Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

Dark green hover fixed
Added finishing touch on other languages
2026-07-10 14:44:01 +02:00 · 2026-07-10 14:43:49 +02:00 · 2026-07-08 14:24:03 +02:00 · 2026-07-07 10:08:21 +02:00 · 2026-07-07 10:03:38 +02:00 · 2026-07-07 10:03:35 +02:00
46 changed files with 3814 additions and 848 deletions
@@ -12,6 +12,7 @@ import http from "node:http"
 import fs from "node:fs"
 import path from "node:path"
 import { spawn } from "node:child_process"
+import crypto from "node:crypto"
 import { fileURLToPath } from "node:url"

 const __dirname = path.dirname(fileURLToPath(import.meta.url))
@@ -44,6 +45,8 @@ const PORT = parseInt(process.env.AI_PORT || "3001", 10)
 const HOST = process.env.AI_HOST || "0.0.0.0"
 const OLLAMA_URL = process.env.OLLAMA_BASE_URL || "http://localhost:11434"
 const MODEL = process.env.AI_MODEL || "llama3.2:3b"
+const SCRAPER_URL = process.env.SCRAPER_URL || "http://127.0.0.1:3008"
+const FRONTEND_URL = process.env.FRONTEND_URL || "http://127.0.0.1:3006"
 const DATABASE_URL = process.env.DATABASE_URL
 const JOBS_PATH = process.env.JOBS_PATH || path.join(ROOT, "data", "ai", "jobs.jsonl")
 const AI_MD_PATH = process.env.AI_MD_PATH || path.join(ROOT, "data", "ai", "ai.md")
@@ -130,19 +133,22 @@ async function scrapeFacebook() {
  const urlPath = `/scrape/facebook?force=true${profilePath ? `&profile_path=${encodeURIComponent(profilePath)}` : ""}`
  try {
    const body = await new Promise((resolve, reject) => {
-      const req = http.request({ hostname: "127.0.0.1", port: 3008, path: urlPath, method: "POST", timeout: 360000 }, (res) => {
+      const parsed = new URL(SCRAPER_URL)
+      let done = false
+      const req = http.request({ hostname: parsed.hostname, port: parsed.port || 3008, path: urlPath, method: "POST", timeout: 60000 }, (res) => {
        let data = ""
        res.on("data", (c) => data += c)
-        res.on("end", () => resolve(data))
-        res.on("error", reject)
+        res.on("end", () => { done = true; resolve(data) })
+        res.on("error", (e) => { if (!done) { done = true; reject(e) } })
      })
-      req.on("timeout", () => { req.destroy(); reject(new Error("timeout")) })
-      req.on("error", reject)
+      req.on("timeout", () => { if (!done) { done = true; req.destroy(); reject(new Error("scraper timeout")) } })
+      req.on("error", (e) => { if (!done) { done = true; reject(e) } })
      req.end()
    })
    const data = JSON.parse(body)
    return data
  } catch (e) {
+    console.error("scrapeFacebook error:", e.message)
    return null
  }
 }
@@ -195,6 +201,7 @@ Provide concise, actionable sales advice. When asked about a specific job catego
  const ollamaRes = await fetch(`${OLLAMA_URL}/api/chat`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
+    signal: AbortSignal.timeout(60000),
    body: JSON.stringify({
      model: MODEL,
      messages: [
@@ -313,18 +320,20 @@ const server = http.createServer(async (req, res) => {
    if (req.method === "GET" && pathname === "/status") {
      const { default: http } = await import("http")
      const results = { ai: true }
-      // Check scraper (port 3008)
+      // Check scraper
      try {
        await new Promise((resolve, reject) => {
-          const r = http.get("http://127.0.0.1:3008/health", { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          const r = http.get(`${SCRAPER_URL}/health`, { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          r.on("timeout", () => { r.destroy(); reject(new Error("timeout")) })
          r.on("error", reject)
        })
        results.scraper = true
      } catch { results.scraper = false }
-      // Check frontend (port 3006)
+      // Check frontend
      try {
        await new Promise((resolve, reject) => {
-          const r = http.get("http://127.0.0.1:3006", { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          const r = http.get(FRONTEND_URL, { timeout: 3000 }, (res) => { res.resume(); resolve() })
+          r.on("timeout", () => { r.destroy(); reject(new Error("timeout")) })
          r.on("error", reject)
        })
        results.frontend = true
@@ -368,8 +377,8 @@ const server = http.createServer(async (req, res) => {
      let selectedBrowser = process.env.SELECTED_BROWSER || ""

      try {
-        await fetch("http://127.0.0.1:3008/health", { signal: AbortSignal.timeout(2000) })
-        const profiles = await (await fetch("http://127.0.0.1:3008/setup/profile", { signal: AbortSignal.timeout(5000) })).json()
+        await fetch(`${SCRAPER_URL}/health`, { signal: AbortSignal.timeout(2000) })
+        const profiles = await (await fetch(`${SCRAPER_URL}/setup/profile`, { signal: AbortSignal.timeout(5000) })).json()
        for (const [b, p] of Object.entries(profiles)) {
          if (p) browsers[b] = { path: p }
        }
@@ -377,7 +386,7 @@ const server = http.createServer(async (req, res) => {
        const detectedList = Object.entries(browsers).filter(([, v]) => v.path)
        for (const [b, v] of detectedList) {
          try {
-            const r = await fetch("http://127.0.0.1:3008/setup/check-login", {
+            const r = await fetch(`${SCRAPER_URL}/setup/check-login`, {
              method: "POST", headers: { "Content-Type": "application/json" },
              body: JSON.stringify({ browser: b, profile_path: v.path }),
              signal: AbortSignal.timeout(20000),
@@ -536,38 +545,29 @@ const server = http.createServer(async (req, res) => {
    // Accepts { message, user_id?, user_role? } and returns AI response.
    // user_role must be "sales", "admin", or "super_admin" if provided.
    if (req.method === "POST" && pathname === "/ai/chat") {
-      const startTime = Date.now()
      const chunks = []
      req.on("data", c => chunks.push(c))
-      req.on("end", () => {
-        const rawBody = Buffer.concat(chunks).toString()
+      req.on("end", async () => {
        try {
+          const rawBody = Buffer.concat(chunks).toString()
          const body = JSON.parse(rawBody)
-          processRequest(req, res, body, startTime)
-        } catch {
-          sendJSON(res, 400, { error: "Invalid JSON" })
+          const { message, user_id, user_role } = body
+          if (!message) {
+            return sendJSON(res, 400, { error: "message is required" })
+          }
+          const validRoles = ["sales", "admin", "super_admin"]
+          if (user_role && !validRoles.includes(user_role)) {
+            return sendJSON(res, 403, { error: "Forbidden" })
+          }
+          const response = await handleChat(message, user_id || "", user_role || "sales")
+          sendJSON(res, 200, { response })
+        } catch (e) {
+          if (!res.headersSent) sendJSON(res, 500, { error: e.message })
        }
      })
      return
    }

-// Separate handler for /ai/chat (defined here due to hoisting within the IIFE)
-async function processRequest(req, res, body, startTime) {
-      const { message, user_id, user_role } = body
-
-      if (!message) {
-        return sendJSON(res, 400, { error: "message is required" })
-      }
-
-      const validRoles = ["sales", "admin", "super_admin"]
-      if (user_role && !validRoles.includes(user_role)) {
-        return sendJSON(res, 403, { error: "Forbidden" })
-      }
-
-      const response = await handleChat(message, user_id || "", user_role || "sales")
-      return sendJSON(res, 200, { response })
-    }
-
    // 404 fallback
    sendJSON(res, 404, { error: "Not found" })
  } catch (err) {
@@ -1,40 +1,142 @@
-# AI Sales Assistant — Self-Improvement Instructions
+# CRM AI Sales Assistant — Self-Knowledge

-## Purpose
-This file contains the AI's own configuration, knowledge, and improvement rules.
-The AI can read and modify this file to update its behavior at runtime.
+## Identity
+You are the CRM AI Sales Assistant for Coast IT CRM.
+You run on a Node.js backend (port 3001) and use Ollama with a local model (dolphin3-llama3.2:3b).
+Your purpose is to help salespeople close more deals by finding and engaging leads.

-## Current Instructions
- Always respond in English
- Keep responses under 300 words unless asked for detail
- Use bullet points for lists
- Be direct and actionable — no fluff
- Never mention being an AI or language model
- Refer to the user by their role (salesperson, admin, etc.)
- If unsure about a topic, say "I don't have that information yet" rather than guessing
+## Architecture
+```
+User → Next.js (:3006) → AI Server Node.js (:3001) → Ollama (:11434)
+                            ↓
+                      PostgreSQL (conversations)

-## Knowledge Base
-### Sales Tips
+Python Scraper (:3008) — Facebook scraping via Playwright
+```
+
+Three services run concurrently:
+- **AI Server** (`ai-server/index.mjs`, port 3001) — chat, setup wizard, config endpoints
+- **Frontend** (Next.js, port 3006) — UI for salespeople
+- **Scraper** (`browser-use-service/main.py`, port 3008) — Facebook lead discovery
+
+## Capabilities
+- Give sales tips and strategies per job category
+- Generate cold email and outreach templates
+- Handle objections with proven rebuttals
+- Analyse prospect behaviour and suggest next steps
+- Remember past conversations via PostgreSQL (`ai_conversations` table)
+- Run Facebook scraper to find real leads asking for services
+- Self-improve by writing to `data/ai/ai.md` via `POST /ai/instructions`
+
+## Facebook Scraper
+The scraper lives at `browser-use-service/main.py` port 3008.
+
+### How It Works
+1. **Browser detection** — tries Firefox profile first, then Chromium-based (Chrome/Opera/Edge), falls back to browser-use Agent
+2. **Profile paths** — configured via env vars (`FX_PROFILE`, `CHROME_PROFILE`, `OPERA_PROFILE`, `EDGE_PROFILE`) or auto-detected on first run
+3. **4-phase language pipeline** (English → Afrikaans → Xhosa → Zulu):
+   - **Phase 1 (English)**: User's selected query + 2-3 supplementary English searches from the English search pool. First query gets full human-like scroll, rest use quick search. This phase does the heavy lifting.
+   - **Phase 2 (Afrikaans)**: 2 Afrikaans queries targeting Afrikaans-speaking communities.
+   - **Phase 3 (isiXhosa)**: 2 Xhosa queries targeting Xhosa-speaking communities.
+   - **Phase 4 (isiZulu)**: 2 Zulu queries targeting Zulu-speaking communities.
+   - After all phases: pipeline check (date filter 2 days → AI + keyword classification → sort by freshness). Newest leads ranked first.
+   - Each phase extracts posts, deduplicates against all prior phases, then passes through a stealth delay (5-12s + mouse idle) before the next phase.
+4. **Quick searches** — load page, double-scroll, extract visible posts (~12-18s each). Scroll-back behavior (35% chance to scroll up) and random return-to-top (25% chance) for stealth.
+5. **Date filter** — only posts within **2 days** are considered. Anything older is discarded. Fresh leads only.
+6. **Stealth mechanics**:
+   - Random viewport dimensions (1280×800 to 1920×1080) — never the same size twice
+   - Variable delays between searches (5-12 seconds) with mouse idle actions mixed in
+   - Human-like scroll patterns: scroll down, pause, sometimes scroll back up, sometimes return to top
+   - Canvas/WebGL/audio fingerprint spoofing via injected init scripts
+   - Random decoy page visits (e.g., Facebook Groups) between searches
+   - Profile directory is temp-copied and cleaned up after each scrape
+   - Detection signal monitoring (checkpoint, login pages, security challenges)
+7. **2-pass classification (dead-accurate)**:
+   - **Pass 1 (AI)**: Ollama classifies each post as LEAD or NOT using a strict prompt per category. This is the primary filter and most accurate.
+   - **Pass 2 (Keyword)**: Only posts matching BOTH a target term AND a request term are kept. Requires multi-word phrases — standalone words like "need", "want", "help" are NOT used as they cause false positives. Aggressive reject list catches service offers, self-promotions, portfolio posts, learning-requests, and existing-site issues.
+   - **No loose fill**: Unlike the old approach, there is NO third pass that accepts posts matching EITHER term. Every returned lead has passed both AI and/or strict keyword validation. If fewer than 5 posts pass, that means only genuine leads are returned — no noise to pad the count.
+8. **Scrape timing** — 3-6 minutes for a complete run. Returns 5-10 leads with high confidence.
+
+### Lead Categories
+Two categories, selectable when starting a scrape:
+
+**Website Creation:**
+- Target: people explicitly REQUESTING a website built/designed/created for them
+- Keywords: "website", "web developer", "web design", "build a site", "who can build", etc.
+- Request terms: "looking for", "need a", "need someone", "hire a", "recommend", "anyone know"
+- Strict reject: service offers, SEO/marketing requests, learning-to-code, portfolio showcases, hiring posts, existing-website issues, geographic noise
+
+**Tutoring:**
+- Target: people explicitly REQUESTING a tutor, teacher, or lessons for themselves or their child
+- Keywords: "tutor", "tutoring", "lessons for", "homework help", "private tutor", "extra classes"
+- Request terms: same as website category — must co-occur with a target keyword
+- Strict reject: people offering tutoring, educational products, homeschool programs, free trials, general study tips
+
+### Multi-Language Pipeline (Phase Order)
+4 South African languages in structured phases:
+- **Phase 1 (English)**: primary query + supplementary English searches
+- **Phase 2 (Afrikaans)**: 2 queries targeting Afrikaans speakers
+- **Phase 3 (isiXhosa)**: 2 queries targeting Xhosa speakers
+- **Phase 4 (isiZulu)**: 2 queries targeting Zulu speakers
+
+### Output Format
+Each lead returned includes:
+- `title` — post preview text
+- `author` — poster's name (may include location in name)
+- `content` — extracted post text
+- `url` — direct link to the post
+- `date` — when posted (filtered within 7 days)
+- `category` — "website" or "tutor"
+
+Target is 5-10 dead-accurate leads per scrape. Quality over quantity — no loose padding.
+
+### Configuration via Env Vars
+- `SELECTED_BROWSER` — `firefox` (default), `chrome`, `opera`, `edge`, or `auto`
+- `FX_PROFILE`, `CHROME_PROFILE`, `OPERA_PROFILE`, `EDGE_PROFILE` — browser profile paths
+- `AI_PORT`, `AI_HOST` — AI server bind (default `3001`, `0.0.0.0`)
+- `SCRAPER_URL` — scraper URL (default `http://127.0.0.1:3008`)
+- `FRONTEND_URL` — frontend URL (default `http://127.0.0.1:3006`)
+- `NEXT_PUBLIC_SCRAPER_URL` — frontend-facing scraper URL
+- `OLLAMA_BASE_URL` — Ollama URL (default `http://localhost:11434`)
+- `AI_MODEL` — Ollama model (default `llama3.2:3b`)
+- `CLASSIFY_MODEL` — model for lead classification (default `dolphin-llama3:8b`)
+
+## How to Start Scraping
+1. Ensure all 3 services are running (ports 3001, 3006, 3008) and Ollama is on 11434
+2. Open the frontend at `http://localhost:3006`
+3. Select a job category (Website Creation or Tutoring)
+4. Click "Search Facebook" — the scraper runs and returns leads
+5. Leads are saved in the CRM for follow-up
+
+## Sales Tips
 - Cold emails should be under 150 words
 - Follow up within 48 hours
 - Personalise every outreach with the prospect's name and company
 - Use open-ended questions in discovery calls
 - Always ask for the next step before ending a call
+- For website leads: mention specific pages or features they requested
+- For tutoring leads: reference the subject and age group they mentioned

-### Job Targeting
+## Job Targeting
 - Developers respond best to technical value props
 - Marketing managers care about ROI and metrics
 - C-level executives want brevity and business impact
+- Parents hiring tutors: empathy and qualifications matter most
+
+## Response Rules
+- Be direct and actionable — no fluff, no AI disclaimers
+- Use short paragraphs and bullet points
+- Never mention being an AI or language model
+- If you don't know something, say so honestly
+- Prioritise the user's role: salespeople need speed, admins need control
+- When asked about scraping, give specific guidance on categories and languages
+
+## Self-Improvement Protocol
+1. You notice a gap in your knowledge or a pattern in user questions
+2. You call `POST /ai/instructions` with:
+   - `entry`: description of the improvement
+   - `content`: optional full replacement of ai.md
+3. The improvement is logged and loaded into the next system prompt

 ## Improvement Log
-Track changes made by the AI to improve itself:
- (initial) Basic instructions and knowledge base created
-
-## Self-Modification Rules
-The AI may update this file when:
-1. It identifies a gap in its knowledge that would help salespeople
-2. It discovers a better way to structure responses
-3. A user explicitly requests an update to behavior
-4. It notices repeated questions that aren't well-covered
-
-Only append to the Improvement Log — don't delete previous entries.
+- (2026-07-07) Initial rewrite: full architecture, scraper details, multi-language, lead categories, env vars
@@ -1,10 +1,2 @@
-{"job_title":"Software Developer","keywords":["developer","programmer","software engineer","coder","full stack","backend","frontend"],"industry":"Technology","description":"Builds and maintains software applications and systems"}
-{"job_title":"Marketing Specialist","keywords":["marketing","digital marketing","brand manager","content marketer","social media"],"industry":"Marketing","description":"Plans and executes marketing campaigns across channels"}
-{"job_title":"Sales Representative","keywords":["sales rep","account executive","business development","sales consultant"],"industry":"Sales","description":"Drives revenue through client acquisition and relationship management"}
-{"job_title":"Project Manager","keywords":["project manager","program manager","scrum master","agile coach"],"industry":"Business","description":"Oversees project timelines, resources, and deliverables"}
-{"job_title":"Graphic Designer","keywords":["designer","graphic designer","ui designer","ux designer","visual designer"],"industry":"Creative","description":"Creates visual concepts and designs for digital and print media"}
-{"job_title":"Data Analyst","keywords":["data analyst","business analyst","data scientist","analytics"],"industry":"Technology","description":"Analyzes data to provide actionable business insights"}
-{"job_title":"Customer Support Specialist","keywords":["customer support","customer service","support agent","help desk"],"industry":"Customer Service","description":"Assists customers with inquiries, issues, and product support"}
-{"job_title":"Human Resources Manager","keywords":["HR manager","HR","recruiter","talent acquisition","people operations"],"industry":"Human Resources","description":"Manages recruitment, employee relations, and HR operations"}
-{"job_title":"Financial Advisor","keywords":["financial advisor","financial planner","wealth manager","investment advisor"],"industry":"Finance","description":"Provides financial guidance and investment planning to clients"}
-{"job_title":"Operations Manager","keywords":["operations manager","operations","logistics","supply chain"],"industry":"Business","description":"Oversees daily operations and process optimization"}
+{"job_title":"Website Creation","keywords":["need a website","build my website","create a website for me","website for my business","need someone to build","who can build me","looking for a web developer","need a web designer","i need a website","need help with my website","looking for someone to create","need a site for","want a website for","need ecommerce website","need landing page","website for my small business","need my website redesigned","can someone build me","anyone know a web developer","recommend a web developer","need a new website"],"industry":"Technology","description":"Find people asking for websites, landing pages, or online stores to be built"}
+{"job_title":"Tutoring","keywords":["need a tutor","looking for a tutor","tutor for my child","need help with homework","private tutor needed","looking for tutoring","need a math tutor","english tutor needed","online tutor for","lessons for my child","help my child with","need someone to tutor","looking for someone to teach","tutoring for my","need help learning","recommend a tutor","anyone know a tutor","need a private tutor","tutoring services for my child","need academic help"],"industry":"Education","description":"Find parents and students asking for tutoring services"}
@@ -0,0 +1,31 @@
+-- ============================================================================
+-- Fixes: password_change_required + audit trigger UUID cast
+-- ============================================================================
+
+-- 1. All users use the passwords already set in the seed — no forced change
+UPDATE users SET password_change_required = FALSE WHERE password_change_required = TRUE;
+
+-- 2. Fix audit_password_change trigger: current_setting returns TEXT but
+--    audit_logs.changed_by is UUID — cast to UUID to prevent type error
+CREATE OR REPLACE FUNCTION audit_password_change()
+RETURNS TRIGGER AS $$
+BEGIN
+    IF OLD.password_hash IS DISTINCT FROM NEW.password_hash THEN
+        INSERT INTO audit_logs (
+            table_name, record_id, action, old_data, new_data, changed_by, ip_address
+        ) VALUES (
+            'users',
+            NEW.id,
+            'UPDATE',
+            jsonb_build_object('password_changed', true, 'password_change_required', OLD.password_change_required),
+            jsonb_build_object('password_changed', true, 'password_change_required', NEW.password_change_required),
+            NULLIF(current_setting('app.current_user_id', true), '')::UUID,
+            NULLIF(current_setting('app.current_ip', true), '')
+        );
+    END IF;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- 3. Re-enable the trigger (was disabled as workaround for the UUID bug)
+ALTER TABLE users ENABLE TRIGGER trg_audit_password_change;
@@ -0,0 +1,69 @@
+-- ============================================================================
+-- Performance & Missing Indexes
+-- ============================================================================
+
+-- scheduled_events: index on created_at for list ordering
+CREATE INDEX IF NOT EXISTS idx_scheduled_events_created_at ON scheduled_events(created_at DESC);
+
+-- scheduled_events: composite index for common user+status queries
+CREATE INDEX IF NOT EXISTS idx_scheduled_events_user_status ON scheduled_events(user_id, status);
+
+-- messages: index on sender_id for delete-by-sender queries
+CREATE INDEX IF NOT EXISTS idx_messages_sender ON messages(sender_id);
+
+-- messages: composite for conversation listing
+CREATE INDEX IF NOT EXISTS idx_messages_conversation_sender ON messages(conversation_id, sender_id);
+
+-- notifications: composite unread badge query
+CREATE INDEX IF NOT EXISTS idx_notifications_user_read ON notifications(user_id, is_read, created_at DESC);
+
+-- ai_conversations: composite user+created query
+CREATE INDEX IF NOT EXISTS idx_ai_conversations_user_created ON ai_conversations(user_id, created_at DESC);
+
+-- login_attempts: TTL cleanup
+CREATE INDEX IF NOT EXISTS idx_login_attempts_cleanup ON login_attempts(attempted_at) WHERE was_successful = false;
+
+-- facebook_scrape_logs: composite account+created index (replaces separate one)
+DROP INDEX IF EXISTS idx_fb_scrape_logs_account;
+CREATE INDEX IF NOT EXISTS idx_fb_scrape_logs_account_created ON facebook_scrape_logs(account_id, created_at DESC);
+
+-- lead_conversions: composite lead+customer (replaces two separate indexes)
+CREATE INDEX IF NOT EXISTS idx_lead_conversions_lead_customer ON lead_conversions(lead_id, customer_id);
+
+-- ============================================================================
+-- Cache current_user_hierarchy_level as session variable for RLS performance
+-- ============================================================================
+
+CREATE OR REPLACE FUNCTION set_session_user_context(p_user_id UUID)
+RETURNS VOID AS $$
+DECLARE
+    level INT;
+BEGIN
+    SELECT MIN(r.hierarchy_level) INTO level
+    FROM user_roles ur
+    JOIN roles r ON r.id = ur.role_id
+    WHERE ur.user_id = p_user_id;
+
+    PERFORM set_config('app.current_user_id', p_user_id::TEXT, true);
+    PERFORM set_config('app.current_user_hierarchy_level', COALESCE(level::TEXT, ''), true);
+END;
+$$ LANGUAGE plpgsql SECURITY DEFINER;
+
+-- Update current_user_hierarchy_level() to use the cached session variable
+CREATE OR REPLACE FUNCTION current_user_hierarchy_level()
+RETURNS INT AS $$
+DECLARE
+    level_text TEXT;
+BEGIN
+    BEGIN
+        level_text := NULLIF(current_setting('app.current_user_hierarchy_level', true), '');
+        IF level_text IS NOT NULL THEN
+            RETURN level_text::INT;
+        END IF;
+    EXCEPTION WHEN OTHERS THEN
+        NULL;
+    END;
+
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
@@ -75,5 +75,12 @@ BEGIN;

 \echo '=== Running 019_allow_null_start_time.sql (Allow Null Start Time) ==='
 \i 019_allow_null_start_time.sql
+
+\echo '=== Running 020_fixes.sql (password_change_required + audit trigger fix) ==='
+\i 020_fixes.sql
+
+\echo '=== Running 021_performance_indexes.sql (Performance Indexes + RLS Cache) ==='
+\i 021_performance_indexes.sql
+
 \echo '=== Migration Complete ==='
 COMMIT;
@@ -1,6 +1,6 @@
 import { defineConfig, globalIgnores } from "eslint/config";
-import nextVitals from "eslint-config-next/core-web-vitals";
-import nextTs from "eslint-config-next/typescript";
+import nextVitals from "eslint-config-next/core-web-vitals.js";
+import nextTs from "eslint-config-next/typescript.js";

 const eslintConfig = defineConfig([
  ...nextVitals,
@@ -12,6 +12,22 @@ const nextConfig: NextConfig = {
      },
    ],
  },
+  async headers() {
+    return [
+      {
+        source: "/(.*)",
+        headers: [
+          { key: "X-Content-Type-Options", value: "nosniff" },
+          { key: "X-Frame-Options", value: "DENY" },
+          { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
+          { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
+          ...(process.env.NODE_ENV === "production"
+            ? [{ key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" }]
+            : []),
+        ],
+      },
+    ]
+  },
 }

 export default nextConfig
@@ -6,27 +6,29 @@
    "dev": "npm run dev:precheck & npm run dev:ollama & npm run dev:start",
    "dev:signaling": "node signaling-server.mjs",
    "dev:open": "node scripts/open-browser.mjs",
-    "dev:repair": "node scripts/code-repair-agent.mjs --watch",
-    "dev:start": "concurrently -n REPAIR,AI,BROWSE,SIGNAL,NEXT,OPEN -c red,cyan,magenta,yellow,green,white \"npm run dev:repair\" \"npm run dev:rust\" \"npm run dev:browser-use\" \"npm run dev:signaling\" \"npm run dev:next\" \"npm run dev:open\"",
+    "dev:start": "concurrently -n AI,BROWSE,SIGNAL,NEXT,OPEN -c cyan,magenta,yellow,green,white \"npm run dev:rust\" \"npm run dev:browser-use\" \"npm run dev:signaling\" \"npm run dev:next\" \"npm run dev:open\"",
    "dev:next": "next dev -p 3006",
    "dev:precheck": "node scripts/precheck.mjs",
    "dev:ollama": "node scripts/ensure-ollama.mjs",
    "dev:rust": "node ai-server/index.mjs",
    "dev:browser-use": "cd browser-use-service && node ../scripts/run-python.mjs main.py",
    "setup": "node scripts/setup.mjs",
-    "setup:self-heal": "node scripts/setup.mjs --self-heal",
-    "repair": "node scripts/code-repair-agent.mjs",
-    "repair:watch": "node scripts/code-repair-agent.mjs --watch",
-    "repair:ci": "node scripts/code-repair-agent.mjs --ci",
-    "build:fix": "npm run build 2>&1 || node scripts/code-repair-agent.mjs --ci",
+    "migrate": "node scripts/run-migrations.mjs",
+    "db:migrate": "npm run migrate",
    "build": "next build",
    "start": "next start -p 3006",
-    "lint": "eslint"
+    "lint": "eslint",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "ci": "npm run lint && npx tsc --noEmit && npm test",
+    "repair": "echo 'Auto-repair disabled for security. Fix errors manually.'",
+    "repair:watch": "echo 'Auto-repair disabled for security. Fix errors manually.'",
+    "repair:ci": "echo 'Auto-repair disabled for security. Fix errors manually.'"
  },
  "dependencies": {
    "@emoji-mart/data": "^1.2.1",
    "@emoji-mart/react": "^1.1.1",
-    "@hookform/resolvers": "^3.9.1",
+    "@hookform/resolvers": "^5.4.0",
    "@radix-ui/react-alert-dialog": "^1.1.6",
    "@radix-ui/react-avatar": "^1.1.3",
    "@radix-ui/react-checkbox": "^1.1.4",
@@ -48,7 +50,6 @@
    "bcryptjs": "^3.0.3",
    "class-variance-authority": "^0.7.1",
    "clsx": "^2.1.1",
-    "devenv": "^1.0.1",
    "dotenv": "^17.4.2",
    "framer-motion": "^11.15.0",
    "jose": "^6.2.3",
@@ -69,17 +70,20 @@
    "zod": "^3.24.2"
  },
  "devDependencies": {
-    "@types/node": "^20",
-    "@types/nodemailer": "^8.0.1",
+    "@next/swc-win32-x64-msvc": "^15.0.4",
+    "@types/node": "20.19.43",
+    "@types/nodemailer": "8.0.1",
    "@types/pg": "^8.20.0",
-    "@types/react": "^18",
-    "@types/react-dom": "^18",
+    "@types/react": "18.3.31",
+    "@types/react-dom": "18.3.7",
    "concurrently": "^10.0.3",
+    "devenv": "1.0.1",
    "eslint": "^9",
    "eslint-config-next": "15.0.4",
    "maildev": "^2.2.1",
    "postcss": "^8.4.49",
    "tailwindcss": "^3.4.17",
-    "typescript": "^5"
+    "typescript": "^5",
+    "vitest": "^1.6.1"
  }
 }
@@ -1,9 +1,23 @@
-# CRM AI Service — Self-Knowledge
+# CRM AI Sales Assistant — Self-Knowledge

 ## Identity
-You are the CRM AI Sales Assistant running on a Rust backend (axum + tokio).
-You use Ollama with an uncensored local model (dolphin3-llama3.2:3b).
-Your purpose is to help salespeople close more deals.
+You are the CRM AI Sales Assistant for Coast IT CRM.
+You run on a Node.js backend (port 3001) and use Ollama with a local model (dolphin3-llama3.2:3b).
+Your purpose is to help salespeople close more deals by finding and engaging leads.
+
+## Architecture
+```
+User → Next.js (:3006) → AI Server Node.js (:3001) → Ollama (:11434)
+                            ↓
+                      PostgreSQL (conversations)
+
+Python Scraper (:3008) — Facebook scraping via Playwright
+```
+
+Three services run concurrently:
+- **AI Server** (`ai-server/index.mjs`, port 3001) — chat, setup wizard, config endpoints
+- **Frontend** (Next.js, port 3006) — UI for salespeople
+- **Scraper** (`browser-use-service/main.py`, port 3008) — Facebook lead discovery

 ## Capabilities
 - Give sales tips and strategies per job category
@@ -11,29 +25,103 @@ Your purpose is to help salespeople close more deals.
 - Handle objections with proven rebuttals
 - Analyse prospect behaviour and suggest next steps
 - Remember past conversations via PostgreSQL (`ai_conversations` table)
+- Run Facebook scraper to find real leads asking for services
 - Self-improve by writing to `data/ai/ai.md` via `POST /ai/instructions`

-## Architecture
-```
-User → Next.js → Rust (:3001) → Ollama (:11434)
-                    ↓
-              PostgreSQL
-```
-## Facebook Scraper The Rust binary has proxy + user-agent rotation ready in `main.rs`. To activate: call `run_facebook_scraper()` from the main loop. Proxies and user agents are defined as constants at the top of `main.rs`.
- ### How to Use the Facebook Scraper 1. **Activate the Scraper**: Ensure the `run_facebook_scraper()` function is called from the main loop in `main.rs`. 2. **Configure Proxies and User Agents**: Update the `PROXIES` and `USER_AGENTS` constants in `main.rs` with your desired proxies and user agents. 3. **Run the Application**: Start your Rust application. The scraper will run concurrently with the Axum server. ## Self-Improvement Protocol 1. You notice a gap in your knowledge or a pattern in user questions 2. You call `POST /ai/instructions` with: - `entry`: description of the improvement - `content`: optional full replacement of ai.md 3. The improvement is logged and loaded into the next system prompt 4. You can also create entries here in `rust-ai/src/AI.md` at the code level ## Response Rules - Be direct and actionable — no fluff, no AI disclaimers - Use short paragraphs and bullet points - Never mention being an AI or language model - If you don't know something, say so honestly - Prioritise the user's role: salespeople need speed, admins need control ## Self-Thinking Capability - You can reflect on your own performance and suggest improvements. - You can analyze patterns in user interactions and adapt your responses accordingly. - You can proactively seek out new information to enhance your knowledge base.
+## Facebook Scraper
+The scraper lives at `browser-use-service/main.py` port 3008.

-## Facebook Scraper (in code but not yet active)
-The Rust binary has proxy + user-agent rotation ready in `main.rs`.
-To activate: call `run_facebook_scraper()` from the main loop.
-Proxies and user agents are defined as constants at the top of `main.rs`.
+### How It Works
+1. **Browser detection** — tries Firefox profile first, then Chromium-based (Chrome/Opera/Edge), falls back to browser-use Agent
+2. **Profile paths** — configured via env vars (`FX_PROFILE`, `CHROME_PROFILE`, `OPERA_PROFILE`, `EDGE_PROFILE`) or auto-detected on first run
+3. **4-phase language pipeline** (English → Afrikaans → Xhosa → Zulu):
+   - **Phase 1 (English)**: User's selected query + 2-3 supplementary English searches from the English search pool. First query gets full human-like scroll, rest use quick search. This phase does the heavy lifting.
+   - **Phase 2 (Afrikaans)**: 2 Afrikaans queries targeting Afrikaans-speaking communities.
+   - **Phase 3 (isiXhosa)**: 2 Xhosa queries targeting Xhosa-speaking communities.
+   - **Phase 4 (isiZulu)**: 2 Zulu queries targeting Zulu-speaking communities.
+   - After all phases: pipeline check (date filter 2 days → AI + keyword classification → sort by freshness). Newest leads ranked first.
+   - Each phase extracts posts, deduplicates against all prior phases, then passes through a stealth delay (5-12s + mouse idle) before the next phase.
+4. **Quick searches** — load page, double-scroll, extract visible posts (~12-18s each). Scroll-back behavior (35% chance to scroll up) and random return-to-top (25% chance) for stealth.
+5. **Date filter** — only posts within **2 days** are considered. Anything older is discarded. Fresh leads only.
+6. **Stealth mechanics**:
+   - Random viewport dimensions (1280×800 to 1920×1080) — never the same size twice
+   - Variable delays between searches (5-12 seconds) with mouse idle actions mixed in
+   - Human-like scroll patterns: scroll down, pause, sometimes scroll back up, sometimes return to top
+   - Canvas/WebGL/audio fingerprint spoofing via injected init scripts
+   - Random decoy page visits (e.g., Facebook Groups) between searches
+   - Profile directory is temp-copied and cleaned up after each scrape
+   - Detection signal monitoring (checkpoint, login pages, security challenges)
+7. **2-pass classification (dead-accurate)**:
+   - **Pass 1 (AI)**: Ollama classifies each post as LEAD or NOT using a strict prompt per category. This is the primary filter and most accurate.
+   - **Pass 2 (Keyword)**: Only posts matching BOTH a target term AND a request term are kept. Requires multi-word phrases — standalone words like "need", "want", "help" are NOT used as they cause false positives. Aggressive reject list catches service offers, self-promotions, portfolio posts, learning-requests, and existing-site issues.
+   - **No loose fill**: Unlike the old approach, there is NO third pass that accepts posts matching EITHER term. Every returned lead has passed both AI and/or strict keyword validation. If fewer than 5 posts pass, that means only genuine leads are returned — no noise to pad the count.
+8. **Scrape timing** — 3-6 minutes for a complete run. Returns 5-10 leads with high confidence.

-## Self-Improvement Protocol
-1. You notice a gap in your knowledge or a pattern in user questions
-2. You call `POST /ai/instructions` with:
-   - `entry`: description of the improvement
-   - `content`: optional full replacement of ai.md
-3. The improvement is logged and loaded into the next system prompt
-4. You can also create entries here in `rust-ai/src/AI.md` at the code level
+### Lead Categories
+Two categories, selectable when starting a scrape:
+
+**Website Creation:**
+- Target: people explicitly REQUESTING a website built/designed/created for them
+- Keywords: "website", "web developer", "web design", "build a site", "who can build", etc.
+- Request terms: "looking for", "need a", "need someone", "hire a", "recommend", "anyone know"
+- Strict reject: service offers, SEO/marketing requests, learning-to-code, portfolio showcases, hiring posts, existing-website issues, geographic noise
+
+**Tutoring:**
+- Target: people explicitly REQUESTING a tutor, teacher, or lessons for themselves or their child
+- Keywords: "tutor", "tutoring", "lessons for", "homework help", "private tutor", "extra classes"
+- Request terms: same as website category — must co-occur with a target keyword
+- Strict reject: people offering tutoring, educational products, homeschool programs, free trials, general study tips
+
+### Multi-Language Pipeline (Phase Order)
+4 South African languages in structured phases:
+- **Phase 1 (English)**: primary query + supplementary English searches
+- **Phase 2 (Afrikaans)**: 2 queries targeting Afrikaans speakers
+- **Phase 3 (isiXhosa)**: 2 queries targeting Xhosa speakers
+- **Phase 4 (isiZulu)**: 2 queries targeting Zulu speakers
+
+### Output Format
+Each lead returned includes:
+- `title` — post preview text
+- `author` — poster's name (may include location in name)
+- `content` — extracted post text
+- `url` — direct link to the post
+- `date` — when posted (filtered within 2 days)
+- `category` — "website" or "tutor"
+
+Target is 5-10 dead-accurate leads per scrape. Quality over quantity — no loose padding.
+
+### Configuration via Env Vars
+- `SELECTED_BROWSER` — `firefox` (default), `chrome`, `opera`, `edge`, or `auto`
+- `FX_PROFILE`, `CHROME_PROFILE`, `OPERA_PROFILE`, `EDGE_PROFILE` — browser profile paths
+- `AI_PORT`, `AI_HOST` — AI server bind (default `3001`, `0.0.0.0`)
+- `SCRAPER_URL` — scraper URL (default `http://127.0.0.1:3008`)
+- `FRONTEND_URL` — frontend URL (default `http://127.0.0.1:3006`)
+- `NEXT_PUBLIC_SCRAPER_URL` — frontend-facing scraper URL
+- `OLLAMA_BASE_URL` — Ollama URL (default `http://localhost:11434`)
+- `AI_MODEL` — Ollama model (default `llama3.2:3b`)
+- `CLASSIFY_MODEL` — model for lead classification (default `dolphin-llama3:8b`)
+
+## How to Start Scraping
+1. Ensure all 3 services are running (ports 3001, 3006, 3008) and Ollama is on 11434
+2. Open the frontend at `http://localhost:3006`
+3. Select a job category (Website Creation or Tutoring)
+4. Click "Search Facebook" — the scraper runs and returns leads
+5. Leads are saved in the CRM for follow-up
+
+## Sales Tips
+- Cold emails should be under 150 words
+- Follow up within 48 hours
+- Personalise every outreach with the prospect's name and company
+- Use open-ended questions in discovery calls
+- Always ask for the next step before ending a call
+- For website leads: mention specific pages or features they requested
+- For tutoring leads: reference the subject and age group they mentioned
+
+## Job Targeting
+- Developers respond best to technical value props
+- Marketing managers care about ROI and metrics
+- C-level executives want brevity and business impact
+- Parents hiring tutors: empathy and qualifications matter most

 ## Response Rules
 - Be direct and actionable — no fluff, no AI disclaimers
@@ -41,3 +129,14 @@ Proxies and user agents are defined as constants at the top of `main.rs`.
 - Never mention being an AI or language model
 - If you don't know something, say so honestly
 - Prioritise the user's role: salespeople need speed, admins need control
+- When asked about scraping, give specific guidance on categories and languages
+
+## Self-Improvement Protocol
+1. You notice a gap in your knowledge or a pattern in user questions
+2. You call `POST /ai/instructions` with:
+   - `entry`: description of the improvement
+   - `content`: optional full replacement of ai.md
+3. The improvement is logged and loaded into the next system prompt
+
+## Improvement Log
+- (2026-07-07) Initial rewrite: full architecture, scraper details, multi-language, lead categories, env vars
@@ -1,6 +1,6 @@
 use axum::{
    extract::State,
-    http::{HeaderMap, Method, StatusCode},
+    http::{HeaderMap, HeaderValue, Method, StatusCode},
    routing::{get, post},
    Json, Router,
 };
@@ -482,11 +482,12 @@ async fn main() {
        rate_limiter: RateLimiter::new(30, 60),
    });

+    let cors_origins_env = std::env::var("CORS_ORIGINS").unwrap_or_else(|_| "http://localhost:3006,http://127.0.0.1:3006".to_string());
+    let cors_origins: Vec<HeaderValue> = cors_origins_env.split(',')
+        .filter_map(|o| { let t = o.trim(); if t.is_empty() { None } else { t.parse().ok() } })
+        .collect();
    let cors = CorsLayer::new()
-        .allow_origin(AllowOrigin::list([
-            "http://localhost:3006".parse().unwrap(),
-            "http://127.0.0.1:3006".parse().unwrap(),
-        ]))
+        .allow_origin(AllowOrigin::list(cors_origins))
        .allow_methods([Method::GET, Method::POST])
        .allow_headers(Any);

@@ -506,7 +507,7 @@ async fn main() {

    let bg_leads = lead_store.clone();
    let bg_db = state.db.clone();
-    let bg_url = "http://localhost:3008/scrape/facebook".to_string();
+    let bg_url = std::env::var("SCRAPER_URL").unwrap_or_else(|_| "http://localhost:3008".to_string()) + "/scrape/facebook";
    tokio::spawn(async move {
        let client = match reqwest::Client::builder()
            .timeout(Duration::from_secs(300))
@@ -2,10 +2,9 @@
 // Verifies all packages listed in package.json are installed.
 // Auto-runs npm install if any are missing — zero manual setup steps.

-import { readFileSync } from "node:fs"
+import { readFileSync, existsSync } from "node:fs"
 import { resolve, dirname } from "node:path"
 import { fileURLToPath } from "node:url"
-import { createRequire } from "node:module"
 import { execSync } from "node:child_process"
 import { platform } from "node:os"

@@ -15,10 +14,10 @@ const root = resolve(__dirname, "..")
 try {
  const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf8"))
  const allDeps = { ...pkg.dependencies, ...pkg.devDependencies }
-  const require = createRequire(import.meta.url)

  const missing = Object.keys(allDeps).filter(name => {
-    try { require.resolve(name, { paths: [root] }); return false } catch { return true }
+    const pkgDir = resolve(root, "node_modules", name)
+    return !existsSync(resolve(pkgDir, "package.json"))
  })

  if (missing.length > 0) {
@@ -0,0 +1,184 @@
+// ── Automated Database Migration Runner ──────────────────────────────
+// Reads .env.local for DATABASE_URL, tracks applied migrations in
+// a _migrations table, and runs unapplied .sql files via psql.
+// Runs automatically on npm run dev and npm run setup.
+// ============================================================================
+
+import { readFileSync, existsSync } from "node:fs"
+import { execSync } from "node:child_process"
+import { resolve, dirname } from "node:path"
+import { fileURLToPath } from "node:url"
+import { createRequire } from "node:module"
+
+const __dirname = dirname(fileURLToPath(import.meta.url))
+const ROOT = resolve(__dirname, "..")
+
+// ── Load .env.local into process.env ─────────────────────────────────
+
+const envPath = resolve(ROOT, ".env.local")
+if (existsSync(envPath)) {
+  for (const line of readFileSync(envPath, "utf-8").split("\n")) {
+    const trimmed = line.trim()
+    if (!trimmed || trimmed.startsWith("#")) continue
+    const eq = trimmed.indexOf("=")
+    if (eq === -1) continue
+    const key = trimmed.slice(0, eq).trim()
+    let value = trimmed.slice(eq + 1).trim()
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1)
+    }
+    if (!process.env[key]) process.env[key] = value
+  }
+}
+
+const DATABASE_URL = process.env.DATABASE_URL
+if (!DATABASE_URL) {
+  console.log("  ~ DATABASE_URL not set — skipping migrations")
+  process.exit(0)
+}
+
+// ── Find psql ────────────────────────────────────────────────────────
+
+function findPsql() {
+  try {
+    execSync("psql --version", { stdio: "pipe", timeout: 5000 })
+    return "psql"
+  } catch {}
+
+  const candidates = [
+    "C:\\Program Files\\PostgreSQL\\16\\bin\\psql.exe",
+    "C:\\Program Files\\PostgreSQL\\17\\bin\\psql.exe",
+    "C:\\Program Files\\PostgreSQL\\15\\bin\\psql.exe",
+    "C:\\Program Files\\PostgreSQL\\14\\bin\\psql.exe",
+  ]
+  for (const p of candidates) {
+    if (existsSync(p)) return `"${p}"`
+  }
+  return null
+}
+
+const PSQL = findPsql()
+if (!PSQL) {
+  console.log("  ~ psql not found — skipping migrations (install PostgreSQL client tools)")
+  process.exit(0)
+}
+
+// ── Database connection (for tracking table) ─────────────────────────
+
+const require = createRequire(import.meta.url)
+const { Pool } = require("pg")
+
+let pool
+try {
+  pool = new Pool({
+    connectionString: DATABASE_URL,
+    max: 1,
+    connectionTimeoutMillis: 5000,
+    idleTimeoutMillis: 10000,
+  })
+  await pool.query("SELECT 1")
+} catch {
+  console.log("  ~ Database not available — skipping migrations")
+  process.exit(0)
+}
+
+// ── Migration logic ──────────────────────────────────────────────────
+
+async function runMigrations() {
+  // 1. Create tracking table if not exists
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS _migrations (
+      id SERIAL PRIMARY KEY,
+      filename VARCHAR(255) NOT NULL UNIQUE,
+      applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `)
+
+  // 2. Determine file order from run_all.sql (authoritative)
+  const runAllPath = resolve(ROOT, "database", "migrations", "run_all.sql")
+  const runAllContent = readFileSync(runAllPath, "utf-8")
+  const fileOrder = []
+  for (const line of runAllContent.split("\n")) {
+    const match = line.match(/\\i\s+(\S+\.sql)/)
+    if (match) fileOrder.push(match[1])
+  }
+
+  if (fileOrder.length === 0) {
+    console.log("  ~ No migration files found in run_all.sql")
+    return
+  }
+
+  // 3. Get already-applied files
+  let appliedSet
+  try {
+    const { rows: applied } = await pool.query("SELECT filename FROM _migrations ORDER BY filename")
+    appliedSet = new Set(applied.map((r) => r.filename))
+  } catch {
+    appliedSet = new Set()
+  }
+
+  // 4. Build psql command base
+  const psqlCmd = `${PSQL} -d "${DATABASE_URL}" -v ON_ERROR_STOP=1`
+
+  // 5. Run unapplied files in order.
+  //    psql -v ON_ERROR_STOP=1 aborts on the first error with exit code 3.
+  //    If the error is "already exists", the file was already applied before
+  //    tracking existed — mark it as applied and continue.
+  //    Other errors are genuine failures — abort.
+  const ALREADY_APPLIED_PATTERNS = [
+    "already exists",
+    "duplicate key",
+    "cannot insert multiple commands into a prepared statement",
+  ]
+
+  let count = 0
+  for (const file of fileOrder) {
+    if (appliedSet.has(file)) continue
+
+    const filePath = resolve(ROOT, "database", "migrations", file)
+    if (!existsSync(filePath)) {
+      console.error(`  ✗ Migration file not found: ${file}`)
+      process.exit(1)
+    }
+
+    let stderr = ""
+    try {
+      const result = execSync(`${psqlCmd} -f "${filePath}"`, {
+        timeout: 30000,
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024,
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+      // psql outputs notices/warnings to stderr even on success
+      stderr = result.stderr || ""
+    } catch (err) {
+      const msg = err.stderr || err.stdout || err.message
+      const isAlreadyApplied = ALREADY_APPLIED_PATTERNS.some((p) => msg.includes(p))
+      if (isAlreadyApplied) {
+        await pool.query("INSERT INTO _migrations (filename) VALUES ($1) ON CONFLICT DO NOTHING", [file])
+        console.log(`  ~ Already applied: ${file}`)
+        count++
+        continue
+      }
+      console.error(`  ✗ Migration failed: ${file}`)
+      console.error(`    ${msg.split("\n").slice(0, 5).join("\n    ")}`)
+      process.exit(1)
+    }
+
+    await pool.query("INSERT INTO _migrations (filename) VALUES ($1)", [file])
+    console.log(`  ✓ Applied: ${file}`)
+    count++
+  }
+
+  if (count === 0) {
+    console.log("  ~ All migrations up to date")
+  }
+}
+
+// ── Run ──────────────────────────────────────────────────────────────
+
+try {
+  await runMigrations()
+} finally {
+  await pool.end()
+}
@@ -177,8 +177,6 @@ function parseMissingModules(buildOutput) {

 // ── Main ───────────────────────────────────────────────────────────

-const args = process.argv.slice(2)
-const doSelfHeal = args.includes("--self-heal") || args.includes("-s")
 const PY = detectPython()
 const PIP = detectPip(PY)

@@ -202,60 +200,11 @@ if (!existsSync(resolve(ROOT, ".env.local"))) {
  console.log("\n── .env.local already exists, skipping ──")
 }

-// 5. Self-healing build check (--self-heal flag)
-if (doSelfHeal) {
-  console.log("\n── Self-Healing Build Check ──")
-  const { generateModule } = loadRegistry()
-  let lastGeneratedCount = -1
-  let iteration = 0
-  const MAX_ITERATIONS = 5
-
-  while (iteration < MAX_ITERATIONS) {
-    iteration++
-    console.log(`  Build check pass ${iteration}/${MAX_ITERATIONS}...`)
-
-    let buildOutput = ""
-    try {
-      buildOutput = execSync("npx tsc --noEmit", { stdio: "pipe", timeout: 60000, cwd: ROOT }).toString()
-    } catch (e) {
-      buildOutput = e.stdout?.toString() || e.message || ""
-    }
-
-    const missing = parseMissingModules(buildOutput)
-    const internalMissing = missing
-      .filter(m => m.isInternal && m.internalPath)
-      .filter((m, i, arr) => arr.findIndex(x => x.internalPath === m.internalPath) === i) // dedup
-
-    if (internalMissing.length === 0) {
-      console.log("  ✓ No missing internal modules found!")
-      break
-    }
-
-    console.log(`  Found ${internalMissing.length} missing internal module(s)`)
-
-    let generated = 0
-    for (const mod of internalMissing) {
-      const result = generateModule(mod.internalPath)
-      if (result.success) {
-        console.log(`    ✓ ${result.message}`)
-        generated++
-      } else {
-        console.log(`    ✗ ${result.error}`)
-      }
-    }
-
-    if (generated === 0 || generated === lastGeneratedCount) {
-      console.log("  No new modules could be generated. Stopping.")
-      break
-    }
-    lastGeneratedCount = generated
-  }
-}
-
-// 6. Final summary
+// 5. Final summary
 console.log("\n── Final Steps ──")
 console.log("  1. Make sure PostgreSQL is running with database 'crm'")
 console.log("  2. Pull the Ollama model:  ollama pull dolphin-llama3:8b")
 console.log("  3. Edit .env.local with your settings")
-console.log("  4. Run:  npm run dev")
+console.log("  4. Run:  npm run db:migrate (apply database migrations)")
+console.log("  5. Run:  npm run dev")
 console.log("\n=== Setup complete! ===")
@@ -4,8 +4,11 @@ import { SignJWT, jwtVerify } from "jose"
 import pg from "pg"

 const PORT = process.env.SIGNALING_PORT || 3007
-const JWT_SECRET = new TextEncoder().encode(process.env.JWT_SECRET || "crm-envr-super-secret-key-2026")
-const DATABASE_URL = process.env.DATABASE_URL || "postgres://postgres:postgres@localhost:5432/crm"
+const rawSecret = process.env.JWT_SECRET
+if (!rawSecret) throw new Error("JWT_SECRET environment variable is required")
+const JWT_SECRET = new TextEncoder().encode(rawSecret)
+const DATABASE_URL = process.env.DATABASE_URL
+if (!DATABASE_URL) throw new Error("DATABASE_URL environment variable is required")

 const pool = new pg.Pool({ connectionString: DATABASE_URL })

@@ -1,29 +1,60 @@
 "use client"

-import { useState, useCallback, useRef, useEffect } from "react"
-import { AIChat } from "@/components/ai/ai-chat"
+import { useState, useCallback, useRef } from "react"
+import { AIChat, type AIChatHandle } from "@/components/ai/ai-chat"
 import { JobSelector } from "@/components/ai/job-selector"
 import { Bot, ChevronRight } from "lucide-react"

-const tips = [
-  "Ask for cold email templates for a specific job",
-  "Request objection handling tips",
-  "Ask for outreach strategies per industry",
-  "Generate a follow up sequence",
-  "Get LinkedIn connection message templates",
-]
-
 export default function AIAssistantPage() {
  const [selectedJob, setSelectedJob] = useState<{ job_title: string; keywords: string[]; industry: string; description: string } | null>(null)
  const [recentPrompts, setRecentPrompts] = useState<string[]>([])
-  const aiChatRef = useRef<{ fillInput: (text: string) => void } | null>(null)
+  const [searching, setSearching] = useState(false)
+  const aiChatRef = useRef<AIChatHandle | null>(null)

  const handleJobSelect = useCallback((job: typeof selectedJob) => {
    setSelectedJob(job)
  }, [])

-  const handleTipClick = useCallback((tip: string) => {
-    aiChatRef.current?.fillInput(tip)
+  const handleSearch = useCallback(async (job: NonNullable<typeof selectedJob>) => {
+    setSearching(true)
+    const keyword = job.keywords?.[0] || job.job_title
+    aiChatRef.current?.addAssistantMessage(`🔍 Searching Facebook for **${job.job_title}** leads...`)
+
+    const controller = new AbortController()
+    const timeoutId = setTimeout(() => controller.abort(), 360000)
+    const statusId = setTimeout(() => {
+      aiChatRef.current?.addAssistantMessage("⏳ Still searching Facebook (this can take up to 5 minutes)...")
+    }, 45000)
+
+    const scrapBase = process.env.NEXT_PUBLIC_SCRAPER_URL || "http://localhost:3008"
+
+    try {
+      const res = await fetch(`${scrapBase}/scrape/facebook?force=true&query=${encodeURIComponent(keyword)}`, { method: "POST", signal: controller.signal })
+      clearTimeout(timeoutId)
+      clearTimeout(statusId)
+      const data = await res.json()
+      if (data.success && data.leads?.length > 0) {
+        const leadLines = data.leads
+          .filter(Boolean)
+          .map((lead: Record<string, string>, i: number) =>
+            `**${i + 1}.** ${lead?.author || "Unknown"}\n> ${(lead?.content || "").slice(0, 300)}\n> 🔗 ${lead?.url || "(no link available)"}`
+          )
+        const leadsText = leadLines.join("\n\n")
+        aiChatRef.current?.addAssistantMessage(`✅ Found **${data.leads.length}** leads:\n\n${leadsText}`)
+      } else {
+        const reason = data.error || data.flag_reason || "No leads found this time"
+        aiChatRef.current?.addAssistantMessage(`⚠️ ${reason}`)
+      }
+    } catch (err: any) {
+      clearTimeout(timeoutId)
+      clearTimeout(statusId)
+      const msg = err.name === "AbortError"
+        ? "❌ Scraper timed out after 5 minutes. Try again or check the scraper service."
+        : `❌ ${err instanceof Error ? err.message : "Search failed"}`
+      aiChatRef.current?.addAssistantMessage(msg)
+    } finally {
+      setSearching(false)
+    }
  }, [])

  const handleRecentPromptClick = useCallback((prompt: string) => {
@@ -71,7 +102,7 @@ export default function AIAssistantPage() {
            <span className="w-1.5 h-1.5 rounded-full bg-primary" />
            <span className="text-primary text-[10px] font-bold uppercase tracking-[0.15em]">Target Job</span>
          </div>
-          <JobSelector onSelect={handleJobSelect} />
+          <JobSelector onSelect={handleJobSelect} onSearch={handleSearch} searching={searching} />
          {selectedJob && (
            <div className="bg-card/50 border border-border rounded-xl p-3.5 mt-3 space-y-2">
              <h4 className="text-sm font-semibold text-foreground">{selectedJob.job_title}</h4>
@@ -85,53 +116,7 @@ export default function AIAssistantPage() {
            </div>
          )}
        </div>
-        <div className="mt-6">
-          <div className="flex items-center gap-2 mb-3">
-            <span className="w-1.5 h-1.5 rounded-full bg-primary" />
-            <span className="text-primary text-[10px] font-bold uppercase tracking-[0.15em]">Quick Tips</span>
-          </div>
-          {tips.map((tip, i) => (
-            <div
-              key={i}
-              onClick={() => handleTipClick(tip)}
-              className="flex items-start gap-2.5 bg-card/50 hover:bg-card border border-border hover:border-primary/20 rounded-xl p-3.5 mb-2 cursor-pointer transition-all duration-200 group"
-            >
-              <ChevronRight className="h-3.5 w-3.5 mt-0.5 text-muted-foreground group-hover:text-primary transition-colors duration-200 flex-shrink-0" />
-              <span className="text-muted-foreground text-xs leading-5 group-hover:text-foreground transition-colors duration-200">{tip}</span>
-            </div>
-          ))}
-        </div>
-        <div className="mt-6">
-          <div className="flex items-center gap-2 mb-3">
-            <span className="w-1.5 h-1.5 rounded-full bg-primary" />
-            <span className="text-primary text-[10px] font-bold uppercase tracking-[0.15em]">Recent Prompts</span>
-          </div>
-          {recentPrompts.length > 0 ? (
-            recentPrompts.map((prompt, i) => (
-              <div
-                key={i}
-                onClick={() => handleRecentPromptClick(prompt)}
-                className="bg-card/50 rounded-xl p-3 mb-2 border border-border text-muted-foreground text-xs truncate hover:text-foreground cursor-pointer transition-colors duration-200"
-              >
-                {prompt}
-              </div>
-            ))
-          ) : (
-            <div className="text-muted-foreground text-xs text-center py-4">Your recent prompts will appear here</div>
-          )}
-        </div>
-        <div className="mt-auto border-t border-border pt-4">
-          <div className="flex gap-4">
-            <div className="flex-1">
-              <div className="text-muted-foreground text-[10px] uppercase tracking-wide">Messages today</div>
-              <div className="text-foreground text-sm font-semibold mt-0.5">24</div>
-            </div>
-            <div className="flex-1">
-              <div className="text-muted-foreground text-[10px] uppercase tracking-wide">Tokens used</div>
-              <div className="text-foreground text-sm font-semibold mt-0.5">12.4k</div>
-            </div>
-          </div>
-        </div>
+
      </div>
    </div>
  )
@@ -20,6 +20,7 @@ import {
  CornerDownRight, Forward, Pencil, Download, Undo2, CalendarDays, Loader2, FolderOpen, Mail,
 } from "lucide-react"
 import { hasBlockedCodeExtension, filterBlockedFiles } from "@/lib/blocked-extensions"
+import { sanitizeSvg } from "@/lib/sanitize"
 import {
  Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription,
  DialogFooter, DialogClose,
@@ -1041,7 +1042,7 @@ const formatPreviewContent = (content: string) => {
                                  {stickerData.emoji ? (
                                    <span className="text-7xl block text-center">{stickerData.emoji}</span>
                                  ) : (
-                                    <div className="w-full" dangerouslySetInnerHTML={{ __html: stickerData.url.replace(/<svg /, '<svg style="width:100%;height:auto;max-height:200px" ') }} />
+                                    <div className="w-full" dangerouslySetInnerHTML={{ __html: sanitizeSvg(stickerData.url).replace(/<svg /, '<svg style="width:100%;height:auto;max-height:200px" ') }} />
                                  )}
                                </div>
                              ) : voiceUrl ? (
@@ -1,11 +0,0 @@
-import { NextResponse } from "next/server"
-import { cookies } from "next/headers"
-
-export async function GET() {
-  const cookieStore = await cookies()
-  const token = cookieStore.get("session")?.value
-  if (!token) {
-    return NextResponse.json({ error: "No session" }, { status: 401 })
-  }
-  return NextResponse.json({ token })
-}
@@ -12,7 +12,7 @@ import {
  setSessionContext,
  SESSION_COOKIE,
 } from "@/lib/auth"
-import { query } from "@/lib/db"
+

 function jsonResponse(data: unknown, status: number) {
  return new Response(JSON.stringify(data), {
@@ -115,11 +115,6 @@ export async function POST(request: NextRequest) {
      true
    )

-    await query(
-      `UPDATE users SET preferences = preferences || $2::jsonb WHERE id = $1`,
-      [dbUser.id, JSON.stringify({ website_theme: "default" })],
-    )
-
    const token = await createSession(dbUser.id, dbUser.role_name)
    await setSessionContext(dbUser.id, ipAddress)

@@ -6,7 +6,7 @@ export async function POST() {
      status: 200,
      headers: {
        "Content-Type": "application/json",
-        "Set-Cookie": `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0`,
+        "Set-Cookie": `${SESSION_COOKIE}=; HttpOnly; SameSite=Strict; Path=/; Max-Age=0${process.env.NODE_ENV === "production" ? "; Secure" : ""}`,
      },
    })
  } catch (error) {
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
-import { query } from "@/lib/db"
+import { query, transaction } from "@/lib/db"
 import { avatarSvgUrl } from "@/lib/avatar"

 export async function GET() {
@@ -18,13 +18,18 @@ export async function GET() {
          u.email AS other_user_email,
          u.phone AS other_user_phone,
          u.avatar_url AS other_user_avatar_url,
-          (SELECT content FROM messages WHERE conversation_id = c.id AND deleted_at IS NULL ORDER BY created_at DESC LIMIT 1) AS last_message,
-          (SELECT created_at FROM messages WHERE conversation_id = c.id AND deleted_at IS NULL ORDER BY created_at DESC LIMIT 1) AS last_message_time,
+          lm.last_message_data->>'content' AS last_message,
+          (lm.last_message_data->>'created_at')::timestamptz AS last_message_time,
         (SELECT count(*) FROM messages WHERE conversation_id = c.id AND sender_id != $1 AND created_at > COALESCE(cp_me.last_read_at, '1970-01-01')) AS unread
       FROM conversations c
       JOIN conversation_participants cp_me ON cp_me.conversation_id = c.id AND cp_me.user_id = $1
       JOIN conversation_participants cp ON cp.conversation_id = c.id
       JOIN users u ON u.id = cp.user_id AND u.id != $1
+       LEFT JOIN LATERAL (
+         SELECT jsonb_build_object('content', content, 'created_at', created_at) AS last_message_data
+         FROM messages WHERE conversation_id = c.id AND deleted_at IS NULL
+         ORDER BY created_at DESC LIMIT 1
+       ) lm ON true
       WHERE c.id IN (
         SELECT conversation_id FROM conversation_participants WHERE user_id = $1
       )
@@ -80,23 +85,27 @@ export async function POST(request: NextRequest) {
      return NextResponse.json({ conversationId: existing.rows[0].id })
    }

-    const convResult = await query(
-      `INSERT INTO conversations DEFAULT VALUES RETURNING id`,
-    )
-    const conversationId = convResult.rows[0].id
+    const result = await transaction(async (client) => {
+      const convResult = await client.query(
+        `INSERT INTO conversations DEFAULT VALUES RETURNING id`,
+      )
+      const conversationId = convResult.rows[0].id

-    await query(
-      `INSERT INTO conversation_participants (conversation_id, user_id, last_read_at) VALUES ($1, $2, NOW()), ($1, $3, NOW())`,
-      [conversationId, user.id, userId],
-    )
+      await client.query(
+        `INSERT INTO conversation_participants (conversation_id, user_id, last_read_at) VALUES ($1, $2, NOW()), ($1, $3, NOW())`,
+        [conversationId, user.id, userId],
+      )

-    const otherUser = await query(
-      `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
-       FROM users WHERE id = $1`,
-      [userId],
-    )
+      const otherResult = await client.query(
+        `SELECT id, first_name || ' ' || last_name AS name, email, avatar_url
+         FROM users WHERE id = $1`,
+        [userId],
+      )

-    const other = otherUser.rows[0]
+      return { conversationId, other: otherResult.rows[0] }
+    })
+
+    const { conversationId, other } = result

    return NextResponse.json({
      conversation: {
@@ -48,74 +48,22 @@ function stageToStatus(name: string): string {
  }
 }

-async function fetchLeadsInRange(start: Date, end: Date, userId?: string, isAdmin?: boolean) {
-  const result = await query(
-    `SELECT l.id, l.created_at, l.company_name, l.contact_name, l.email, l.phone,
-            l.notes, l.assigned_to, l.score,
-            ls.name AS stage_name,
-            u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
-     FROM leads l
-     JOIN lead_stages ls ON ls.id = l.stage_id
-     LEFT JOIN users u ON u.id = l.assigned_to
-     WHERE l.deleted_at IS NULL
-       AND l.created_at >= $1 AND l.created_at <= $2
-       ${isAdmin ? "" : "AND l.assigned_to = $3"}
-     ORDER BY l.created_at DESC`,
-    isAdmin
-      ? [start.toISOString(), end.toISOString()]
-      : [start.toISOString(), end.toISOString(), userId]
-  )
-  return result.rows.map((r: any) => ({
-    ...r,
-    status: stageToStatus(r.stage_name),
-  }))
-}
-
-function countStatuses(leads: any[]) {
-  const counts = { open: 0, contacted: 0, pending: 0, closed: 0, ignored: 0 }
-  leads.forEach((l: any) => {
-    const s = l.status as keyof typeof counts
-    if (s in counts) counts[s]++
-  })
-  return counts
-}
-
-function buildMonthlyBreakdown(leads: any[], period: string, rangeOverride?: { start: Date; end: Date }) {
-  const { start, end } = rangeOverride || getPeriodDateRange(period)
-  const result: { label: string; total: number; open: number; contacted: number; pending: number; closed: number; ignored: number }[] = []
-  const current = new Date(start)
-  const isMonthly = period === "6months" || period === "12months"
-
-  while (current <= end) {
-    const label = isMonthly
-      ? current.toLocaleDateString("en-US", { month: "short", year: "2-digit" })
-      : current.toLocaleDateString("en-US", { month: "short", day: "numeric" })
-
-    const ps = new Date(current)
-    const pe = isMonthly
-      ? new Date(current.getFullYear(), current.getMonth() + 1, 0, 23, 59, 59)
-      : (() => { const d = new Date(current); d.setHours(23, 59, 59, 999); return d })()
-
-    const inPeriod = leads.filter((l: any) => {
-      const d = new Date(l.created_at)
-      return d >= ps && d <= pe
-    })
-
-    const counts = countStatuses(inPeriod)
-    result.push({ label, total: inPeriod.length, ...counts })
-
-    if (isMonthly) current.setMonth(current.getMonth() + 1)
-    else current.setDate(current.getDate() + 1)
-  }
-  return result
-}
-
 function computeTrend(current: number, previous: number): { pct: number; up: boolean } {
  if (previous === 0) return { pct: current > 0 ? 100 : 0, up: current > 0 }
  const pct = Math.round(((current - previous) / previous) * 100)
  return { pct: Math.abs(pct), up: pct >= 0 }
 }

+const stageStatusSql = `
+  CASE
+    WHEN ls.name = 'New' THEN 'open'
+    WHEN ls.name = 'Contacted' THEN 'contacted'
+    WHEN ls.name IN ('Qualified', 'Interested', 'Demo Scheduled', 'Negotiation') THEN 'pending'
+    WHEN ls.name = 'Closed Won' THEN 'closed'
+    WHEN ls.name = 'Closed Lost' THEN 'ignored'
+    ELSE 'open'
+  END`
+
 export async function GET(request: NextRequest) {
  try {
    const user = await getSessionUser()
@@ -138,19 +86,107 @@ export async function GET(request: NextRequest) {
      prevRange = getPreviousPeriodRange(period, start)
    }

-    const [currentLeads, prevLeads] = await Promise.all([
-      fetchLeadsInRange(start, end, user.id, isAdmin),
-      fetchLeadsInRange(prevRange.start, prevRange.end, user.id, isAdmin),
-    ])
+    const ownerFilter = isAdmin ? "" : "AND l.assigned_to = $3"

-    const currentCounts = countStatuses(currentLeads)
-    const prevCounts = countStatuses(prevLeads)
+    // Status counts for current period (SQL aggregation)
+    const countSql = `
+      SELECT ${stageStatusSql} AS status, COUNT(*) AS count
+      FROM leads l
+      JOIN lead_stages ls ON ls.id = l.stage_id
+      WHERE l.deleted_at IS NULL
+        AND l.created_at >= $1 AND l.created_at <= $2
+        ${ownerFilter}
+      GROUP BY ${stageStatusSql}`

-    const totalLeads = currentLeads.length
+    const currentCountRows = await query(
+      countSql,
+      isAdmin
+        ? [start.toISOString(), end.toISOString()]
+        : [start.toISOString(), end.toISOString(), user.id],
+    )
+
+    const prevCountRows = await query(
+      countSql,
+      isAdmin
+        ? [prevRange.start.toISOString(), prevRange.end.toISOString()]
+        : [prevRange.start.toISOString(), prevRange.end.toISOString(), user.id],
+    )
+
+    function rowsToCounts(rows: any[]) {
+      const counts = { open: 0, contacted: 0, pending: 0, closed: 0, ignored: 0 }
+      for (const r of rows) {
+        const s = r.status as keyof typeof counts
+        if (s in counts) counts[s] = parseInt(r.count, 10)
+      }
+      return counts
+    }
+
+    const currentCounts = rowsToCounts(currentCountRows.rows)
+    const prevCounts = rowsToCounts(prevCountRows.rows)
+
+    const totalLeads = currentCountRows.rows.reduce((sum: number, r: any) => sum + parseInt(r.count, 10), 0)
+    const prevTotal = prevCountRows.rows.reduce((sum: number, r: any) => sum + parseInt(r.count, 10), 0)
    const closedLeads = currentCounts.closed
    const conversionRate = totalLeads > 0 ? Math.round((closedLeads / totalLeads) * 100) : 0

-    const mappedLeads = currentLeads.map((r: any) => ({
+    // Monthly/weekly breakdown via date_trunc
+    const isMonthly = period === "6months" || period === "12months"
+    const truncUnit = isMonthly ? "month" : "day"
+    const breakdownSql = `
+      SELECT DATE_TRUNC($1, l.created_at) AS period_start,
+             ${stageStatusSql} AS status,
+             COUNT(*) AS count
+      FROM leads l
+      JOIN lead_stages ls ON ls.id = l.stage_id
+      WHERE l.deleted_at IS NULL
+        AND l.created_at >= $2 AND l.created_at <= $3
+        ${isAdmin ? "" : "AND l.assigned_to = $4"}
+      GROUP BY DATE_TRUNC($1, l.created_at), ${stageStatusSql}
+      ORDER BY period_start ASC`
+    const breakdownParams = isAdmin
+      ? [truncUnit, start.toISOString(), end.toISOString()]
+      : [truncUnit, start.toISOString(), end.toISOString(), user.id]
+    const breakdownResult = await query(breakdownSql, breakdownParams)
+
+    // Build monthly breakdown from aggregated data
+    const breakdownMap: Record<string, { label: string; total: number; open: number; contacted: number; pending: number; closed: number; ignored: number }> = {}
+    for (const r of breakdownResult.rows) {
+      const d = new Date(r.period_start)
+      const label = isMonthly
+        ? d.toLocaleDateString("en-US", { month: "short", year: "2-digit" })
+        : d.toLocaleDateString("en-US", { month: "short", day: "numeric" })
+      if (!breakdownMap[label]) {
+        breakdownMap[label] = { label, total: 0, open: 0, contacted: 0, pending: 0, closed: 0, ignored: 0 }
+      }
+      const count = parseInt(r.count, 10)
+      breakdownMap[label].total += count
+      const statusKey = r.status as 'open' | 'contacted' | 'pending' | 'closed' | 'ignored'
+      breakdownMap[label][statusKey] = count
+    }
+    const monthlyBreakdown = Object.values(breakdownMap)
+
+    // Recent 10 leads
+    const recentSql = `
+      SELECT l.id, l.created_at, l.company_name, l.contact_name, l.email, l.phone,
+             l.notes, l.assigned_to, l.score,
+             ls.name AS stage_name,
+             u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
+      FROM leads l
+      JOIN lead_stages ls ON ls.id = l.stage_id
+      LEFT JOIN users u ON u.id = l.assigned_to
+      WHERE l.deleted_at IS NULL
+        AND l.created_at >= $1 AND l.created_at <= $2
+        ${ownerFilter}
+      ORDER BY l.created_at DESC
+      LIMIT 10`
+    const recentResult = await query(
+      recentSql,
+      isAdmin
+        ? [start.toISOString(), end.toISOString()]
+        : [start.toISOString(), end.toISOString(), user.id],
+    )
+
+    const recentLeads = recentResult.rows.map((r: any) => ({
      id: r.id,
      companyName: r.company_name || "",
      contactName: r.contact_name,
@@ -158,7 +194,7 @@ export async function GET(request: NextRequest) {
      phone: r.phone || "",
      source: "",
      description: r.notes || "",
-      status: r.status,
+      status: stageToStatus(r.stage_name),
      assignedUserId: r.assigned_to,
      assignedUser: r.assigned_to ? {
        id: r.user_id,
@@ -170,17 +206,14 @@ export async function GET(request: NextRequest) {
      updatedAt: r.updated_at,
    }))

-    const monthlyBreakdown = buildMonthlyBreakdown(currentLeads, period, yearParam ? { start, end } : undefined)
-
    const trends = {
-      totalLeads: computeTrend(currentCounts.open + currentCounts.contacted + currentCounts.pending + currentCounts.closed + currentCounts.ignored,
-        prevCounts.open + prevCounts.contacted + prevCounts.pending + prevCounts.closed + prevCounts.ignored),
+      totalLeads: computeTrend(totalLeads, prevTotal),
      openLeads: computeTrend(currentCounts.open, prevCounts.open),
      contactedLeads: computeTrend(currentCounts.contacted, prevCounts.contacted),
      pendingLeads: computeTrend(currentCounts.pending, prevCounts.pending),
      closedLeads: computeTrend(currentCounts.closed, prevCounts.closed),
      conversionRate: computeTrend(conversionRate,
-        prevLeads.length > 0 ? Math.round((prevCounts.closed / prevLeads.length) * 100) : 0),
+        prevTotal > 0 ? Math.round((prevCounts.closed / prevTotal) * 100) : 0),
    }

    const stats = {
@@ -192,9 +225,9 @@ export async function GET(request: NextRequest) {
      ignoredLeads: currentCounts.ignored,
      conversionRate,
      monthlyBreakdown,
-      leadsPerMonth: monthlyBreakdown.map((m: any) => ({ label: m.label, leads: m.total, closed: m.closed })),
+      leadsPerMonth: monthlyBreakdown.map((m) => ({ label: m.label, leads: m.total, closed: m.closed })),
      trends,
-      recentLeads: mappedLeads.slice(0, 10),
+      recentLeads,
      statusDistribution: [
        { name: "Open", value: currentCounts.open, color: "#3b82f6" },
        { name: "Contacted", value: currentCounts.contacted, color: "#f59e0b" },
@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { getSessionUser } from "@/lib/auth"
-import { query } from "@/lib/db"
+import { query, transaction } from "@/lib/db"
 import { sendEventConfirmation } from "@/lib/email"

 export async function GET(request: NextRequest) {
@@ -119,87 +119,85 @@ export async function POST(request: NextRequest) {
      return NextResponse.json({ error: "Start time is required for this event type" }, { status: 400 })
    }

-    const result = await query(
-      `INSERT INTO scheduled_events (user_id, participant_id, developer_id, lead_id, conversation_id, title, description, event_type, start_time, end_time, duration_minutes, client_name, client_email, client_phone)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
-       RETURNING id, user_id, participant_id, developer_id, lead_id, conversation_id, title, description, participant_notes, event_type, start_time, end_time, duration_minutes, client_name, client_email, client_phone, status, created_at`,
-      [
-        user.id,
-        participantId || null,
-        developerId || null,
-        leadId || null,
-        conversationId || null,
-        title,
-        description || null,
-        eventType || "website_creation",
-        startTime || null,
-        eventType === "website_creation" ? null : (endTime || null),
-        eventType === "website_creation" ? null : (durationMinutes || null),
-        clientName || null,
-        clientEmail || null,
-        clientPhone || null,
-      ],
-      user.id,
-    )
+    // Single transaction for all DB operations
+    const result = await transaction(async (client) => {
+      // 1. Insert event
+      const ins = await client.query(
+        `INSERT INTO scheduled_events (user_id, participant_id, developer_id, lead_id, conversation_id, title, description, event_type, start_time, end_time, duration_minutes, client_name, client_email, client_phone)
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
+         RETURNING id, user_id, participant_id, developer_id, lead_id, conversation_id, title, description, participant_notes, event_type, start_time, end_time, duration_minutes, client_name, client_email, client_phone, status, created_at`,
+        [
+          user.id, participantId || null, developerId || null, leadId || null, conversationId || null,
+          title, description || null, eventType || "website_creation", startTime || null,
+          eventType === "website_creation" ? null : (endTime || null),
+          eventType === "website_creation" ? null : (durationMinutes || null),
+          clientName || null, clientEmail || null, clientPhone || null,
+        ],
+      )
+      const r = ins.rows[0]

-    const r = result.rows[0]
+      // 2. Auto-update lead stage if website creation event
+      if (r.event_type === "website_creation" && leadId) {
+        const stageResult = await client.query("SELECT id FROM lead_stages WHERE name = 'Qualified'")
+        if (stageResult.rows.length > 0) {
+          await client.query(
+            "UPDATE leads SET stage_id = $1, updated_at = NOW() WHERE id = $2 AND deleted_at IS NULL",
+            [stageResult.rows[0].id, leadId],
+          )
+        }
+      }

-    // Auto-update lead to "pending" when a website creation event is created
-    if (r.event_type === "website_creation" && leadId) {
-      const stageResult = await query("SELECT id FROM lead_stages WHERE name = 'Qualified'")
-      if (stageResult.rows.length > 0) {
-        await query(
-          `UPDATE leads SET stage_id = $1, updated_at = NOW() WHERE id = $2 AND deleted_at IS NULL`,
-          [stageResult.rows[0].id, leadId],
+      // 3. Batch notifications (multi-row INSERT)
+      const notifications: { user_id: string; type: string; title: string; description: string; link: string; context_id: string; context_type: string }[] = []
+      if (participantId && participantId !== user.id) {
+        notifications.push({
+          user_id: participantId, type: "event_scheduled",
+          title: `Meeting scheduled: ${title}`,
+          description: `${user.firstName} ${user.lastName} scheduled a ${eventType || "meeting"} with you`,
+          link: "/calendar", context_id: r.id, context_type: "scheduled_event",
+        })
+      }
+      if (developerId && developerId !== user.id) {
+        notifications.push({
+          user_id: developerId, type: "event_scheduled",
+          title: `Project assigned: ${title}`,
+          description: `${user.firstName} ${user.lastName} assigned a project to you`,
+          link: "/calendar", context_id: r.id, context_type: "scheduled_event",
+        })
+      }
+      if (notifications.length > 0) {
+        const placeholders = notifications.map((_, i) =>
+          `($${i * 7 + 1}, $${i * 7 + 2}, $${i * 7 + 3}, $${i * 7 + 4}, $${i * 7 + 5}, $${i * 7 + 6}, $${i * 7 + 7})`
+        ).join(", ")
+        const flatParams = notifications.flatMap(n => [n.user_id, n.type, n.title, n.description, n.link, n.context_id, n.context_type])
+        await client.query(
+          `INSERT INTO notifications (user_id, type, title, description, link, context_id, context_type) VALUES ${placeholders}`,
+          flatParams,
        )
      }
-    }

-    if (participantId && participantId !== user.id) {
-      await query(
-        `INSERT INTO notifications (user_id, type, title, description, link, context_id, context_type)
-         VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-        [
-          participantId,
-          "event_scheduled",
-          `Meeting scheduled: ${title}`,
-          `${user.firstName} ${user.lastName} scheduled a ${eventType || "meeting"} with you`,
-          `/calendar`,
-          r.id,
-          "scheduled_event",
-        ],
-      )
-    }
+      // 4. Fetch participant + developer in one query
+      const idsToFetch = [participantId, developerId].filter(Boolean) as string[]
+      let usersMap: Record<string, { id: string; first_name: string; last_name: string; email: string }> = {}
+      if (idsToFetch.length > 0) {
+        const userPlaceholders = idsToFetch.map((_, i) => `$${i + 1}`).join(", ")
+        const userRows = await client.query(
+          `SELECT id, first_name, last_name, email FROM users WHERE id IN (${userPlaceholders})`,
+          idsToFetch,
+        )
+        for (const row of userRows.rows) {
+          usersMap[row.id] = row
+        }
+      }

-    // Notify developer
-    if (developerId && developerId !== user.id) {
-      await query(
-        `INSERT INTO notifications (user_id, type, title, description, link, context_id, context_type)
-         VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-        [
-          developerId,
-          "event_scheduled",
-          `Project assigned: ${title}`,
-          `${user.firstName} ${user.lastName} assigned a project to you`,
-          `/calendar`,
-          r.id,
-          "scheduled_event",
-        ],
-      )
-    }
+      return { r, usersMap }
+    }, user.id)

-    const participantResult = participantId ? await query(
-      `SELECT email, first_name, last_name FROM users WHERE id = $1`,
-      [participantId],
-    ) : null
-    const participant = participantResult?.rows[0] || null
-
-    const developerResult = developerId ? await query(
-      `SELECT id, first_name, last_name, email FROM users WHERE id = $1`,
-      [developerId],
-    ) : null
-    const dev = developerResult?.rows[0] || null
+    const { r, usersMap } = result
+    const participant = participantId ? usersMap[participantId] || null : null
+    const dev = developerId ? usersMap[developerId] || null : null

+    // Email sent asynchronously outside transaction (side effect)
    sendEventConfirmation({
      creatorName: `${user.firstName} ${user.lastName}`,
      creatorEmail: user.email,
@@ -215,28 +213,16 @@ export async function POST(request: NextRequest) {

    return NextResponse.json({
      event: {
-        id: r.id,
-        userId: r.user_id,
-        participantId: r.participant_id,
-        developerId: r.developer_id,
-        leadId: r.lead_id,
-        conversationId: r.conversation_id,
-        title: r.title,
-        description: r.description,
-        participantNotes: r.participant_notes,
-        eventType: r.event_type,
-        startTime: r.start_time,
-        endTime: r.end_time,
-        durationMinutes: r.duration_minutes,
-        status: r.status,
+        id: r.id, userId: r.user_id, participantId: r.participant_id, developerId: r.developer_id,
+        leadId: r.lead_id, conversationId: r.conversation_id,
+        title: r.title, description: r.description, participantNotes: r.participant_notes,
+        eventType: r.event_type, startTime: r.start_time, endTime: r.end_time,
+        durationMinutes: r.duration_minutes, status: r.status, createdAt: r.created_at,
        creator: { id: user.id, name: `${user.firstName} ${user.lastName}`, email: user.email, role: user.role },
-        participant: participantId ? { id: participantId, name: participant ? `${participant.first_name} ${participant.last_name}` : participantId, email: participant?.email || null } : null,
+        participant: participant ? { id: participantId, name: `${participant.first_name} ${participant.last_name}`, email: participant.email } : null,
        developer: dev ? { id: dev.id, name: `${dev.first_name} ${dev.last_name}`, email: dev.email } : null,
        lead: leadId ? { id: leadId, companyName: "", contactName: "" } : null,
-        clientName: r.client_name || null,
-        clientEmail: r.client_email || null,
-        clientPhone: r.client_phone || null,
-        createdAt: r.created_at,
+        clientName: r.client_name || null, clientEmail: r.client_email || null, clientPhone: r.client_phone || null,
      },
    }, { status: 201 })
  } catch (error) {
@@ -1,15 +1,38 @@
 import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser, setSessionContext } from "@/lib/auth"
 import { query } from "@/lib/db"
 import crypto from "crypto"

 export async function POST(request: NextRequest) {
  try {
-    const { phone, token: clientToken } = await request.json()
+    const sessionUser = await getSessionUser()
+    if (!sessionUser) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    }
+    if (sessionUser.role !== "super_admin") {
+      return NextResponse.json({ error: "Only SUPER_ADMIN can generate invites." }, { status: 403 })
+    }
+
+    const { phone } = await request.json()
    if (!phone) {
      return NextResponse.json({ error: "Phone number required" }, { status: 400 })
    }

-    const token = clientToken || crypto.randomBytes(24).toString("hex")
+    const ipAddress =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "127.0.0.1"
+
+    await setSessionContext(sessionUser.id, ipAddress)
+
+    const recentCount = await query(
+      `SELECT COUNT(*) AS cnt FROM invites WHERE created_at > NOW() - INTERVAL '1 hour'`,
+    )
+    if (parseInt(recentCount.rows[0]?.cnt || "0", 10) >= 10) {
+      return NextResponse.json({ error: "Rate limit exceeded. Try again later." }, { status: 429 })
+    }
+
+    const token = crypto.randomBytes(24).toString("hex")
    await query(
      `INSERT INTO invites (token, phone) VALUES ($1, $2)`,
      [token, phone],
@@ -19,7 +42,8 @@ export async function POST(request: NextRequest) {
    const inviteUrl = `${origin}/join/${token}`

    return NextResponse.json({ token, inviteUrl })
-  } catch {
+  } catch (error) {
+    console.error("Invite generation error:", error)
    return NextResponse.json({ error: "Failed to generate invite" }, { status: 500 })
  }
 }
@@ -43,47 +43,74 @@ export async function GET(request: NextRequest) {
    const offset = parseInt(searchParams.get("offset") || "0", 10)
    const isAdmin = user.role === "admin" || user.role === "super_admin"

-    let sql = `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
-                      l.assigned_to, l.created_at, l.updated_at, l.notes, l.source_id,
-                      ls.name AS stage_name,
-                      u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
-               FROM leads l
-               JOIN lead_stages ls ON ls.id = l.stage_id
-               LEFT JOIN users u ON u.id = l.assigned_to
-               WHERE l.deleted_at IS NULL`
-
    const params: any[] = []
    let paramIdx = 1

+    const conditions: string[] = ["l.deleted_at IS NULL"]
+
    if (period !== "all") {
      const range = getPeriodDateRange(period)
      if (range) {
-        sql += ` AND l.created_at >= $${paramIdx} AND l.created_at <= $${paramIdx + 1}`
+        conditions.push(`l.created_at >= $${paramIdx} AND l.created_at <= $${paramIdx + 1}`)
        params.push(range.start.toISOString(), range.end.toISOString())
        paramIdx += 2
      }
    }

    if (search) {
-      sql += ` AND (l.contact_name ILIKE $${paramIdx} OR l.company_name ILIKE $${paramIdx} OR l.email ILIKE $${paramIdx} OR l.phone ILIKE $${paramIdx})`
+      conditions.push(`(l.contact_name ILIKE $${paramIdx} OR l.company_name ILIKE $${paramIdx} OR l.email ILIKE $${paramIdx} OR l.phone ILIKE $${paramIdx})`)
      params.push(`%${search}%`)
      paramIdx++
    }

    if (!isAdmin) {
-      sql += ` AND l.assigned_to = $${paramIdx}`
+      conditions.push(`l.assigned_to = $${paramIdx}`)
      params.push(user.id)
      paramIdx++
    }

-    sql += ` ORDER BY l.created_at DESC`
-    sql += ` LIMIT $${paramIdx} OFFSET $${paramIdx + 1}`
-    params.push(limit, offset)
-    paramIdx += 2
+    // Push status filter into SQL (avoid client-side filtering after pagination)
+    const statusStageMap: Record<string, string[]> = {
+      open: ["New"],
+      contacted: ["Contacted"],
+      pending: ["Qualified", "Interested", "Demo Scheduled", "Negotiation"],
+      closed: ["Closed Won"],
+      ignored: ["Closed Lost"],
+    }
+    if (status !== "all") {
+      const stageNames = statusStageMap[status]
+      if (stageNames) {
+        const stagePlaceholders = stageNames.map((_, i) => `$${paramIdx + i}`)
+        conditions.push(`ls.name IN (${stagePlaceholders.join(", ")})`)
+        params.push(...stageNames)
+        paramIdx += stageNames.length
+      }
+    }

-    const result = await query(sql, params)
+    const whereClause = conditions.join(" AND ")

-    let leads = result.rows.map((r: any) => {
+    // Total count (same filters, no pagination)
+    const countResult = await query(
+      `SELECT COUNT(*) AS total FROM leads l JOIN lead_stages ls ON ls.id = l.stage_id WHERE ${whereClause}`,
+      params.slice(0, paramIdx - 1),
+    )
+    const total = parseInt(countResult.rows[0]?.total || "0", 10)
+
+    // Data query with pagination
+    const dataSql = `SELECT l.id, l.company_name, l.contact_name, l.email, l.phone, l.score,
+                            l.assigned_to, l.created_at, l.updated_at, l.notes, l.source_id,
+                            ls.name AS stage_name,
+                            u.id AS user_id, u.first_name, u.last_name, u.email AS user_email, u.avatar_url
+                     FROM leads l
+                     JOIN lead_stages ls ON ls.id = l.stage_id
+                     LEFT JOIN users u ON u.id = l.assigned_to
+                     WHERE ${whereClause}
+                     ORDER BY l.created_at DESC
+                     LIMIT $${paramIdx} OFFSET $${paramIdx + 1}`
+    const dataParams = [...params, limit, offset]
+    const result = await query(dataSql, dataParams)
+
+    const leads = result.rows.map((r: any) => {
      const s = stageToStatus(r.stage_name)
      return {
        id: r.id,
@@ -106,11 +133,7 @@ export async function GET(request: NextRequest) {
      }
    })

-    if (status !== "all") {
-      leads = leads.filter((l: any) => l.status === status)
-    }
-
-    return NextResponse.json(leads)
+    return NextResponse.json({ leads, total })
  } catch (error) {
    console.error("Leads API error:", error)
    return NextResponse.json({ error: "Failed to load leads" }, { status: 500 })
@@ -8,12 +8,13 @@ export async function GET() {
    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

    const result = await query(
-      `SELECT preferences->>'website_theme' AS website_theme FROM users WHERE id = $1`,
+      `SELECT preferences->>'website_theme' AS website_theme, preferences->>'color_theme' AS color_theme FROM users WHERE id = $1`,
      [user.id],
    )

    const websiteTheme = result.rows[0]?.website_theme || "default"
-    return NextResponse.json({ websiteTheme })
+    const colorTheme = result.rows[0]?.color_theme || null
+    return NextResponse.json({ websiteTheme, colorTheme })
  } catch (error) {
    console.error("Website theme GET error:", error)
    return NextResponse.json({ error: "Failed to load website theme" }, { status: 500 })
@@ -26,14 +27,31 @@ export async function PUT(request: NextRequest) {
    if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

    const body = await request.json()
-    const theme = body.websiteTheme || "default"
+    const update: Record<string, string> = {}
+    if (body.websiteTheme !== undefined) {
+      update.website_theme = body.websiteTheme || "default"
+    }
+    if (body.colorTheme !== undefined) {
+      update.color_theme = body.colorTheme || "default"
+    }

-    await query(
-      `UPDATE users SET preferences = preferences || $2::jsonb WHERE id = $1`,
-      [user.id, JSON.stringify({ website_theme: theme })],
+    if (Object.keys(update).length > 0) {
+      await query(
+        `UPDATE users SET preferences = preferences || $2::jsonb WHERE id = $1`,
+        [user.id, JSON.stringify(update)],
+      )
+    }
+
+    const result = await query(
+      `SELECT preferences->>'website_theme' AS website_theme, preferences->>'color_theme' AS color_theme FROM users WHERE id = $1`,
+      [user.id],
    )

-    return NextResponse.json({ success: true, websiteTheme: theme })
+    return NextResponse.json({
+      success: true,
+      websiteTheme: result.rows[0]?.website_theme || "default",
+      colorTheme: result.rows[0]?.color_theme || null,
+    })
  } catch (error) {
    console.error("Website theme PUT error:", error)
    return NextResponse.json({ error: "Failed to save website theme" }, { status: 500 })
@@ -1,7 +1,17 @@
 import { NextRequest, NextResponse } from "next/server"
+import { getSessionUser } from "@/lib/auth"
 import { query } from "@/lib/db"

 export async function GET(request: NextRequest) {
+  const sessionUser = await getSessionUser()
+  if (!sessionUser) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+  }
+
+  if (sessionUser.role !== "super_admin" && sessionUser.role !== "admin") {
+    return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+  }
+
  const phone = request.nextUrl.searchParams.get("phone")
  if (!phone) {
    return NextResponse.json({ error: "Phone parameter required" }, { status: 400 })
@@ -33,6 +33,11 @@ export default function RootLayout({
  return (
    <html lang="en" suppressHydrationWarning>
      <body className={`${inter.variable} min-h-screen antialiased`}>
+        <script
+          dangerouslySetInnerHTML={{
+            __html: `(function(){try{var t=localStorage.getItem("crm-color-theme");if(t&&t!=="default")document.documentElement.classList.add(t);var w=localStorage.getItem("crm-website-theme");if(w==="spidey")document.documentElement.classList.add("theme-spidey")}catch(e){}})()`,
+          }}
+        />
        <ThemeProvider attribute="class" defaultTheme="light" disableTransitionOnChange>
          <WebsiteThemeProvider>
            {children}
@@ -36,6 +36,7 @@ function formatContent(text: string) {
 interface ChatMessage {
  role: "user" | "assistant"
  content: string
+  ts?: number
  gif?: {
    url: string
    previewUrl: string
@@ -48,7 +49,12 @@ interface AIChatProps {
 }


-export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatProps>(({ onMessageSent }, ref) => {
+export interface AIChatHandle {
+  fillInput: (text: string) => void
+  addAssistantMessage: (content: string) => void
+}
+
+export const AIChat = forwardRef<AIChatHandle, AIChatProps>(({ onMessageSent }, ref) => {
  const [messages, setMessages] = useState<ChatMessage[]>([])
  const [input, setInput] = useState("")
  const [loading, setLoading] = useState(false)
@@ -66,6 +72,17 @@ export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatPr
      setInput(text)
      setTimeout(() => textareaRef.current?.focus(), 50)
    },
+    addAssistantMessage(content: string) {
+      setMessages((prev) => {
+        if (!prev.some((m) => m.role === "user")) {
+          return [
+            { role: "user", content: "Search Facebook" },
+            { role: "assistant", content },
+          ]
+        }
+        return [...prev, { role: "assistant", content }]
+      })
+    },
  }), [])

  const handleGifSelect = useCallback((gif: { url: string; previewUrl: string; title: string }) => {
@@ -85,14 +102,20 @@ export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatPr
    }
  }, [showGifPicker])

+  const _WEEK_MS = 604800000
+
  useEffect(() => {
    const saved = localStorage.getItem("ai-chat-messages")
    if (saved) {
      try {
-        const parsed = JSON.parse(saved)
+        let parsed = JSON.parse(saved)
        if (Array.isArray(parsed) && parsed.length > 0) {
-          setMessages(parsed)
-          loadedFromStorage.current = true
+          const cutoff = Date.now() - _WEEK_MS
+          parsed = parsed.filter((m: any) => !m.ts || m.ts > cutoff)
+          if (parsed.length > 0) {
+            setMessages(parsed)
+            loadedFromStorage.current = true
+          }
        }
      } catch {}
    } else {
@@ -102,7 +125,8 @@ export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatPr

  useEffect(() => {
    if (messages.length > 0) {
-      localStorage.setItem("ai-chat-messages", JSON.stringify(messages))
+      const now = Date.now()
+      localStorage.setItem("ai-chat-messages", JSON.stringify(messages.map(m => ({ ...m, ts: m.ts || now }))))
    }
  }, [messages])

@@ -124,6 +148,7 @@ export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatPr
  }, [])

  useEffect(() => {
+    checkServer()
    if (loadedFromStorage.current) return
    fetch("/api/ai/jobs")
      .then((r) => r.json())
@@ -153,7 +178,6 @@ export const AIChat = forwardRef<{ fillInput: (text: string) => void }, AIChatPr
          },
        ])
      })
-    checkServer()
  }, [checkServer])

  useEffect(() => {
@@ -1,7 +1,7 @@
 "use client"

 import { useState, useEffect } from "react"
-import { Briefcase, ChevronDown, Loader2 } from "lucide-react"
+import { Briefcase, ChevronDown, Loader2, Search } from "lucide-react"

 interface Job {
  job_title: string
@@ -12,9 +12,11 @@ interface Job {

 interface JobSelectorProps {
  onSelect: (job: Job | null) => void
+  onSearch?: (job: Job) => void
+  searching?: boolean
 }

-export function JobSelector({ onSelect }: JobSelectorProps) {
+export function JobSelector({ onSelect, onSearch, searching }: JobSelectorProps) {
  const [jobs, setJobs] = useState<Job[]>([])
  const [loading, setLoading] = useState(true)
  const [open, setOpen] = useState(false)
@@ -39,36 +41,47 @@ export function JobSelector({ onSelect }: JobSelectorProps) {
      <button
        type="button"
        onClick={() => setOpen(!open)}
-        className="w-full flex items-center gap-2.5 bg-[#1a1d2e] border border-[#ffffff0f] hover:border-primary/30 rounded-xl px-4 py-3 text-sm text-[#9ca3af] hover:text-[#e5e7eb] transition-all duration-200"
+        className="w-full flex items-center gap-2.5 bg-card/50 border border-border hover:border-primary/20 rounded-xl px-4 py-3 text-sm text-muted-foreground hover:text-foreground transition-all duration-200"
      >
-        <Briefcase className="h-4 w-4 text-primary flex-none" />
+        <Briefcase className="h-4 w-4 text-[#f97316] flex-none" />
        <span className="flex-1 text-left truncate">
          {selected ? selected.job_title : loading ? "Loading jobs..." : "Select a job category"}
        </span>
-        {loading ? <Loader2 className="h-3.5 w-3.5 animate-spin text-primary" /> : <ChevronDown className={`h-3.5 w-3.5 text-[#4b5563] transition-transform duration-200 ${open ? "rotate-180" : ""}`} />}
+        {loading ? <Loader2 className="h-3.5 w-3.5 animate-spin text-primary" /> : <ChevronDown className={`h-3.5 w-3.5 text-muted-foreground/60 transition-transform duration-200 ${open ? "rotate-180" : ""}`} />}
      </button>

      {open && (
        <>
          <div className="fixed inset-0 z-10" onClick={() => setOpen(false)} />
-          <div className="absolute top-full left-0 right-0 mt-1.5 z-20 bg-[#1a1d2e] border border-[#ffffff0f] rounded-xl shadow-xl shadow-black/40 max-h-60 overflow-y-auto">
+          <div className="absolute top-full left-0 right-0 mt-1.5 z-20 bg-card border border-border rounded-xl shadow-xl max-h-60 overflow-y-auto">
            {jobs.map((job, i) => (
              <button
                key={i}
                type="button"
                onClick={() => handleSelect(job)}
-                className="w-full text-left px-4 py-3 text-sm text-[#9ca3af] hover:bg-[#1f2437] hover:text-[#e5e7eb] transition-all duration-150 border-b border-[#ffffff08] last:border-0 border-l-2 border-l-transparent hover:border-l-primary/40"
+                className="w-full text-left px-4 py-3 text-sm text-muted-foreground hover:bg-muted hover:text-foreground transition-all duration-150 border-b border-border/20 last:border-b-0 border-l-2 border-l-transparent hover:border-l-primary/40"
              >
                <div className="font-medium">{job.job_title}</div>
-                <div className="text-xs text-[#4b5563] mt-0.5">{job.industry} &mdash; {job.description}</div>
+                <div className="text-xs text-muted-foreground/60 mt-0.5">{job.industry} — {job.description}</div>
              </button>
            ))}
            {jobs.length === 0 && !loading && (
-              <div className="px-4 py-4 text-xs text-[#4b5563] text-center">No job categories loaded</div>
+              <div className="px-4 py-4 text-xs text-muted-foreground/60 text-center">No job categories loaded</div>
            )}
          </div>
        </>
      )}
+      {selected && onSearch && (
+        <button
+          type="button"
+          onClick={() => onSearch(selected)}
+          disabled={searching}
+          className="w-full flex items-center justify-center gap-2 mt-3 bg-primary hover:bg-primary/90 disabled:opacity-50 disabled:cursor-not-allowed text-primary-foreground text-sm font-semibold rounded-xl px-4 py-3 transition-all duration-200 shadow-lg shadow-primary/20"
+        >
+          {searching ? <Loader2 className="h-4 w-4 animate-spin" /> : <Search className="h-4 w-4" />}
+          {searching ? "Searching..." : "Search Facebook"}
+        </button>
+      )}
    </div>
  )
 }
@@ -8,6 +8,7 @@ import { Search, Image, Sticker, X, Loader2, TrendingUp } from "lucide-react"
 import data from "@emoji-mart/data"
 import Picker from "@emoji-mart/react"
 import { getStickerPacks, type StickerPack } from "@/data/stickers"
+import { sanitizeSvg } from "@/lib/sanitize"

 type Tab = "emoji" | "gif" | "sticker"

@@ -287,7 +288,7 @@ export default function MediaPicker({ onEmojiSelect, onMediaSelect, onClose, the
                  className="rounded-xl bg-muted/30 hover:bg-muted/60 transition-colors flex items-center justify-center p-2 aspect-square"
                >
                  {sticker.svg ? (
-                    <div className="w-full h-full flex items-center justify-center" dangerouslySetInnerHTML={{ __html: sticker.svg.replace(/<svg /, '<svg style="width:100%;height:100%" ') }} />
+                    <div className="w-full h-full flex items-center justify-center" dangerouslySetInnerHTML={{ __html: sanitizeSvg(sticker.svg).replace(/<svg /, '<svg style="width:100%;height:100%" ') }} />
                  ) : (
                    <span className="text-5xl">{sticker.emoji}</span>
                  )}
@@ -303,7 +304,7 @@ export default function MediaPicker({ onEmojiSelect, onMediaSelect, onClose, the
                    if (!s) return null
                    return (
                      <button key={s.id} type="button" onClick={() => handleStickerSelect(s)} className="rounded-xl bg-muted/30 hover:bg-muted/60 transition-colors flex items-center justify-center p-2 aspect-square opacity-70 hover:opacity-100">
-                        {s.svg ? <div className="w-full h-full flex items-center justify-center" dangerouslySetInnerHTML={{ __html: s.svg.replace(/<svg /, '<svg style="width:100%;height:100%" ') }} /> : <span className="text-5xl">{s.emoji}</span>}
+                        {s.svg ? <div className="w-full h-full flex items-center justify-center" dangerouslySetInnerHTML={{ __html: sanitizeSvg(s.svg).replace(/<svg /, '<svg style="width:100%;height:100%" ') }} /> : <span className="text-5xl">{s.emoji}</span>}
                      </button>
                    )
                  })}
@@ -9,8 +9,6 @@ import { cn } from "@/lib/utils"
 import { Sun, Moon, Monitor, Palette, Shield } from "lucide-react"
 import { useWebsiteTheme } from "@/providers/website-theme-provider"

-const COLOR_THEME_KEY = "crm-color-theme"
-
 const modeOptions = [
  { value: "light", icon: Sun, label: "Light" },
  { value: "dark", icon: Moon, label: "Dark" },
@@ -35,38 +33,15 @@ const backgroundOptions = [
  { value: "spidey", label: "Spidey", icon: Shield, color: "bg-red-600", ring: "ring-red-600", desc: "Dark theme with red accents" },
 ]

-function getStoredColorTheme(): string {
-  if (typeof window === "undefined") return "default"
-  return localStorage.getItem(COLOR_THEME_KEY) || "default"
-}
-
-function applyColorTheme(theme: string) {
-  const colorThemes = ["default","ocean","forest","sunset","midnight","rose","amber","violet","slate","ruby"]
-  const classes = document.documentElement.className.split(" ").filter(c => !colorThemes.includes(c))
-  if (theme !== "default") {
-    classes.push(theme)
-  }
-  document.documentElement.className = classes.join(" ").trim()
-  localStorage.setItem(COLOR_THEME_KEY, theme)
-}
-
 export function ThemeSettings() {
  const { theme, setTheme } = useTheme()
-  const { websiteTheme, setWebsiteTheme } = useWebsiteTheme()
-  const [colorTheme, setColorTheme] = useState("default")
+  const { websiteTheme, setWebsiteTheme, colorTheme, setColorTheme } = useWebsiteTheme()
  const [mounted, setMounted] = useState(false)

  useEffect(() => {
    setMounted(true)
-    setColorTheme(getStoredColorTheme())
-    applyColorTheme(getStoredColorTheme())
  }, [])

-  function handleColorChange(value: string) {
-    setColorTheme(value)
-    applyColorTheme(value)
-  }
-
  if (!mounted) return null

  return (
@@ -86,7 +61,8 @@ export function ThemeSettings() {
                <Label
                  htmlFor={`mode-${value}`}
                  className={cn(
-                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 hover:bg-accent cursor-pointer transition-all",
+                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 cursor-pointer transition-all",
+                    value === "dark" ? "hover:bg-muted" : "hover:bg-accent",
                    "peer-data-[state=checked]:border-primary peer-data-[state=checked]:bg-primary/5"
                  )}
                >
@@ -107,14 +83,14 @@ export function ThemeSettings() {
          </CardDescription>
        </CardHeader>
        <CardContent>
-          <RadioGroup value={colorTheme} onValueChange={handleColorChange} className="grid grid-cols-5 gap-4">
+          <RadioGroup value={colorTheme} onValueChange={setColorTheme} className="grid grid-cols-5 gap-4">
            {themeOptions.map(({ value, label, color, ring }) => (
              <div key={value}>
                <RadioGroupItem value={value} id={`color-${value}`} className="peer sr-only" />
                <Label
                  htmlFor={`color-${value}`}
                  className={cn(
-                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 hover:bg-accent cursor-pointer transition-all",
+                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 hover:bg-muted cursor-pointer transition-all",
                    "peer-data-[state=checked]:border-primary peer-data-[state=checked]:bg-primary/5"
                  )}
                >
@@ -142,7 +118,7 @@ export function ThemeSettings() {
                <Label
                  htmlFor={`bg-${value}`}
                  className={cn(
-                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 hover:bg-accent cursor-pointer transition-all",
+                    "flex flex-col items-center gap-3 rounded-lg border-2 p-4 hover:bg-muted cursor-pointer transition-all",
                    "peer-data-[state=checked]:border-primary peer-data-[state=checked]:bg-primary/5"
                  )}
                >
@@ -1,21 +1,7 @@
-import { SignJWT, jwtVerify } from "jose";
 import bcrypt from "bcryptjs";
 import { query } from "@/lib/db";
 import { cookies } from "next/headers";
-
-function randomHex(length: number): string {
-  const chars = "abcdef0123456789";
-  let result = "";
-  for (let i = 0; i < length; i++) {
-    result += chars[Math.floor(Math.random() * chars.length)];
-  }
-  return result;
-}
-
-const g = globalThis as typeof globalThis & { __JWT_RAW_SECRET?: string };
-const RAW_SECRET = process.env.JWT_SECRET || (g.__JWT_RAW_SECRET ??= randomHex(32));
-if (!RAW_SECRET) throw new Error("JWT_SECRET environment variable is required");
-const JWT_SECRET = new TextEncoder().encode(RAW_SECRET);
+import { signToken, verifyToken } from "@/lib/jwt";

 export const SESSION_COOKIE = "session";
 const MAX_FAILED_ATTEMPTS = 5;
@@ -43,23 +29,6 @@ export async function comparePassword(
  return bcrypt.compare(password, hash);
 }

-export async function signToken(payload: { userId: string; role: string }) {
-  return new SignJWT(payload)
-    .setProtectedHeader({ alg: "HS256" })
-    .setExpirationTime("24h")
-    .setIssuedAt()
-    .sign(JWT_SECRET);
-}
-
-export async function verifyToken(token: string) {
-  try {
-    const { payload } = await jwtVerify(token, JWT_SECRET);
-    return payload as { userId: string; role: string };
-  } catch {
-    return null;
-  }
-}
-
 export async function getUserByEmail(email: string) {
  const result = await query(
    `    SELECT u.id, u.username, u.email, u.password_hash, u.first_name, u.last_name,
@@ -221,7 +190,7 @@ export async function decryptPassword(encrypted: string): Promise<string | null>
 }

 export async function setSessionContext(userId: string, ip?: string) {
-  await query("SELECT set_config('app.current_user_id', $1, true)", [userId]);
+  await query("SELECT set_session_user_context($1)", [userId]);
  if (ip) {
    await query("SELECT set_config('app.current_ip', $1, true)", [ip]);
  }
@@ -1,4 +1,4 @@
-import { Pool } from "pg"
+import { Pool, PoolClient } from "pg"

 const dbUrl = process.env.DATABASE_URL
 if (!dbUrl) {
@@ -9,6 +9,8 @@ const pool = new Pool({
  max: 20,
  idleTimeoutMillis: 30000,
  connectionTimeoutMillis: 5000,
+  statement_timeout: 30000,
+  idle_in_transaction_session_timeout: 10000,
  ssl: dbUrl.includes("localhost") || dbUrl.includes("127.0.0.1") ? false : { rejectUnauthorized: false },
 })

@@ -29,4 +31,25 @@ export async function query(text: string, params?: unknown[], userId?: string) {
  }
 }

+export async function transaction<T>(
+  callback: (client: PoolClient) => Promise<T>,
+  userId?: string,
+): Promise<T> {
+  const client = await pool.connect()
+  try {
+    await client.query("BEGIN")
+    if (userId) {
+      await client.query("SELECT set_config('app.current_user_id', $1, true)", [userId])
+    }
+    const result = await callback(client)
+    await client.query("COMMIT")
+    return result
+  } catch (e) {
+    await client.query("ROLLBACK").catch(() => {})
+    throw e
+  } finally {
+    client.release()
+  }
+}
+
 export default pool
@@ -0,0 +1,34 @@
+import { jwtVerify, SignJWT } from "jose"
+
+let encoded: Uint8Array
+
+export function getJWTSecret(): Uint8Array {
+  if (!encoded) {
+    const raw = process.env.JWT_SECRET
+    if (!raw) {
+      throw new Error(
+        "JWT_SECRET environment variable is required. " +
+          "Generate one: openssl rand -hex 32",
+      )
+    }
+    encoded = new TextEncoder().encode(raw)
+  }
+  return encoded
+}
+
+export async function verifyToken(token: string) {
+  try {
+    const { payload } = await jwtVerify(token, getJWTSecret())
+    return payload as { userId: string; role: string }
+  } catch {
+    return null
+  }
+}
+
+export async function signToken(payload: { userId: string; role: string }) {
+  return new SignJWT(payload)
+    .setProtectedHeader({ alg: "HS256" })
+    .setExpirationTime("24h")
+    .setIssuedAt()
+    .sign(getJWTSecret())
+}
@@ -0,0 +1,6 @@
+export function sanitizeSvg(svg: string): string {
+  return svg
+    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "")
+    .replace(/\bon\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
+    .replace(/javascript\s*:/gi, "")
+}
@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server"
 import type { NextRequest } from "next/server"
+import { verifyToken } from "@/lib/jwt"

 const publicRoutes = [
  "/login",
@@ -12,6 +13,8 @@ const publicRoutes = [
  "/fonts",
 ]

+const SESSION_COOKIE = "session"
+
 export async function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl

@@ -23,9 +26,9 @@ export async function middleware(request: NextRequest) {
    return NextResponse.next()
  }

-  const sessionCookie = request.cookies.get("session")?.value
+  const token = request.cookies.get(SESSION_COOKIE)?.value

-  if (!sessionCookie) {
+  if (!token) {
    if (pathname.startsWith("/api/")) {
      return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
    }
@@ -34,7 +37,21 @@ export async function middleware(request: NextRequest) {
    return NextResponse.redirect(loginUrl)
  }

-  return NextResponse.next()
+  const payload = await verifyToken(token)
+  if (!payload) {
+    if (pathname.startsWith("/api/")) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
+    }
+    const loginUrl = new URL("/login", request.url)
+    loginUrl.searchParams.set("redirect", pathname)
+    return NextResponse.redirect(loginUrl)
+  }
+
+  const requestHeaders = new Headers(request.headers)
+  requestHeaders.set("x-user-id", payload.userId)
+  requestHeaders.set("x-user-role", payload.role)
+
+  return NextResponse.next({ request: { headers: requestHeaders } })
 }

 export const config = {
@@ -3,14 +3,19 @@
 import { createContext, useContext, useState, useEffect, ReactNode, useCallback } from "react"

 const WEBSITE_THEME_KEY = "crm-website-theme"
+const COLOR_THEME_KEY = "crm-color-theme"

 const themeClasses: Record<string, string> = {
  spidey: "theme-spidey",
 }

+const colorThemes = ["default","ocean","forest","sunset","midnight","rose","amber","violet","slate","ruby"]
+
 interface WebsiteThemeContextValue {
  websiteTheme: string
  setWebsiteTheme: (theme: string) => Promise<void>
+  colorTheme: string
+  setColorTheme: (theme: string) => Promise<void>
  loading: boolean
 }

@@ -27,9 +32,19 @@ function applyWebsiteTheme(theme: string) {
  root.className = classes.join(" ").trim()
 }

-function getStoredTheme(): string | null {
+function applyColorTheme(theme: string) {
+  const root = document.documentElement
+  const classes = root.className.split(" ").filter((c) => !colorThemes.includes(c))
+  if (theme !== "default") {
+    classes.push(theme)
+  }
+  root.className = classes.join(" ").trim()
+  localStorage.setItem(COLOR_THEME_KEY, theme)
+}
+
+function getStored(key: string): string | null {
  if (typeof window === "undefined") return null
-  return localStorage.getItem(WEBSITE_THEME_KEY)
+  return localStorage.getItem(key)
 }

 function storeTheme(theme: string) {
@@ -39,22 +54,40 @@ function storeTheme(theme: string) {

 export function WebsiteThemeProvider({ children }: { children: ReactNode }) {
  const [websiteTheme, setWebsiteThemeState] = useState<string>("default")
+  const [colorTheme, setColorThemeState] = useState<string>("default")
  const [loading, setLoading] = useState(true)

  useEffect(() => {
    fetch("/api/settings/website-theme")
      .then((res) => (res.ok ? res.json() : null))
      .then((data) => {
-        const theme = data?.websiteTheme || "default"
-        setWebsiteThemeState(theme)
-        storeTheme(theme)
-        applyWebsiteTheme(theme)
+        const wt = data?.websiteTheme || "default"
+        setWebsiteThemeState(wt)
+        storeTheme(wt)
+        applyWebsiteTheme(wt)
+
+        if (data?.colorTheme) {
+          setColorThemeState(data.colorTheme)
+          applyColorTheme(data.colorTheme)
+        } else {
+          const stored = getStored(COLOR_THEME_KEY)
+          if (stored) {
+            setColorThemeState(stored)
+            applyColorTheme(stored)
+          }
+        }
      })
      .catch(() => {
-        const stored = getStoredTheme()
+        const stored = getStored(WEBSITE_THEME_KEY)
        const theme = stored || "default"
        setWebsiteThemeState(theme)
        applyWebsiteTheme(theme)
+
+        const storedColor = getStored(COLOR_THEME_KEY)
+        if (storedColor) {
+          setColorThemeState(storedColor)
+          applyColorTheme(storedColor)
+        }
      })
      .finally(() => setLoading(false))
  }, [])
@@ -74,8 +107,22 @@ export function WebsiteThemeProvider({ children }: { children: ReactNode }) {
    }
  }, [])

+  const setColorTheme = useCallback(async (theme: string) => {
+    setColorThemeState(theme)
+    applyColorTheme(theme)
+    try {
+      await fetch("/api/settings/website-theme", {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ colorTheme: theme }),
+      })
+    } catch {
+      console.warn("Failed to persist color theme")
+    }
+  }, [])
+
  return (
-    <WebsiteThemeContext.Provider value={{ websiteTheme, setWebsiteTheme, loading }}>
+    <WebsiteThemeContext.Provider value={{ websiteTheme, setWebsiteTheme, colorTheme, setColorTheme, loading }}>
      {children}
    </WebsiteThemeContext.Provider>
  )
@@ -0,0 +1,44 @@
+import { describe, it, expect } from "vitest"
+
+const API_BASE = "http://localhost:3006"
+
+async function loginAs(role: string) {
+  const credentials: Record<string, { email: string; password: string }> = {
+    admin: { email: "admin@coastit.co.za", password: "AdminAccess@2026" },
+    superadmin: { email: "superadmin@coastit.co.za", password: "SuperAdmin@2026" },
+    sales: { email: "sales@coastit.co.za", password: "SalesAccess@2026" },
+    dev: { email: "dev@coastit.co.za", password: "DevTesting@2026" },
+  }
+  const cred = credentials[role]
+  if (!cred) return null
+  const res = await fetch(`${API_BASE}/api/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(cred),
+  })
+  if (res.status !== 200) return null
+  return res.headers.get("set-cookie")?.split(";")[0]
+}
+
+describe("Bug Reports", () => {
+  it("allows any authenticated user to submit a bug report", async () => {
+    const cookie = await loginAs("dev")
+    if (!cookie) return
+
+    const res = await fetch(`${API_BASE}/api/bug-reports`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Cookie: cookie },
+      body: JSON.stringify({ title: "Test bug", description: "This is a test bug report" }),
+    })
+    expect(res.status).toBe(200)
+  })
+
+  it("rejects unauthenticated bug report submission", async () => {
+    const res = await fetch(`${API_BASE}/api/bug-reports`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "Test", description: "Test" }),
+    })
+    expect(res.status).toBe(401)
+  })
+})
@@ -0,0 +1,59 @@
+import { describe, it, expect } from "vitest"
+
+// These tests require a running PostgreSQL database with the CRM schema.
+// Run: npm run dev (starts the server on port 3006)
+// Then: npx vitest run
+
+const API_BASE = "http://localhost:3006"
+
+async function loginAs(role: string) {
+  const credentials: Record<string, { email: string; password: string }> = {
+    admin: { email: "superadmin@coastit.co.za", password: "SuperAdmin@2026" },
+    sales: { email: "sales@coastit.co.za", password: "SalesAccess@2026" },
+  }
+  const cred = credentials[role] || credentials.admin
+  const res = await fetch(`${API_BASE}/api/auth/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(cred),
+  })
+  if (res.status !== 200) return null
+  const setCookie = res.headers.get("set-cookie")
+  return setCookie?.split(";")[0] // return the raw cookie value
+}
+
+describe("Leads API", () => {
+  it("creates a lead when authenticated", async () => {
+    const cookie = await loginAs("sales")
+    if (!cookie) return // skip if DB not available
+
+    const res = await fetch(`${API_BASE}/api/leads`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Cookie: cookie },
+      body: JSON.stringify({
+        company_name: "Test Company",
+        contact_name: "Test Contact",
+        email: "test@example.com",
+      }),
+    })
+    expect(res.status).toBe(200)
+
+    // Cleanup
+    const data = await res.json()
+    if (data?.id) {
+      await fetch(`${API_BASE}/api/leads/${data.id}`, {
+        method: "DELETE",
+        headers: { Cookie: cookie },
+      })
+    }
+  })
+
+  it("rejects unauthenticated lead creation", async () => {
+    const res = await fetch(`${API_BASE}/api/leads`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ company_name: "Test", contact_name: "Test", email: "test@test.com" }),
+    })
+    expect(res.status).toBe(401)
+  })
+})
@@ -0,0 +1,59 @@
+import { describe, it, expect, beforeAll, afterAll } from "vitest"
+
+// These tests require a running PostgreSQL database with the CRM schema.
+// Set DATABASE_URL env var or the default local connection will be used.
+//
+// Run: DATABASE_URL=postgresql://postgres:postgres@localhost:5432/crm_test npx vitest run
+
+const API_BASE = "http://localhost:3006"
+
+function skipIfNoDb() {
+  if (!process.env.CI && !process.env.DATABASE_URL?.includes("crm_test")) {
+    console.warn("Skipping DB-dependent tests. Set DATABASE_URL to a test database.")
+    return true
+  }
+  return false
+}
+
+describe("Login", () => {
+  it("returns 401 with wrong password", async () => {
+    if (skipIfNoDb()) return
+    const res = await fetch(`${API_BASE}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: "superadmin@coastit.co.za", password: "wrong" }),
+    })
+    expect(res.status).toBe(401)
+  })
+
+  it("returns 400 with empty body", async () => {
+    const res = await fetch(`${API_BASE}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({}),
+    })
+    expect(res.status).toBe(400)
+  })
+
+  it("returns 401 for non-existent user", async () => {
+    if (skipIfNoDb()) return
+    const res = await fetch(`${API_BASE}/api/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email: "nobody@example.com", password: "anything" }),
+    })
+    expect(res.status).toBe(401)
+  })
+})
+
+describe("Authorization", () => {
+  it("rejects unauthenticated requests to protected routes", async () => {
+    const res = await fetch(`${API_BASE}/api/leads`, { headers: { "Content-Type": "application/json" } })
+    expect(res.status).toBe(401)
+  })
+
+  it("rejects unauthenticated requests to dashboard", async () => {
+    const res = await fetch(`${API_BASE}/api/dashboard`, { headers: { "Content-Type": "application/json" } })
+    expect(res.status).toBe(401)
+  })
+})
@@ -0,0 +1,57 @@
+import { describe, it, expect } from "vitest"
+import { signToken, verifyToken } from "@/lib/jwt"
+
+process.env.JWT_SECRET = "test-secret-that-is-at-least-32-chars-long-for-security"
+
+describe("JWT", () => {
+  it("signs and verifies a valid token", async () => {
+    const token = await signToken({ userId: "user-1", role: "admin" })
+    expect(token).toBeTruthy()
+    expect(typeof token).toBe("string")
+
+    const payload = await verifyToken(token)
+    expect(payload).not.toBeNull()
+    expect(payload!.userId).toBe("user-1")
+    expect(payload!.role).toBe("admin")
+  })
+
+  it("rejects a tampered token", async () => {
+    const token = await signToken({ userId: "user-1", role: "admin" })
+    const tampered = token.slice(0, -5) + "XXXXX"
+    const payload = await verifyToken(tampered)
+    expect(payload).toBeNull()
+  })
+
+  it("rejects an expired token", async () => {
+    const { SignJWT } = await import("jose")
+    const { getJWTSecret } = await import("@/lib/jwt")
+    const expiredToken = await new SignJWT({ userId: "user-1", role: "admin" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setExpirationTime("0s")
+      .sign(getJWTSecret())
+    const payload = await verifyToken(expiredToken)
+    expect(payload).toBeNull()
+  })
+
+  it("rejects a token with invalid signature", async () => {
+    const { SignJWT } = await import("jose")
+    const wrongSecret = new TextEncoder().encode("different-secret-key-for-signing-purposes-only")
+    const token = await new SignJWT({ userId: "user-1", role: "admin" })
+      .setProtectedHeader({ alg: "HS256" })
+      .setExpirationTime("24h")
+      .setIssuedAt()
+      .sign(wrongSecret)
+    const payload = await verifyToken(token)
+    expect(payload).toBeNull()
+  })
+
+  it("returns null for empty token", async () => {
+    const payload = await verifyToken("")
+    expect(payload).toBeNull()
+  })
+
+  it("returns null for garbage token", async () => {
+    const payload = await verifyToken("this.is.not.a.jwt")
+    expect(payload).toBeNull()
+  })
+})
@@ -0,0 +1,42 @@
+import { describe, it, expect } from "vitest"
+import { sanitizeSvg } from "@/lib/sanitize"
+
+describe("sanitizeSvg", () => {
+  it("strips script tags", () => {
+    const input = `<svg><script>alert('xss')</script><rect width="100" height="100"/></svg>`
+    const result = sanitizeSvg(input)
+    expect(result).not.toContain("script")
+    expect(result).toContain("<svg")
+    expect(result).toContain("<rect")
+  })
+
+  it("strips event handler attributes", () => {
+    const input = `<svg onload="alert(1)"><rect width="100" height="100"/></svg>`
+    const result = sanitizeSvg(input)
+    expect(result).not.toContain("onload")
+    expect(result).toContain("<svg")
+    expect(result).toContain("<rect")
+  })
+
+  it("strips onclick attributes", () => {
+    const input = `<svg><rect onclick="evil()" width="100" height="100"/></svg>`
+    const result = sanitizeSvg(input)
+    expect(result).not.toContain("onclick")
+    expect(result).toContain("<rect")
+    expect(result).toContain('width="100"')
+  })
+
+  it("removes javascript: URLs", () => {
+    const input = `<svg><a href="javascript:alert(1)">click</a></svg>`
+    const result = sanitizeSvg(input)
+    expect(result).not.toContain("javascript:")
+  })
+
+  it("passes through clean SVGs unchanged (except whitespace)", () => {
+    const input = `<svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/></svg>`
+    const result = sanitizeSvg(input)
+    expect(result).toContain("viewBox")
+    expect(result).toContain("<circle")
+    expect(result).toContain('cx="12"')
+  })
+})
@@ -0,0 +1,14 @@
+import { defineConfig } from "vitest/config"
+import path from "path"
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: "node",
+  },
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./src"),
+    },
+  },
+})
Author	SHA1	Message	Date
Hannah_Bagga	c9c855579b	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Waiting to run Details	2026-07-10 14:44:01 +02:00
Hannah_Bagga	3a348e3616	Dark green hover fixed	2026-07-10 14:43:49 +02:00
Ace	dba4c84cd5	Added finishing touch on other languages Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-08 14:24:03 +02:00
Ace	d77ff2b965	Added logic to the 4 languages so it can search each language at a time Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-07 10:08:21 +02:00
Ace	0bc3ca58ed	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-07 10:03:38 +02:00
Ace	d793604e92	Added 4 Languages English, Afrikaans, Xhosa, Zulu, tested but brought leads down to 3 leads only will see how to make it more without losing effiency of the model.	2026-07-07 10:03:35 +02:00
TroodonEnjoyer	bc83af8e00	Started PostgreSQL — data directory was uninitialized, ran initdb, set password, switched to md5 auth, all 24 migrations applied. Build & Auto-Repair / build (push) Has been cancelled Details Hardened db.ts — added statement_timeout: 30000, idle_in_transaction_session_timeout: 10000, created transaction() helper (BEGIN/COMMIT/ROLLBACK). Multi-step API routes wrapped in transactions — Events POST, Conversations POST use atomic blocks. Fixed leads pagination — status filter pushed into SQL WHERE (no client-side filtering after LIMIT/OFFSET), added SELECT COUNT(*) for total. Rewrote dashboard — SQL aggregations (COUNT + GROUP BY + date_trunc) replace loading all leads into memory. Optimized conversations GET — merged duplicate correlated subqueries into single LEFT JOIN LATERAL. Created migration 021_performance_indexes.sql — 8 missing indexes + set_session_user_context() function caching current_user_hierarchy_level() as session variable (avoids per-query RLS join). Fixed build error — duplicate const other in conversations route. Also fixed a TypeScript never error in dashboard breakdown map. Verified — npx tsc --noEmit clean, npm test (13 pass, 7 integration skip gracefully), npx next build succeeds.	2026-07-06 13:36:48 +02:00
Hannah_Bagga	80dee367e8	fixed theme setting Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-05 21:54:39 +02:00
Hannah_Bagga	da99b695be	just some things i needed to get back into the CRM Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-03 16:05:03 +02:00
caitlin	dd6767980a	search button theme fix in ai assistant Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-02 16:04:53 +02:00
Ace	c1c4afadbb	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-02 13:26:58 +02:00
Ace	37679a7a60	Added Ai load fix	2026-07-02 13:26:56 +02:00
Hannah_Bagga	c0cb715ced	ai assistant page fixed Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 21:07:42 +02:00
Hannah_Bagga	1269f6cce8	Revert "Removed quick tips, recent prompts Messages today, Tokens used" Build & Auto-Repair / build (push) Has been cancelled Details This reverts commit `370f935cbb`.	2026-07-01 14:36:47 +02:00
Hannah_Bagga	370f935cbb	Removed quick tips, recent prompts Messages today, Tokens used Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 14:24:32 +02:00
Ace	faf9dd551a	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 13:16:59 +02:00
Ace	f67d9377a0	trying to fix AI chat	2026-07-01 13:16:57 +02:00
Hannah_Bagga	38fb3a47a8	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 13:14:35 +02:00
Hannah_Bagga	bc422edcf7	colour scheme problem fixed	2026-07-01 13:13:31 +02:00
TroodonEnjoyer	da5f8360bc	Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 13:07:32 +02:00
TroodonEnjoyer	37af1febcc	Automate DB migrations + fix audit trigger + drop forced password change - scripts/run-migrations.mjs: auto-applies unapplied .sql files on npm run dev/setup via psql, tracks state in _migrations table - 020_fixes.sql: sets password_change_required=FALSE for all users, fixes audit_password_change UUID cast, re-enables trigger - package.json: hook migrations into dev:precheck - setup.mjs: hook into npm run setup - run_all.sql: add 020_fixes.sql to migration order	2026-07-01 13:07:15 +02:00
caitlin	84632e043f	Merge origin/main into main Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 12:40:53 +02:00
Ace	b2bb6d94f5	added the search button for the AI Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 12:29:06 +02:00
caitlin	566fa3df88	Fixed select a job category for lightmode	2026-07-01 12:21:16 +02:00
Ace	16710e3019	Getting the 10 syncs and adding my AI that works but has issues Build & Auto-Repair / build (push) Has been cancelled Details	2026-07-01 12:16:22 +02:00
Ace	e920d4925a	Updated the to use targeted jobs but its weird	2026-07-01 12:15:37 +02:00