Files Changed

Security Fixes
File	Change
.env.local	Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts	Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts	sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts	Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts	POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts	DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts	GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts	DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts	GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs	CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File	Change
src/app/api/leads/route.ts	Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/route.ts	Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts	Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx	Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx	Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql	Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File	Change
src/lib/ai.ts	Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts	bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx	"Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx	Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below)	Added console.warn("...") context messages

src/components/leads/lead-form-dialog.tsx

@@ -32,7 +32,6 @@ import {
 } from "@/components/ui/select"
 import { Lead, LeadStatus, User } from "@/types"
 import { LEAD_SOURCES, LEAD_STATUSES } from "@/lib/constants"
-import { users } from "@/data/users"
 import { useNotifications } from "@/providers/notification-provider"
 
 const leadFormSchema = z.object({
@@ -52,11 +51,21 @@ interface LeadFormDialogProps {
   open: boolean
   onOpenChange: (open: boolean) => void
   lead?: Lead | null
+  onSuccess?: () => void
 }
 
-export function LeadFormDialog({ open, onOpenChange, lead }: LeadFormDialogProps) {
+export function LeadFormDialog({ open, onOpenChange, lead, onSuccess }: LeadFormDialogProps) {
   const isEditing = !!lead
   const { addNotification } = useNotifications()
+  const [users, setUsers] = useState<User[]>([])
+  const [saving, setSaving] = useState(false)
+
+  useEffect(() => {
+    fetch("/api/users")
+      .then((r) => r.json())
+      .then((data) => setUsers(data.users || []))
+      .catch(() => {})
+  }, [])
 
   const form = useForm<LeadFormValues>({
     resolver: zodResolver(leadFormSchema),
@@ -98,22 +107,37 @@ export function LeadFormDialog({ open, onOpenChange, lead }: LeadFormDialogProps
     }
   }, [lead, form])
 
-  function onSubmit(values: LeadFormValues) {
-    const payload = {
-      ...values,
-      assignedUserId: values.assignedUserId === "none" ? null : values.assignedUserId,
+  async function onSubmit(values: LeadFormValues) {
+    setSaving(true)
+    try {
+      const payload = {
+        ...values,
+        assignedUserId: values.assignedUserId === "none" ? null : values.assignedUserId,
+      }
+      if (isEditing && lead) {
+        const res = await fetch(`/api/leads/${lead.id}`, {
+          method: "PATCH",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(payload),
+        })
+        if (!res.ok) throw new Error("Failed to update")
+        addNotification("lead_status_changed", "Lead Updated", `${values.companyName}`, "#")
+      } else {
+        const res = await fetch("/api/leads", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(payload),
+        })
+        if (!res.ok) throw new Error("Failed to create")
+        addNotification("lead_created", "New Lead Created", `${values.companyName} — ${values.contactName}`, "#")
+      }
+      onOpenChange(false)
+      onSuccess?.()
+    } catch (e) {
+      console.error("Lead save error:", e)
+    } finally {
+      setSaving(false)
     }
-    if (!isEditing) {
-      const now = new Date().toISOString()
-      addNotification(
-        "lead_created",
-        "New Lead Created",
-        `${values.companyName} — ${values.contactName}`,
-        "#"
-      )
-    }
-    console.log(payload)
-    onOpenChange(false)
   }
 
   return (
@@ -277,7 +301,7 @@ export function LeadFormDialog({ open, onOpenChange, lead }: LeadFormDialogProps
               <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
                 Cancel
               </Button>
-              <Button type="submit">{isEditing ? "Save Changes" : "Create Lead"}</Button>
+              <Button type="submit" disabled={saving}>{saving ? "Saving..." : isEditing ? "Save Changes" : "Create Lead"}</Button>
             </DialogFooter>
           </form>
         </Form>