Files Changed

Security Fixes
File	Change
.env.local	Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts	Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts	sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts	Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts	POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts	DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts	GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts	DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts	GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs	CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File	Change
src/app/api/leads/route.ts	Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/route.ts	Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts	Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts	Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx	Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx	Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql	Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File	Change
src/lib/ai.ts	Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts	bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx	"Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx	Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below)	Added console.warn("...") context messages

src/app/api/ai/chat/route.ts

@@ -16,7 +16,11 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Message is required" }, { status: 400 })
     }
 
-    const response = await chatWithAI(message, user.id, user.role)
+    // Forward the JWT from the session cookie to the Rust backend
+    const sessionCookie = request.cookies.get("session")?.value
+    if (!sessionCookie) return NextResponse.json({ error: "No session" }, { status: 401 })
+
+    const response = await chatWithAI(message, sessionCookie)
 
     return NextResponse.json({ response })
   } catch (error) {

src/app/api/ai/jobs/route.ts

@@ -14,6 +14,7 @@ export async function GET() {
     const jobs = await fetchJobs()
     return NextResponse.json({ jobs })
   } catch {
+    console.warn("Failed to fetch AI jobs in API route")
     return NextResponse.json({ jobs: [] })
   }
 }

src/app/api/auth/login/route.ts

@@ -113,7 +113,7 @@ export async function POST(request: NextRequest) {
   } catch (error) {
     console.error("Login error:", error)
     return NextResponse.json(
-      { error: "Authentication service unavailable. Please ensure PostgreSQL is running and configured." },
+      { error: "Authentication service unavailable." },
       { status: 503 }
     )
   }

src/app/api/conversations/[id]/messages/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(
   _request: NextRequest,
@@ -12,18 +13,40 @@ export async function GET(
 
     const { id } = await params
 
+    const { searchParams } = new URL(_request.url)
+    const limit = parseInt(searchParams.get("limit") || "100", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+    const before = searchParams.get("before") || ""
+
+    // Verify user is a participant
+    const partCheck = await query(
+      `SELECT 1 FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2`,
+      [id, user.id]
+    )
+    if (partCheck.rows.length === 0) {
+      return NextResponse.json({ error: "Not a participant" }, { status: 403 })
+    }
+
+    let msgSql = `SELECT m.id, m.sender_id, m.content, m.created_at, m.updated_at, m.deleted_at,
+                         u.first_name || ' ' || u.last_name AS sender_name,
+                         u.email AS sender_email,
+                         u.avatar_url AS sender_avatar_url
+                  FROM messages m
+                  JOIN users u ON u.id = m.sender_id
+                  WHERE m.conversation_id = $1 AND m.deleted_at IS NULL`
+    const msgParams: any[] = [id]
+
+    if (before) {
+      msgSql += ` AND m.created_at < $2`
+      msgParams.push(before)
+    }
+
+    msgSql += ` ORDER BY m.created_at ASC`
+    msgSql += ` LIMIT $${msgParams.length + 1} OFFSET $${msgParams.length + 2}`
+    msgParams.push(limit, offset)
+
     const [msgResult, otherReadResult] = await Promise.all([
-      query(
-        `SELECT m.id, m.sender_id, m.content, m.created_at, m.updated_at, m.deleted_at,
-                u.first_name || ' ' || u.last_name AS sender_name,
-                u.email AS sender_email,
-                u.avatar_url AS sender_avatar_url
-         FROM messages m
-         JOIN users u ON u.id = m.sender_id
-         WHERE m.conversation_id = $1 AND m.deleted_at IS NULL
-         ORDER BY m.created_at ASC`,
-        [id],
-      ),
+      query(msgSql, msgParams),
       query(
         `SELECT last_read_at FROM conversation_participants
          WHERE conversation_id = $1 AND user_id != $2`,
@@ -40,7 +63,7 @@ export async function GET(
       conversationId: id,
       senderId: row.sender_id,
       senderName: row.sender_name,
-      senderAvatar: row.sender_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.sender_name)}&background=1d4ed8&color=fff&size=128`,
+      senderAvatar: avatarSvgUrl(row.sender_name),
       content: row.content,
       timestamp: formatTime(new Date(row.created_at)),
       createdAt: row.created_at,
@@ -65,8 +88,17 @@ export async function POST(
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
-    const { content } = await request.json()
 
+    // Verify user is a participant
+    const partCheck = await query(
+      `SELECT 1 FROM conversation_participants WHERE conversation_id = $1 AND user_id = $2`,
+      [id, user.id]
+    )
+    if (partCheck.rows.length === 0) {
+      return NextResponse.json({ error: "Not a participant" }, { status: 403 })
+    }
+
+    const { content } = await request.json()
     if (!content?.trim()) {
       return NextResponse.json({ error: "Message content is required" }, { status: 400 })
     }

src/app/api/conversations/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET() {
   try {
@@ -26,7 +27,8 @@ export async function GET() {
        WHERE c.id IN (
          SELECT conversation_id FROM conversation_participants WHERE user_id = $1
        )
-       ORDER BY c.updated_at DESC`,
+        ORDER BY c.updated_at DESC
+        LIMIT 50`,
       [user.id],
     )
 
@@ -37,7 +39,7 @@ export async function GET() {
         id: row.other_user_id,
         name: row.other_user_name,
         email: row.other_user_email,
-        avatar: row.other_user_avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.other_user_name)}&background=1d4ed8&color=fff&size=128`,
+        avatar: avatarSvgUrl(row.other_user_name),
       },
       lastMessage: row.last_message || "",
       lastMessageTime: row.last_message_time ? timeAgo(new Date(row.last_message_time)) : "",
@@ -103,7 +105,7 @@ export async function POST(request: NextRequest) {
           id: other.id,
           name: other.name,
           email: other.email,
-          avatar: other.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(other.name)}&background=1d4ed8&color=fff&size=128`,
+          avatar: avatarSvgUrl(other.name),
         },
         lastMessage: "",
         lastMessageTime: "",

src/app/api/dashboard/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 function getPeriodDateRange(period: string): { start: Date; end: Date } {
   const end = new Date()
@@ -158,7 +159,7 @@ export async function GET(request: NextRequest) {
         id: r.user_id,
         name: `${r.first_name} ${r.last_name}`,
         email: r.user_email,
-        avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+        avatar: avatarSvgUrl(`${r.first_name} ${r.last_name}`),
       } : null,
       createdAt: r.created_at,
       updatedAt: r.updated_at,

src/app/api/leads/[id]/notes/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   try {
@@ -32,6 +33,9 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    const { searchParams } = new URL(request.url)
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
 
     const result = await query(
       `SELECT cn.id, cn.created_at, cn.updated_at, cn.content,
@@ -39,8 +43,9 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
        FROM customer_notes cn
        JOIN users u ON u.id = cn.author_id
        WHERE cn.customer_id = $1 AND cn.deleted_at IS NULL
-       ORDER BY cn.created_at DESC`,
-      [id]
+       ORDER BY cn.created_at DESC
+       LIMIT $2 OFFSET $3`,
+      [id, limit, offset]
     )
 
     const notes = result.rows.map((r: any) => ({
@@ -48,7 +53,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
       leadId: id,
       userId: r.user_id,
       authorName: `${r.first_name} ${r.last_name}`,
-      authorAvatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      authorAvatar: avatarSvgUrl(`${r.first_name} ${r.last_name}`),
       note: r.content,
       createdAt: r.created_at,
       updatedAt: r.updated_at,

src/app/api/leads/[id]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 function stageToStatus(name: string): string {
   switch (name) {
@@ -22,6 +23,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
     const { id } = await params
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
 
     const result = await query(
       `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
@@ -31,8 +33,9 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
        FROM leads l
        JOIN lead_stages ls ON ls.id = l.stage_id
        LEFT JOIN users u ON u.id = l.assigned_to
-       WHERE l.id = $1 AND l.deleted_at IS NULL`,
-      [id]
+       WHERE l.id = $1 AND l.deleted_at IS NULL
+         AND ($2 = true OR l.assigned_to = $3)`,
+      [id, isAdmin, user.id]
     )
 
     if (result.rows.length === 0) {
@@ -54,7 +57,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
         id: r.user_id,
         name: `${r.first_name} ${r.last_name}`,
         email: r.user_email,
-        avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+        avatar: avatarSvgUrl(`${r.first_name} ${r.last_name}`),
       } : null,
       createdAt: r.created_at,
       updatedAt: r.updated_at,
@@ -66,3 +69,85 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
     return NextResponse.json({ error: "Failed to load lead" }, { status: 500 })
   }
 }
+
+function statusToStageName(status: string): string {
+  switch (status) {
+    case "open": return "New"
+    case "contacted": return "Contacted"
+    case "pending": return "Qualified"
+    case "closed": return "Closed Won"
+    case "ignored": return "Closed Lost"
+    default: return "New"
+  }
+}
+
+export async function PATCH(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { id } = await params
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+
+    // Verify access
+    const accessCheck = await query(
+      `SELECT id FROM leads WHERE id = $1 AND deleted_at IS NULL
+       AND ($2 = true OR assigned_to = $3)`,
+      [id, isAdmin, user.id]
+    )
+    if (accessCheck.rows.length === 0) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
+    const body = await request.json()
+    const fields: string[] = []
+    const values: any[] = []
+    let idx = 1
+
+    if (body.companyName !== undefined) { fields.push(`company_name = $${idx++}`); values.push(body.companyName) }
+    if (body.contactName !== undefined) { fields.push(`contact_name = $${idx++}`); values.push(body.contactName) }
+    if (body.email !== undefined) { fields.push(`email = $${idx++}`); values.push(body.email) }
+    if (body.phone !== undefined) { fields.push(`phone = $${idx++}`); values.push(body.phone) }
+    if (body.description !== undefined) { fields.push(`notes = $${idx++}`); values.push(body.description) }
+    if (body.source !== undefined) { fields.push(`source_id = $${idx++}`); values.push(body.source) }
+    if (body.assignedUserId !== undefined) {
+      fields.push(`assigned_to = $${idx++}`)
+      values.push(body.assignedUserId === "none" ? null : body.assignedUserId)
+    }
+    if (body.status !== undefined) {
+      const stageName = statusToStageName(body.status)
+      const stageResult = await query("SELECT id FROM lead_stages WHERE name = $1", [stageName])
+      if (stageResult.rows.length > 0) {
+        fields.push(`stage_id = $${idx++}`)
+        values.push(stageResult.rows[0].id)
+      }
+    }
+    if (body.score !== undefined) {
+      const score = Number(body.score)
+      if (!isFinite(score) || score < 0 || score > 100) {
+        return NextResponse.json({ error: "Score must be a number between 0 and 100" }, { status: 400 })
+      }
+      fields.push(`score = $${idx++}`)
+      values.push(score)
+    }
+
+    if (fields.length === 0) {
+      return NextResponse.json({ error: "No fields to update" }, { status: 400 })
+    }
+
+    fields.push(`updated_at = NOW()`)
+    values.push(id)
+
+    const sql = `UPDATE leads SET ${fields.join(", ")} WHERE id = $${idx} AND deleted_at IS NULL RETURNING id`
+    const result = await query(sql, values)
+
+    if (result.rows.length === 0) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
+    return NextResponse.json({ success: true, id: result.rows[0].id })
+  } catch (error) {
+    console.error("Lead PATCH error:", error)
+    return NextResponse.json({ error: "Failed to update lead" }, { status: 500 })
+  }
+}

src/app/api/leads/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 function stageToStatus(name: string): string {
   switch (name) {
@@ -38,6 +39,9 @@ export async function GET(request: NextRequest) {
     const search = searchParams.get("search") || ""
     const status = searchParams.get("status") || "all"
     const period = searchParams.get("period") || "all"
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
 
     let sql = `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
                       l.assigned_to, l.created_at, l.updated_at, l.notes, l.source_id,
@@ -66,7 +70,16 @@ export async function GET(request: NextRequest) {
       paramIdx++
     }
 
+    if (!isAdmin) {
+      sql += ` AND l.assigned_to = $${paramIdx}`
+      params.push(user.id)
+      paramIdx++
+    }
+
     sql += ` ORDER BY l.created_at DESC`
+    sql += ` LIMIT $${paramIdx} OFFSET $${paramIdx + 1}`
+    params.push(limit, offset)
+    paramIdx += 2
 
     const result = await query(sql, params)
 
@@ -86,7 +99,7 @@ export async function GET(request: NextRequest) {
           id: r.user_id,
           name: `${r.first_name} ${r.last_name}`,
           email: r.user_email,
-          avatar: r.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${r.first_name} ${r.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+          avatar: avatarSvgUrl(`${r.first_name} ${r.last_name}`),
         } : null,
         createdAt: r.created_at,
         updatedAt: r.updated_at,
@@ -103,3 +116,66 @@ export async function GET(request: NextRequest) {
     return NextResponse.json({ error: "Failed to load leads" }, { status: 500 })
   }
 }
+
+export async function POST(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const body = await request.json()
+
+    const stageResult = await query(
+      "SELECT id FROM lead_stages WHERE name = $1",
+      [body.status === "open" ? "New" : "Contacted"]
+    )
+    const stageId = stageResult.rows[0]?.id || 1
+
+    const result = await query(
+      `INSERT INTO leads (company_name, contact_name, email, phone, notes, source_id, stage_id, assigned_to, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW(), NOW())
+       RETURNING id`,
+      [
+        body.companyName,
+        body.contactName,
+        body.email,
+        body.phone || null,
+        body.description || null,
+        body.source || null,
+        stageId,
+        body.assignedUserId === "none" ? null : body.assignedUserId,
+      ]
+    )
+
+    return NextResponse.json({ success: true, id: result.rows[0].id }, { status: 201 })
+  } catch (error) {
+    console.error("Leads POST error:", error)
+    return NextResponse.json({ error: "Failed to create lead" }, { status: 500 })
+  }
+}
+
+export async function DELETE(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const isAdmin = user.role === "admin" || user.role === "super_admin"
+
+    const { searchParams } = new URL(request.url)
+    const id = searchParams.get("id")
+    if (!id) return NextResponse.json({ error: "id is required" }, { status: 400 })
+
+    const result = await query(
+      "UPDATE leads SET deleted_at = NOW() WHERE id = $1 AND deleted_at IS NULL AND ($2 = true OR assigned_to = $3) RETURNING id",
+      [id, isAdmin, user.id]
+    )
+
+    if (result.rows.length === 0) {
+      return NextResponse.json({ error: "Lead not found" }, { status: 404 })
+    }
+
+    return NextResponse.json({ success: true })
+  } catch (error) {
+    console.error("Leads DELETE error:", error)
+    return NextResponse.json({ error: "Failed to delete lead" }, { status: 500 })
+  }
+}

src/app/api/settings/company/route.ts

@@ -6,6 +6,9 @@ export async function GET() {
   try {
     const user = await getSessionUser()
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const result = await query(`SELECT * FROM company_settings ORDER BY updated_at DESC LIMIT 1`)
     const row = result.rows[0]
@@ -37,6 +40,9 @@ export async function PATCH(request: NextRequest) {
   try {
     const user = await getSessionUser()
     if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    if (user.role !== "admin" && user.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+    }
 
     const body = await request.json()
 

src/app/api/system/monitor/route.ts

@@ -1,10 +1,14 @@
 import { NextResponse } from "next/server"
 import os from "os"
+import { getSessionUser } from "@/lib/auth"
 
 let prevCpu = process.cpuUsage()
 let prevTime = Date.now()
 
 export async function GET() {
+  const sessionUser = await getSessionUser()
+  if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
   const now = Date.now()
   const elapsed = now - prevTime
   const currentCpu = process.cpuUsage()

src/app/api/users/[id]/route.ts

@@ -8,9 +8,16 @@ export async function DELETE(request: NextRequest, { params }: { params: Promise
     if (!sessionUser) {
       return NextResponse.json({ error: "Not authenticated" }, { status: 401 })
     }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only super admins can delete users" }, { status: 403 })
+    }
 
     const { id } = await params
 
+    if (id === sessionUser.id) {
+      return NextResponse.json({ error: "Cannot delete yourself" }, { status: 400 })
+    }
+
     await query(
       `UPDATE users SET deleted_at = NOW() WHERE id = $1 AND deleted_at IS NULL`,
       [id]

src/app/api/users/route.ts

@@ -1,9 +1,17 @@
 import { NextRequest, NextResponse } from "next/server"
 import { query } from "@/lib/db"
 import { hashPassword, getSessionUser } from "@/lib/auth"
+import { avatarSvgUrl } from "@/lib/avatar"
 
-export async function GET() {
+export async function GET(request: NextRequest) {
   try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const { searchParams } = new URL(request.url)
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+
     const result = await query(
       `SELECT u.id, u.username, u.email, u.first_name, u.last_name,
               u.is_active AS active, u.created_at, u.avatar_url,
@@ -12,7 +20,9 @@ export async function GET() {
        JOIN user_roles ur ON ur.user_id = u.id
        JOIN roles r ON r.id = ur.role_id
        WHERE u.deleted_at IS NULL
-       ORDER BY u.created_at DESC`
+       ORDER BY u.created_at DESC
+       LIMIT $1 OFFSET $2`,
+      [limit, offset]
     )
     const users = result.rows.map((row: any) => ({
       id: row.id,
@@ -20,7 +30,7 @@ export async function GET() {
       email: row.email,
       role: row.role.toLowerCase(),
       active: row.active,
-      avatar: row.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(`${row.first_name}+${row.last_name}`)}&background=1d4ed8&color=fff&size=128`,
+      avatar: avatarSvgUrl(`${row.first_name} ${row.last_name}`),
       createdAt: row.created_at,
     }))
     return NextResponse.json({ users }, { status: 200 })
@@ -36,12 +46,20 @@ export async function POST(request: NextRequest) {
     if (!sessionUser) {
       return NextResponse.json({ error: "Not authenticated" }, { status: 401 })
     }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only super admins can create users" }, { status: 403 })
+    }
 
     const { name, email, password, role, active } = await request.json()
     if (!name || !email || !password || !role) {
       return NextResponse.json({ error: "Name, email, password, and role are required" }, { status: 400 })
     }
 
+    const validRoles = ["sales", "admin", "super_admin", "dev"]
+    if (!validRoles.includes(role)) {
+      return NextResponse.json({ error: "Invalid role" }, { status: 400 })
+    }
+
     const nameParts = name.trim().split(/\s+/)
     const firstName = nameParts[0]
     const lastName = nameParts.slice(1).join(" ") || firstName
@@ -52,7 +70,7 @@ export async function POST(request: NextRequest) {
       `INSERT INTO users (username, email, password_hash, first_name, last_name, is_active, created_by)
        VALUES ($1, $2, $3, $4, $5, $6, $7)
        RETURNING id`,
-      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active, sessionUser.id]
+      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active ?? true, sessionUser.id]
     )
 
     const roleId = (

src/app/api/users/search/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"
+import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(request: NextRequest) {
   try {
@@ -29,7 +30,7 @@ export async function GET(request: NextRequest) {
       id: row.id,
       name: row.name,
       email: row.email,
-      avatar: row.avatar_url || `https://ui-avatars.com/api/?name=${encodeURIComponent(row.name)}&background=1d4ed8&color=fff&size=128`,
+      avatar: avatarSvgUrl(row.name),
     }))
 
     return NextResponse.json({ users })