Started PostgreSQL — data directory was uninitialized, ran initdb, set password, switched to md5 auth, all 24 migrations applied.

Hardened db.ts — added statement_timeout: 30000, idle_in_transaction_session_timeout: 10000, created transaction() helper (BEGIN/COMMIT/ROLLBACK).
Multi-step API routes wrapped in transactions — Events POST, Conversations POST use atomic blocks.
Fixed leads pagination — status filter pushed into SQL WHERE (no client-side filtering after LIMIT/OFFSET), added SELECT COUNT(*) for total.
Rewrote dashboard — SQL aggregations (COUNT + GROUP BY + date_trunc) replace loading all leads into memory.
Optimized conversations GET — merged duplicate correlated subqueries into single LEFT JOIN LATERAL.
Created migration 021_performance_indexes.sql — 8 missing indexes + set_session_user_context() function caching current_user_hierarchy_level() as session variable (avoids per-query RLS join).
Fixed build error — duplicate const other in conversations route. Also fixed a TypeScript never error in dashboard breakdown map.
Verified — npx tsc --noEmit clean, npm test (13 pass, 7 integration skip gracefully), npx next build succeeds.

src/lib/auth.ts

@@ -1,21 +1,7 @@
-import { SignJWT, jwtVerify } from "jose";
 import bcrypt from "bcryptjs";
 import { query } from "@/lib/db";
 import { cookies } from "next/headers";
-
-function randomHex(length: number): string {
-  const chars = "abcdef0123456789";
-  let result = "";
-  for (let i = 0; i < length; i++) {
-    result += chars[Math.floor(Math.random() * chars.length)];
-  }
-  return result;
-}
-
-const g = globalThis as typeof globalThis & { __JWT_RAW_SECRET?: string };
-const RAW_SECRET = process.env.JWT_SECRET || (g.__JWT_RAW_SECRET ??= randomHex(32));
-if (!RAW_SECRET) throw new Error("JWT_SECRET environment variable is required");
-const JWT_SECRET = new TextEncoder().encode(RAW_SECRET);
+import { signToken, verifyToken } from "@/lib/jwt";
 
 export const SESSION_COOKIE = "session";
 const MAX_FAILED_ATTEMPTS = 5;
@@ -43,23 +29,6 @@ export async function comparePassword(
   return bcrypt.compare(password, hash);
 }
 
-export async function signToken(payload: { userId: string; role: string }) {
-  return new SignJWT(payload)
-    .setProtectedHeader({ alg: "HS256" })
-    .setExpirationTime("24h")
-    .setIssuedAt()
-    .sign(JWT_SECRET);
-}
-
-export async function verifyToken(token: string) {
-  try {
-    const { payload } = await jwtVerify(token, JWT_SECRET);
-    return payload as { userId: string; role: string };
-  } catch {
-    return null;
-  }
-}
-
 export async function getUserByEmail(email: string) {
   const result = await query(
     `    SELECT u.id, u.username, u.email, u.password_hash, u.first_name, u.last_name,
@@ -221,7 +190,7 @@ export async function decryptPassword(encrypted: string): Promise<string | null>
 }
 
 export async function setSessionContext(userId: string, ip?: string) {
-  await query("SELECT set_config('app.current_user_id', $1, true)", [userId]);
+  await query("SELECT set_session_user_context($1)", [userId]);
   if (ip) {
     await query("SELECT set_config('app.current_ip', $1, true)", [ip]);
   }