admin/property-management-network
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Consolidate audit-fixes branch: webhooks, integrations, and deploy hardening

Browse Source 
Batch commit of the pending working tree on security/audit-fixes-2026-07.
Major areas:
- Outbound webhooks / Zapier: schema + signed delivery with retries, public
  v1 API (REST-hook subscribe/unsubscribe), settings UI, cron drain.
- Deploy hardening: email via SMTP2GO (Resend fully removed), verified DB TLS
  (DATABASE_SSL=require + DATABASE_CA), storage fails loud in production when
  Spaces is unconfigured instead of silently using ephemeral disk.
- Integrations & features (concurrent work): accounting (QuickBooks/Xero),
  e-signature (DocuSign/Dropbox Sign), PayPal, geocoding/maps, onboarding,
  expanded legal pages.
- DB migrations 0006–0009.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Leon Serfaty
2026-07-02 13:42:34 -04:00
co-authored by Claude Opus 4.8
parent 969d5d4c8a
commit c9968531e4
282 changed files with 41530 additions and 4013 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/tenants/[id]/rotate-portal-token/route.ts
+5 -1
View File
@@ -4,17 +4,21 @@ import { randomUUID } from "crypto"
import { db } from "@/lib/db"
import { tenants } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getAccountContext } from "@/lib/account"
// Lets a landlord rotate a tenant's portal token (invalidates the old private link).
export async function POST(_: Request, { params }: { params: Promise<{ id: string }> }) {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ctx = await getAccountContext(user.id)
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const { id } = await params
const [row] = await db
.update(tenants)
.set({ portal_token: randomUUID() })
.where(and(eq(tenants.id, id), eq(tenants.user_id, user.id)))
.where(and(eq(tenants.id, id), eq(tenants.user_id, ctx.ownerId)))
.returning({ id: tenants.id, portal_token: tenants.portal_token })
if (!row) return NextResponse.json({ error: "Not found" }, { status: 404 })
app/api/tenants/[id]/route.ts
+18 -7
View File
@@ -5,14 +5,17 @@ import { tenants, units } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { tenantSchema } from "@/lib/validations"
import { ownsProperty, ownsUnit } from "@/lib/db/ownership"
import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
export async function GET(_: Request, { params }: { params: Promise<{ id: string }> }) {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ownerId = await getEffectiveOwnerId(user.id)
const { id } = await params
const data = await db.query.tenants.findFirst({
where: and(eq(tenants.id, id), eq(tenants.user_id, user.id)),
where: and(eq(tenants.id, id), eq(tenants.user_id, ownerId)),
with: {
unit: {},
property: {},
@@ -29,14 +32,18 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ctx = await getAccountContext(user.id)
const ownerId = ctx.ownerId
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const { id } = await params
const body = await request.json()
const parsed = tenantSchema.partial().safeParse(body)
if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
if (
!(await ownsProperty(user.id, parsed.data.property_id)) ||
!(await ownsUnit(user.id, parsed.data.unit_id))
!(await ownsProperty(ownerId, parsed.data.property_id)) ||
!(await ownsUnit(ownerId, parsed.data.unit_id))
) {
return NextResponse.json({ error: "Invalid reference" }, { status: 403 })
}
@@ -45,7 +52,7 @@ export async function PATCH(request: Request, { params }: { params: Promise<{ id
const [data] = await db
.update(tenants)
.set(parsed.data)
.where(and(eq(tenants.id, id), eq(tenants.user_id, user.id)))
.where(and(eq(tenants.id, id), eq(tenants.user_id, ownerId)))
.returning()
return NextResponse.json(data)
@@ -58,23 +65,27 @@ export async function DELETE(_: Request, { params }: { params: Promise<{ id: str
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ctx = await getAccountContext(user.id)
const ownerId = ctx.ownerId
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const { id } = await params
try {
// Get tenant to free unit
const tenant = await db.query.tenants.findFirst({
where: and(eq(tenants.id, id), eq(tenants.user_id, user.id)),
where: and(eq(tenants.id, id), eq(tenants.user_id, ownerId)),
columns: { unit_id: true },
})
await db.delete(tenants).where(and(eq(tenants.id, id), eq(tenants.user_id, user.id)))
await db.delete(tenants).where(and(eq(tenants.id, id), eq(tenants.user_id, ownerId)))
// Free unit
if (tenant?.unit_id) {
await db
.update(units)
.set({ status: "vacant", current_tenant_id: null })
.where(and(eq(units.id, tenant.unit_id), eq(units.user_id, user.id)))
.where(and(eq(units.id, tenant.unit_id), eq(units.user_id, ownerId)))
}
return NextResponse.json({ success: true })
app/api/tenants/route.ts
+32 -7
View File
@@ -5,12 +5,18 @@ import { tenants, units } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { tenantSchema } from "@/lib/validations"
import { ownsProperty, ownsUnit } from "@/lib/db/ownership"
import { getUserPlan } from "@/lib/plan-limits"
import { checkLimit } from "@/lib/stripe/plans"
import { logActivity } from "@/lib/activity"
import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
import { emitWebhookEvent } from "@/lib/webhooks/emit"
export async function GET(request: Request) {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ownerId = await getEffectiveOwnerId(user.id)
const { searchParams } = new URL(request.url)
const propertyId = searchParams.get("property_id")
const status = searchParams.get("status") ?? "active"
@@ -24,7 +30,7 @@ export async function GET(request: Request) {
}
const where = and(
eq(tenants.user_id, user.id),
eq(tenants.user_id, ownerId),
eq(tenants.status, status as typeof tenants.$inferSelect.status),
propertyId ? eq(tenants.property_id, propertyId) : undefined
)
@@ -50,20 +56,37 @@ export async function POST(request: Request) {
const user = await getSessionUser()
if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
const ctx = await getAccountContext(user.id)
const ownerId = ctx.ownerId
if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
const body = await request.json()
const parsed = tenantSchema.safeParse(body)
if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 400 })
// Enforce per-plan tenant limit (Starter = 3).
const plan = await getUserPlan(ownerId)
const [{ count }] = await db
.select({ count: sql<number>`count(*)::int` })
.from(tenants)
.where(eq(tenants.user_id, ownerId))
if (!checkLimit(plan, "maxTenants", count)) {
return NextResponse.json(
{ error: "Plan limit reached. Upgrade to add more tenants." },
{ status: 403 }
)
}
if (
!(await ownsProperty(user.id, parsed.data.property_id)) ||
!(await ownsUnit(user.id, parsed.data.unit_id))
!(await ownsProperty(ownerId, parsed.data.property_id)) ||
!(await ownsUnit(ownerId, parsed.data.unit_id))
) {
return NextResponse.json({ error: "Forbidden" }, { status: 403 })
}
const [tenant] = await db
.insert(tenants)
.values({ ...parsed.data, user_id: user.id })
.values({ ...parsed.data, user_id: ownerId })
.returning()
// Mark unit as occupied — verify unit belongs to the submitted property first
@@ -72,7 +95,7 @@ export async function POST(request: Request) {
where: and(
eq(units.id, parsed.data.unit_id),
eq(units.property_id, parsed.data.property_id),
eq(units.user_id, user.id)
eq(units.user_id, ownerId)
),
columns: { id: true },
})
@@ -81,12 +104,12 @@ export async function POST(request: Request) {
await db
.update(units)
.set({ status: "occupied", current_tenant_id: tenant.id })
.where(and(eq(units.id, parsed.data.unit_id), eq(units.user_id, user.id)))
.where(and(eq(units.id, parsed.data.unit_id), eq(units.user_id, ownerId)))
}
}
await logActivity({
userId: user.id,
userId: ownerId,
type: "tenant_added",
title: `New tenant added: ${parsed.data.first_name} ${parsed.data.last_name}`,
description: parsed.data.email ?? undefined,
@@ -94,5 +117,7 @@ export async function POST(request: Request) {
entityId: tenant.id,
})
await emitWebhookEvent({ ownerId, event: "tenant.created", data: { tenant } })
return NextResponse.json(tenant, { status: 201 })
}