admin/property-management-network
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Browse Source 
Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Leon Serfaty
2026-07-02 13:42:34 -04:00
co-authored by Claude Opus 4.8
parent 969d5d4c8a
commit c9968531e4
282 changed files with 41530 additions and 4013 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/ai/ask/route.ts
+12 -9
View File
@@ -12,6 +12,7 @@ import {
expenses,
} from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getEffectiveOwnerId } from "@/lib/account"
import { openai } from "@/lib/ai/client"
import { enforceAiQuota } from "@/lib/ai/usage"
import { dataBlock } from "@/lib/ai/prompts"
@@ -23,8 +24,10 @@ export async function POST(request: Request) {
const quota = await enforceAiQuota(user.id, "ai_ask")
if (!quota.ok) return NextResponse.json({ error: quota.error }, { status: quota.status })
const ownerId = await getEffectiveOwnerId(user.id)
const profile = await db.query.profiles.findFirst({
where: eq(profiles.id, user.id),
where: eq(profiles.id, ownerId),
columns: { full_name: true },
})
@@ -45,7 +48,7 @@ export async function POST(request: Request) {
total_units: properties.total_units,
})
.from(properties)
.where(eq(properties.user_id, user.id)),
.where(eq(properties.user_id, ownerId)),
db
.select({
id: units.id,
@@ -56,7 +59,7 @@ export async function POST(request: Request) {
status: units.status,
})
.from(units)
.where(eq(units.user_id, user.id)),
.where(eq(units.user_id, ownerId)),
db
.select({
id: tenants.id,
@@ -69,7 +72,7 @@ export async function POST(request: Request) {
move_in_date: tenants.move_in_date,
})
.from(tenants)
.where(and(eq(tenants.user_id, user.id), eq(tenants.status, "active"))),
.where(and(eq(tenants.user_id, ownerId), eq(tenants.status, "active"))),
db
.select({
amount: rent_payments.amount,
@@ -79,7 +82,7 @@ export async function POST(request: Request) {
property_id: rent_payments.property_id,
})
.from(rent_payments)
.where(and(eq(rent_payments.user_id, user.id), gte(rent_payments.due_date, threeMonthsAgo))),
.where(and(eq(rent_payments.user_id, ownerId), gte(rent_payments.due_date, threeMonthsAgo))),
db
.select({
id: maintenance_requests.id,
@@ -91,7 +94,7 @@ export async function POST(request: Request) {
created_at: maintenance_requests.created_at,
})
.from(maintenance_requests)
.where(and(eq(maintenance_requests.user_id, user.id), inArray(maintenance_requests.status, ["open", "in_progress"]))),
.where(and(eq(maintenance_requests.user_id, ownerId), inArray(maintenance_requests.status, ["open", "in_progress"]))),
db
.select({
id: leases.id,
@@ -102,7 +105,7 @@ export async function POST(request: Request) {
status: leases.status,
})
.from(leases)
.where(and(eq(leases.user_id, user.id), eq(leases.status, "active"))),
.where(and(eq(leases.user_id, ownerId), eq(leases.status, "active"))),
db
.select({
amount: expenses.amount,
@@ -112,7 +115,7 @@ export async function POST(request: Request) {
property_id: expenses.property_id,
})
.from(expenses)
.where(and(eq(expenses.user_id, user.id), gte(expenses.expense_date, threeMonthsAgo))),
.where(and(eq(expenses.user_id, ownerId), gte(expenses.expense_date, threeMonthsAgo))),
])
// Build summary stats
@@ -162,5 +165,5 @@ Answer the landlord's question in a helpful, concise, and professional manner. U
const answer = completion.choices[0].message.content ?? ""
return NextResponse.json({ answer })
return NextResponse.json({ answer, usage: { used: quota.used, limit: quota.limit } })
}
app/api/ai/impact/route.ts
+4 -1
View File
@@ -3,15 +3,18 @@ import { eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { ai_recommendations } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getEffectiveOwnerId } from "@/lib/account"
export async function GET() {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ownerId = await getEffectiveOwnerId(user.id)
const all = await db
.select()
.from(ai_recommendations)
.where(eq(ai_recommendations.user_id, user.id))
.where(eq(ai_recommendations.user_id, ownerId))
const approved = all.filter((r) => r.status === "approved")
const dismissed = all.filter((r) => r.status === "dismissed")
app/api/ai/maintenance-summary/route.ts
+5 -2
View File
@@ -3,6 +3,7 @@ import { and, eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { properties, maintenance_requests } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getEffectiveOwnerId } from "@/lib/account"
import { openai } from "@/lib/ai/client"
import { MAINTENANCE_SUMMARY_PROMPT, dataBlock } from "@/lib/ai/prompts"
import { enforceAiQuota } from "@/lib/ai/usage"
@@ -14,6 +15,8 @@ export async function POST(request: Request) {
const quota = await enforceAiQuota(user.id, "ai_maintenance_summary")
if (!quota.ok) return NextResponse.json({ error: quota.error }, { status: quota.status })
const ownerId = await getEffectiveOwnerId(user.id)
const { property_id } = await request.json() as { property_id: string }
const requests = await db
@@ -29,10 +32,10 @@ export async function POST(request: Request) {
resolved_at: maintenance_requests.resolved_at,
})
.from(maintenance_requests)
.where(and(eq(maintenance_requests.user_id, user.id), eq(maintenance_requests.property_id, property_id)))
.where(and(eq(maintenance_requests.user_id, ownerId), eq(maintenance_requests.property_id, property_id)))
const property = await db.query.properties.findFirst({
where: and(eq(properties.id, property_id), eq(properties.user_id, user.id)),
where: and(eq(properties.id, property_id), eq(properties.user_id, ownerId)),
columns: { name: true },
})
app/api/ai/predictions/route.ts
+18 -11
View File
@@ -12,6 +12,7 @@ import {
expenses,
} from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
import { openai } from "@/lib/ai/client"
import { logActivity } from "@/lib/activity"
import { enforceAiQuota } from "@/lib/ai/usage"
@@ -21,10 +22,12 @@ export async function GET() {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ownerId = await getEffectiveOwnerId(user.id)
const data = await db
.select()
.from(ai_predictions)
.where(eq(ai_predictions.user_id, user.id))
.where(eq(ai_predictions.user_id, ownerId))
.orderBy(desc(ai_predictions.created_at))
.limit(30)
@@ -38,13 +41,17 @@ export async function POST() {
const quota = await enforceAiQuota(user.id, "ai_predictions")
if (!quota.ok) return NextResponse.json({ error: quota.error }, { status: quota.status })
const ctx = await getAccountContext(user.id)
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const ownerId = ctx.ownerId
const now = new Date()
const sixMonthsAgo = new Date(now)
sixMonthsAgo.setMonth(sixMonthsAgo.getMonth() - 6)
const sixMonthsAgoDate = sixMonthsAgo.toISOString().slice(0, 10)
const [propertiesData, unitsData, tenantsData, payments, maintenance, leasesData, expensesData] = await Promise.all([
db.select({ id: properties.id, name: properties.name }).from(properties).where(eq(properties.user_id, user.id)),
db.select({ id: properties.id, name: properties.name }).from(properties).where(eq(properties.user_id, ownerId)),
db
.select({
id: units.id,
@@ -54,7 +61,7 @@ export async function POST() {
status: units.status,
})
.from(units)
.where(eq(units.user_id, user.id)),
.where(eq(units.user_id, ownerId)),
db
.select({
id: tenants.id,
@@ -64,7 +71,7 @@ export async function POST() {
property_id: tenants.property_id,
})
.from(tenants)
.where(and(eq(tenants.user_id, user.id), eq(tenants.status, "active"))),
.where(and(eq(tenants.user_id, ownerId), eq(tenants.status, "active"))),
db
.select({
amount: rent_payments.amount,
@@ -73,7 +80,7 @@ export async function POST() {
property_id: rent_payments.property_id,
})
.from(rent_payments)
.where(and(eq(rent_payments.user_id, user.id), gte(rent_payments.due_date, sixMonthsAgoDate)))
.where(and(eq(rent_payments.user_id, ownerId), gte(rent_payments.due_date, sixMonthsAgoDate)))
.orderBy(rent_payments.due_date),
db
.select({
@@ -84,7 +91,7 @@ export async function POST() {
property_id: maintenance_requests.property_id,
})
.from(maintenance_requests)
.where(eq(maintenance_requests.user_id, user.id)),
.where(eq(maintenance_requests.user_id, ownerId)),
db
.select({
tenant_id: leases.tenant_id,
@@ -94,7 +101,7 @@ export async function POST() {
status: leases.status,
})
.from(leases)
.where(eq(leases.user_id, user.id)),
.where(eq(leases.user_id, ownerId)),
db
.select({
amount: expenses.amount,
@@ -103,7 +110,7 @@ export async function POST() {
property_id: expenses.property_id,
})
.from(expenses)
.where(and(eq(expenses.user_id, user.id), gte(expenses.expense_date, sixMonthsAgoDate))),
.where(and(eq(expenses.user_id, ownerId), gte(expenses.expense_date, sixMonthsAgoDate))),
])
// Build monthly revenue trend
@@ -183,10 +190,10 @@ Only return valid JSON, no other text.`
}
// Replace old predictions
await db.delete(ai_predictions).where(eq(ai_predictions.user_id, user.id))
await db.delete(ai_predictions).where(eq(ai_predictions.user_id, ownerId))
const toInsert = predictions.map((p: any) => ({
user_id: user.id,
user_id: ownerId,
type: p.type ?? "growth_opportunity",
title: p.title,
prediction: p.prediction,
@@ -199,7 +206,7 @@ Only return valid JSON, no other text.`
const inserted = toInsert.length > 0 ? await db.insert(ai_predictions).values(toInsert).returning() : []
await logActivity({
userId: user.id,
userId: ownerId,
type: "ai_action",
title: `AI generated ${inserted.length} predictions and risk alerts`,
entityType: "ai_predictions",
app/api/ai/recommendations/[id]/route.ts
+7 -2
View File
@@ -3,12 +3,17 @@ import { and, eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { ai_recommendations } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getAccountContext } from "@/lib/account"
import { logActivity } from "@/lib/activity"
export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ctx = await getAccountContext(user.id)
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const ownerId = ctx.ownerId
const { id } = await params
const { status } = await request.json() as { status: "approved" | "dismissed" }
@@ -23,13 +28,13 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
const [data] = await db
.update(ai_recommendations)
.set(updateData)
.where(and(eq(ai_recommendations.id, id), eq(ai_recommendations.user_id, user.id)))
.where(and(eq(ai_recommendations.id, id), eq(ai_recommendations.user_id, ownerId)))
.returning()
if (!data) return NextResponse.json({ error: "Not found" }, { status: 404 })
await logActivity({
userId: user.id,
userId: ownerId,
type: "ai_action",
title: status === "approved"
? `AI recommendation approved: ${data.title}`
app/api/ai/recommendations/route.ts
+18 -11
View File
@@ -12,6 +12,7 @@ import {
expenses,
} from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
import { openai } from "@/lib/ai/client"
import { logActivity } from "@/lib/activity"
import { enforceAiQuota } from "@/lib/ai/usage"
@@ -21,10 +22,12 @@ export async function GET() {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ownerId = await getEffectiveOwnerId(user.id)
const data = await db
.select()
.from(ai_recommendations)
.where(eq(ai_recommendations.user_id, user.id))
.where(eq(ai_recommendations.user_id, ownerId))
.orderBy(desc(ai_recommendations.created_at))
return NextResponse.json(data)
@@ -37,6 +40,10 @@ export async function POST() {
const quota = await enforceAiQuota(user.id, "ai_recommendations")
if (!quota.ok) return NextResponse.json({ error: quota.error }, { status: quota.status })
const ctx = await getAccountContext(user.id)
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const ownerId = ctx.ownerId
// Fetch portfolio data
const now = new Date()
const threeMonthsAgo = new Date(now)
@@ -47,7 +54,7 @@ export async function POST() {
db
.select({ id: properties.id, name: properties.name, address_line1: properties.address_line1, city: properties.city })
.from(properties)
.where(eq(properties.user_id, user.id)),
.where(eq(properties.user_id, ownerId)),
db
.select({
id: units.id,
@@ -57,7 +64,7 @@ export async function POST() {
status: units.status,
})
.from(units)
.where(eq(units.user_id, user.id)),
.where(eq(units.user_id, ownerId)),
db
.select({
id: tenants.id,
@@ -69,7 +76,7 @@ export async function POST() {
move_in_date: tenants.move_in_date,
})
.from(tenants)
.where(and(eq(tenants.user_id, user.id), eq(tenants.status, "active"))),
.where(and(eq(tenants.user_id, ownerId), eq(tenants.status, "active"))),
db
.select({
id: rent_payments.id,
@@ -80,7 +87,7 @@ export async function POST() {
property_id: rent_payments.property_id,
})
.from(rent_payments)
.where(and(eq(rent_payments.user_id, user.id), gte(rent_payments.due_date, threeMonthsAgoDate))),
.where(and(eq(rent_payments.user_id, ownerId), gte(rent_payments.due_date, threeMonthsAgoDate))),
db
.select({
id: maintenance_requests.id,
@@ -91,7 +98,7 @@ export async function POST() {
created_at: maintenance_requests.created_at,
})
.from(maintenance_requests)
.where(and(eq(maintenance_requests.user_id, user.id), inArray(maintenance_requests.status, ["open", "in_progress"]))),
.where(and(eq(maintenance_requests.user_id, ownerId), inArray(maintenance_requests.status, ["open", "in_progress"]))),
db
.select({
id: leases.id,
@@ -102,7 +109,7 @@ export async function POST() {
status: leases.status,
})
.from(leases)
.where(and(eq(leases.user_id, user.id), eq(leases.status, "active"))),
.where(and(eq(leases.user_id, ownerId), eq(leases.status, "active"))),
db
.select({
amount: expenses.amount,
@@ -111,7 +118,7 @@ export async function POST() {
expense_date: expenses.expense_date,
})
.from(expenses)
.where(and(eq(expenses.user_id, user.id), gte(expenses.expense_date, threeMonthsAgoDate))),
.where(and(eq(expenses.user_id, ownerId), gte(expenses.expense_date, threeMonthsAgoDate))),
])
const totalRevenue = payments.filter((p) => p.status === "paid").reduce((s, p) => s + Number(p.amount), 0)
@@ -175,10 +182,10 @@ Only return valid JSON, no other text.`
// Delete old pending recommendations and insert new ones
await db
.delete(ai_recommendations)
.where(and(eq(ai_recommendations.user_id, user.id), eq(ai_recommendations.status, "pending")))
.where(and(eq(ai_recommendations.user_id, ownerId), eq(ai_recommendations.status, "pending")))
const toInsert = recommendations.map((r: any) => ({
user_id: user.id,
user_id: ownerId,
type: r.type ?? "opportunity",
title: r.title,
description: r.description,
@@ -192,7 +199,7 @@ Only return valid JSON, no other text.`
const inserted = toInsert.length > 0 ? await db.insert(ai_recommendations).values(toInsert).returning() : []
await logActivity({
userId: user.id,
userId: ownerId,
type: "ai_action",
title: `AI generated ${inserted.length} new recommendations`,
entityType: "ai_recommendations",