Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/(dashboard)/settings/api-keys/page.tsx

@@ -0,0 +1,48 @@
+import { redirect } from "next/navigation"
+import Link from "next/link"
+import { desc, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { api_keys } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { ApiKeyManager, type ApiKeyRow } from "@/components/dashboard/api-key-manager"
+
+export const metadata = { title: "API Keys" }
+
+export default async function ApiKeysSettingsPage() {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const rows = await db
+    .select({
+      id: api_keys.id,
+      name: api_keys.name,
+      key_prefix: api_keys.key_prefix,
+      created_at: api_keys.created_at,
+      last_used_at: api_keys.last_used_at,
+      revoked_at: api_keys.revoked_at,
+    })
+    .from(api_keys)
+    .where(eq(api_keys.user_id, user.id))
+    .orderBy(desc(api_keys.created_at))
+
+  const keys: ApiKeyRow[] = rows
+
+  return (
+    <div className="max-w-2xl space-y-6">
+      <div>
+        <h2 className="text-lg font-semibold text-white">API Keys</h2>
+        <p className="text-sm text-white/40">
+          Create keys to authenticate with the public REST API. See the{" "}
+          <Link
+            href="/api-docs"
+            className="text-indigo-400 underline underline-offset-2 transition hover:text-indigo-300"
+          >
+            API documentation
+          </Link>{" "}
+          for available endpoints.
+        </p>
+      </div>
+      <ApiKeyManager initialKeys={keys} />
+    </div>
+  )
+}

app/(dashboard)/settings/billing/page.tsx

@@ -5,7 +5,9 @@ import { profiles, properties, tenants } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { CheckoutButton } from "@/components/forms/checkout-button"
 import { PortalButton } from "@/components/forms/portal-button"
-import { getPlanLabel, PLAN_LIMITS } from "@/lib/stripe/plans"
+import { PaypalCancelButton } from "@/components/forms/paypal-cancel-button"
+import { getPlanLabel, PLAN_LIMITS, annualEnabled } from "@/lib/stripe/plans"
+import { paypalConfigured } from "@/lib/paypal/client"
 import { Check } from "lucide-react"
 import type { Plan } from "@/types"
 
@@ -57,7 +59,7 @@ const PLANS = [
 export default async function BillingPage({
   searchParams,
 }: {
-  searchParams: Promise<{ success?: string; canceled?: string }>
+  searchParams: Promise<{ success?: string; canceled?: string; error?: string }>
 }) {
   const user = await getSessionUser()
   if (!user) redirect("/login")
@@ -70,13 +72,18 @@ export default async function BillingPage({
       plan_expires_at: true,
       stripe_customer_id: true,
       stripe_subscription_id: true,
+      paypal_subscription_id: true,
+      billing_provider: true,
     },
   })
 
   const params = await searchParams
   const currentPlan = (profile?.plan ?? "starter") as Plan
   const hasStripeAccount = !!profile?.stripe_customer_id
+  const isPaypal = profile?.billing_provider === "paypal" || !!profile?.paypal_subscription_id
+  const paypalEnabled = paypalConfigured()
   const limits = PLAN_LIMITS[currentPlan]
+  const canBillAnnually = annualEnabled()
 
   const [[{ count: propertiesUsed }], [{ count: tenantsUsed }]] = await Promise.all([
     db
@@ -106,6 +113,11 @@ export default async function BillingPage({
           Checkout canceled — no charge was made.
         </div>
       )}
+      {params.error === "paypal" && (
+        <div className="rounded-xl border border-red-500/20 bg-red-500/10 px-5 py-4 text-sm text-red-400">
+          We couldn&apos;t complete your PayPal payment. No charge was made — please try again.
+        </div>
+      )}
 
       {/* Current plan */}
       <div className="rounded-xl border border-white/[0.06] bg-[#16161f] p-5">
@@ -117,9 +129,12 @@ export default async function BillingPage({
               <p className="mt-0.5 text-xs text-white/40 capitalize">Status: {profile.subscription_status}</p>
             )}
           </div>
-          {hasStripeAccount && currentPlan !== "starter" && currentPlan !== "lifetime" && (
-            <PortalButton />
-          )}
+          {currentPlan !== "starter" && currentPlan !== "lifetime" &&
+            (isPaypal ? (
+              <PaypalCancelButton />
+            ) : hasStripeAccount ? (
+              <PortalButton />
+            ) : null)}
         </div>
       </div>
 
@@ -177,7 +192,13 @@ export default async function BillingPage({
                     {plan.key === "starter" ? "Free" : "Downgrade via portal"}
                   </div>
                 ) : (
-                  <CheckoutButton plan={plan.key} label={plan.cta} highlight={plan.highlight} />
+                  <CheckoutButton
+                    plan={plan.key}
+                    label={plan.cta}
+                    highlight={plan.highlight}
+                    annualAvailable={canBillAnnually && plan.key !== "lifetime"}
+                    paypalEnabled={paypalEnabled}
+                  />
                 )}
               </div>
             </div>

app/(dashboard)/settings/branding/page.tsx

@@ -0,0 +1,69 @@
+import Link from "next/link"
+import { redirect } from "next/navigation"
+import { eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { profiles } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { PLAN_LIMITS } from "@/lib/stripe/plans"
+import { BrandingForm } from "@/components/forms/branding-form"
+import { Sparkles, ArrowRight } from "lucide-react"
+import type { Plan } from "@/types"
+
+export const metadata = { title: "White-Label Branding" }
+
+export default async function BrandingSettingsPage() {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const profile = await db.query.profiles.findFirst({
+    where: eq(profiles.id, user.id),
+    columns: {
+      plan: true,
+      brand_name: true,
+      brand_logo_url: true,
+      brand_color: true,
+      hide_powered_by: true,
+    },
+  })
+
+  const plan = (profile?.plan ?? "starter") as Plan
+  const hasWhiteLabel = PLAN_LIMITS[plan]?.hasWhiteLabel === true
+
+  return (
+    <div className="max-w-4xl space-y-6">
+      <div>
+        <h2 className="text-lg font-semibold text-white">White-Label Branding</h2>
+        <p className="text-sm text-white/40">
+          Customize how the tenant portal looks with your own brand.
+        </p>
+      </div>
+
+      {hasWhiteLabel ? (
+        <BrandingForm
+          brandName={profile?.brand_name ?? null}
+          brandLogoUrl={profile?.brand_logo_url ?? null}
+          brandColor={profile?.brand_color ?? null}
+          hidePoweredBy={profile?.hide_powered_by ?? false}
+        />
+      ) : (
+        <div className="rounded-xl border border-indigo-500/20 bg-indigo-600/5 p-8 text-center">
+          <div className="mx-auto mb-4 flex h-12 w-12 items-center justify-center rounded-xl bg-indigo-600">
+            <Sparkles className="h-6 w-6 text-white" />
+          </div>
+          <h3 className="text-base font-semibold text-white">White-label is a Landlord feature</h3>
+          <p className="mx-auto mt-2 max-w-md text-sm text-white/50">
+            Put your own brand name, logo, and accent color on the tenant portal — and remove the
+            “Powered by” line. Available on the Landlord and Lifetime plans.
+          </p>
+          <Link
+            href="/settings/billing"
+            className="mt-6 inline-flex items-center gap-2 rounded-lg bg-indigo-600 px-5 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500"
+          >
+            Upgrade to unlock
+            <ArrowRight className="h-4 w-4" />
+          </Link>
+        </div>
+      )}
+    </div>
+  )
+}

app/(dashboard)/settings/demo/page.tsx

@@ -2,7 +2,7 @@ import { seedDemoData, clearDemoData, setTestPlan } from "@/app/actions/seed-dem
 import { eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { profiles } from "@/lib/db/schema"
-import { getSessionUser } from "@/lib/session"
+import { getSessionUser, isAdminUser } from "@/lib/session"
 import { redirect, notFound } from "next/navigation"
 import {
   Building2, Users, CreditCard, Wrench,
@@ -30,7 +30,8 @@ export default async function DemoDataPage() {
   const user = await getSessionUser()
   if (!user) redirect("/login")
 
-  if (process.env.NODE_ENV === "production") notFound()
+  // Admin-only testing tool — regular users get a 404 (and never see the nav link).
+  if (!isAdminUser(user)) notFound()
 
   const profile = await db.query.profiles.findFirst({
     where: eq(profiles.id, user.id),

app/(dashboard)/settings/integrations/page.tsx

@@ -0,0 +1,39 @@
+import { redirect } from "next/navigation"
+import { getSessionUser } from "@/lib/session"
+import { getAccountContext } from "@/lib/account"
+import { listProviders, listConnections } from "@/lib/accounting"
+import { AccountingIntegrations } from "@/components/dashboard/accounting-integrations"
+
+export const metadata = { title: "Integrations" }
+export const dynamic = "force-dynamic"
+
+export default async function IntegrationsPage({
+  searchParams,
+}: {
+  searchParams: Promise<{ connected?: string; error?: string }>
+}) {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+  const ctx = await getAccountContext(user.id)
+  const sp = await searchParams
+
+  const providers = listProviders()
+  const connections = ctx.isOwner ? await listConnections(ctx.ownerId) : []
+
+  return (
+    <div className="max-w-3xl mx-auto space-y-6">
+      <div>
+        <h2 className="text-lg font-bold text-white">Integrations</h2>
+        <p className="text-sm text-white/40 mt-0.5">
+          Connect your accounting software to automatically push rent income and expenses into your books.
+        </p>
+      </div>
+      <AccountingIntegrations
+        providers={providers}
+        connections={connections}
+        isOwner={ctx.isOwner}
+        flash={{ connected: sp.connected, error: sp.error }}
+      />
+    </div>
+  )
+}

app/(dashboard)/settings/team/page.tsx

@@ -0,0 +1,120 @@
+import Link from "next/link"
+import { redirect } from "next/navigation"
+import { and, desc, eq, ne } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { account_members, profiles } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { getAccountContext } from "@/lib/account"
+import { PLAN_LIMITS } from "@/lib/stripe/plans"
+import { TeamManager, type TeamMember } from "@/components/dashboard/team-manager"
+import { Users } from "lucide-react"
+import type { Plan } from "@/types"
+
+export const metadata = { title: "Team Access" }
+
+export default async function TeamSettingsPage() {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  const ctx = await getAccountContext(user.id)
+
+  // If the user is a MEMBER of someone else's account, show a read-only note
+  // instead of management UI — they can't manage the owner's team.
+  if (!ctx.isOwner) {
+    const owner = await db.query.profiles.findFirst({
+      where: eq(profiles.id, ctx.ownerId),
+      columns: { full_name: true, company_name: true, email: true },
+    })
+    const ownerName =
+      owner?.company_name || owner?.full_name || owner?.email || "another landlord"
+
+    return (
+      <div className="max-w-2xl space-y-6">
+        <PageHeader />
+        <div className="rounded-xl border border-white/[0.06] bg-[#16161f] p-6">
+          <div className="flex items-start gap-3">
+            <div className="rounded-lg bg-indigo-600/10 p-2">
+              <Users className="h-5 w-5 text-indigo-400" />
+            </div>
+            <div>
+              <p className="text-sm font-medium text-white">
+                You&apos;re a {ctx.role} of {ownerName}&apos;s account
+              </p>
+              <p className="mt-1 text-sm text-white/50">
+                You&apos;re working inside {ownerName}&apos;s portfolio.{" "}
+                {ctx.canWrite
+                  ? "You can view and edit their data."
+                  : "You have read-only access to their data."}{" "}
+                Only the account owner can manage team members.
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    )
+  }
+
+  // Owner: gate on their plan.
+  const profile = await db.query.profiles.findFirst({
+    where: eq(profiles.id, user.id),
+    columns: { plan: true },
+  })
+  const plan = (profile?.plan ?? "starter") as Plan
+  const hasTeamAccess = PLAN_LIMITS[plan].hasTeamAccess
+
+  if (!hasTeamAccess) {
+    return (
+      <div className="max-w-2xl space-y-6">
+        <PageHeader />
+        <div className="rounded-xl border border-indigo-500/20 bg-indigo-600/5 p-8 text-center">
+          <div className="mx-auto mb-4 w-fit rounded-xl bg-indigo-600/10 p-3">
+            <Users className="h-6 w-6 text-indigo-400" />
+          </div>
+          <h3 className="text-base font-semibold text-white">Team access is a paid feature</h3>
+          <p className="mx-auto mt-2 max-w-md text-sm text-white/50">
+            Invite staff or co-managers to access your portfolio with the Landlord
+            or Lifetime plan. Members can help manage your properties, and viewers
+            get read-only access.
+          </p>
+          <Link
+            href="/settings/billing"
+            className="mt-6 inline-flex items-center justify-center rounded-lg bg-indigo-600 px-5 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500"
+          >
+            Upgrade your plan
+          </Link>
+        </div>
+      </div>
+    )
+  }
+
+  const rows = await db
+    .select({
+      id: account_members.id,
+      email: account_members.email,
+      role: account_members.role,
+      status: account_members.status,
+    })
+    .from(account_members)
+    .where(and(eq(account_members.owner_id, user.id), ne(account_members.status, "revoked")))
+    .orderBy(desc(account_members.created_at))
+
+  const members: TeamMember[] = rows
+
+  return (
+    <div className="max-w-2xl space-y-6">
+      <PageHeader />
+      <TeamManager initialMembers={members} />
+    </div>
+  )
+}
+
+function PageHeader() {
+  return (
+    <div>
+      <h2 className="text-lg font-semibold text-white">Team Access</h2>
+      <p className="text-sm text-white/40">
+        Invite people to help manage your property portfolio
+      </p>
+    </div>
+  )
+}

app/(dashboard)/settings/webhooks/page.tsx

@@ -0,0 +1,61 @@
+import { redirect } from "next/navigation"
+import Link from "next/link"
+import { desc, eq } from "drizzle-orm"
+import { db } from "@/lib/db"
+import { webhook_endpoints } from "@/lib/db/schema"
+import { getSessionUser } from "@/lib/session"
+import { getEffectiveOwnerId } from "@/lib/account"
+import { WebhookManager } from "@/components/dashboard/webhook-manager"
+import type { WebhookEndpointDTO } from "@/app/actions/webhooks"
+
+export const metadata = { title: "Webhooks" }
+
+export default async function WebhooksSettingsPage() {
+  const user = await getSessionUser()
+  if (!user) redirect("/login")
+
+  // Endpoints belong to the account owner (team-aware) so every portfolio event
+  // is delivered regardless of which member triggered it.
+  const ownerId = await getEffectiveOwnerId(user.id)
+
+  const rows = await db
+    .select()
+    .from(webhook_endpoints)
+    .where(eq(webhook_endpoints.user_id, ownerId))
+    .orderBy(desc(webhook_endpoints.created_at))
+
+  const endpoints: WebhookEndpointDTO[] = rows.map((row) => ({
+    id: row.id,
+    url: row.url,
+    description: row.description,
+    events: row.events,
+    secret: row.secret,
+    status: row.status,
+    source: row.source,
+    last_success_at: row.last_success_at,
+    last_error_at: row.last_error_at,
+    last_error: row.last_error,
+    failure_count: row.failure_count,
+    created_at: row.created_at,
+  }))
+
+  return (
+    <div className="max-w-2xl space-y-6">
+      <div>
+        <h2 className="text-lg font-semibold text-white">Webhooks</h2>
+        <p className="text-sm text-white/40">
+          Send real-time events to Zapier, Make, or your own server. Each delivery is signed with the
+          endpoint&apos;s secret so you can verify it&apos;s from us. See the{" "}
+          <Link
+            href="/api-docs#webhooks"
+            className="text-indigo-400 underline underline-offset-2 transition hover:text-indigo-300"
+          >
+            webhook documentation
+          </Link>{" "}
+          for the payload format and signature scheme.
+        </p>
+      </div>
+      <WebhookManager initialEndpoints={endpoints} />
+    </div>
+  )
+}