letsbe/pn-new-crm
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

Browse Source 
Closes the second wave of HIGH-priority audit findings:

* fetchWithTimeout helper (new src/lib/fetch-with-timeout.ts) wraps
  Documenso, OCR, currency, Umami, IMAP, etc. — a hung upstream can
  no longer pin a worker concurrency slot indefinitely.  OpenAI client
  passes timeout: 30_000.  ImapFlow gets socket / greeting / connection
  timeouts.
* SIGTERM / SIGINT handler in src/server.ts drains in-flight HTTP,
  closes Socket.io, and disconnects Redis before exit; compose
  stop_grace_period bumped to 30s.  Adds closeSocketServer() helper.
* env.ts gains zod-validated PORT and MULTI_NODE_DEPLOYMENT, and
  filesystem.ts now reads from env (a typo can no longer silently
  disable the multi-node guard).
* Per-port Documenso template + recipient IDs land in system_settings
  with env fallback (PortDocumensoConfig now exposes eoiTemplateId,
  clientRecipientId, developerRecipientId, approvalRecipientId).
  document-templates.ts uses the per-port config and threads portId
  into documensoGenerateFromTemplate().
* Migration 0042 wires the eleven HIGH-tier missing FK constraints
  (documents/files/interests/reminders/berth_waiting_list/
  form_submissions) plus polymorphic CHECK round 2
  (yacht_ownership_history.owner_type, document_sends.document_kind),
  invoices.billing_entity_id NOT EMPTY, and clients.merged_into self-FK.
  Drizzle schema columns updated to .references(...) where possible
  so the misleading "FK wired in relations.ts" comments are gone.

Test status: 1168/1168 vitest, tsc clean.

Refs: docs/audit-comprehensive-2026-05-05.md HIGH §§5,6,7,8,9,10 +
MED §§14,15,16,18.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Matt Ciaccio
2026-05-05 19:52:58 +02:00
parent cf430d70c3
commit 6a609ecf94
22 changed files with 440 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

124
src/lib/db/migrations/0042_missing_fk_constraints.sql Normal file
View File

@@ -0,0 +1,124 @@
-- Audit-final v3 — wire the FK columns currently exposed via Drizzle
-- relations() but missing actual Postgres constraints. relations() only
-- configures relational query JOINs; it does NOT install constraints, so
-- a service that writes interest_id='nonexistent' faces no DB rejection
-- and downstream null-tolerant joins silently misbehave.
--
-- All adds are NOT VALID-friendly (we use IF NOT EXISTS via DO blocks);
-- the migration is idempotent so re-running it is safe.
--
-- Cascade rule:
-- nullable column → ON DELETE SET NULL (orphan tolerance)
-- notNull column → ON DELETE RESTRICT (force callers to clean up)
-- All audit-listed columns happen to be nullable so they get SET NULL.
--
-- Refs: docs/audit-comprehensive-2026-05-05.md HIGH §10 (auditor-C3 Issue 1).
-- documents
DO $$ BEGIN
ALTER TABLE documents
ADD CONSTRAINT documents_interest_id_fkey
FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE documents
ADD CONSTRAINT documents_yacht_id_fkey
FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE documents
ADD CONSTRAINT documents_company_id_fkey
FOREIGN KEY (company_id) REFERENCES companies(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE documents
ADD CONSTRAINT documents_reservation_id_fkey
FOREIGN KEY (reservation_id) REFERENCES berth_reservations(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- files
DO $$ BEGIN
ALTER TABLE files
ADD CONSTRAINT files_yacht_id_fkey
FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE files
ADD CONSTRAINT files_company_id_fkey
FOREIGN KEY (company_id) REFERENCES companies(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- interests (yacht_id is wired via relations only)
DO $$ BEGIN
ALTER TABLE interests
ADD CONSTRAINT interests_yacht_id_fkey
FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- reminders
DO $$ BEGIN
ALTER TABLE reminders
ADD CONSTRAINT reminders_interest_id_fkey
FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE reminders
ADD CONSTRAINT reminders_berth_id_fkey
FOREIGN KEY (berth_id) REFERENCES berths(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- berth_waiting_list
DO $$ BEGIN
ALTER TABLE berth_waiting_list
ADD CONSTRAINT berth_waiting_list_yacht_id_fkey
FOREIGN KEY (yacht_id) REFERENCES yachts(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- form_submissions
DO $$ BEGIN
ALTER TABLE form_submissions
ADD CONSTRAINT form_submissions_interest_id_fkey
FOREIGN KEY (interest_id) REFERENCES interests(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- ─── Polymorphic CHECK round 2 ──────────────────────────────────────────────
-- 0036 covered yachts.current_owner_type and invoices.billing_entity_type.
-- These two discriminators were missed and remain free-text.
DO $$ BEGIN
ALTER TABLE yacht_ownership_history
ADD CONSTRAINT yacht_ownership_history_owner_type_chk
CHECK (owner_type IN ('client', 'company'));
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
DO $$ BEGIN
ALTER TABLE document_sends
ADD CONSTRAINT document_sends_document_kind_chk
CHECK (document_kind IN ('berth_pdf', 'brochure'));
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- ─── invoices.billing_entity_id sanity check ───────────────────────────────
-- The schema declared notNull() with default('') which combined with the
-- 0036 type CHECK lets a row insert with billing_entity_type='client' and
-- billing_entity_id='' — the polymorphic resolver looks up the empty
-- string and returns null with no DB-level signal.
DO $$ BEGIN
ALTER TABLE invoices
ADD CONSTRAINT invoices_billing_entity_id_nonempty_chk
CHECK (billing_entity_id <> '');
EXCEPTION WHEN duplicate_object THEN NULL; END $$;
-- ─── clients.merged_into_client_id self-FK ─────────────────────────────────
-- Already nullable; populated when a client is soft-merged into another.
DO $$ BEGIN
ALTER TABLE clients
ADD CONSTRAINT clients_merged_into_client_id_fkey
FOREIGN KEY (merged_into_client_id) REFERENCES clients(id) ON DELETE SET NULL;
EXCEPTION WHEN duplicate_object THEN NULL; END $$;

7
src/lib/db/migrations/meta/_journal.json
View File

@@ -295,6 +295,13 @@
"when": 1778400000000,
"tag": "0041_role_permissions_edit_keys",
"breakpoints": true
},
{
"idx": 42,
"version": "7",
"when": 1778500000000,
"tag": "0042_missing_fk_constraints",
"breakpoints": true
}
]
}

3
src/lib/db/schema/berths.ts
View File

@@ -13,6 +13,7 @@ import {
} from 'drizzle-orm/pg-core';
import { ports } from './ports';
import { clients } from './clients';
import { yachts } from './yachts';
export const berths = pgTable(
'berths',
@@ -158,7 +159,7 @@ export const berthWaitingList = pgTable(
clientId: text('client_id')
.notNull()
.references(() => clients.id, { onDelete: 'cascade' }),
yachtId: text('yacht_id'), // FK added via relation; nullable (waiting for this yacht)
yachtId: text('yacht_id').references(() => yachts.id, { onDelete: 'set null' }),
position: integer('position').notNull(),
priority: text('priority').notNull().default('normal'), // normal, high
notifyPref: text('notify_pref').default('email'), // email, in_app, both

5
src/lib/db/schema/clients.ts
View File

@@ -34,7 +34,10 @@ export const clients = pgTable(
/** When this client was merged into another (the "loser" of a dedup
* merge), this points at the surviving client. Used by the
* /admin/duplicates review queue to redirect any stragglers, and by
* the unmerge flow to restore. Null for live clients. */
* the unmerge flow to restore. Null for live clients. The Postgres
* self-FK is installed via migration 0042; Drizzle's table builder
* doesn't accept self-references in the column factory so the
* constraint isn't reflected here in `.references(...)`. */
mergedIntoClientId: text('merged_into_client_id'),
createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),

20
src/lib/db/schema/documents.ts
View File

@@ -12,6 +12,10 @@ import {
import { sql } from 'drizzle-orm';
import { ports } from './ports';
import { clients } from './clients';
import { yachts } from './yachts';
import { companies } from './companies';
import { interests } from './interests';
import { berthReservations } from './reservations';
export const files = pgTable(
'files',
@@ -23,8 +27,8 @@ export const files = pgTable(
.notNull()
.references(() => ports.id),
clientId: text('client_id').references(() => clients.id),
yachtId: text('yacht_id'), // FK wired in relations.ts
companyId: text('company_id'), // FK wired in relations.ts
yachtId: text('yacht_id').references(() => yachts.id, { onDelete: 'set null' }),
companyId: text('company_id').references(() => companies.id, { onDelete: 'set null' }),
filename: text('filename').notNull(),
originalName: text('original_name').notNull(),
mimeType: text('mime_type'),
@@ -52,11 +56,13 @@ export const documents = pgTable(
portId: text('port_id')
.notNull()
.references(() => ports.id),
interestId: text('interest_id'), // references interests.id
interestId: text('interest_id').references(() => interests.id, { onDelete: 'set null' }),
clientId: text('client_id').references(() => clients.id),
yachtId: text('yacht_id'), // FK wired in relations.ts
companyId: text('company_id'), // FK wired in relations.ts
reservationId: text('reservation_id'), // FK wired in relations.ts
yachtId: text('yacht_id').references(() => yachts.id, { onDelete: 'set null' }),
companyId: text('company_id').references(() => companies.id, { onDelete: 'set null' }),
reservationId: text('reservation_id').references(() => berthReservations.id, {
onDelete: 'set null',
}),
documentType: text('document_type').notNull(), // eoi, contract, nda, reservation_agreement, other
title: text('title').notNull(),
status: text('status').notNull().default('draft'), // draft, sent, partially_signed, completed, expired, cancelled
@@ -220,7 +226,7 @@ export const formSubmissions = pgTable(
.notNull()
.references(() => formTemplates.id),
clientId: text('client_id').references(() => clients.id),
interestId: text('interest_id'), // references interests.id
interestId: text('interest_id').references(() => interests.id, { onDelete: 'set null' }),
token: text('token').notNull().unique(),
prefilledData: jsonb('prefilled_data').default({}),
submittedData: jsonb('submitted_data'),

3
src/lib/db/schema/interests.ts
View File

@@ -13,6 +13,7 @@ import { sql } from 'drizzle-orm';
import { ports } from './ports';
import { clients } from './clients';
import { berths } from './berths';
import { yachts } from './yachts';
// Pipeline stages: open, details_sent, in_communication, eoi_sent, eoi_signed, deposit_10pct, contract_sent, contract_signed, completed
@@ -28,7 +29,7 @@ export const interests = pgTable(
clientId: text('client_id')
.notNull()
.references(() => clients.id),
yachtId: text('yacht_id'), // FK added via relation; nullable until pipeline leaves 'open'
yachtId: text('yacht_id').references(() => yachts.id, { onDelete: 'set null' }),
pipelineStage: text('pipeline_stage').notNull().default('open'),
leadCategory: text('lead_category'), // general_interest, specific_qualified, hot_lead
source: text('source'), // website, manual, referral, broker

56
src/lib/db/schema/operations.ts
View File

@@ -1,21 +1,17 @@
import {
pgTable,
text,
boolean,
timestamp,
jsonb,
index,
uniqueIndex,
} from 'drizzle-orm/pg-core';
import { pgTable, text, boolean, timestamp, jsonb, index, uniqueIndex } from 'drizzle-orm/pg-core';
import { sql } from 'drizzle-orm';
import { ports } from './ports';
import { clients } from './clients';
import { files } from './documents';
import { interests } from './interests';
import { berths } from './berths';
export const reminders = pgTable(
'reminders',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
portId: text('port_id')
.notNull()
.references(() => ports.id),
@@ -27,8 +23,8 @@ export const reminders = pgTable(
assignedTo: text('assigned_to'), // user ID
createdBy: text('created_by').notNull(),
clientId: text('client_id').references(() => clients.id),
interestId: text('interest_id'), // references interests.id
berthId: text('berth_id'), // references berths.id
interestId: text('interest_id').references(() => interests.id, { onDelete: 'set null' }),
berthId: text('berth_id').references(() => berths.id, { onDelete: 'set null' }),
autoGenerated: boolean('auto_generated').notNull().default(false),
googleCalendarEventId: text('google_calendar_event_id'),
googleCalendarSynced: boolean('google_calendar_synced').notNull().default(false),
@@ -40,16 +36,18 @@ export const reminders = pgTable(
(table) => [
index('idx_reminders_port').on(table.portId),
index('idx_reminders_assigned').on(table.assignedTo, table.status),
index('idx_reminders_due').on(table.portId, table.dueAt).where(
sql`${table.status} IN ('pending', 'snoozed')`
),
index('idx_reminders_due')
.on(table.portId, table.dueAt)
.where(sql`${table.status} IN ('pending', 'snoozed')`),
],
);
export const googleCalendarTokens = pgTable(
'google_calendar_tokens',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
userId: text('user_id').notNull().unique(),
accessToken: text('access_token').notNull(), // encrypted
refreshToken: text('refresh_token').notNull(), // encrypted
@@ -67,7 +65,9 @@ export const googleCalendarTokens = pgTable(
export const googleCalendarCache = pgTable(
'google_calendar_cache',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
userId: text('user_id').notNull(),
eventId: text('event_id').notNull(), // Google Calendar event ID
title: text('title').notNull(),
@@ -88,7 +88,9 @@ export const googleCalendarCache = pgTable(
export const notifications = pgTable(
'notifications',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
portId: text('port_id')
.notNull()
.references(() => ports.id),
@@ -114,7 +116,9 @@ export const notifications = pgTable(
export const scheduledReports = pgTable(
'scheduled_reports',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
portId: text('port_id')
.notNull()
.references(() => ports.id),
@@ -135,7 +139,9 @@ export const scheduledReports = pgTable(
export const reportRecipients = pgTable(
'report_recipients',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
reportId: text('report_id')
.notNull()
.references(() => scheduledReports.id, { onDelete: 'cascade' }),
@@ -151,7 +157,9 @@ export const reportRecipients = pgTable(
export const generatedReports = pgTable(
'generated_reports',
{
id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
id: text('id')
.primaryKey()
.$defaultFn(() => crypto.randomUUID()),
portId: text('port_id')
.notNull()
.references(() => ports.id),
@@ -171,9 +179,9 @@ export const generatedReports = pgTable(
(table) => [
index('idx_gr_port_created').on(table.portId, table.createdAt),
index('idx_gr_port_status').on(table.portId, table.status),
index('idx_gr_scheduled').on(table.scheduledReportId).where(
sql`${table.scheduledReportId} IS NOT NULL`
),
index('idx_gr_scheduled')
.on(table.scheduledReportId)
.where(sql`${table.scheduledReportId} IS NOT NULL`),
],
);