2 Commits

Author	SHA1	Message	Date
Matt	449b9497ab	fix(uat): batch — timeline overshoot, name-sync, reset-password, dashboard cleanup, queue/seed hygiene + alpha UAT findings doc ... UAT findings landed across the last few Playwright + React Grab passes; single grouped commit so the index doesn't fragment into 30 one-liners. User & auth: - `user-settings`: name now updates the avatar + topbar menu after save (was reading stale session). - `me/password-reset`: 3 bugs (token validation, error response shape, redirect chain). - Admin user permission-overrides route honours the same envelope as the rest of the admin surface. Dashboard: - Removed obsolete `revenue-breakdown-chart` + `dashboard-widgets-card` (replaced by the customisable widget grid). - Strip `revenue_breakdown` from analytics route + use-analytics + service + integration test so nothing renders an empty card. - Activity log timeline overshoot fix (`interest-timeline` + `entity-activity-feed`). - Tightened tiles: active-deals, berth-heat-widget, pipeline-value, kpi-tile. - `dev-mode-banner`: derive dismissed state synchronously instead of via an effect (set-state-in-effect lint rule). Forms & lists (assorted polish): - client / company / yacht / interest / reminder forms — validation + empty-state copy + tab transitions. - companies/yachts list tweaks; berth recommender panel; qualification checklist; supplemental info request button. Infra & misc: - Queue workers (ai / email / notifications) — log shape + per-job timeout consistency. - Auth / brochures / users schema small adjustments; seeds reflect permissions matrix changes. - Scan shell + scanner manifest + AI admin page small fixes. - `next.config.transpilePackages` adds `echarts`/`zrender`/`echarts-for-react` (recommended config from echarts-for-react inside Next). Docs: - `docs/superpowers/audits/alpha-uat-master.md` — single rolling cross-cutting UAT findings doc (per CLAUDE.md convention). - `docs/BACKLOG.md`: dashboard stats cards (§I) + activity-log normalization (§J). - 2026-05-18 audit log updated with this batch. - `CLAUDE.md` — small manual UAT scaffold notes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 15:56:11 +02:00
Matt	1b8dacfa54	docs(audit): full codebase audit — 128 findings across 16 areas ... Spawned 16-agent sonnet[1m] audit team covering schemas (people/orgs, pipeline, docs+infra), APIs (public, admin, v1 CRUD, webhooks/auth/ storage), services (EOI/Documenso, domain, observability), background jobs, UI (admin, entity), and cross-cutting security/performance/tests- deps. 13 of 16 agents delivered detailed JSON reports; A1/F1/B3 audited inline after their agents stalled. E1/E2 (admin + entity UI) couldn't complete in a single spawn — flagged for re-attempt with narrower scope. Top findings: - 5 CRITICAL: send-invoice and invoice-overdue-notify silently no-op (D1#1); 5 maintenance crons including database-backup scheduled but unimplemented (D1#2); tenure-expiry-check ditto (D1#3); GDPR export bundles not deleted on RTBF (C3#1, gap in A.7 shipped today); residential_clients has no hard-delete path at all (C3#2). - 15 HIGH including: /api/public/interests doesn't validate portId (B1#1, cross-tenant injection); documents.documenso_id has zero index (A3#1, every webhook is a full scan); better-auth rate limit is in-memory (B4#1, multi-replica bypass); generateAndSignViaInApp omits portId on Documenso calls (C1#1); custom-doc-upload calls placeFields after distribute (C1#2); {{eoi.berthRange}} + {{reservation.*}} tokens never resolved (C1#3); recommender SQL/JS stage-scale off-by-one (C2#1); getClientById runs 6 queries serial (F2#1); no CI pipeline + zero tests on client-hard-delete (F3#1,2). - 36 medium, 53 low, 19 info. Triage groups in the doc: Tier S: 7 ship-stopping bugs (today) Tier 1: ~12 high-severity items (this week) Tier 2: ~36 medium (next sprint) Tier 3: ~53 low (rolling) Tier 4: re-spawn E1+E2 with narrower scope Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-18 18:38:10 +02:00