- Add the Umami tracking snippet to index.html (rides into prerendered pages too).
- Allow https://fickanalytics.phluit.net in the prod CSP script-src and connect-src
so the script loads and can send events.
Addresses the findings from the platform security audit. Verified green:
all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests,
and 0 high/critical production dependency vulnerabilities.
Dependencies (High):
- Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier)
and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal
and the react-router open-redirect. Remaining audit items are dev-only
build tooling (esbuild/vite), not shipped at runtime.
AI cost control + storage quota (new ai_usage table, migration 0002):
- Per-firm monthly AI token budget enforced before each completion (429),
with every completion recorded to an ai_usage ledger (lib/ai-usage.ts).
- Enforce per-plan storage quota on upload (402) and maintain
storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the
column int→bigint so 8GB/50GB plans don't overflow.
Auth (defense-in-depth):
- Constant-time login: verify against a dummy argon2 hash when the account
doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe).
- Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification.
Web:
- Validate the post-login ?next= redirect to same-origin paths only
(open-redirect / phishing).
Deploy hardening:
- docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host.
- .dockerignore: keep destructive one-off scripts (seed-demo, create-admin,
migrate-storage) out of the runtime image; retain the cron scripts.
- seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host.
Webhooks / config:
- Stripe idempotency via a stripe_events ledger (skip already-processed
events; record only after successful processing so a transient failure
still retries); make the plan-upgraded email non-blocking.
- Rate-limit account export and invoice PDF; cap invoice item arrays at 200.
- Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails
open on a forgotten key); don't load .env under NODE_ENV=test so the suite
is hermetic.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add Dockerfile (multi-stage Node 20), .dockerignore, docker-compose.yml, and
DEPLOY-DOKPLOY.md for container deployment on Dokploy.
- Commit the DigitalOcean managed-Postgres Project CA cert (certs/ca-certificate.crt)
so production TLS verification (fail-closed) works in-container. Public CA, safe to commit.
- Blog cover images served from DO Spaces; allow *.digitaloceanspaces.com in the prod CSP img-src.
- Includes the AI (case summaries) and Cloudflare Turnstile bot-protection features.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- E2E suite (23 tests, `npm run test:e2e -w @lawdesk/api`): boots the real
Fastify app against a disposable Dockerized Postgres (never a real DB) and
covers signup/login/lockout/rate limits, CSRF (incl. forged-token
rejection), logout, password reset, email verification, the superadmin
verified-email promotion gate, and cross-firm tenancy isolation
- packages/db: DATABASE_SSL=disable opt-out for local/test databases that
don't speak TLS; refused in production
- retention-sweep.ts cron enforcing Privacy Policy windows (sessions,
tokens, login attempts, tool usage, contact messages, audit log) +
sweep-orphaned-storage.ts Spaces reconciliation + scripts/README
- Expose emailVerified on the session user; in-app verify-email banner
with resend, and verified=1|0 toasts on the login page
- Silence Fastify logger under NODE_ENV=test; fix footer resource link;
document login-attempt/tool-usage retention in the Privacy Policy
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).
Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.
Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).
Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)
Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Local file storage via STORAGE_PATH env var (replaces DO Spaces)
- POST/GET/DELETE /api/cases/:caseId/documents + GET /api/documents/:docId/download
- useDocuments hook + upload/list/download/delete UI in CaseDetailPage
- GET /api/invoices/summary — live SUM of sent+overdue invoices
- Dashboard outstanding KPI wired to real DB value
- api.upload() for FormData, formatBytes() utility
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Leon Serfaty