Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/documents/[id]/route.ts

@@ -4,14 +4,17 @@ import { db } from "@/lib/db"
 import { documents } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { deleteFile } from "@/lib/storage"
+import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
 
 export async function GET(_: Request, { params }: { params: Promise<{ id: string }> }) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { id } = await params
   const doc = await db.query.documents.findFirst({
-    where: and(eq(documents.id, id), eq(documents.user_id, user.id)),
+    where: and(eq(documents.id, id), eq(documents.user_id, ownerId)),
   })
 
   if (!doc) return NextResponse.json({ error: "Not found" }, { status: 404 })
@@ -25,16 +28,20 @@ export async function DELETE(_: Request, { params }: { params: Promise<{ id: str
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const { id } = await params
 
   const doc = await db.query.documents.findFirst({
-    where: and(eq(documents.id, id), eq(documents.user_id, user.id)),
+    where: and(eq(documents.id, id), eq(documents.user_id, ownerId)),
     columns: { storage_path: true },
   })
 
   if (!doc) return NextResponse.json({ error: "Not found" }, { status: 404 })
 
-  await db.delete(documents).where(and(eq(documents.id, id), eq(documents.user_id, user.id)))
+  await db.delete(documents).where(and(eq(documents.id, id), eq(documents.user_id, ownerId)))
 
   if (doc.storage_path) {
     await deleteFile(doc.storage_path)

app/api/documents/route.ts

@@ -3,20 +3,24 @@ import { and, desc, eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { documents, properties } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
-import { saveFile } from "@/lib/storage"
+import { saveFile, isAllowedUploadExt, StorageNotConfiguredError } from "@/lib/storage"
+import { checkStorageLimit } from "@/lib/plan-limits"
 import { ownsProperty, ownsTenant } from "@/lib/db/ownership"
+import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
 
 export async function GET(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { searchParams } = new URL(request.url)
   const propertyId = searchParams.get("property_id")
 
   let propertyName = ""
   if (propertyId) {
     const prop = await db.query.properties.findFirst({
-      where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
+      where: and(eq(properties.id, propertyId), eq(properties.user_id, ownerId)),
       columns: { name: true },
     })
     propertyName = prop?.name ?? ""
@@ -24,7 +28,7 @@ export async function GET(request: Request) {
 
   const data = await db.query.documents.findMany({
     where: and(
-      eq(documents.user_id, user.id),
+      eq(documents.user_id, ownerId),
       propertyId ? eq(documents.property_id, propertyId) : undefined
     ),
     orderBy: desc(documents.created_at),
@@ -37,6 +41,10 @@ export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const contentType = request.headers.get("content-type") ?? ""
 
   if (contentType.includes("multipart/form-data")) {
@@ -48,20 +56,37 @@ export async function POST(request: Request) {
 
     if (!file) return NextResponse.json({ error: "No file provided" }, { status: 400 })
     if (file.size > 20 * 1024 * 1024) return NextResponse.json({ error: "File too large (max 20 MB)" }, { status: 400 })
+    if (!isAllowedUploadExt(file.name)) return NextResponse.json({ error: "File type not allowed" }, { status: 400 })
+
+    const storageError = await checkStorageLimit(ownerId, file.size)
+    if (storageError) return NextResponse.json({ error: storageError }, { status: 403 })
 
     // Verify the property belongs to the user before attaching a document to it.
     const prop = await db.query.properties.findFirst({
-      where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
+      where: and(eq(properties.id, propertyId), eq(properties.user_id, ownerId)),
       columns: { id: true },
     })
     if (!prop) return NextResponse.json({ error: "Property not found" }, { status: 404 })
 
-    const { key, size, type } = await saveFile(file, { userId: user.id, scope: "documents" })
+    let saved
+    try {
+      saved = await saveFile(file, { userId: ownerId, scope: "documents" })
+    } catch (err) {
+      if (err instanceof StorageNotConfiguredError) {
+        console.error("[documents]", err.message)
+        return NextResponse.json(
+          { error: "File uploads are temporarily unavailable. Please try again later." },
+          { status: 503 }
+        )
+      }
+      throw err
+    }
+    const { key, size, type } = saved
 
     const [data] = await db
       .insert(documents)
       .values({
-        user_id: user.id,
+        user_id: ownerId,
         property_id: propertyId,
         name: name || file.name,
         category,
@@ -81,10 +106,10 @@ export async function POST(request: Request) {
   const tenantId = body.tenant_id as string | undefined
 
   // Verify the property/tenant belong to the user before attaching a document.
-  if (!(await ownsProperty(user.id, propertyId))) {
+  if (!(await ownsProperty(ownerId, propertyId))) {
     return NextResponse.json({ error: "Property not found" }, { status: 404 })
   }
-  if (!(await ownsTenant(user.id, tenantId))) {
+  if (!(await ownsTenant(ownerId, tenantId))) {
     return NextResponse.json({ error: "Tenant not found" }, { status: 404 })
   }
 
@@ -92,7 +117,7 @@ export async function POST(request: Request) {
   const [data] = await db
     .insert(documents)
     .values({
-      user_id: user.id,
+      user_id: ownerId,
       property_id: propertyId as string,
       tenant_id: tenantId,
       name: body.name as string,