsers] = useState<User[]>([])
|
|
const [saving, setSaving] = useState(false)
|
|
|
|
useEffect(() => {
|
|
fetch("/api/users")
|
|
.then((r) => r.json())
|
|
.then((data) => setUsers(data.users || []))
|
|
.catch(() => {})
|
|
}, [])
|
|
|
|
const form = useForm<LeadFormValues>({
|
|
resolver: zodResolver(leadFormSchema),
|
|
defaultValues: {
|
|
companyName: "",
|
|
contactName: "",
|
|
email: "",
|
|
phone: "",
|
|
source: "",
|
|
description: "",
|
|
status: "open",
|
|
assignedUserId: "none",
|
|
},
|
|
})
|
|
|
|
useEffect(() => {
|
|
if (lead) {
|
|
form.reset({
|
|
companyName: lead.companyName,
|
|
contactName: lead.contactName,
|
|
email: lead.email,
|
|
phone: lead.phone || "",
|
|
source: lead.source || "",
|
|
description: lead.description || "",
|
|
status: lead.status,
|
|
assignedUserId: lead.assignedUserId || "none",
|
|
})
|
|
} else {
|
|
form.reset({
|
|
companyName: "",
|
|
contactName: "",
|
|
email: "",
|
|
phone: "",
|
|
source: "",
|
|
description: "",
|
|
status: "open",
|
|
assignedUserId: "none",
|
|
})
|
|
}
|
|
}, [lead, form])
|
|
|
|
async function onSubmit(values: LeadFormValues) {
|
|
setSaving(true)
|
|
try {
|
|
const payload = {
|
|
...values,
|
|
assignedUserId: values.assignedUserId === "none" ? null : values.assignedUserId,
|
|
}
|
|
if (isEditing && lead) {
|
|
const res = await fetch(`/api/leads/${lead.id}`, {
|
|
method: "PATCH",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify(payload),
|
|
})
|
|
if (!res.ok) throw new Error("Failed to update")
|
|
addNotification("lead_status_changed", "Lead Updated", `${values.companyName}`, "#")
|
|
} else {
|
|
const res = await fetch("/api/leads", {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify(payload),
|
|
})
|
|
if (!res.ok) throw new Error("Failed to create")
|
|
addNotification("lead_created", "New Lead Created", `${values.companyName} — ${values.contactName}`, "#")
|
|
}
|
|
onOpenChange(false)
|
|
onSuccess?.()
|
|
} catch (e) {
|
|
console.error("Lead save error:", e)
|
|
} finally {
|
|
setSaving(false)
|
|
}
|
|
}
|
|
|
|
return (
|
|
<Dialog open={open} onOpenChange={onOpenChange}>
|
|
<DialogContent className="sm:max-w-[600px]">
|
|
<DialogHeader>
|
|
<DialogTitle>{isEditing ? "Edit Lead" : "Create New Lead"}</DialogTitle>
|
|
<DialogDescription>
|
|
{isEditing
|
|
? "Update the lead information below."
|
|
: "Fill in the details to add a new lead."}
|
|
</DialogDescription>
|
|
</DialogHeader>
|
|
<Form {...form}>
|
|
<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
|
|
<div className="grid grid-cols-2 gap-4">
|
|
<FormField
|
|
control={form.control}
|
|
name="companyName"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Company Name</FormLabel>
|
|
<FormControl>
|
|
<Input placeholder="Acme Corp" {...field} />
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="contactName"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Contact Name</FormLabel>
|
|
<FormControl>
|
|
<Input placeholder="John Doe" {...field} />
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="email"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Email</FormLabel>
|
|
<FormControl>
|
|
<Input placeholder="john@acme.com" type="email" {...field} />
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="phone"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Phone</FormLabel>
|
|
<FormControl>
|
|
<Input placeholder="(555) 123-4567" {...field} />
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="source"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Source</FormLabel>
|
|
<Select onValueChange={field.onChange} defaultValue={field.value}>
|
|
<FormControl>
|
|
<SelectTrigger>
|
|
<SelectValue placeholder="Select source" />
|
|
</SelectTrigger>
|
|
</FormControl>
|
|
<SelectContent>
|
|
{LEAD_SOURCES.map((source) => (
|
|
<SelectItem key={source} value={source}>
|
|
{source}
|
|
</SelectItem>
|
|
))}
|
|
</SelectContent>
|
|
</Select>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="status"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Status</FormLabel>
|
|
<Select onValueChange={field.onChange} defaultValue={field.value}>
|
|
<FormControl>
|
|
<SelectTrigger>
|
|
<SelectValue placeholder="Select status" />
|
|
</SelectTrigger>
|
|
</FormControl>
|
|
<SelectContent>
|
|
{Object.entries(LEAD_STATUSES).map(([key, { label }]) => (
|
|
<SelectItem key={key} value={key}>
|
|
{label}
|
|
</SelectItem>
|
|
))}
|
|
</SelectContent>
|
|
</Select>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
</div>
|
|
<FormField
|
|
control={form.control}
|
|
name="description"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Description</FormLabel>
|
|
<FormControl>
|
|
<Textarea
|
|
placeholder="Brief description of the lead and their requirements..."
|
|
className="min-h-[100px]"
|
|
{...field}
|
|
/>
|
|
</FormControl>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<FormField
|
|
control={form.control}
|
|
name="assignedUserId"
|
|
render={({ field }) => (
|
|
<FormItem>
|
|
<FormLabel>Assign To</FormLabel>
|
|
<Select onValueChange={field.onChange} defaultValue={field.value}>
|
|
<FormControl>
|
|
<SelectTrigger>
|
|
<SelectValue placeholder="Select user" />
|
|
</SelectTrigger>
|
|
</FormControl>
|
|
<SelectContent>
|
|
<SelectItem value="none">Unassigned</SelectItem>
|
|
{users.filter(u => u.active).map((user) => (
|
|
<SelectItem key={user.id} value={user.id}>
|
|
{user.name} ({user.role})
|
|
</SelectItem>
|
|
))}
|
|
</SelectContent>
|
|
</Select>
|
|
<FormMessage />
|
|
</FormItem>
|
|
)}
|
|
/>
|
|
<DialogFooter>
|
|
<Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
|
|
Cancel
|
|
</Button>
|
|
<Button type="submit" disabled={saving}>{saving ? "Saving..." : isEditing ? "Save Changes" : "Create Lead"}</Button>
|
|
</DialogFooter>
|
|
</form>
|
|
</Form>
|
|
</DialogContent>
|
|
</Dialog>
|
|
)
|
|
}
|