Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/leases/[leaseId]/edit/page.tsx

@@ -0,0 +1,76 @@
+import { notFound, redirect } from "next/navigation"
+import { and, asc, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { tenants as tenantsTable, properties, leases as leasesTable } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
+import { LeaseForm } from "@/components/forms/lease-form"
+import { BackButton } from "@/components/ui/back-button"
+
+export const metadata = { title: "Edit Lease" }
+
+export default async function EditLeasePage({ params }: { params: Promise<{ leaseId: string }> }) {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const ownerId = await getEffectiveOwnerId(user.id)
+
+  const { leaseId } = await params
+
+  const [lease, tenants, properties_] = await Promise.all([
+    db.query.leases.findFirst({
+      where: and(eq(leasesTable.id, leaseId), eq(leasesTable.user_id, ownerId)),
+      with: {
+        tenant: { columns: { id: true, first_name: true, last_name: true } },
+      },
+    }),
+    db
+      .select({
+        id: tenantsTable.id,
+        first_name: tenantsTable.first_name,
+        last_name: tenantsTable.last_name,
+        unit_id: tenantsTable.unit_id,
+        property_id: tenantsTable.property_id,
+      })
+      .from(tenantsTable)
+      .where(and(eq(tenantsTable.user_id, ownerId), eq(tenantsTable.status, "active")))
+      .orderBy(asc(tenantsTable.first_name)),
+    db.query.properties.findMany({
+      where: eq(properties.user_id, ownerId),
+      columns: { id: true, name: true },
+      with: {
+        units: { columns: { id: true, unit_number: true } },
+      },
+      orderBy: asc(properties.name),
+    }),
+  ])
+
+  if (!lease) notFound()
+
+  // Ensure the lease's own tenant is selectable even if now inactive.
+  const tenantList = tenants.some((t) => t.id === lease.tenant_id)
+    ? tenants
+    : [
+        {
+          id: lease.tenant_id,
+          first_name: lease.tenant?.first_name ?? "",
+          last_name: lease.tenant?.last_name ?? "",
+          unit_id: lease.unit_id,
+          property_id: lease.property_id,
+        },
+        ...tenants,
+      ]
+
+  return (
+    <div className="mx-auto max-w-2xl space-y-6">
+      <BackButton href={`/leases/${leaseId}`} />
+      <div>
+        <h2 className="text-lg font-semibold text-white">Edit Lease</h2>
+        <p className="text-sm text-white/40">
+          {lease.tenant?.first_name} {lease.tenant?.last_name}
+        </p>
+      </div>
+      <LeaseForm tenants={tenantList} properties={properties_ ?? []} lease={lease} />
+    </div>
+  )
+}

app/(dashboard)/leases/[leaseId]/page.tsx

@@ -0,0 +1,225 @@
+import { notFound, redirect } from "next/navigation"
+import { and, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { leases as leasesTable } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { getAccountContext } from "@/lib/account"
+import { listAdapters, listRequestsForLease } from "@/lib/esign"
+import Link from "next/link"
+import { FileText, ExternalLink } from "lucide-react"
+import { formatCurrency, formatDate, daysUntil } from "@/lib/utils"
+import { cn } from "@/lib/utils"
+import { LeaseActions } from "@/components/forms/lease-actions"
+import { EsignLease } from "@/components/forms/esign-lease"
+
+export const metadata = { title: "Lease" }
+
+const statusColors: Record<string, string> = {
+  active:     "text-emerald-400 bg-emerald-500/10 border-emerald-500/20",
+  expired:    "text-red-400 bg-red-500/10 border-red-500/20",
+  terminated: "text-white/40 bg-white/5 border-white/10",
+  renewed:    "text-blue-400 bg-blue-500/10 border-blue-500/20",
+}
+
+const leaseTypeLabels: Record<string, string> = {
+  fixed:          "Fixed Term",
+  month_to_month: "Month-to-Month",
+}
+
+function InfoRow({ label, children }: { label: string; children: React.ReactNode }) {
+  return (
+    <div className="flex items-center justify-between gap-4 py-3">
+      <span className="text-sm text-white/40">{label}</span>
+      <span className="text-right text-sm font-medium text-white">{children}</span>
+    </div>
+  )
+}
+
+export default async function LeaseDetailPage({ params }: { params: Promise<{ leaseId: string }> }) {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+
+  const { leaseId } = await params
+
+  const lease = await db.query.leases.findFirst({
+    where: and(eq(leasesTable.id, leaseId), eq(leasesTable.user_id, ownerId)),
+    with: {
+      tenant: { columns: { id: true, first_name: true, last_name: true, email: true } },
+      property: { columns: { name: true } },
+      unit: { columns: { unit_number: true } },
+    },
+  })
+
+  if (!lease) notFound()
+
+  const esignRequests = await listRequestsForLease(ownerId, leaseId)
+  const esignProviders = listAdapters()
+  const canSendEsign = ctx.canWrite && !!lease.document_url && !!lease.tenant?.email
+  const esignDisabledReason = !ctx.canWrite
+    ? "You have read-only access."
+    : !lease.document_url
+      ? "Upload a lease document to enable e-signature."
+      : !lease.tenant?.email
+        ? "The tenant has no email address on file."
+        : ""
+
+  const days = daysUntil(lease.lease_end)
+  const totalDays = Math.max(
+    0,
+    Math.round(
+      (new Date(lease.lease_end).getTime() - new Date(lease.lease_start).getTime()) /
+        (1000 * 60 * 60 * 24)
+    )
+  )
+
+  return (
+    <div className="mx-auto max-w-4xl space-y-6">
+      {/* Breadcrumb */}
+      <div className="flex items-center gap-2 text-sm text-white/40">
+        <Link href="/leases" className="hover:text-white transition">Leases</Link>
+        <span>/</span>
+        <span className="text-white/70">
+          {lease.tenant?.first_name} {lease.tenant?.last_name}
+        </span>
+      </div>
+
+      {/* Header */}
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex items-center gap-4">
+          <div className="flex h-14 w-14 items-center justify-center rounded-2xl border border-indigo-500/20 bg-indigo-600/20 text-indigo-400">
+            <FileText className="h-6 w-6" />
+          </div>
+          <div>
+            <div className="flex items-center gap-3">
+              <h2 className="text-xl font-bold text-white">
+                {lease.tenant?.first_name} {lease.tenant?.last_name}
+              </h2>
+              <span className={cn("rounded-md border px-2 py-0.5 text-xs font-medium capitalize", statusColors[lease.status] ?? statusColors.active)}>
+                {lease.status}
+              </span>
+            </div>
+            <p className="mt-1 text-sm text-white/50">
+              {lease.property?.name} · Unit {lease.unit?.unit_number ?? "—"}
+            </p>
+          </div>
+        </div>
+
+        <LeaseActions lease={lease} />
+      </div>
+
+      <div className="grid gap-6 lg:grid-cols-3">
+        {/* Main */}
+        <div className="lg:col-span-2 space-y-6">
+          {/* Term */}
+          <div className="rounded-xl border border-white/[0.06] bg-[#16161f]">
+            <div className="border-b border-white/[0.06] px-5 py-4">
+              <h3 className="text-sm font-semibold text-white">Lease Term</h3>
+            </div>
+            <div className="divide-y divide-white/[0.04] px-5">
+              <InfoRow label="Start date">{formatDate(lease.lease_start)}</InfoRow>
+              <InfoRow label="End date">{formatDate(lease.lease_end)}</InfoRow>
+              <InfoRow label="Duration">{totalDays} days</InfoRow>
+              <InfoRow label={days <= 0 ? "Expired" : "Ends in"}>
+                {lease.status === "active"
+                  ? days <= 0
+                    ? <span className="text-red-400">{Math.abs(days)} days ago</span>
+                    : <span className={days <= 30 ? "text-amber-400" : "text-white"}>{days} days</span>
+                  : <span className="text-white/40">—</span>}
+              </InfoRow>
+            </div>
+          </div>
+
+          {/* Financials */}
+          <div className="rounded-xl border border-white/[0.06] bg-[#16161f]">
+            <div className="border-b border-white/[0.06] px-5 py-4">
+              <h3 className="text-sm font-semibold text-white">Financials</h3>
+            </div>
+            <div className="divide-y divide-white/[0.04] px-5">
+              <InfoRow label="Monthly rent">
+                {formatCurrency(lease.rent_amount)}<span className="text-xs text-white/30">/mo</span>
+              </InfoRow>
+              <InfoRow label="Security deposit">
+                {lease.security_deposit != null ? formatCurrency(lease.security_deposit) : <span className="text-white/40">—</span>}
+              </InfoRow>
+            </div>
+          </div>
+
+          {/* Notes */}
+          {lease.notes && (
+            <div className="rounded-xl border border-white/[0.06] bg-[#16161f]">
+              <div className="border-b border-white/[0.06] px-5 py-4">
+                <h3 className="text-sm font-semibold text-white">Notes</h3>
+              </div>
+              <p className="whitespace-pre-wrap px-5 py-4 text-sm text-white/60">{lease.notes}</p>
+            </div>
+          )}
+        </div>
+
+        {/* Sidebar */}
+        <div className="space-y-4">
+          <div className="rounded-xl border border-white/[0.06] bg-[#16161f] p-5 space-y-3">
+            <h3 className="text-xs font-medium uppercase tracking-wider text-white/30">Details</h3>
+            <div className="space-y-2">
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-white/40">Tenant</span>
+                {lease.tenant?.id ? (
+                  <Link href={`/tenants/${lease.tenant.id}`} className="text-sm font-medium text-indigo-400 hover:text-indigo-300 transition">
+                    {lease.tenant.first_name} {lease.tenant.last_name}
+                  </Link>
+                ) : (
+                  <span className="text-sm font-medium text-white">
+                    {lease.tenant?.first_name} {lease.tenant?.last_name}
+                  </span>
+                )}
+              </div>
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-white/40">Property</span>
+                <span className="text-sm font-medium text-white">{lease.property?.name}</span>
+              </div>
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-white/40">Unit</span>
+                <span className="text-sm font-medium text-white">{lease.unit?.unit_number ?? "—"}</span>
+              </div>
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-white/40">Type</span>
+                <span className="text-sm font-medium text-white">{leaseTypeLabels[lease.lease_type] ?? lease.lease_type}</span>
+              </div>
+              <div className="flex items-center justify-between">
+                <span className="text-sm text-white/40">Auto-renew</span>
+                <span className={cn("text-sm font-medium", lease.auto_renew ? "text-emerald-400" : "text-white/40")}>
+                  {lease.auto_renew ? "Enabled" : "Disabled"}
+                </span>
+              </div>
+            </div>
+          </div>
+
+          {lease.document_url && (
+            <a
+              href={lease.document_url}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="flex items-center justify-between rounded-xl border border-white/[0.06] bg-[#16161f] p-5 transition hover:border-white/15"
+            >
+              <div className="flex items-center gap-2 text-sm font-medium text-white">
+                <FileText className="h-4 w-4 text-indigo-400" />
+                Lease document
+              </div>
+              <ExternalLink className="h-4 w-4 text-white/40" />
+            </a>
+          )}
+
+          <EsignLease
+            leaseId={leaseId}
+            providers={esignProviders}
+            requests={esignRequests}
+            canSend={canSendEsign}
+            disabledReason={esignDisabledReason}
+          />
+        </div>
+      </div>
+    </div>
+  )
+}

app/(dashboard)/leases/new/page.tsx

@@ -3,6 +3,7 @@ import { and, asc, eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { tenants as tenantsTable, properties } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import { LeaseForm } from "@/components/forms/lease-form"
 import { BackButton } from "@/components/ui/back-button"
 
@@ -12,6 +13,8 @@ export default async function NewLeasePage({ searchParams }: { searchParams: Pro
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const params = await searchParams
   const prefill = {
     tenant_id:   params.tenant_id   ?? "",
@@ -30,10 +33,10 @@ export default async function NewLeasePage({ searchParams }: { searchParams: Pro
         property_id: tenantsTable.property_id,
       })
       .from(tenantsTable)
-      .where(and(eq(tenantsTable.user_id, user.id), eq(tenantsTable.status, "active")))
+      .where(and(eq(tenantsTable.user_id, ownerId), eq(tenantsTable.status, "active")))
       .orderBy(asc(tenantsTable.first_name)),
     db.query.properties.findMany({
-      where: eq(properties.user_id, user.id),
+      where: eq(properties.user_id, ownerId),
       columns: { id: true, name: true },
       with: {
         units: { columns: { id: true, unit_number: true } },

app/(dashboard)/leases/page.tsx

@@ -3,6 +3,7 @@ import { eq, asc } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { leases as leasesTable } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import Link from "next/link"
 import { FileText, AlertTriangle, ArrowRight } from "lucide-react"
 import { EmptyState } from "@/components/shared/empty-state"
@@ -34,8 +35,10 @@ export default async function LeasesPage() {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const leases = await db.query.leases.findMany({
-    where: eq(leasesTable.user_id, user.id),
+    where: eq(leasesTable.user_id, ownerId),
     with: {
       tenant: { columns: { first_name: true, last_name: true } },
       property: { columns: { name: true } },
@@ -90,9 +93,9 @@ export default async function LeasesPage() {
                   return (
                     <tr key={lease.id} className="group hover:bg-white/[0.02] transition">
                       <td className="px-5 py-3.5">
-                        <p className="text-sm font-medium text-white">
+                        <Link href={`/leases/${lease.id}`} className="text-sm font-medium text-white hover:text-indigo-300 transition">
                           {lease.tenant?.first_name} {lease.tenant?.last_name}
-                        </p>
+                        </Link>
                       </td>
                       <td className="px-5 py-3.5">
                         <p className="text-sm text-white/70">{lease.property?.name}</p>
@@ -114,14 +117,22 @@ export default async function LeasesPage() {
                         <DaysChip days={days} status={lease.status} />
                       </td>
                       <td className="px-5 py-3.5 text-right">
-                        {canRenew && (
+                        <div className="flex items-center justify-end gap-4">
+                          {canRenew && (
+                            <Link
+                              href={`/leases/new?tenant_id=${lease.tenant_id}&property_id=${lease.property_id}&unit_id=${lease.unit_id ?? ""}&rent_amount=${lease.rent_amount}`}
+                              className="inline-flex items-center gap-1 text-xs font-medium text-indigo-400 hover:text-indigo-300 transition"
+                            >
+                              Renew <ArrowRight className="h-3 w-3" />
+                            </Link>
+                          )}
                           <Link
-                            href={`/leases/new?tenant_id=${lease.tenant_id}&property_id=${lease.property_id}&unit_id=${lease.unit_id ?? ""}&rent_amount=${lease.rent_amount}`}
-                            className="inline-flex items-center gap-1 text-xs font-medium text-indigo-400 hover:text-indigo-300 transition"
+                            href={`/leases/${lease.id}`}
+                            className="inline-flex items-center gap-1 text-xs font-medium text-white/50 hover:text-white transition"
                           >
-                            Renew <ArrowRight className="h-3 w-3" />
+                            View <ArrowRight className="h-3 w-3" />
                           </Link>
-                        )}
+                        </div>
                       </td>
                     </tr>
                   )
@@ -138,14 +149,14 @@ export default async function LeasesPage() {
               return (
                 <div key={lease.id} className="rounded-xl border border-white/[0.06] bg-[#16161f] p-4 space-y-3">
                   <div className="flex items-start justify-between gap-2">
-                    <div>
+                    <Link href={`/leases/${lease.id}`} className="min-w-0">
                       <p className="text-sm font-semibold text-white">
                         {lease.tenant?.first_name} {lease.tenant?.last_name}
                       </p>
                       <p className="text-xs text-white/40 mt-0.5">
                         {lease.property?.name} · Unit {lease.unit?.unit_number ?? "—"}
                       </p>
-                    </div>
+                    </Link>
                     <span className={cn("shrink-0 rounded-md border px-2 py-0.5 text-xs font-medium capitalize", statusColors[lease.status] ?? statusColors.active)}>
                       {lease.status}
                     </span>