Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).
Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.
Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).
Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)
Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- New NavDrawer + hamburger menus for the app and admin layouts (below
md there was previously no navigation at all)
- Disable the dead Documents nav link that routed to the marketing
landing page via the catch-all route
- Replace the decorative topbar search with a debounced clients+cases
search dropdown (keyboard navigable, loading/error/empty states)
- Surface dashboard API failures: retry banner, em-dash KPIs, and a
retryable error state on the recent-cases card
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Passenger's node-loader uses require() which cannot load ES modules.
server.cjs is a CommonJS shim that bridges into server.js via dynamic import().
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Local file storage via STORAGE_PATH env var (replaces DO Spaces)
- POST/GET/DELETE /api/cases/:caseId/documents + GET /api/documents/:docId/download
- useDocuments hook + upload/list/download/delete UI in CaseDetailPage
- GET /api/invoices/summary — live SUM of sent+overdue invoices
- Dashboard outstanding KPI wired to real DB value
- api.upload() for FormData, formatBytes() utility
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
