Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app/api/rent/[id]/route.ts

@@ -6,20 +6,26 @@ import { getSessionUser } from "@/lib/session"
 import { rentPaymentSchema } from "@/lib/validations"
 import { ownsProperty, ownsUnit, ownsTenant } from "@/lib/db/ownership"
 import { logActivity } from "@/lib/activity"
+import { getAccountContext } from "@/lib/account"
+import { emitWebhookEvent } from "@/lib/webhooks/emit"
 
 export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const { id } = await params
   const body = await request.json()
   const parsed = rentPaymentSchema.partial().safeParse(body)
   if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
 
   if (
-    !(await ownsProperty(user.id, parsed.data.property_id)) ||
-    !(await ownsUnit(user.id, parsed.data.unit_id)) ||
-    !(await ownsTenant(user.id, parsed.data.tenant_id))
+    !(await ownsProperty(ownerId, parsed.data.property_id)) ||
+    !(await ownsUnit(ownerId, parsed.data.unit_id)) ||
+    !(await ownsTenant(ownerId, parsed.data.tenant_id))
   ) {
     return NextResponse.json({ error: "Invalid reference" }, { status: 403 })
   }
@@ -33,17 +39,18 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
   const [data] = await db
     .update(rent_payments)
     .set(updateData)
-    .where(and(eq(rent_payments.id, id), eq(rent_payments.user_id, user.id)))
+    .where(and(eq(rent_payments.id, id), eq(rent_payments.user_id, ownerId)))
     .returning()
 
   if (parsed.data.status === "paid") {
     await logActivity({
-      userId: user.id,
+      userId: ownerId,
       type: "rent_paid",
       title: "Rent payment marked as paid",
       entityType: "rent_payment",
       entityId: id,
     })
+    await emitWebhookEvent({ ownerId, event: "payment.paid", data: { payment: data } })
   }
 
   return NextResponse.json(data)
@@ -53,7 +60,11 @@ export async function DELETE(_: Request, { params }: { params: Promise<{ id: str
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const { id } = await params
-  await db.delete(rent_payments).where(and(eq(rent_payments.id, id), eq(rent_payments.user_id, user.id)))
+  await db.delete(rent_payments).where(and(eq(rent_payments.id, id), eq(rent_payments.user_id, ownerId)))
   return NextResponse.json({ success: true })
 }

app/api/rent/generate/route.ts

@@ -3,11 +3,16 @@ import { and, eq } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { leases, rent_payments } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
+import { getAccountContext } from "@/lib/account"
 
 export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const { year, month } = await request.json() as { year: number; month: number }
   if (!year || month === undefined) return NextResponse.json({ error: "year and month required" }, { status: 400 })
 
@@ -21,7 +26,7 @@ export async function POST(request: Request) {
       rent_amount: leases.rent_amount,
     })
     .from(leases)
-    .where(and(eq(leases.user_id, user.id), eq(leases.status, "active")))
+    .where(and(eq(leases.user_id, ownerId), eq(leases.status, "active")))
 
   if (!activeLeases.length) return NextResponse.json({ created: 0, skipped: 0 })
 
@@ -33,14 +38,14 @@ export async function POST(request: Request) {
   const existing = await db
     .select({ tenant_id: rent_payments.tenant_id })
     .from(rent_payments)
-    .where(and(eq(rent_payments.user_id, user.id), eq(rent_payments.due_date, due_date)))
+    .where(and(eq(rent_payments.user_id, ownerId), eq(rent_payments.due_date, due_date)))
 
   const existingTenantIds = new Set(existing.map((p) => p.tenant_id))
 
   const toInsert = activeLeases
     .filter((l) => !existingTenantIds.has(l.tenant_id))
     .map((l) => ({
-      user_id:     user.id,
+      user_id:     ownerId,
       tenant_id:   l.tenant_id,
       property_id: l.property_id,
       unit_id:     l.unit_id ?? null,

app/api/rent/payment-link/route.ts

@@ -4,15 +4,20 @@ import { db } from "@/lib/db"
 import { rent_payments } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { createRentPaymentLink } from "@/lib/stripe/payment-links"
+import { getAccountContext } from "@/lib/account"
 
 export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const { payment_id } = await request.json() as { payment_id: string }
 
   const payment = await db.query.rent_payments.findFirst({
-    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, user.id)),
+    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, ownerId)),
     with: {
       tenant: { columns: { first_name: true, last_name: true } },
       property: { columns: { name: true } },
@@ -35,7 +40,7 @@ export async function POST(request: Request) {
   await db
     .update(rent_payments)
     .set({ stripe_payment_link_id: link.id })
-    .where(and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, user.id)))
+    .where(and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, ownerId)))
 
   return NextResponse.json({ url: link.url })
 }

app/api/rent/route.ts

@@ -5,11 +5,15 @@ import { rent_payments } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
 import { rentPaymentSchema } from "@/lib/validations"
 import { ownsProperty, ownsUnit, ownsTenant } from "@/lib/db/ownership"
+import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
+import { emitWebhookEvent } from "@/lib/webhooks/emit"
 
 export async function GET(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ownerId = await getEffectiveOwnerId(user.id)
+
   const { searchParams } = new URL(request.url)
   const status = searchParams.get("status")
   const tenantId = searchParams.get("tenant_id")
@@ -18,7 +22,7 @@ export async function GET(request: Request) {
   const offset = (page - 1) * limit
 
   const where = and(
-    eq(rent_payments.user_id, user.id),
+    eq(rent_payments.user_id, ownerId),
     status ? eq(rent_payments.status, status as typeof rent_payments.$inferSelect.status) : undefined,
     tenantId ? eq(rent_payments.tenant_id, tenantId) : undefined
   )
@@ -45,22 +49,32 @@ export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const body = await request.json()
   const parsed = rentPaymentSchema.safeParse(body)
   if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
 
   if (
-    !(await ownsProperty(user.id, parsed.data.property_id)) ||
-    !(await ownsUnit(user.id, parsed.data.unit_id)) ||
-    !(await ownsTenant(user.id, parsed.data.tenant_id))
+    !(await ownsProperty(ownerId, parsed.data.property_id)) ||
+    !(await ownsUnit(ownerId, parsed.data.unit_id)) ||
+    !(await ownsTenant(ownerId, parsed.data.tenant_id))
   ) {
     return NextResponse.json({ error: "Invalid reference" }, { status: 403 })
   }
 
   const [data] = await db
     .insert(rent_payments)
-    .values({ ...parsed.data, user_id: user.id })
+    .values({ ...parsed.data, user_id: ownerId })
     .returning()
 
+  await emitWebhookEvent({ ownerId, event: "payment.recorded", data: { payment: data } })
+  // A payment created already in the "paid" state also fires payment.paid.
+  if (data.status === "paid") {
+    await emitWebhookEvent({ ownerId, event: "payment.paid", data: { payment: data } })
+  }
+
   return NextResponse.json(data, { status: 201 })
 }

app/api/rent/send-payment-link/route.ts

@@ -3,13 +3,18 @@ import { and, eq, sql } from "drizzle-orm"
 import { db } from "@/lib/db"
 import { rent_payments, profiles } from "@/lib/db/schema"
 import { getSessionUser } from "@/lib/session"
-import { sendEmail, escapeHtml } from "@/lib/email/send"
+import { sendEmail, paymentLinkHtml } from "@/lib/email/send"
 import { paymentLinkSchema } from "@/lib/validations"
+import { getAccountContext } from "@/lib/account"
 
 export async function POST(request: Request) {
   const user = await getSessionUser()
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
 
+  const ctx = await getAccountContext(user.id)
+  const ownerId = ctx.ownerId
+  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
+
   const body = await request.json()
   const parsed = paymentLinkSchema.safeParse(body)
   if (!parsed.success) {
@@ -20,7 +25,7 @@ export async function POST(request: Request) {
 
   // Fetch payment with tenant details
   const payment = await db.query.rent_payments.findFirst({
-    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, user.id)),
+    where: and(eq(rent_payments.id, payment_id), eq(rent_payments.user_id, ownerId)),
     with: {
       tenant: { columns: { first_name: true, last_name: true, email: true } },
       property: { columns: { name: true } },
@@ -31,9 +36,9 @@ export async function POST(request: Request) {
   if (!payment) return NextResponse.json({ error: "Payment not found" }, { status: 404 })
   if (!payment.tenant?.email) return NextResponse.json({ error: "Tenant has no email address" }, { status: 400 })
 
-  // Fetch landlord profile for payment instructions
+  // Fetch landlord (portfolio owner) profile for payment instructions
   const profile = await db.query.profiles.findFirst({
-    where: eq(profiles.id, user.id),
+    where: eq(profiles.id, ownerId),
     columns: { full_name: true },
   })
 
@@ -41,27 +46,17 @@ export async function POST(request: Request) {
   const amount = Number(payment.amount).toLocaleString("en-US", { style: "currency", currency: "USD" })
   const dueDate = new Date(payment.due_date).toLocaleDateString("en-US", { month: "long", day: "numeric", year: "numeric" })
 
-  const html = `
-    <div style="font-family:sans-serif;max-width:560px;margin:0 auto;background:#09090b;color:#fff;border-radius:12px;overflow:hidden;">
-      <div style="background:linear-gradient(135deg,#4f46e5,#7c3aed);padding:32px;text-align:center;">
-        <h1 style="margin:0;font-size:24px;font-weight:700;">Rent Payment Due</h1>
-        <p style="margin:8px 0 0;opacity:.8;font-size:14px;">Property Management Network</p>
-      </div>
-      <div style="padding:32px;">
-        <p style="font-size:16px;margin:0 0 8px;">Hi ${escapeHtml(tenantName)},</p>
-        <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 24px;">
-          Your rent payment of <strong style="color:#fff;">${amount}</strong> is due on <strong style="color:#fff;">${dueDate}</strong>
-          for ${escapeHtml(payment.property?.name)}${payment.unit ? ` Unit ${escapeHtml(payment.unit.unit_number)}` : ""}.
-        </p>
-        <p style="color:rgba(255,255,255,.6);font-size:14px;margin:0 0 16px;">
-          Please arrange payment at your earliest convenience. Contact your landlord if you have any questions.
-        </p>
-        <p style="color:rgba(255,255,255,.4);font-size:12px;margin:24px 0 0;border-top:1px solid rgba(255,255,255,.08);padding-top:16px;">
-          Sent by ${escapeHtml(profile?.full_name ?? "Your Landlord")} via Property Management Network
-        </p>
-      </div>
-    </div>
-  `
+  const propertyLabel = `${payment.property?.name ?? "your property"}${
+    payment.unit ? ` — Unit ${payment.unit.unit_number}` : ""
+  }`
+
+  const html = paymentLinkHtml({
+    tenantName,
+    amount,
+    dueDate,
+    propertyLabel,
+    senderName: profile?.full_name ?? "Your Landlord",
+  })
 
   try {
     await sendEmail({
@@ -76,7 +71,7 @@ export async function POST(request: Request) {
   // Update rent_payment to mark reminder sent
   try {
     await db.execute(
-      sql`update rent_payments set reminder_sent_at = now() where id = ${payment_id} and user_id = ${user.id}`
+      sql`update rent_payments set reminder_sent_at = now() where id = ${payment_id} and user_id = ${ownerId}`
     )
   } catch {
     // Email sent successfully, but tracking update failed — still return ok