Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/properties/[propertyId]/edit/page.tsx

@@ -3,15 +3,18 @@ import { and, eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { properties } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import { PropertyForm } from "@/components/forms/property-form"
 
 export default async function EditPropertyPage({ params }: { params: Promise<{ propertyId: string }> }) {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { propertyId } = await params
   const property = await db.query.properties.findFirst({
-    where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
+    where: and(eq(properties.id, propertyId), eq(properties.user_id, ownerId)),
   })
 
   if (!property) notFound()

app/(dashboard)/properties/[propertyId]/page.tsx

@@ -3,6 +3,7 @@ import { and, eq, gte } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { properties as propertiesTable, rent_payments, expenses as expensesTable } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import Link from "next/link"
 import { MapPin, Plus, BedDouble, Bath, Edit } from "lucide-react"
 import { formatCurrency, getOccupancyRate } from "@/lib/utils"
@@ -10,11 +11,15 @@ import { DeletePropertyButton } from "@/components/forms/delete-property-button"
 import { AiMaintenanceSummary } from "@/components/forms/ai-maintenance-summary"
 import { PropertyRevenueChart } from "@/components/dashboard/property-revenue-chart"
 import { PropertyPhotoUpload } from "@/components/forms/property-photo-upload"
+import { UnitActions } from "@/components/forms/unit-actions"
+import { PropertyMap } from "@/components/maps/property-map"
 
 export default async function PropertyDetailPage({ params }: { params: Promise<{ propertyId: string }> }) {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { propertyId } = await params
 
   const sixMonthsAgo = new Date()
@@ -24,7 +29,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
 
   const [property, payments, expenses] = await Promise.all([
     db.query.properties.findFirst({
-      where: and(eq(propertiesTable.id, propertyId), eq(propertiesTable.user_id, user.id)),
+      where: and(eq(propertiesTable.id, propertyId), eq(propertiesTable.user_id, ownerId)),
       with: {
         units: {
           with: {
@@ -38,7 +43,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
       .from(rent_payments)
       .where(
         and(
-          eq(rent_payments.user_id, user.id),
+          eq(rent_payments.user_id, ownerId),
           eq(rent_payments.property_id, propertyId),
           gte(rent_payments.due_date, rangeStart)
         )
@@ -48,7 +53,7 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
       .from(expensesTable)
       .where(
         and(
-          eq(expensesTable.user_id, user.id),
+          eq(expensesTable.user_id, ownerId),
           eq(expensesTable.property_id, propertyId),
           gte(expensesTable.expense_date, rangeStart)
         )
@@ -167,8 +172,11 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
                     )}
                   </div>
                 </div>
-                <div className="text-right">
-                  <p className="text-sm font-semibold text-white">{formatCurrency(unit.rent_amount)}<span className="text-xs text-white/40">/mo</span></p>
+                <div className="flex items-center gap-4">
+                  <div className="text-right">
+                    <p className="text-sm font-semibold text-white">{formatCurrency(unit.rent_amount)}<span className="text-xs text-white/40">/mo</span></p>
+                  </div>
+                  <UnitActions propertyId={propertyId} unitId={unit.id} unitNumber={unit.unit_number} />
                 </div>
               </div>
             ))}
@@ -176,6 +184,28 @@ export default async function PropertyDetailPage({ params }: { params: Promise<{
         )}
       </div>
 
+      {/* Location */}
+      {property.latitude != null && property.longitude != null && (
+        <div className="rounded-xl border border-white/[0.06] bg-[#16161f] overflow-hidden">
+          <div className="flex items-center gap-2 border-b border-white/[0.06] px-5 py-4">
+            <MapPin className="h-4 w-4 text-indigo-400" />
+            <h3 className="text-sm font-semibold text-white">Location</h3>
+          </div>
+          <PropertyMap
+            className="h-72 w-full"
+            markers={[
+              {
+                id: property.id,
+                name: property.name,
+                lat: property.latitude,
+                lng: property.longitude,
+                subtitle: `${property.address_line1}, ${property.city}${property.state ? `, ${property.state}` : ""}`,
+              },
+            ]}
+          />
+        </div>
+      )}
+
       {/* Revenue chart */}
       <PropertyRevenueChart data={chartData} />
 

app/(dashboard)/properties/[propertyId]/units/[unitId]/edit/page.tsx

@@ -0,0 +1,44 @@
+import { redirect } from "next/navigation"
+import { and, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { properties, units } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
+import { BackButton } from "@/components/ui/back-button"
+import { UnitForm } from "@/components/forms/unit-form"
+
+export const metadata = { title: "Edit Unit" }
+
+export default async function EditUnitPage({ params }: { params: Promise<{ propertyId: string; unitId: string }> }) {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const ownerId = await getEffectiveOwnerId(user.id)
+
+  const { propertyId, unitId } = await params
+
+  const [property, unit] = await Promise.all([
+    db.query.properties.findFirst({
+      where: and(eq(properties.id, propertyId), eq(properties.user_id, ownerId)),
+      columns: { id: true, name: true },
+    }),
+    db.query.units.findFirst({
+      where: and(eq(units.id, unitId), eq(units.property_id, propertyId), eq(units.user_id, ownerId)),
+    }),
+  ])
+
+  if (!property || !unit) redirect(`/properties/${propertyId}`)
+
+  return (
+    <div className="mx-auto max-w-2xl space-y-6">
+      <BackButton href={`/properties/${propertyId}`} />
+      <div>
+        <h2 className="text-lg font-semibold text-white">Edit Unit {unit.unit_number}</h2>
+        <p className="text-sm text-white/40">{property.name}</p>
+      </div>
+      <div className="rounded-xl border border-white/[0.06] bg-[#16161f] p-6">
+        <UnitForm propertyId={propertyId} unit={unit} />
+      </div>
+    </div>
+  )
+}

app/(dashboard)/properties/[propertyId]/units/new/page.tsx

@@ -3,6 +3,7 @@ import { and, eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { properties } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import { BackButton } from "@/components/ui/back-button"
 import { UnitForm } from "@/components/forms/unit-form"
 
@@ -12,10 +13,12 @@ export default async function NewUnitPage({ params }: { params: Promise<{ proper
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { propertyId } = await params
 
   const property = await db.query.properties.findFirst({
-    where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
+    where: and(eq(properties.id, propertyId), eq(properties.user_id, ownerId)),
     columns: { id: true, name: true },
   })
 

app/(dashboard)/properties/page.tsx

@@ -3,9 +3,11 @@ import { eq, desc } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { properties as propertiesTable } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
 import Link from "next/link"
 import { Building2, MapPin, BedDouble, ArrowRight, TrendingUp } from "lucide-react"
 import { EmptyState } from "@/components/shared/empty-state"
+import { PropertyMap } from "@/components/maps/property-map"
 import { formatCurrency, getOccupancyRate } from "@/lib/utils"
 
 export const metadata = { title: "Properties" }
@@ -14,8 +16,10 @@ export default async function PropertiesPage() {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const properties = await db.query.properties.findMany({
-    where: eq(propertiesTable.user_id, user.id),
+    where: eq(propertiesTable.user_id, ownerId),
     with: {
       units: { columns: { id: true, status: true, rent_amount: true } },
     },
@@ -26,6 +30,17 @@ export default async function PropertiesPage() {
     return sum + (p.units ?? []).filter((u: any) => u.status === "occupied").reduce((s: number, u: any) => s + Number(u.rent_amount), 0)
   }, 0)
 
+  const mapMarkers = (properties ?? [])
+    .filter((p: any) => p.latitude != null && p.longitude != null)
+    .map((p: any) => ({
+      id: p.id,
+      name: p.name,
+      lat: p.latitude as number,
+      lng: p.longitude as number,
+      subtitle: `${p.address_line1 ? `${p.address_line1}, ` : ""}${p.city}${p.state ? `, ${p.state}` : ""}`,
+      href: `/properties/${p.id}`,
+    }))
+
   return (
     <div className="space-y-6">
       {/* Page header */}
@@ -39,6 +54,12 @@ export default async function PropertiesPage() {
         </div>
       </div>
 
+      {mapMarkers.length > 0 && (
+        <div className="rounded-2xl border border-white/[0.06] bg-[#16161f] overflow-hidden">
+          <PropertyMap className="h-80 w-full" markers={mapMarkers} />
+        </div>
+      )}
+
       {!properties?.length ? (
         <EmptyState
           icon={Building2}