Storage - Migrate document/media storage from local disk to DigitalOcean Spaces (S3); lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required. - Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time). Security hardening (all report findings) - DB pool fails closed in production when the CA cert is missing (no more silent unverified TLS); warns in dev. - trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits. - Login lockout keyed by (email, ip) so an attacker can't lock out a victim. - Superadmin auto-grant now requires a verified email. - CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt. - Upload content-sniffing (magic bytes) rejects spoofed MIME types. - create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED. Production-blocker fixes - SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache. - Invoice numbering is transaction-safe (per-firm advisory lock + max sequence), eliminating concurrent collisions and delete-reuse — no schema change. - Checkout guards against double-billing a firm already on a paid plan. - Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps). Honesty / trust - Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA, and the login-panel stats; replace with non-fabricated copy. - Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.) Quality - Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
88 lines
2.8 KiB
TypeScript
88 lines
2.8 KiB
TypeScript
// Flips past-due 'sent' invoices to 'overdue' and emails the client a payment reminder.
|
|
// The email goes out only on the sent→overdue transition, so re-running never double-sends.
|
|
// Run daily from the monorepo root (cron / scheduled task): npx tsx scripts/send-overdue-reminders.ts
|
|
|
|
import path from 'node:path';
|
|
import { fileURLToPath } from 'node:url';
|
|
import dotenv from 'dotenv';
|
|
|
|
const __dirname = path.dirname(fileURLToPath(import.meta.url));
|
|
dotenv.config({ path: path.resolve(__dirname, '../.env') });
|
|
|
|
import { and, eq, lt } from 'drizzle-orm';
|
|
import { getDb, getPool, invoices, clients, firms } from '@lawdesk/db';
|
|
import { sendEmail, invoiceOverdueEmail } from '../apps/api/src/lib/email';
|
|
|
|
async function main() {
|
|
const db = getDb();
|
|
const now = new Date();
|
|
|
|
const due = await db
|
|
.select({
|
|
id: invoices.id,
|
|
number: invoices.number,
|
|
total: invoices.total,
|
|
dueAt: invoices.dueAt,
|
|
clientName: clients.name,
|
|
clientEmail: clients.email,
|
|
firmName: firms.name,
|
|
})
|
|
.from(invoices)
|
|
.innerJoin(clients, eq(invoices.clientId, clients.id))
|
|
.innerJoin(firms, eq(invoices.firmId, firms.id))
|
|
.where(and(eq(invoices.status, 'sent'), lt(invoices.dueAt, now)));
|
|
|
|
console.log(`Found ${due.length} past-due invoice(s) to mark overdue.`);
|
|
|
|
let flipped = 0;
|
|
let emailed = 0;
|
|
|
|
for (const inv of due) {
|
|
// Guard on status='sent' so a concurrent run can't flip (and email) the same invoice twice.
|
|
const [row] = await db
|
|
.update(invoices)
|
|
.set({ status: 'overdue', updatedAt: new Date() })
|
|
.where(and(eq(invoices.id, inv.id), eq(invoices.status, 'sent')))
|
|
.returning({ id: invoices.id });
|
|
if (!row) continue;
|
|
flipped++;
|
|
|
|
if (!inv.clientEmail || !inv.dueAt) {
|
|
console.log(` ${inv.number}: marked overdue, no reminder (missing client email or due date)`);
|
|
continue;
|
|
}
|
|
|
|
const totalFmt = new Intl.NumberFormat('en-US', { style: 'currency', currency: 'USD' }).format(
|
|
Number(inv.total),
|
|
);
|
|
const dueDate = inv.dueAt.toLocaleDateString('en-US', {
|
|
year: 'numeric',
|
|
month: 'short',
|
|
day: 'numeric',
|
|
});
|
|
|
|
const tpl = invoiceOverdueEmail({
|
|
clientName: inv.clientName,
|
|
firmName: inv.firmName,
|
|
invoiceNumber: inv.number,
|
|
total: totalFmt,
|
|
dueDate,
|
|
});
|
|
const result = await sendEmail({ to: inv.clientEmail, ...tpl });
|
|
if (result.ok && !result.skipped) {
|
|
emailed++;
|
|
console.log(` ${inv.number}: marked overdue, reminder sent to ${inv.clientEmail}`);
|
|
} else {
|
|
console.log(` ${inv.number}: marked overdue, reminder ${result.skipped ? 'skipped (no API key)' : `FAILED: ${result.error}`}`);
|
|
}
|
|
}
|
|
|
|
console.log(`Done. ${flipped} invoice(s) marked overdue, ${emailed} reminder(s) sent.`);
|
|
await getPool().end();
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error(err);
|
|
process.exit(1);
|
|
});
|