Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

ai-server/index.mjs

@@ -256,11 +256,47 @@ const server = http.createServer(async (req, res) => {
   const { pathname } = parseURL(req)
 
   try {
+    // GET /splash — loading screen
+    if (req.method === "GET" && pathname === "/splash") {
+      const splashPath = path.join(ROOT, "splash.html")
+      if (fs.existsSync(splashPath)) {
+        const html = fs.readFileSync(splashPath, "utf-8")
+        res.writeHead(200, { "Content-Type": "text/html" })
+        res.end(html)
+        return
+      }
+      sendJSON(res, 200, { status: "ok" })
+      return
+    }
+
     // GET /health
     if (req.method === "GET" && pathname === "/health") {
       return sendJSON(res, 200, { status: "ok", model: MODEL })
     }
 
+    // GET /status — combined health of all services
+    if (req.method === "GET" && pathname === "/status") {
+      const { default: http } = await import("http")
+      const results = { ai: true }
+      // Check scraper
+      try {
+        await new Promise((resolve, reject) => {
+          const r = http.get("http://127.0.0.1:3008/health", { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          r.on("error", reject)
+        })
+        results.scraper = true
+      } catch { results.scraper = false }
+      // Check frontend
+      try {
+        await new Promise((resolve, reject) => {
+          const r = http.get("http://127.0.0.1:3006", { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          r.on("error", reject)
+        })
+        results.frontend = true
+      } catch { results.frontend = false }
+      return sendJSON(res, 200, results)
+    }
+
     // GET /ai/jobs
     if (req.method === "GET" && pathname === "/ai/jobs") {
       return sendJSON(res, 200, { jobs: loadedJobs })

database/migrations/013_security_upgrade.sql

@@ -0,0 +1,604 @@
+-- ============================================================================
+-- CRM Security Architecture Upgrade
+-- Internal Company CRM — Prioritizes control, recovery, and maintainability
+-- ============================================================================
+-- Implements:
+--   • Dual password storage (bcrypt + pgcrypto AES reversible)
+--   • SUPER_ADMIN master key recovery system
+--   • Row Level Security (RLS) on CRM tables
+--   • Database export logging
+--   • Backup logging
+--   • Immutable admin action tracking
+--   • SQL injection defense (parameterized queries enforced app-side)
+-- ============================================================================
+
+-- ============================================================================
+-- 1. DUAL PASSWORD STORAGE
+-- ============================================================================
+-- password_hash (bcrypt)      — used for normal login authentication
+-- password_encrypted (AES)    — reversible encryption for emergency credential recovery
+-- ============================================================================
+
+ALTER TABLE users ADD COLUMN IF NOT EXISTS password_encrypted TEXT;
+
+-- ============================================================================
+-- 2. SUPER_ADMIN MASTER KEY SYSTEM
+-- ============================================================================
+-- Stores the master decryption key used with pgp_sym_encrypt/pgp_sym_decrypt.
+-- Only accessible by SUPER_ADMIN role via security definer functions.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS master_keys (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    key_name VARCHAR(100) NOT NULL UNIQUE,
+    key_value TEXT NOT NULL,
+    description TEXT,
+    created_by UUID REFERENCES users(id),
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    is_active BOOLEAN NOT NULL DEFAULT TRUE
+);
+
+CREATE INDEX idx_master_keys_active ON master_keys(key_name) WHERE is_active = TRUE;
+
+-- ============================================================================
+-- 3. DATABASE EXPORT LOGGING
+-- ============================================================================
+-- Tracks all database exports and SQL dumps performed by SUPER_ADMIN.
+-- Immutable — never allow deletion or update.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS database_export_logs (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    exported_by UUID NOT NULL REFERENCES users(id),
+    export_type VARCHAR(50) NOT NULL,
+    file_name VARCHAR(500) NOT NULL,
+    file_size_bytes BIGINT,
+    record_count INT,
+    ip_address INET,
+    user_agent TEXT,
+    notes TEXT,
+    exported_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX idx_export_logs_user ON database_export_logs(exported_by);
+CREATE INDEX idx_export_logs_time ON database_export_logs(exported_at DESC);
+
+COMMENT ON TABLE database_export_logs IS 'Immutable audit of all database exports. Never DELETE or UPDATE rows.';
+COMMENT ON COLUMN database_export_logs.export_type IS 'pg_dump, csv_export, full_backup, selective_export';
+
+-- ============================================================================
+-- 4. BACKUP LOGGING
+-- ============================================================================
+-- Records every automated or manual database backup.
+-- Retention: minimum 30 days of backup history.
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS backup_logs (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    backup_type VARCHAR(20) NOT NULL,
+    status VARCHAR(20) NOT NULL,
+    file_name VARCHAR(500),
+    file_size_bytes BIGINT,
+    pg_dump_exit_code INT,
+    error_message TEXT,
+    checksum VARCHAR(64),
+    verification_status VARCHAR(20),
+    started_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    completed_at TIMESTAMPTZ,
+    duration_seconds INT,
+    retention_days INT NOT NULL DEFAULT 30,
+    triggered_by UUID REFERENCES users(id),
+    notes TEXT
+);
+
+CREATE INDEX idx_backup_logs_time ON backup_logs(started_at DESC);
+CREATE INDEX idx_backup_logs_status ON backup_logs(status);
+CREATE INDEX idx_backup_logs_type ON backup_logs(backup_type);
+CREATE INDEX idx_backup_logs_completed ON backup_logs(status)
+    WHERE status = 'completed';
+
+-- ============================================================================
+-- 5. AUDIT TRIGGER: Password changes
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION audit_password_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF OLD.password_hash IS DISTINCT FROM NEW.password_hash THEN
+        INSERT INTO audit_logs (
+            table_name, record_id, action, old_data, new_data, changed_by, ip_address
+        ) VALUES (
+            'users',
+            NEW.id,
+            'UPDATE',
+            jsonb_build_object('password_changed', true, 'password_change_required', OLD.password_change_required),
+            jsonb_build_object('password_changed', true, 'password_change_required', NEW.password_change_required),
+            NULLIF(current_setting('app.current_user_id', true), ''),
+            NULLIF(current_setting('app.current_ip', true), '')
+        );
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS trg_audit_password_change ON users;
+CREATE TRIGGER trg_audit_password_change
+    AFTER UPDATE OF password_hash ON users
+    FOR EACH ROW
+    EXECUTE FUNCTION audit_password_change();
+
+-- ============================================================================
+-- 6. AUDIT TRIGGER: User creation
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION audit_user_creation()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO audit_logs (
+        table_name, record_id, action, new_data, changed_by
+    ) VALUES (
+        'users',
+        NEW.id,
+        'CREATE',
+        jsonb_build_object(
+            'username', NEW.username,
+            'email', NEW.email,
+            'first_name', NEW.first_name,
+            'last_name', NEW.last_name,
+            'is_active', NEW.is_active
+        ),
+        NEW.created_by
+    );
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS trg_audit_user_create ON users;
+CREATE TRIGGER trg_audit_user_create
+    AFTER INSERT ON users
+    FOR EACH ROW
+    EXECUTE FUNCTION audit_user_creation();
+
+-- ============================================================================
+-- 7. AUDIT TRIGGER: Database exports
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION audit_database_export()
+RETURNS TRIGGER AS $$
+BEGIN
+    INSERT INTO audit_logs (
+        table_name, record_id, action, new_data, changed_by
+    ) VALUES (
+        'database_export_logs',
+        NEW.id,
+        'CREATE',
+        jsonb_build_object(
+            'export_type', NEW.export_type,
+            'file_name', NEW.file_name,
+            'file_size_bytes', NEW.file_size_bytes,
+            'record_count', NEW.record_count
+        ),
+        NEW.exported_by
+    );
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS trg_audit_database_export ON database_export_logs;
+CREATE TRIGGER trg_audit_database_export
+    AFTER INSERT ON database_export_logs
+    FOR EACH ROW
+    EXECUTE FUNCTION audit_database_export();
+
+-- ============================================================================
+-- 8. AUDIT TRIGGER: Login/logout already exists via login_attempts trigger
+--    (trg_audit_login in 001_schema.sql)
+--    This enhances it to also track session-level events.
+-- ============================================================================
+
+DROP TRIGGER IF EXISTS trg_audit_login ON login_attempts;
+CREATE TRIGGER trg_audit_login
+    AFTER INSERT ON login_attempts
+    FOR EACH ROW
+    EXECUTE FUNCTION audit_login();
+
+-- ============================================================================
+-- 9. ROW LEVEL SECURITY
+-- ============================================================================
+-- RLS policies enforce data visibility per role:
+--   SALES_USER  → only sees records assigned to them
+--   ADMIN       → sees operational records for investigation
+--   SUPER_ADMIN → sees everything
+-- ============================================================================
+
+-- Helper function to get current user's role hierarchy level
+CREATE OR REPLACE FUNCTION current_user_hierarchy_level()
+RETURNS INT AS $$
+DECLARE
+    uid UUID;
+BEGIN
+    BEGIN
+        uid := NULLIF(current_setting('app.current_user_id', true), '')::UUID;
+    EXCEPTION WHEN OTHERS THEN
+        RETURN NULL;
+    END;
+
+    IF uid IS NULL THEN
+        RETURN NULL;
+    END IF;
+
+    RETURN (
+        SELECT MIN(r.hierarchy_level)
+        FROM user_roles ur
+        JOIN roles r ON r.id = ur.role_id
+        WHERE ur.user_id = uid
+    );
+END;
+$$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
+
+-- Helper function to get current user's ID from session setting
+CREATE OR REPLACE FUNCTION current_user_id()
+RETURNS UUID AS $$
+BEGIN
+    BEGIN
+        RETURN NULLIF(current_setting('app.current_user_id', true), '')::UUID;
+    EXCEPTION WHEN OTHERS THEN
+        RETURN NULL;
+    END;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+-- SALES_USER level = 3, ADMIN level = 2, SUPER_ADMIN level = 1
+
+-- ── customers ──
+ALTER TABLE customers ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS rls_customers_select ON customers;
+CREATE POLICY rls_customers_select ON customers
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NULL
+        OR current_user_hierarchy_level() <= 2  -- ADMIN and SUPER_ADMIN see all
+        OR owner_id = current_user_id()
+    );
+
+DROP POLICY IF EXISTS rls_customers_insert ON customers;
+CREATE POLICY rls_customers_insert ON customers
+    FOR INSERT
+    WITH CHECK (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2  -- ADMIN and SUPER_ADMIN can assign any owner
+            OR owner_id = current_user_id()       -- SALES_USER can only assign to self
+        )
+    );
+
+DROP POLICY IF EXISTS rls_customers_update ON customers;
+CREATE POLICY rls_customers_update ON customers
+    FOR UPDATE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR owner_id = current_user_id()
+        )
+    )
+    WITH CHECK (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR (
+                owner_id = current_user_id()
+                AND owner_id = current_user_id()  -- SALES_USER cannot reassign ownership
+            )
+        )
+    );
+
+DROP POLICY IF EXISTS rls_customers_delete ON customers;
+CREATE POLICY rls_customers_delete ON customers
+    FOR DELETE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+-- ── leads ──
+ALTER TABLE leads ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS rls_leads_select ON leads;
+CREATE POLICY rls_leads_select ON leads
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NULL
+        OR current_user_hierarchy_level() <= 2
+        OR assigned_to = current_user_id()
+    );
+
+DROP POLICY IF EXISTS rls_leads_insert ON leads;
+CREATE POLICY rls_leads_insert ON leads
+    FOR INSERT
+    WITH CHECK (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR assigned_to = current_user_id()
+        )
+    );
+
+DROP POLICY IF EXISTS rls_leads_update ON leads;
+CREATE POLICY rls_leads_update ON leads
+    FOR UPDATE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR assigned_to = current_user_id()
+        )
+    );
+
+DROP POLICY IF EXISTS rls_leads_delete ON leads;
+CREATE POLICY rls_leads_delete ON leads
+    FOR DELETE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+-- ── opportunities ──
+ALTER TABLE opportunities ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS rls_opportunities_select ON opportunities;
+CREATE POLICY rls_opportunities_select ON opportunities
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NULL
+        OR current_user_hierarchy_level() <= 2
+        OR owner_id = current_user_id()
+    );
+
+DROP POLICY IF EXISTS rls_opportunities_insert ON opportunities;
+CREATE POLICY rls_opportunities_insert ON opportunities
+    FOR INSERT
+    WITH CHECK (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR owner_id = current_user_id()
+        )
+    );
+
+DROP POLICY IF EXISTS rls_opportunities_update ON opportunities;
+CREATE POLICY rls_opportunities_update ON opportunities
+    FOR UPDATE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR owner_id = current_user_id()
+        )
+    );
+
+DROP POLICY IF EXISTS rls_opportunities_delete ON opportunities;
+CREATE POLICY rls_opportunities_delete ON opportunities
+    FOR DELETE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+-- ── communications ──
+ALTER TABLE communications ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS rls_communications_select ON communications;
+CREATE POLICY rls_communications_select ON communications
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NULL
+        OR current_user_hierarchy_level() <= 2
+        OR created_by = current_user_id()
+    );
+
+DROP POLICY IF EXISTS rls_communications_insert ON communications;
+CREATE POLICY rls_communications_insert ON communications
+    FOR INSERT
+    WITH CHECK (
+        current_user_hierarchy_level() IS NOT NULL
+    );
+
+DROP POLICY IF EXISTS rls_communications_delete ON communications;
+CREATE POLICY rls_communications_delete ON communications
+    FOR DELETE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+-- ── tasks ──
+ALTER TABLE tasks ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS rls_tasks_select ON tasks;
+CREATE POLICY rls_tasks_select ON tasks
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NULL
+        OR current_user_hierarchy_level() <= 2
+        OR assigned_to = current_user_id()
+        OR assigned_by = current_user_id()
+    );
+
+DROP POLICY IF EXISTS rls_tasks_update ON tasks;
+CREATE POLICY rls_tasks_update ON tasks
+    FOR UPDATE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND (
+            current_user_hierarchy_level() <= 2
+            OR assigned_to = current_user_id()
+            OR assigned_by = current_user_id()
+        )
+    );
+
+-- ============================================================================
+-- 10. IMMUTABLE AUDIT LOG PROTECTION
+-- ============================================================================
+-- Prevent deletion or update of audit_logs at the database level.
+-- Even SUPER_ADMIN cannot delete historical audit records.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION prevent_audit_mutation()
+RETURNS TRIGGER AS $$
+BEGIN
+    RAISE EXCEPTION 'IMMUTABLE: audit_logs cannot be modified or deleted. All changes are permanently recorded.';
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_prevent_audit_delete ON audit_logs;
+CREATE TRIGGER trg_prevent_audit_delete
+    BEFORE DELETE ON audit_logs
+    FOR EACH ROW
+    EXECUTE FUNCTION prevent_audit_mutation();
+
+DROP TRIGGER IF EXISTS trg_prevent_audit_update ON audit_logs;
+CREATE TRIGGER trg_prevent_audit_update
+    BEFORE UPDATE ON audit_logs
+    FOR EACH ROW
+    EXECUTE FUNCTION prevent_audit_mutation();
+
+-- Same protection for database_export_logs
+DROP TRIGGER IF EXISTS trg_prevent_export_delete ON database_export_logs;
+CREATE TRIGGER trg_prevent_export_delete
+    BEFORE DELETE ON database_export_logs
+    FOR EACH ROW
+    EXECUTE FUNCTION prevent_audit_mutation();
+
+DROP TRIGGER IF EXISTS trg_prevent_export_update ON database_export_logs;
+CREATE TRIGGER trg_prevent_export_update
+    BEFORE UPDATE ON database_export_logs
+    FOR EACH ROW
+    EXECUTE FUNCTION prevent_audit_mutation();
+
+-- ============================================================================
+-- 11. ENCRYPTION FUNCTIONS
+-- ============================================================================
+-- Uses pgcrypto's pgp_sym_encrypt / pgp_sym_decrypt with the master key.
+-- Master key is stored in master_keys table, fetched by security definer functions.
+-- ============================================================================
+
+-- Get the active master decryption key
+-- Only callable by SUPER_ADMIN
+CREATE OR REPLACE FUNCTION get_master_decryption_key()
+RETURNS TEXT AS $$
+DECLARE
+    key_value TEXT;
+    uid UUID;
+    user_level INT;
+BEGIN
+    uid := current_user_id();
+    IF uid IS NULL THEN
+        RAISE EXCEPTION 'Not authenticated';
+    END IF;
+
+    user_level := current_user_hierarchy_level();
+    IF user_level IS NULL OR user_level > 1 THEN
+        RAISE EXCEPTION 'ACCESS DENIED: Only SUPER_ADMIN can access the master decryption key';
+    END IF;
+
+    SELECT mk.key_value INTO key_value
+    FROM master_keys mk
+    WHERE mk.is_active = TRUE
+    ORDER BY mk.created_at DESC
+    LIMIT 1;
+
+    RETURN key_value;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- Encrypt a plaintext password using the active master key
+CREATE OR REPLACE FUNCTION encrypt_password(p_plaintext TEXT)
+RETURNS TEXT AS $$
+DECLARE
+    master_key TEXT;
+BEGIN
+    SELECT key_value INTO master_key
+    FROM master_keys
+    WHERE is_active = TRUE
+    ORDER BY created_at DESC
+    LIMIT 1;
+
+    IF master_key IS NULL THEN
+        RAISE EXCEPTION 'No active master key found. Contact SUPER_ADMIN.';
+    END IF;
+
+    RETURN encode(
+        pgp_sym_encrypt(p_plaintext, master_key, 'compress-algo=2, cipher-algo=aes256'),
+        'escape'
+    );
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- Decrypt a password that was encrypted with encrypt_password()
+CREATE OR REPLACE FUNCTION decrypt_password(p_encrypted TEXT)
+RETURNS TEXT AS $$
+DECLARE
+    master_key TEXT;
+BEGIN
+    master_key := get_master_decryption_key();
+    RETURN pgp_sym_decrypt(decode(p_encrypted, 'escape'), master_key);
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- ============================================================================
+-- 12. RLS BYPASS FOR SUPER_ADMIN
+-- ============================================================================
+-- SUPER_ADMIN bypasses all RLS. This function is used by triggers/policies
+-- to check if the current user should bypass restrictions.
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION is_super_admin()
+RETURNS BOOLEAN AS $$
+BEGIN
+    RETURN COALESCE(current_user_hierarchy_level(), 999) <= 1;
+END;
+$$ LANGUAGE plpgsql STABLE SECURITY DEFINER;
+
+-- ============================================================================
+-- 13. SEED DATA: Master key (for development/testing)
+-- ============================================================================
+-- In production, this key should be set via a secure deployment process.
+-- The key is stored in the database and encrypted at rest by PostgreSQL.
+-- ============================================================================
+
+INSERT INTO master_keys (key_name, key_value, description, created_by)
+SELECT
+    'MASTER_DECRYPTION_KEY',
+    encode(gen_random_bytes(32), 'hex'),
+    'Master key for reversible password encryption. Used with pgp_sym_encrypt/decrypt.',
+    '00000000-0000-0000-0000-000000000001'
+WHERE NOT EXISTS (
+    SELECT 1 FROM master_keys WHERE key_name = 'MASTER_DECRYPTION_KEY'
+);
+
+-- ============================================================================
+-- 14. UPDATE SEED DATA: Encrypt passwords for existing test accounts
+-- ============================================================================
+
+UPDATE users SET password_encrypted = encrypt_password('SuperAdmin@2026')
+WHERE id = '00000000-0000-0000-0000-000000000001' AND password_encrypted IS NULL;
+
+UPDATE users SET password_encrypted = encrypt_password('AdminAccess@2026')
+WHERE id = '00000000-0000-0000-0000-000000000002' AND password_encrypted IS NULL;
+
+UPDATE users SET password_encrypted = encrypt_password('SalesAccess@2026')
+WHERE id = '00000000-0000-0000-0000-000000000003' AND password_encrypted IS NULL;
+
+UPDATE users SET password_encrypted = encrypt_password('DevTesting@2026')
+WHERE id = '00000000-0000-0000-0000-000000000004' AND password_encrypted IS NULL;
+
+-- ============================================================================
+-- FUTURE REQUIREMENT NOTE:
+-- If this system is ever exposed publicly, remove reversible password storage
+-- immediately. Keep bcrypt only. Delete the password_encrypted column and
+-- master_keys table. The MASTER_DECRYPTION_KEY must never be exposed externally.
+-- ============================================================================
+

database/migrations/014_bug_reports.sql

@@ -0,0 +1,145 @@
+-- ============================================================================
+-- Bug Reporting System
+-- ============================================================================
+-- Access rules:
+--   ALL authenticated users can INSERT (submit bug reports)
+--   Only ADMIN and SUPER_ADMIN can SELECT, UPDATE (view/manage)
+--   SALES_USER and DEVELOPER cannot view bug_reports after submission
+-- ============================================================================
+
+CREATE TABLE IF NOT EXISTS bug_reports (
+    id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+    reported_by UUID NOT NULL REFERENCES users(id),
+    title VARCHAR(255) NOT NULL,
+    description TEXT NOT NULL,
+    severity VARCHAR(20) NOT NULL DEFAULT 'medium'
+        CHECK (severity IN ('low', 'medium', 'high', 'critical')),
+    page_url TEXT,
+    screenshot_url TEXT,
+    status VARCHAR(20) NOT NULL DEFAULT 'open'
+        CHECK (status IN ('open', 'in_progress', 'resolved', 'closed')),
+    assigned_to UUID REFERENCES users(id),
+    resolution_notes TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_bug_reports_reported_by ON bug_reports(reported_by);
+CREATE INDEX IF NOT EXISTS idx_bug_reports_status ON bug_reports(status);
+CREATE INDEX IF NOT EXISTS idx_bug_reports_severity ON bug_reports(severity);
+CREATE INDEX IF NOT EXISTS idx_bug_reports_assigned ON bug_reports(assigned_to);
+CREATE INDEX IF NOT EXISTS idx_bug_reports_created ON bug_reports(created_at DESC);
+
+-- RLS: Allow INSERT for all authenticated users
+--      Allow SELECT/UPDATE only for ADMIN and SUPER_ADMIN
+ALTER TABLE bug_reports ENABLE ROW LEVEL SECURITY;
+
+DROP POLICY IF EXISTS bug_reports_insert ON bug_reports;
+CREATE POLICY bug_reports_insert ON bug_reports
+    FOR INSERT
+    WITH CHECK (
+        current_user_id() IS NOT NULL
+        AND reported_by = current_user_id()
+    );
+
+DROP POLICY IF EXISTS bug_reports_select ON bug_reports;
+CREATE POLICY bug_reports_select ON bug_reports
+    FOR SELECT
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+DROP POLICY IF EXISTS bug_reports_update ON bug_reports;
+CREATE POLICY bug_reports_update ON bug_reports
+    FOR UPDATE
+    USING (
+        current_user_hierarchy_level() IS NOT NULL
+        AND current_user_hierarchy_level() <= 2
+    );
+
+-- Audit trigger for bug report actions
+CREATE OR REPLACE FUNCTION audit_bug_report_action()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF TG_OP = 'INSERT' THEN
+        INSERT INTO audit_logs (table_name, record_id, action, new_data, changed_by)
+        VALUES (
+            'bug_reports',
+            NEW.id,
+            'BUG_CREATED',
+            jsonb_build_object(
+                'title', NEW.title,
+                'severity', NEW.severity,
+                'page_url', NEW.page_url,
+                'status', NEW.status
+            ),
+            NEW.reported_by
+        );
+    ELSIF TG_OP = 'UPDATE' THEN
+        IF OLD.status IS DISTINCT FROM NEW.status THEN
+            INSERT INTO audit_logs (table_name, record_id, action, new_data, changed_by)
+            VALUES (
+                'bug_reports',
+                NEW.id,
+                CASE NEW.status
+                    WHEN 'resolved' THEN 'BUG_RESOLVED'
+                    ELSE 'BUG_UPDATED'
+                END,
+                jsonb_build_object(
+                    'old_status', OLD.status,
+                    'new_status', NEW.status,
+                    'assigned_to', NEW.assigned_to,
+                    'resolution_notes', NEW.resolution_notes
+                ),
+                NULLIF(current_setting('app.current_user_id', true), '')
+            );
+        END IF;
+        IF OLD.assigned_to IS DISTINCT FROM NEW.assigned_to AND NEW.assigned_to IS NOT NULL THEN
+            INSERT INTO audit_logs (table_name, record_id, action, new_data, changed_by)
+            VALUES (
+                'bug_reports',
+                NEW.id,
+                'BUG_ASSIGNED',
+                jsonb_build_object(
+                    'assigned_to', NEW.assigned_to,
+                    'previous_assignee', OLD.assigned_to,
+                    'status', NEW.status
+                ),
+                NULLIF(current_setting('app.current_user_id', true), '')
+            );
+        END IF;
+    END IF;
+    RETURN COALESCE(NEW, OLD);
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+DROP TRIGGER IF EXISTS trg_audit_bug_report ON bug_reports;
+CREATE TRIGGER trg_audit_bug_report
+    AFTER INSERT OR UPDATE ON bug_reports
+    FOR EACH ROW
+    EXECUTE FUNCTION audit_bug_report_action();
+
+-- Widen audit action constraint to include bug report events
+ALTER TABLE audit_logs DROP CONSTRAINT IF EXISTS chk_audit_action;
+ALTER TABLE audit_logs ADD CONSTRAINT chk_audit_action
+    CHECK (action::text = ANY (ARRAY[
+        'CREATE', 'UPDATE', 'DELETE',
+        'BUG_CREATED', 'BUG_UPDATED', 'BUG_ASSIGNED', 'BUG_RESOLVED',
+        'LOGIN', 'LOGOUT'
+    ]::text[]));
+
+-- Prevent SALES_USER and DEVELOPER from reading bug_reports directly
+-- via RLS bypass attempts (additional safety via trigger)
+CREATE OR REPLACE FUNCTION prevent_bug_report_read_bypass()
+RETURNS TRIGGER AS $$
+DECLARE
+    user_level INT;
+BEGIN
+    user_level := current_user_hierarchy_level();
+    IF user_level IS NULL OR user_level > 2 THEN
+        RAISE EXCEPTION 'ACCESS DENIED: Only ADMIN and SUPER_ADMIN can view bug reports.';
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;

database/migrations/run_all.sql

@@ -34,5 +34,11 @@ BEGIN;
 \echo '=== Running 009_settings.sql (Company Settings + User Preferences) ==='
 \i 009_settings.sql
 
+\echo '=== Running 013_security_upgrade.sql (Security Architecture: RLS, Encryption, Master Keys, Backups) ==='
+\i 013_security_upgrade.sql
+
+\echo '=== Running 014_bug_reports.sql (Bug Reporting System) ==='
+\i 014_bug_reports.sql
+
 \echo '=== Migration Complete ==='
 COMMIT;

package.json

@@ -5,7 +5,8 @@
   "scripts": {
     "dev": "npm run dev:precheck & npm run dev:ollama & npm run dev:start",
     "dev:signaling": "node signaling-server.mjs",
-    "dev:start": "concurrently -n AI,BROWSE,SIGNAL,NEXT -c cyan,magenta,yellow,green \"npm run dev:rust\" \"npm run dev:browser-use\" \"npm run dev:signaling\" \"npm run dev:next\"",
+    "dev:open": "powershell -NoProfile -Command \"Start-Sleep 8; Start-Process 'http://localhost:3001/splash'\"",
+    "dev:start": "concurrently -n AI,BROWSE,SIGNAL,NEXT,OPEN -c cyan,magenta,yellow,green,white \"npm run dev:rust\" \"npm run dev:browser-use\" \"npm run dev:signaling\" \"npm run dev:next\" \"npm run dev:open\"",
     "dev:next": "next dev -p 3006",
     "dev:precheck": "powershell -NoProfile -Command \"Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 3001,3006,3007,3008 } | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue; Write-Host ('Freed port '+$_.LocalPort) }\"",
     "dev:ollama": "powershell -NoProfile -Command \"$ollama = if (Get-Command ollama -ErrorAction SilentlyContinue) { 'ollama' } else { Join-Path $env:LOCALAPPDATA 'Programs\\Ollama\\ollama.exe' }; if (-not (Get-Process ollama -ErrorAction SilentlyContinue)) { Start-Process $ollama -ArgumentList 'serve' -WindowStyle Hidden; Start-Sleep 3 }; exit 0\"",

scripts/backup.ps1

@@ -0,0 +1,125 @@
+param(
+    [string]$BackupDir = "$PSScriptRoot\..\backups",
+    [int]$RetentionDays = 30
+)
+
+$ErrorActionPreference = "Stop"
+$startTime = Get-Date
+
+# Ensure backup directory exists
+if (-not (Test-Path $BackupDir)) {
+    New-Item -ItemType Directory -Path $BackupDir -Force | Out-Null
+}
+
+# Determine database URL from env or .env.local
+$dbUrl = $env:DATABASE_URL
+if (-not $dbUrl -and (Test-Path "$PSScriptRoot\..\.env.local")) {
+    $envContent = Get-Content "$PSScriptRoot\..\.env.local" -Raw
+    if ($envContent -match 'DATABASE_URL=(.+)') {
+        $dbUrl = $Matches[1].Trim()
+    }
+}
+
+if (-not $dbUrl) {
+    Write-Error "DATABASE_URL not found. Set it as an environment variable or in .env.local"
+    exit 1
+}
+
+# Parse the database URL
+$uri = [System.Uri]$dbUrl
+$pgUser = $uri.UserInfo.Split(':')[0]
+$pgPass = $uri.UserInfo.Split(':')[1]
+$pgHost = $uri.Host
+$pgPort = $uri.Port
+$pgDb = $uri.AbsolutePath.TrimStart('/')
+
+# Set PGPASSWORD for pg_dump
+$env:PGPASSWORD = $pgPass
+
+$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
+$filename = "crm_backup_$timestamp.sql"
+$filepath = Join-Path $BackupDir $filename
+
+Write-Output "Starting backup of database '$pgDb' to $filepath"
+Write-Output "Database: $pgHost:$pgPort/$pgDb"
+
+try {
+    # Run pg_dump
+    $pgDumpPath = if (Get-Command pg_dump -ErrorAction SilentlyContinue) {
+        "pg_dump"
+    } else {
+        "$env:TEMP\pg\pgsql\bin\pg_dump.exe"
+    }
+
+    $output = & $pgDumpPath -h $pgHost -p $pgPort -U $pgUser -d $pgDb --format=custom --verbose --file $filename 2>&1
+    $exitCode = $LASTEXITCODE
+
+    if ($exitCode -ne 0 -or -not (Test-Path $filename)) {
+        throw "pg_dump failed with exit code $exitCode"
+    }
+
+    Move-Item -Path $filename -Destination $filepath -Force
+    $fileInfo = Get-Item $filepath
+    $fileSize = $fileInfo.Length
+
+    # Verify backup by checking if file is valid custom format
+    $verifyOutput = & $pgDumpPath -h $pgHost -p $pgPort -U $pgUser -d $pgDb --format=custom --schema-only --file "$filename.verify" 2>&1
+    $verifyExitCode = $LASTEXITCODE
+    if (Test-Path "$filename.verify") { Remove-Item "$filename.verify" -Force }
+
+    $verificationStatus = if ($verifyExitCode -eq 0) { "verified" } else { "failed" }
+
+    # Calculate duration
+    $endTime = Get-Date
+    $durationSeconds = [math]::Round(($endTime - $startTime).TotalSeconds)
+
+    # Log the backup
+    $logQuery = @"
+INSERT INTO backup_logs (backup_type, status, file_name, file_size_bytes, pg_dump_exit_code, verification_status, started_at, completed_at, duration_seconds, retention_days)
+VALUES ('full', 'completed', '$filename', $fileSize, $exitCode, '$verificationStatus', '$($startTime.ToString("yyyy-MM-dd HH:mm:ss"))', '$($endTime.ToString("yyyy-MM-dd HH:mm:ss"))', $durationSeconds, $RetentionDays);
+"@
+
+    # Try to log to database (may fail if db is not reachable for logging, that's OK)
+    try {
+        $env:PGPASSWORD = $pgPass
+        & $env:TEMP\pg\pgsql\bin\psql.exe -h $pgHost -p $pgPort -U $pgUser -d $pgDb -c $logQuery 2>&1 | Out-Null
+    } catch {
+        Write-Warning "Could not log backup to database: $_"
+    }
+
+    Write-Output "Backup completed successfully:"
+    Write-Output "  File: $filename"
+    Write-Output "  Size: $([math]::Round($fileSize / 1MB, 2)) MB"
+    Write-Output "  Duration: ${durationSeconds}s"
+    Write-Output "  Status: $verificationStatus"
+
+    # Cleanup old backups (beyond retention period)
+    $cutoff = (Get-Date).AddDays(-$RetentionDays)
+    $oldBackups = Get-ChildItem $BackupDir -Filter "crm_backup_*.sql" | Where-Object {
+        $_.CreationTime -lt $cutoff
+    }
+    foreach ($old in $oldBackups) {
+        Remove-Item $old.FullName -Force
+        Write-Output "Removed old backup: $($old.Name)"
+    }
+
+} catch {
+    Write-Error "Backup failed: $_"
+
+    # Log failure
+    $endTime = Get-Date
+    $durationSeconds = [math]::Round(($endTime - $startTime).TotalSeconds)
+    $errorMsg = $_.ToString().Replace("'", "''")
+    $failQuery = @"
+INSERT INTO backup_logs (backup_type, status, file_name, error_message, pg_dump_exit_code, verification_status, started_at, completed_at, duration_seconds, retention_days)
+VALUES ('full', 'failed', '$filename', '$errorMsg', $exitCode, 'failed', '$($startTime.ToString("yyyy-MM-dd HH:mm:ss"))', '$($endTime.ToString("yyyy-MM-dd HH:mm:ss"))', $durationSeconds, $RetentionDays);
+"@
+    try {
+        $env:PGPASSWORD = $pgPass
+        & $env:TEMP\pg\pgsql\bin\psql.exe -h $pgHost -p $pgPort -U $pgUser -d $pgDb -c $failQuery 2>&1 | Out-Null
+    } catch {}
+
+    exit 1
+} finally {
+    Remove-Item "Env:PGPASSWORD" -ErrorAction SilentlyContinue
+}

splash.html

@@ -0,0 +1,453 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Loading CoastIT CRM</title>
+<style>
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body {
+    background: #0a0a1a;
+    min-height: 100vh;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    font-family: 'Segoe UI', system-ui, sans-serif;
+    color: #fff;
+    overflow: hidden;
+  }
+
+  /* Robot */
+  .robot {
+    position: relative;
+    width: 120px;
+    height: 160px;
+    margin-bottom: 40px;
+    animation: float 2s ease-in-out infinite;
+  }
+  @keyframes float {
+    0%, 100% { transform: translateY(0); }
+    50% { transform: translateY(-12px); }
+  }
+
+  .robot-head {
+    width: 70px;
+    height: 60px;
+    background: linear-gradient(135deg, #6366f1, #8b5cf6);
+    border-radius: 16px 16px 8px 8px;
+    margin: 0 auto 4px;
+    position: relative;
+    animation: bob 0.6s ease-in-out infinite alternate;
+    box-shadow: 0 0 30px rgba(99,102,241,0.3);
+  }
+  @keyframes bob {
+    0% { transform: rotate(-3deg); }
+    100% { transform: rotate(3deg); }
+  }
+
+  .robot-eye {
+    position: absolute;
+    width: 10px;
+    height: 10px;
+    background: #22d3ee;
+    border-radius: 50%;
+    top: 20px;
+    box-shadow: 0 0 8px #22d3ee;
+    animation: blink 3s infinite;
+  }
+  .robot-eye.left { left: 16px; }
+  .robot-eye.right { right: 16px; }
+  @keyframes blink {
+    0%, 94%, 100% { transform: scaleY(1); }
+    97% { transform: scaleY(0.1); }
+  }
+
+  .robot-antenna {
+    width: 4px;
+    height: 12px;
+    background: #8b5cf6;
+    margin: -10px auto 0;
+    border-radius: 2px;
+    animation: antenna-pulse 1s ease-in-out infinite;
+  }
+  .robot-antenna::after {
+    content: '';
+    display: block;
+    width: 8px;
+    height: 8px;
+    background: #22d3ee;
+    border-radius: 50%;
+    margin: -2px auto 0;
+    box-shadow: 0 0 10px #22d3ee;
+  }
+  @keyframes antenna-pulse {
+    0%, 100% { opacity: 0.7; }
+    50% { opacity: 1; }
+  }
+
+  .robot-body {
+    width: 60px;
+    height: 50px;
+    background: linear-gradient(135deg, #4f46e5, #7c3aed);
+    border-radius: 6px;
+    margin: 0 auto;
+    position: relative;
+    box-shadow: 0 0 20px rgba(99,102,241,0.2);
+  }
+
+  .robot-arm {
+    position: absolute;
+    width: 12px;
+    height: 36px;
+    background: #6366f1;
+    border-radius: 6px;
+    top: 6px;
+    animation: swing 0.8s ease-in-out infinite alternate;
+  }
+  .robot-arm.left { left: -16px; transform-origin: top center; }
+  .robot-arm.right { right: -16px; transform-origin: top center; animation-delay: 0.4s; }
+  @keyframes swing {
+    0% { transform: rotate(-25deg); }
+    100% { transform: rotate(25deg); }
+  }
+
+  .robot-leg {
+    position: absolute;
+    width: 14px;
+    height: 30px;
+    background: #4f46e5;
+    border-radius: 4px;
+    bottom: -28px;
+    animation: step 0.6s ease-in-out infinite alternate;
+  }
+  .robot-leg.left { left: 8px; }
+  .robot-leg.right { right: 8px; animation-delay: 0.3s; }
+  @keyframes step {
+    0% { transform: translateY(0) rotate(-8deg); }
+    100% { transform: translateY(-4px) rotate(8deg); }
+  }
+
+  /* Status indicators */
+  .services {
+    display: flex;
+    flex-direction: column;
+    gap: 12px;
+    margin-bottom: 32px;
+    min-width: 300px;
+  }
+  .service {
+    display: flex;
+    align-items: center;
+    gap: 12px;
+    padding: 10px 16px;
+    background: rgba(255,255,255,0.04);
+    border-radius: 10px;
+    border: 1px solid rgba(255,255,255,0.06);
+    transition: all 0.3s;
+  }
+  .service.ready {
+    border-color: rgba(34,211,238,0.3);
+    background: rgba(34,211,238,0.06);
+  }
+  .service.failed {
+    border-color: rgba(239,68,68,0.3);
+    background: rgba(239,68,68,0.06);
+  }
+
+  .service-name {
+    flex: 1;
+    font-size: 14px;
+    font-weight: 500;
+    opacity: 0.7;
+  }
+  .service.ready .service-name {
+    opacity: 1;
+    color: #22d3ee;
+  }
+  .service.failed .service-name {
+    opacity: 1;
+    color: #ef4444;
+  }
+
+  .status-dots {
+    display: flex;
+    gap: 5px;
+  }
+  .status-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    background: rgba(255,255,255,0.1);
+    transition: all 0.4s;
+  }
+  .service.ready .status-dot {
+    background: #22d3ee;
+    box-shadow: 0 0 6px rgba(34,211,238,0.5);
+  }
+  .service.failed .status-dot {
+    background: #ef4444;
+    box-shadow: 0 0 6px rgba(239,68,68,0.5);
+  }
+  .status-dot:nth-child(2) { transition-delay: 0.1s; }
+  .status-dot:nth-child(3) { transition-delay: 0.2s; }
+
+  .status-text {
+    font-size: 11px;
+    opacity: 0.4;
+    min-width: 50px;
+    text-align: right;
+  }
+  .service.ready .status-text {
+    opacity: 0.8;
+    color: #22d3ee;
+  }
+  .service.failed .status-text {
+    opacity: 0.8;
+    color: #ef4444;
+  }
+
+  /* Loading text */
+  .loading-text {
+    font-size: 16px;
+    font-weight: 600;
+    background: linear-gradient(135deg, #6366f1, #22d3ee);
+    -webkit-background-clip: text;
+    -webkit-text-fill-color: transparent;
+    background-clip: text;
+    animation: pulse-text 2s ease-in-out infinite;
+  }
+  @keyframes pulse-text {
+    0%, 100% { opacity: 0.6; }
+    50% { opacity: 1; }
+  }
+
+  /* Launch gear (inline, below everything) */
+  .launch-overlay {
+    display: none;
+    flex-direction: column;
+    align-items: center;
+    gap: 16px;
+    margin-top: 8px;
+  }
+  .launch-overlay.active {
+    display: flex;
+  }
+  .launch-gear {
+    width: 80px;
+    height: 80px;
+    border: 4px solid #6366f1;
+    border-top-color: #22d3ee;
+    border-radius: 50%;
+    animation: spin 0.8s linear infinite;
+  }
+  @keyframes spin {
+    to { transform: rotate(360deg); }
+  }
+  .launch-text {
+    font-size: 20px;
+    font-weight: 700;
+    color: #22d3ee;
+    animation: scale-in 0.5s ease-out;
+  }
+  @keyframes scale-in {
+    0% { transform: scale(0.5); opacity: 0; }
+    100% { transform: scale(1); opacity: 1; }
+  }
+
+  /* Error state */
+  .loading-text.error {
+    background: linear-gradient(135deg, #ef4444, #f97316);
+    -webkit-background-clip: text;
+    -webkit-text-fill-color: transparent;
+    background-clip: text;
+  }
+
+  .error-msg {
+    display: none;
+    font-size: 13px;
+    color: #ef4444;
+    margin-top: 4px;
+    text-align: center;
+  }
+  .error-msg.active {
+    display: block;
+  }
+
+  .retry-btn {
+    display: none;
+    margin-top: 12px;
+    padding: 8px 24px;
+    background: linear-gradient(135deg, #6366f1, #8b5cf6);
+    border: none;
+    border-radius: 8px;
+    color: #fff;
+    font-size: 14px;
+    font-weight: 600;
+    cursor: pointer;
+    transition: opacity 0.2s;
+  }
+  .retry-btn:hover {
+    opacity: 0.85;
+  }
+  .retry-btn.active {
+    display: inline-block;
+  }
+</style>
+</head>
+<body>
+
+  <!-- Robot -->
+  <div class="robot">
+    <div class="robot-antenna"></div>
+    <div class="robot-head">
+      <div class="robot-eye left"></div>
+      <div class="robot-eye right"></div>
+    </div>
+    <div class="robot-body">
+      <div class="robot-arm left"></div>
+      <div class="robot-arm right"></div>
+      <div class="robot-leg left"></div>
+      <div class="robot-leg right"></div>
+    </div>
+  </div>
+
+  <!-- Services -->
+  <div class="services">
+    <div class="service" id="svc-ai">
+      <span class="service-name">AI Server</span>
+      <div class="status-dots">
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+      </div>
+      <span class="status-text" id="status-ai">waiting...</span>
+    </div>
+    <div class="service" id="svc-scraper">
+      <span class="service-name">Scraper</span>
+      <div class="status-dots">
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+      </div>
+      <span class="status-text" id="status-scraper">waiting...</span>
+    </div>
+    <div class="service" id="svc-frontend">
+      <span class="service-name">Frontend</span>
+      <div class="status-dots">
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+        <div class="status-dot"></div>
+      </div>
+      <span class="status-text" id="status-frontend">waiting...</span>
+    </div>
+  </div>
+
+  <div class="loading-text" id="loading-text">Loading...</div>
+
+  <!-- Launch gear (inline, below everything) -->
+  <div class="launch-overlay" id="launch-overlay">
+    <div class="launch-gear"></div>
+    <div class="launch-text">🚀 Launching gear!</div>
+  </div>
+
+  <div class="error-msg" id="error-msg"></div>
+  <button class="retry-btn" id="retry-btn" onclick="location.reload()">Try Again</button>
+
+<script>
+const MAX_ATTEMPTS = 30;
+let attempts = 0;
+
+const CHECKS = [
+  { id: 'ai',      key: 'ai',       ready: false, failed: false },
+  { id: 'scraper', key: 'scraper',  ready: false, failed: false },
+  { id: 'frontend',key: 'frontend', ready: false, failed: false },
+];
+
+const MSGS = { ai: 'AI Ready', scraper: 'Scraper Ready', frontend: 'Frontend Ready' };
+const NAMES = { ai: 'AI Server', scraper: 'Scraper', frontend: 'Frontend' };
+
+async function checkAllServices() {
+  try {
+    const res = await fetch('/status', { cache: 'no-store' });
+    const data = await res.json();
+    for (const svc of CHECKS) {
+      svc.ready = data[svc.key] === true;
+    }
+  } catch {
+    for (const svc of CHECKS) svc.ready = false;
+  }
+}
+
+function updateUI() {
+  let allReady = true;
+  let anyFailed = false;
+  const failedNames = [];
+
+  for (const svc of CHECKS) {
+    const el = document.getElementById('svc-' + svc.id);
+    const statusText = document.getElementById('status-' + svc.id);
+    el.classList.remove('ready', 'failed');
+
+    if (svc.ready) {
+      el.classList.add('ready');
+      statusText.textContent = MSGS[svc.id];
+    } else if (svc.failed) {
+      el.classList.add('failed');
+      statusText.textContent = 'Failed';
+      anyFailed = true;
+      allReady = false;
+      failedNames.push(NAMES[svc.id]);
+    } else {
+      statusText.textContent = 'waiting...';
+      allReady = false;
+    }
+  }
+
+  const loadingText = document.getElementById('loading-text');
+  const errorMsg = document.getElementById('error-msg');
+  const retryBtn = document.getElementById('retry-btn');
+
+  if (anyFailed) {
+    loadingText.className = 'loading-text error';
+    loadingText.textContent = 'Something went wrong';
+    errorMsg.textContent = failedNames.join(', ') + ' failed to start. Check your terminal for details.';
+    errorMsg.classList.add('active');
+    retryBtn.classList.add('active');
+    document.getElementById('launch-overlay').classList.remove('active');
+  } else if (allReady) {
+    loadingText.className = 'loading-text';
+    loadingText.textContent = 'All systems ready!';
+    errorMsg.classList.remove('active');
+    retryBtn.classList.remove('active');
+    document.getElementById('launch-overlay').classList.add('active');
+    setTimeout(() => { window.location.href = 'http://localhost:3006/login'; }, 5000);
+  } else {
+    loadingText.className = 'loading-text';
+    const ready = CHECKS.filter(s => s.ready).length;
+    loadingText.textContent = `Loading... (${ready}/${CHECKS.length})`;
+  }
+}
+
+async function poll() {
+  attempts++;
+  if (attempts > MAX_ATTEMPTS) {
+    for (const svc of CHECKS) {
+      if (!svc.ready) svc.failed = true;
+    }
+    updateUI();
+    return;
+  }
+
+  await checkAllServices();
+  updateUI();
+
+  if (!CHECKS.every(s => s.ready) && !CHECKS.some(s => s.failed)) {
+    setTimeout(poll, 2000);
+  }
+}
+
+poll();
+</script>
+</body>
+</html>

src/app/api/auth/login/route.ts

@@ -9,6 +9,7 @@ import {
   resetFailedAttempts,
   isAccountLocked,
   createSession,
+  setSessionContext,
 } from "@/lib/auth"
 
 export async function POST(request: NextRequest) {
@@ -106,6 +107,7 @@ export async function POST(request: NextRequest) {
     )
 
     await createSession(dbUser.id, dbUser.role_name)
+    await setSessionContext(dbUser.id, ipAddress)
 
     const user = mapDbUserToSessionUser(dbUser)
 

src/app/api/auth/recover/route.ts

@@ -0,0 +1,64 @@
+import { NextRequest, NextResponse } from "next/server"
+import {
+  getSessionUser,
+  decryptPassword,
+  setSessionContext,
+} from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only SUPER_ADMIN can recover passwords." }, { status: 403 })
+    }
+
+    const { userId } = await request.json()
+    if (!userId) {
+      return NextResponse.json({ error: "userId is required." }, { status: 400 })
+    }
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const result = await query(
+      `SELECT id, username, email, first_name, last_name, password_encrypted
+       FROM users WHERE id = $1 AND deleted_at IS NULL`,
+      [userId]
+    )
+
+    const user = result.rows[0]
+    if (!user) {
+      return NextResponse.json({ error: "User not found." }, { status: 404 })
+    }
+
+    if (!user.password_encrypted) {
+      return NextResponse.json({ error: "No encrypted password stored for this user." }, { status: 404 })
+    }
+
+    const plaintextPassword = await decryptPassword(user.password_encrypted)
+    if (!plaintextPassword) {
+      return NextResponse.json({ error: "Failed to decrypt password. Master key may have changed." }, { status: 500 })
+    }
+
+    return NextResponse.json({
+      user: {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+        name: `${user.first_name} ${user.last_name}`,
+      },
+      password: plaintextPassword,
+    }, { status: 200 })
+  } catch (error) {
+    console.error("Password recovery error:", error)
+    return NextResponse.json({ error: "Recovery service unavailable." }, { status: 503 })
+  }
+}

src/app/api/bug-reports/[id]/route.ts

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser, setSessionContext } from "@/lib/auth"
+
+export async function PATCH(request: NextRequest, { params: routeParams }: { params: Promise<{ id: string }> }) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden. Only admins can update bug reports." }, { status: 403 })
+    }
+
+    const { id } = await routeParams
+    const { status, assigned_to, resolution_notes } = await request.json()
+
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const validStatuses = ["open", "in_progress", "resolved", "closed"]
+    if (status && !validStatuses.includes(status)) {
+      return NextResponse.json({ error: "Invalid status." }, { status: 400 })
+    }
+
+    const existing = await query("SELECT id, status FROM bug_reports WHERE id = $1", [id])
+    if (existing.rows.length === 0) {
+      return NextResponse.json({ error: "Bug report not found." }, { status: 404 })
+    }
+
+    const updates: string[] = []
+    const values: unknown[] = []
+    let paramIndex = 1
+
+    if (status !== undefined) {
+      updates.push(`status = $${paramIndex++}`)
+      values.push(status)
+    }
+    if (assigned_to !== undefined) {
+      updates.push(`assigned_to = $${paramIndex++}`)
+      values.push(assigned_to === "null" ? null : assigned_to)
+    }
+    if (resolution_notes !== undefined) {
+      updates.push(`resolution_notes = $${paramIndex++}`)
+      values.push(resolution_notes)
+    }
+
+    if (updates.length === 0) {
+      return NextResponse.json({ error: "No fields to update." }, { status: 400 })
+    }
+
+    updates.push(`updated_at = NOW()`)
+    values.push(id)
+
+    await query(
+      `UPDATE bug_reports SET ${updates.join(", ")} WHERE id = $${paramIndex}`,
+      values
+    )
+
+    return NextResponse.json({ success: true }, { status: 200 })
+  } catch (error) {
+    console.error("Error updating bug report:", error)
+    return NextResponse.json({ error: "Failed to update bug report." }, { status: 500 })
+  }
+}

src/app/api/bug-reports/route.ts

@@ -0,0 +1,118 @@
+import { NextRequest, NextResponse } from "next/server"
+import { query } from "@/lib/db"
+import { getSessionUser } from "@/lib/auth"
+
+export async function POST(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+
+    const { title, description, severity, page_url, screenshot_url } = await request.json()
+
+    if (!title || !description) {
+      return NextResponse.json({ error: "Title and description are required." }, { status: 400 })
+    }
+
+    const validSeverities = ["low", "medium", "high", "critical"]
+    if (severity && !validSeverities.includes(severity)) {
+      return NextResponse.json({ error: "Invalid severity." }, { status: 400 })
+    }
+
+    const result = await query(
+      `INSERT INTO bug_reports (reported_by, title, description, severity, page_url, screenshot_url)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       RETURNING id, created_at`,
+      [sessionUser.id, title, description, severity || "medium", page_url || null, screenshot_url || null]
+    )
+
+    return NextResponse.json({
+      success: true,
+      id: result.rows[0].id,
+      created_at: result.rows[0].created_at,
+    }, { status: 201 })
+  } catch (error) {
+    console.error("Error creating bug report:", error)
+    return NextResponse.json({ error: "Failed to submit bug report." }, { status: 500 })
+  }
+}
+
+export async function GET(request: NextRequest) {
+  try {
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
+    }
+    if (sessionUser.role !== "admin" && sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Forbidden. Only admins can view bug reports." }, { status: 403 })
+    }
+
+    const { searchParams } = new URL(request.url)
+    const status = searchParams.get("status")
+    const severity = searchParams.get("severity")
+    const limit = parseInt(searchParams.get("limit") || "50", 10)
+    const offset = parseInt(searchParams.get("offset") || "0", 10)
+
+    let sql = `SELECT br.id, br.title, br.description, br.severity, br.page_url,
+                      br.screenshot_url, br.status, br.resolution_notes,
+                      br.created_at, br.updated_at,
+                      reporter.id AS reporter_id,
+                      reporter.first_name AS reporter_first_name,
+                      reporter.last_name AS reporter_last_name,
+                      reporter.email AS reporter_email,
+                      assignee.id AS assignee_id,
+                      assignee.first_name AS assignee_first_name,
+                      assignee.last_name AS assignee_last_name
+               FROM bug_reports br
+               JOIN users reporter ON reporter.id = br.reported_by
+               LEFT JOIN users assignee ON assignee.id = br.assigned_to`
+    const params: unknown[] = []
+    const conditions: string[] = []
+
+    if (status) {
+      conditions.push(`br.status = $${params.length + 1}`)
+      params.push(status)
+    }
+    if (severity) {
+      conditions.push(`br.severity = $${params.length + 1}`)
+      params.push(severity)
+    }
+
+    if (conditions.length > 0) {
+      sql += " WHERE " + conditions.join(" AND ")
+    }
+
+    sql += " ORDER BY br.created_at DESC LIMIT $" + (params.length + 1) + " OFFSET $" + (params.length + 2)
+    params.push(limit, offset)
+
+    const result = await query(sql, params)
+
+    const reports = result.rows.map((row: any) => ({
+      id: row.id,
+      title: row.title,
+      description: row.description,
+      severity: row.severity,
+      page_url: row.page_url,
+      screenshot_url: row.screenshot_url,
+      status: row.status,
+      resolution_notes: row.resolution_notes,
+      created_at: row.created_at,
+      updated_at: row.updated_at,
+      reporter: {
+        id: row.reporter_id,
+        name: `${row.reporter_first_name} ${row.reporter_last_name}`,
+        email: row.reporter_email,
+      },
+      assignee: row.assignee_id ? {
+        id: row.assignee_id,
+        name: `${row.assignee_first_name} ${row.assignee_last_name}`,
+      } : null,
+    }))
+
+    return NextResponse.json({ reports }, { status: 200 })
+  } catch (error) {
+    console.error("Error fetching bug reports:", error)
+    return NextResponse.json({ error: "Failed to fetch bug reports." }, { status: 500 })
+  }
+}

src/app/api/settings/website-theme/route.ts

@@ -0,0 +1,41 @@
+import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
+import { query } from "@/lib/db"
+
+export async function GET() {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const result = await query(
+      `SELECT preferences->>'website_theme' AS website_theme FROM users WHERE id = $1`,
+      [user.id],
+    )
+
+    const websiteTheme = result.rows[0]?.website_theme || "spidey"
+    return NextResponse.json({ websiteTheme })
+  } catch (error) {
+    console.error("Website theme GET error:", error)
+    return NextResponse.json({ error: "Failed to load website theme" }, { status: 500 })
+  }
+}
+
+export async function PUT(request: NextRequest) {
+  try {
+    const user = await getSessionUser()
+    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+
+    const body = await request.json()
+    const theme = body.websiteTheme || "spidey"
+
+    await query(
+      `UPDATE users SET preferences = preferences || $2::jsonb WHERE id = $1`,
+      [user.id, JSON.stringify({ website_theme: theme })],
+    )
+
+    return NextResponse.json({ success: true, websiteTheme: theme })
+  } catch (error) {
+    console.error("Website theme PUT error:", error)
+    return NextResponse.json({ error: "Failed to save website theme" }, { status: 500 })
+  }
+}

src/app/api/users/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { query } from "@/lib/db"
-import { hashPassword, getSessionUser } from "@/lib/auth"
+import { hashPassword, getSessionUser, encryptPassword, setSessionContext } from "@/lib/auth"
 import { avatarSvgUrl } from "@/lib/avatar"
 
 export async function GET(request: NextRequest) {
@@ -63,17 +63,20 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Invalid role" }, { status: 400 })
     }
 
+    await setSessionContext(sessionUser.id)
+
     const nameParts = name.trim().split(/\s+/)
     const firstName = nameParts[0]
     const lastName = nameParts.slice(1).join(" ") || firstName
     const username = email.split("@")[0]
     const passwordHash = await hashPassword(password)
+    const passwordEncrypted = await encryptPassword(password)
 
     const result = await query(
-      `INSERT INTO users (username, email, password_hash, first_name, last_name, is_active, created_by)
+      `INSERT INTO users (username, email, password_hash, password_encrypted, first_name, last_name, is_active, created_by)
-       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
        RETURNING id`,
-      [username.toLowerCase(), email.toLowerCase(), passwordHash, firstName, lastName, active ?? true, sessionUser.id]
+      [username.toLowerCase(), email.toLowerCase(), passwordHash, passwordEncrypted, firstName, lastName, active ?? true, sessionUser.id]
     )
 
     const roleId = (

src/app/layout.tsx

@@ -1,6 +1,7 @@
 import type { Metadata, Viewport } from "next"
 import { Inter } from "next/font/google"
 import { ThemeProvider } from "@/providers/theme-provider"
+import { WebsiteThemeProvider } from "@/providers/website-theme-provider"
 import { Toaster } from "@/components/ui/sonner"
 import "./globals.css"
 
@@ -31,8 +32,10 @@ export default function RootLayout({
     <html lang="en" suppressHydrationWarning>
       <body className={`${inter.variable} min-h-screen antialiased`}>
         <ThemeProvider attribute="class" defaultTheme="dark" disableTransitionOnChange>
-          {children}
+          <WebsiteThemeProvider>
-          <Toaster />
+            {children}
+            <Toaster />
+          </WebsiteThemeProvider>
         </ThemeProvider>
       </body>
     </html>

src/components/layout/topbar.tsx

@@ -9,6 +9,7 @@ import { Input } from "@/components/ui/input";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { useUser } from "@/providers/user-provider";
 import { useNotifications } from "@/providers/notification-provider";
+import { BugReportModal } from "@/components/shared/bug-report-modal";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -27,6 +28,7 @@ import {
   LogOut,
   User,
   Settings,
+  Bug,
   CheckCheck,
   Trash2,
 } from "lucide-react";
@@ -43,6 +45,7 @@ export function Topbar({ onMenuClick }: TopbarProps) {
     useNotifications();
   const [mounted, setMounted] = useState(false);
   const [searchOpen, setSearchOpen] = useState(false);
+  const [bugModalOpen, setBugModalOpen] = useState(false);
 
   useEffect(() => {
     setMounted(true);
@@ -113,6 +116,17 @@ export function Topbar({ onMenuClick }: TopbarProps) {
           <Search className="h-5 w-5" />
         </Button>
 
+        {/* Report a Bug */}
+        <Button
+          variant="ghost"
+          size="icon"
+          onClick={() => setBugModalOpen(true)}
+          className="text-muted-foreground"
+          title="Report a Bug"
+        >
+          <Bug className="h-5 w-5" />
+        </Button>
+
         {/* Theme toggle */}
         <Button
           variant="ghost"
@@ -247,6 +261,7 @@ export function Topbar({ onMenuClick }: TopbarProps) {
           </DropdownMenuContent>
         </DropdownMenu>
       </div>
+      <BugReportModal open={bugModalOpen} onClose={() => setBugModalOpen(false)} />
     </header>
   );
 }

src/components/settings/theme-settings.tsx

@@ -6,7 +6,8 @@ import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/com
 import { Label } from "@/components/ui/label"
 import { RadioGroup, RadioGroupItem } from "@/components/ui/radio-group"
 import { cn } from "@/lib/utils"
-import { Sun, Moon, Monitor } from "lucide-react"
+import { useWebsiteTheme } from "@/providers/website-theme-provider"
+import { Sun, Moon, Monitor, Check } from "lucide-react"
 
 const COLOR_THEME_KEY = "crm-color-theme"
 
@@ -44,8 +45,17 @@ function applyColorTheme(theme: string) {
   localStorage.setItem(COLOR_THEME_KEY, theme)
 }
 
+const websiteThemes = [
+  {
+    id: "spidey",
+    name: "Spidey",
+    description: "Current website theme",
+  },
+]
+
 export function ThemeSettings() {
   const { theme, setTheme } = useTheme()
+  const { websiteTheme, setWebsiteTheme } = useWebsiteTheme()
   const [colorTheme, setColorTheme] = useState("default")
   const [mounted, setMounted] = useState(false)
 
@@ -119,6 +129,71 @@ export function ThemeSettings() {
           </RadioGroup>
         </CardContent>
       </Card>
+
+      <Card>
+        <CardHeader>
+          <CardTitle>Website Themes</CardTitle>
+          <CardDescription>
+            Select your website&apos;s visual theme.
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <div className="grid grid-cols-2 gap-4 sm:grid-cols-3 md:grid-cols-4">
+            {websiteThemes.map((wt) => {
+              const isActive = websiteTheme === wt.id
+              return (
+                <button
+                  key={wt.id}
+                  type="button"
+                  onClick={() => setWebsiteTheme(wt.id)}
+                  className={cn(
+                    "group relative flex flex-col items-start gap-3 rounded-xl border-2 p-4 text-left transition-all",
+                    "hover:bg-accent cursor-pointer",
+                    isActive
+                      ? "border-primary bg-primary/5 shadow-sm"
+                      : "border-border hover:border-muted-foreground/30"
+                  )}
+                >
+                  {isActive && (
+                    <span className="absolute right-2 top-2 flex h-5 w-5 items-center justify-center rounded-full bg-primary text-[10px] text-primary-foreground">
+                      <Check className="h-3 w-3" />
+                    </span>
+                  )}
+
+                  <div className="flex h-20 w-full items-center justify-center overflow-hidden rounded-lg border border-border bg-background">
+                    <div className="flex h-full w-full">
+                      <div className="flex w-1/3 flex-col gap-0.5 bg-[#0a0a0f] p-1.5">
+                        <div className="h-1 w-full rounded-sm bg-[#1a1a24]" />
+                        <div className="h-1 w-2/3 rounded-sm bg-[#1a1a24]" />
+                        <div className="mt-auto h-1.5 w-full rounded-sm bg-[#1a1a24]" />
+                      </div>
+                      <div className="flex flex-1 flex-col">
+                        <div className="flex h-5 items-center gap-1 bg-[#CC0000] px-1.5">
+                          <div className="h-1.5 w-1.5 rounded-full bg-white/30" />
+                          <div className="h-1.5 w-1.5 rounded-full bg-white/30" />
+                          <div className="h-1.5 w-1.5 rounded-full bg-white/30" />
+                        </div>
+                        <div className="flex flex-1 items-center justify-center bg-[#141414]">
+                          <div className="h-2 w-2 rounded-full bg-[#CC0000]/40" />
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+
+                  <div className="flex w-full items-center justify-between gap-2">
+                    <span className="text-sm font-medium">{wt.name}</span>
+                    {isActive && (
+                      <span className="rounded-full bg-primary/10 px-2 py-0.5 text-[10px] font-semibold text-primary">
+                        Current
+                      </span>
+                    )}
+                  </div>
+                </button>
+              )
+            })}
+          </div>
+        </CardContent>
+      </Card>
     </div>
   )
 }

src/components/shared/bug-report-modal.tsx

@@ -0,0 +1,188 @@
+"use client"
+
+import { useState } from "react"
+import { motion, AnimatePresence } from "framer-motion"
+import { X, Bug, Loader2, CheckCircle } from "lucide-react"
+
+interface BugReportModalProps {
+  open: boolean
+  onClose: () => void
+}
+
+export function BugReportModal({ open, onClose }: BugReportModalProps) {
+  const [title, setTitle] = useState("")
+  const [description, setDescription] = useState("")
+  const [severity, setSeverity] = useState("medium")
+  const [loading, setLoading] = useState(false)
+  const [submitted, setSubmitted] = useState(false)
+  const [error, setError] = useState("")
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault()
+    setError("")
+    setLoading(true)
+
+    try {
+      const res = await fetch("/api/bug-reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          title,
+          description,
+          severity,
+          page_url: window.location.href,
+        }),
+      })
+
+      if (res.ok) {
+        setSubmitted(true)
+        setTitle("")
+        setDescription("")
+        setSeverity("medium")
+      } else {
+        const data = await res.json().catch(() => ({}))
+        setError(data.error || "Failed to submit bug report.")
+      }
+    } catch {
+      setError("Connection error. Please try again.")
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  const handleClose = () => {
+    setSubmitted(false)
+    setError("")
+    onClose()
+  }
+
+  return (
+    <AnimatePresence>
+      {open && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4">
+          <motion.div
+            initial={{ opacity: 0 }}
+            animate={{ opacity: 1 }}
+            exit={{ opacity: 0 }}
+            className="absolute inset-0 bg-black/60 backdrop-blur-sm"
+            onClick={handleClose}
+          />
+          <motion.div
+            initial={{ opacity: 0, scale: 0.95, y: 10 }}
+            animate={{ opacity: 1, scale: 1, y: 0 }}
+            exit={{ opacity: 0, scale: 0.95, y: 10 }}
+            className="relative w-full max-w-md rounded-xl border bg-white dark:bg-[#141414] p-6 shadow-2xl"
+          >
+            <button
+              onClick={handleClose}
+              className="absolute right-4 top-4 text-[#888888] hover:text-[#111111] dark:hover:text-white transition-colors"
+            >
+              <X className="h-5 w-5" />
+            </button>
+
+            {submitted ? (
+              <div className="flex flex-col items-center py-8 text-center">
+                <CheckCircle className="h-12 w-12 text-emerald-500 mb-4" />
+                <h3 className="text-lg font-semibold text-[#111111] dark:text-white mb-2">
+                  Bug Report Submitted
+                </h3>
+                <p className="text-sm text-[#666666] dark:text-[#AAAAAA]">
+                  Thank you for your report. The development team will investigate.
+                </p>
+                <button
+                  onClick={handleClose}
+                  className="mt-6 rounded-lg bg-[#CC0000] px-6 py-2 text-sm font-medium text-white hover:bg-[#AA0000] transition-colors"
+                >
+                  Done
+                </button>
+              </div>
+            ) : (
+              <>
+                <div className="flex items-center gap-3 mb-6">
+                  <div className="flex h-10 w-10 items-center justify-center rounded-lg bg-red-100 dark:bg-red-900/30">
+                    <Bug className="h-5 w-5 text-[#CC0000]" />
+                  </div>
+                  <div>
+                    <h3 className="text-lg font-semibold text-[#111111] dark:text-white">
+                      Report a Bug
+                    </h3>
+                    <p className="text-xs text-[#666666] dark:text-[#AAAAAA]">
+                      Help us improve the system
+                    </p>
+                  </div>
+                </div>
+
+                {error && (
+                  <div className="mb-4 rounded-lg bg-red-500/10 px-4 py-2 text-sm text-red-500">
+                    {error}
+                  </div>
+                )}
+
+                <form onSubmit={handleSubmit} className="space-y-4">
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Title <span className="text-[#CC0000]">*</span>
+                    </label>
+                    <input
+                      type="text"
+                      value={title}
+                      onChange={(e) => setTitle(e.target.value)}
+                      placeholder="Brief description of the issue"
+                      required
+                      className="w-full rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white placeholder-[#999999] focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    />
+                  </div>
+
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Description <span className="text-[#CC0000]">*</span>
+                    </label>
+                    <textarea
+                      value={description}
+                      onChange={(e) => setDescription(e.target.value)}
+                      placeholder="What happened? What did you expect?"
+                      rows={4}
+                      required
+                      className="w-full resize-none rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white placeholder-[#999999] focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    />
+                  </div>
+
+                  <div>
+                    <label className="mb-1.5 block text-sm font-medium text-[#444444] dark:text-[#CCCCCC]">
+                      Severity
+                    </label>
+                    <select
+                      value={severity}
+                      onChange={(e) => setSeverity(e.target.value)}
+                      className="w-full rounded-lg border border-[#E0E0E0] dark:border-[#333333] bg-white dark:bg-[#1E1E1E] px-3 py-2 text-sm text-[#111111] dark:text-white focus:border-[#CC0000] focus:outline-none focus:ring-1 focus:ring-[#CC0000]"
+                    >
+                      <option value="low">Low — Minor cosmetic issue</option>
+                      <option value="medium">Medium — Affects functionality</option>
+                      <option value="high">High — Major feature broken</option>
+                      <option value="critical">Critical — System is blocked</option>
+                    </select>
+                  </div>
+
+                  <div className="rounded-lg bg-[#F5F5F5] dark:bg-[#1A1A1A] px-3 py-2">
+                    <p className="text-xs text-[#888888]">
+                      <span className="font-medium">Page:</span> {typeof window !== "undefined" ? window.location.href : ""}
+                    </p>
+                  </div>
+
+                  <button
+                    type="submit"
+                    disabled={loading}
+                    className="flex w-full items-center justify-center gap-2 rounded-lg bg-[#CC0000] px-4 py-2.5 text-sm font-medium text-white hover:bg-[#AA0000] disabled:opacity-50 transition-colors"
+                  >
+                    {loading && <Loader2 className="h-4 w-4 animate-spin" />}
+                    {loading ? "Submitting..." : "Submit Bug Report"}
+                  </button>
+                </form>
+              </>
+            )}
+          </motion.div>
+        </div>
+      )}
+    </AnimatePresence>
+  )
+}

src/lib/auth.ts

@@ -194,6 +194,27 @@ export function mapDbUserToSessionUser(
   };
 }
 
+export async function encryptPassword(password: string): Promise<string> {
+  const result = await query("SELECT encrypt_password($1) AS encrypted", [password]);
+  return result.rows[0]?.encrypted;
+}
+
+export async function decryptPassword(encrypted: string): Promise<string | null> {
+  try {
+    const result = await query("SELECT decrypt_password($1) AS decrypted", [encrypted]);
+    return result.rows[0]?.decrypted || null;
+  } catch {
+    return null;
+  }
+}
+
+export async function setSessionContext(userId: string, ip?: string) {
+  await query("SELECT set_config('app.current_user_id', $1, true)", [userId]);
+  if (ip) {
+    await query("SELECT set_config('app.current_ip', $1, true)", [ip]);
+  }
+}
+
 export async function createSession(userId: string, role: string) {
   const token = await signToken({ userId, role });
 

src/providers/website-theme-provider.tsx

@@ -0,0 +1,92 @@
+"use client"
+
+import { createContext, useContext, useState, useEffect, ReactNode, useCallback } from "react"
+
+const WEBSITE_THEME_KEY = "crm-website-theme"
+
+const themeClasses: Record<string, string> = {
+  spidey: "",
+}
+
+interface WebsiteThemeContextValue {
+  websiteTheme: string
+  setWebsiteTheme: (theme: string) => Promise<void>
+  loading: boolean
+}
+
+const WebsiteThemeContext = createContext<WebsiteThemeContextValue | null>(null)
+
+function applyWebsiteTheme(theme: string) {
+  const prefix = "theme-"
+  const root = document.documentElement
+  const classes = root.className.split(" ").filter((c) => !c.startsWith(prefix))
+  const cls = themeClasses[theme]
+  if (cls) {
+    classes.push(cls)
+  }
+  root.className = classes.join(" ").trim()
+}
+
+function getStoredTheme(): string | null {
+  if (typeof window === "undefined") return null
+  return localStorage.getItem(WEBSITE_THEME_KEY)
+}
+
+function storeTheme(theme: string) {
+  if (typeof window === "undefined") return
+  localStorage.setItem(WEBSITE_THEME_KEY, theme)
+}
+
+export function WebsiteThemeProvider({ children }: { children: ReactNode }) {
+  const [websiteTheme, setWebsiteThemeState] = useState<string>("spidey")
+  const [loading, setLoading] = useState(true)
+
+  useEffect(() => {
+    const stored = getStoredTheme()
+    if (stored) {
+      setWebsiteThemeState(stored)
+      applyWebsiteTheme(stored)
+      setLoading(false)
+      return
+    }
+    fetch("/api/settings/website-theme")
+      .then((res) => (res.ok ? res.json() : null))
+      .then((data) => {
+        const theme = data?.websiteTheme || "spidey"
+        setWebsiteThemeState(theme)
+        storeTheme(theme)
+        applyWebsiteTheme(theme)
+      })
+      .catch(() => {
+        applyWebsiteTheme("spidey")
+      })
+      .finally(() => setLoading(false))
+  }, [])
+
+  const setWebsiteTheme = useCallback(async (theme: string) => {
+    setWebsiteThemeState(theme)
+    storeTheme(theme)
+    applyWebsiteTheme(theme)
+    try {
+      await fetch("/api/settings/website-theme", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ websiteTheme: theme }),
+      })
+    } catch {
+      console.warn("Failed to persist website theme")
+    }
+  }, [])
+
+  return (
+    <WebsiteThemeContext.Provider value={{ websiteTheme, setWebsiteTheme, loading }}>
+      {children}
+    </WebsiteThemeContext.Provider>
+  )
+}
+
+export function useWebsiteTheme() {
+  const ctx = useContext(WebsiteThemeContext)
+  if (!ctx) throw new Error("useWebsiteTheme must be used within WebsiteThemeProvider")
+  return ctx
+}

src/types/index.ts

@@ -4,7 +4,7 @@ export type LeadStatus =
   | "pending"
   | "closed"
   | "ignored";
-export type UserRole = "super_admin" | "admin" | "sales";
+export type UserRole = "super_admin" | "admin" | "sales" | "dev";
 
 export interface User {
   id: string;