admin/property-management-network
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening from 2026-07-01 audit

Browse Source 
- Exclude supabase/ from Docker build context (leaked service_role key file)
- /api/files: exact per-user namespace match + reject path traversal;
  storage resolveKey rejects ".."/"." segments (fixes cross-user file read)
- Add ownsProperty/Unit/Tenant checks to tenants, maintenance (landlord path),
  and documents (JSON branch, now field-whitelisted) create handlers
- Escape user data in follow-up + payment-link emails (reuse escapeHtml)
- Neutralize CSV formula injection in toCsv + export routes
- Tighter sign-in rate limit (10/min); env-gated email verification + sender
- Per-request nonce CSP; drop script-src 'unsafe-inline' (styles unchanged)
- Add input length bounds; validate follow-ups POST body

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Leon Serfaty
2026-07-01 13:56:34 -04:00
co-authored by Claude Opus 4.8
parent 857b9a7811
commit 969d5d4c8a
18 changed files with 224 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/follow-ups/route.ts
+7 -3
View File
@@ -3,6 +3,7 @@ import { desc, eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { follow_up_rules, follow_up_log } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { followUpRuleSchema } from "@/lib/validations"
export async function GET() {
const user = await getSessionUser()
@@ -30,13 +31,16 @@ export async function POST(request: Request) {
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const body = await request.json()
const { type, name, trigger_days, message_template } = body
const parsed = followUpRuleSchema.safeParse(body)
if (!parsed.success) {
return NextResponse.json({ error: parsed.error.issues[0]?.message ?? "Invalid input" }, { status: 400 })
}
if (!type || !name) return NextResponse.json({ error: "type and name required" }, { status: 400 })
const { type, name, trigger_days, message_template } = parsed.data
const [data] = await db
.insert(follow_up_rules)
.values({ user_id: user.id, type, name, trigger_days: trigger_days ?? 3, message_template })
.values({ user_id: user.id, type, name, trigger_days, message_template })
.returning()
return NextResponse.json(data, { status: 201 })
app/api/follow-ups/run/route.ts
+2 -2
View File
@@ -11,7 +11,7 @@ import {
} from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { logActivity } from "@/lib/activity"
import { sendEmail } from "@/lib/email/send"
import { sendEmail, escapeHtml } from "@/lib/email/send"
export async function POST() {
const user = await getSessionUser()
@@ -170,7 +170,7 @@ export async function POST() {
<html>
<body style="font-family:sans-serif;background:#09090b;color:#fff;padding:40px 20px;max-width:560px;margin:0 auto;">
<div style="background:#16161f;border:1px solid rgba(255,255,255,0.08);border-radius:12px;padding:32px;">
<p style="font-size:15px;line-height:1.6;color:rgba(255,255,255,0.8);margin:0 0 24px;">${log.message.replace(/\n/g, "<br/>")}</p>
<p style="font-size:15px;line-height:1.6;color:rgba(255,255,255,0.8);margin:0 0 24px;">${escapeHtml(log.message).replace(/\n/g, "<br/>")}</p>
<p style="color:rgba(255,255,255,0.3);font-size:11px;margin:24px 0 0;border-top:1px solid rgba(255,255,255,0.06);padding-top:16px;">
Property Management Network — Automated Follow-up System
</p>