Ace
1adc4806fa
Security Fixes
File Change
.env.local Placeholder JWT secret (rotate to random value: openssl rand -base64 64)
src/middleware.ts Removed /api/auth/me bypass; API routes return JSON 401 (not 302 redirect)
src/lib/auth.ts sameSite: "lax" → "strict" (create + destroy cookie); SVG name chars are pre-computed (no injection)
src/lib/avatar.ts Added sanitizeName() — strips non-alphanumeric/safe chars, max 50 chars
src/app/api/users/route.ts POST restricted to super_admin; validates role against whitelist ["sales","admin","super_admin","dev"]; validates active defaults to true
src/app/api/users/[id]/route.ts DELETE restricted to super_admin; blocks self-deletion
src/app/api/leads/[id]/route.ts GET: non-admin users filtered by assigned_to; PATCH: ownership check + score validated 0-100 range
src/app/api/leads/route.ts DELETE: ownership + admin check; GET: ownership filter for non-admin users
src/app/api/conversations/[id]/messages/route.ts GET/POST: verify user is a conversation_participant before access
rust-ai/src/main.rs CORS: AllowOrigin::list(["localhost:3006", "127.0.0.1:3006"]) (was Any)
Performance Fixes
File Change
src/app/api/leads/route.ts Added limit (default 50), offset query params; ownership filter in SQL
src/app/api/users/route.ts Added limit (default 50), offset query params
src/app/api/conversations/route.ts Added LIMIT 50
src/app/api/leads/[id]/notes/route.ts Added limit (default 50), offset query params
src/app/api/conversations/[id]/messages/route.ts Added limit (default 100), offset, before query params
src/app/(dashboard)/chats/page.tsx Pruned to 5 cached conversations; useMemo wraps messages/conversation/filteredConversations; otherParticipant moved outside component; added 10MB file size limit; recordingChunksRef cleared on discard
src/app/(dashboard)/leads/[id]/page.tsx Optimistic status update rolls back on fetch failure
database/migrations/003_chat.sql Added composite index idx_messages_conversation_created on (conversation_id, created_at DESC)
Code Quality Fixes
File Change
src/lib/ai.ts Removed dead getInstructions()/updateInstructions() (called nonexistent /ai/instructions)
src/lib/auth.ts bcrypt.hash(password, 12) — kept (acceptable, OWASP-recommended)
src/app/login/page.tsx "Forgot password?" button now shows alert to contact admin (was no-op)
src/components/users/user-form-dialog.tsx Password min 6 → 8 chars
26 silent catch {} blocks across 16 files (see below) Added console.warn("...") context messages
68 lines
2.5 KiB
JSON
68 lines
2.5 KiB
JSON
{
|
|
"name": "frontend",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"scripts": {
|
|
"dev": "npm run dev:precheck & npm run dev:ollama & npm run dev:start",
|
|
"dev:start": "concurrently -n AI,BROWSE,NEXT -c cyan,magenta,green \"npm run dev:rust\" \"npm run dev:browser-use\" \"npm run dev:next\"",
|
|
"dev:next": "next dev -p 3006",
|
|
"dev:precheck": "powershell -NoProfile -Command \"Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -in 3001,3006,3008 } | ForEach-Object { Stop-Process -Id $_.OwningProcess -Force -ErrorAction SilentlyContinue; Write-Host ('Freed port '+$_.LocalPort) }\"",
|
|
"dev:ollama": "powershell -NoProfile -Command \"if (-not (Get-Process ollama -ErrorAction SilentlyContinue)) { Start-Process ollama -ArgumentList 'serve' -WindowStyle Hidden; Start-Sleep 3 }; exit 0\"",
|
|
"dev:rust": "cd rust-ai && cargo run",
|
|
"dev:browser-use": "cd browser-use-service && python main.py",
|
|
"build": "next build",
|
|
"start": "next start -p 3006",
|
|
"lint": "eslint"
|
|
},
|
|
"dependencies": {
|
|
"@emoji-mart/data": "^1.2.1",
|
|
"@emoji-mart/react": "^1.1.1",
|
|
"@hookform/resolvers": "^3.9.1",
|
|
"@radix-ui/react-alert-dialog": "^1.1.6",
|
|
"@radix-ui/react-avatar": "^1.1.3",
|
|
"@radix-ui/react-checkbox": "^1.1.4",
|
|
"@radix-ui/react-dialog": "^1.1.6",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.6",
|
|
"@radix-ui/react-label": "^2.1.2",
|
|
"@radix-ui/react-radio-group": "^1.2.3",
|
|
"@radix-ui/react-scroll-area": "^1.2.3",
|
|
"@radix-ui/react-select": "^2.1.6",
|
|
"@radix-ui/react-separator": "^1.1.2",
|
|
"@radix-ui/react-slot": "^1.1.2",
|
|
"@radix-ui/react-switch": "^1.1.3",
|
|
"@radix-ui/react-tabs": "^1.1.3",
|
|
"@radix-ui/react-tooltip": "^1.1.8",
|
|
"@tanstack/react-table": "^8.20.6",
|
|
"autoprefixer": "^10.4.20",
|
|
"bcryptjs": "^3.0.3",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"framer-motion": "^11.15.0",
|
|
"jose": "^6.2.3",
|
|
"lucide-react": "^0.468.0",
|
|
"next": "15.0.4",
|
|
"next-themes": "^0.4.4",
|
|
"pg": "^8.21.0",
|
|
"react": "^18.3.1",
|
|
"react-dom": "^18.3.1",
|
|
"react-hook-form": "^7.54.2",
|
|
"recharts": "^2.15.0",
|
|
"sonner": "^1.7.4",
|
|
"tailwind-merge": "^2.6.0",
|
|
"vaul": "^1.1.2",
|
|
"zod": "^3.24.2"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^20",
|
|
"@types/pg": "^8.20.0",
|
|
"@types/react": "^18",
|
|
"@types/react-dom": "^18",
|
|
"concurrently": "^10.0.3",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "15.0.4",
|
|
"postcss": "^8.4.49",
|
|
"tailwindcss": "^3.4.17",
|
|
"typescript": "^5"
|
|
}
|
|
}
|