83239104e0
Final audit polish — closes the remaining LOW + MED items the previous
tiers didn't reach:
* Validation hardening: me.preferences uses .strict() + 8KB cap
instead of unbounded .passthrough(); files.uploadFile gains
magic-byte verification (jpeg/png/gif/webp/pdf/doc/xlsx); OCR scan
endpoint enforces 10MB cap + magic-byte check on receipt images;
port logoUrl + me.avatarUrl reject javascript:/data: schemes via
a shared httpUrl refinement.
* Permission gates: document-sends/{brochure,berth-pdf} now require
email.send (was withAuth-only); document-sends/{preview,list} on
email.view; ai/email-draft on email.send; documents/[id]/send
uses send_for_signing (was create); expenses/export/parent-company
flips from hard isSuperAdmin to expenses.export for parity;
admin/users/options gated on reminders.assign_others (was withAuth).
* Envelope hygiene: auth/set-password switches the third {message}
variant to errorResponse + {data: {email}}; ai/email-draft wraps
jobId in {data: {jobId}}.
* UI polish: reports-list.handleDownload surfaces failures via
toastError (was console-only).
* Ops/infra: pin pnpm@10.33.2 across all three Dockerfiles +
packageManager field in package.json; Dockerfile.worker re-orders
user creation BEFORE pnpm install so node_modules / .cache dirs
are worker-owned (fixes tesseract.js + sharp EACCES at first PDF
parse); add Redis-ping HEALTHCHECK to the worker container.
* Public health endpoint: returns full env+appUrl payload only when
the caller presents X-Intake-Secret, otherwise a minimal {status}
so generic uptime monitors still work but anonymous internet
doesn't get deployment fingerprints.
* Per-port Documenso webhook secret: new system_settings key
+ listDocumensoWebhookSecrets() helper. The webhook receiver
iterates every configured per-port secret with timing-safe
comparison + falls back to env, then forwards the resolved portId
into handleDocumentExpired so two ports sharing a documensoId
cannot cross-mutate.
Deferred (handled in dedicated follow-up PRs):
* Tier 5.1 — direct service tests for portal-auth / users /
email-accounts / document-sends / sales-email-config. MED, large
test-writing scope.
* The {ok: true} → {data: null} envelope migration across
alerts/expenses/admin-ocr-settings/storage routes. Mechanical but
needs coordinated client + test updates.
* CSP-nonce migration (drop unsafe-inline) — needs middleware-level
nonce generation that the Next 15 router has to thread through.
* Idempotency-Key header on Documenso createDocument. Requires
schema column on documents to persist the key; deferred so it
doesn't bundle a migration into this commit.
* The 16 better-auth user_id FKs — separate dedicated migration
with care (some columns are NOT NULL today and cascade decisions
matter).
* PermissionGate / Skeleton / EmptyState wraps across 5 admin lists
(auditor-H §§36–37) and the residential-clients filter bar.
Test status: 1175/1175 vitest, tsc clean.
Refs: docs/audit-comprehensive-2026-05-05.md MED §§28,29,30 + LOW §§32–43
+ HIGH §9 (Documenso secrets follow-up).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
127 lines
4.2 KiB
JSON
127 lines
4.2 KiB
JSON
{
|
|
"name": "port-nimara-crm",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"packageManager": "pnpm@10.33.2",
|
|
"scripts": {
|
|
"dev": "next dev",
|
|
"build": "next build && pnpm build:server",
|
|
"build:server": "esbuild src/server.ts --bundle --platform=node --target=node20 --format=cjs --outdir=dist --packages=external --tsconfig=tsconfig.server.json",
|
|
"build:worker": "esbuild src/worker.ts --bundle --platform=node --target=node20 --format=cjs --outdir=dist --packages=external --tsconfig=tsconfig.server.json",
|
|
"start": "next start",
|
|
"lint": "next lint",
|
|
"format": "prettier --write \"src/**/*.{ts,tsx,json,css}\"",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:push": "drizzle-kit push",
|
|
"db:studio": "drizzle-kit studio",
|
|
"db:seed": "tsx src/lib/db/seed.ts",
|
|
"test:e2e": "playwright test",
|
|
"test:e2e:smoke": "playwright test --project=smoke",
|
|
"test:e2e:exhaustive": "playwright test --project=exhaustive",
|
|
"test:e2e:destructive": "playwright test --project=destructive",
|
|
"prepare": "husky"
|
|
},
|
|
"dependencies": {
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@hookform/resolvers": "^3.9.0",
|
|
"@pdfme/common": "^5.5.8",
|
|
"@pdfme/generator": "^5.5.8",
|
|
"@pdfme/schemas": "^5.5.8",
|
|
"@radix-ui/react-accordion": "^1.2.12",
|
|
"@radix-ui/react-alert-dialog": "^1.1.15",
|
|
"@radix-ui/react-avatar": "^1.1.11",
|
|
"@radix-ui/react-checkbox": "^1.3.3",
|
|
"@radix-ui/react-dialog": "^1.1.15",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.16",
|
|
"@radix-ui/react-icons": "^1.3.0",
|
|
"@radix-ui/react-label": "^2.1.8",
|
|
"@radix-ui/react-navigation-menu": "^1.2.14",
|
|
"@radix-ui/react-popover": "^1.1.15",
|
|
"@radix-ui/react-progress": "^1.1.8",
|
|
"@radix-ui/react-radio-group": "^1.3.8",
|
|
"@radix-ui/react-scroll-area": "^1.2.10",
|
|
"@radix-ui/react-select": "^2.2.6",
|
|
"@radix-ui/react-separator": "^1.1.8",
|
|
"@radix-ui/react-slider": "^1.3.6",
|
|
"@radix-ui/react-slot": "^1.2.4",
|
|
"@radix-ui/react-switch": "^1.2.6",
|
|
"@radix-ui/react-tabs": "^1.1.13",
|
|
"@radix-ui/react-tooltip": "^1.2.8",
|
|
"@socket.io/redis-adapter": "^8.3.0",
|
|
"@tanstack/react-query": "^5.62.0",
|
|
"@tanstack/react-query-devtools": "^5.62.0",
|
|
"@tanstack/react-table": "^8.21.3",
|
|
"@types/pdfkit": "^0.17.6",
|
|
"archiver": "^7.0.1",
|
|
"better-auth": "^1.2.0",
|
|
"bullmq": "^5.25.0",
|
|
"class-variance-authority": "^0.7.0",
|
|
"clsx": "^2.1.1",
|
|
"cmdk": "^1.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"drizzle-orm": "^0.38.0",
|
|
"imapflow": "^1.2.13",
|
|
"ioredis": "^5.4.0",
|
|
"iso-3166-2": "^1.0.0",
|
|
"jose": "^6.2.1",
|
|
"libphonenumber-js": "^1.12.42",
|
|
"lucide-react": "^0.460.0",
|
|
"mailparser": "^3.9.4",
|
|
"minio": "^8.0.0",
|
|
"next": "15.2.9",
|
|
"next-themes": "^0.4.0",
|
|
"nodemailer": "^6.9.0",
|
|
"openai": "^6.27.0",
|
|
"pdf-lib": "^1.17.1",
|
|
"pdfkit": "^0.18.0",
|
|
"pino": "^9.5.0",
|
|
"pino-pretty": "^13.0.0",
|
|
"postgres": "^3.4.0",
|
|
"react": "^19.0.0",
|
|
"react-day-picker": "^9.14.0",
|
|
"react-dom": "^19.0.0",
|
|
"react-hook-form": "^7.54.0",
|
|
"recharts": "^3.8.0",
|
|
"sharp": "^0.34.5",
|
|
"socket.io": "^4.8.0",
|
|
"socket.io-client": "^4.8.0",
|
|
"sonner": "^1.7.0",
|
|
"tailwind-merge": "^2.6.0",
|
|
"tailwindcss-animate": "^1.0.7",
|
|
"tesseract.js": "^7.0.0",
|
|
"vaul": "^1.1.2",
|
|
"zod": "^3.24.0",
|
|
"zustand": "^5.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "^3.3.5",
|
|
"@playwright/test": "^1.58.2",
|
|
"@types/archiver": "^7.0.0",
|
|
"@types/iso-3166-2": "^1.0.4",
|
|
"@types/mailparser": "^3.4.6",
|
|
"@types/node": "^22.0.0",
|
|
"@types/nodemailer": "^6.4.0",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitest/coverage-v8": "^4.1.0",
|
|
"autoprefixer": "^10.4.27",
|
|
"dotenv": "^17.3.1",
|
|
"drizzle-kit": "^0.30.0",
|
|
"esbuild": "^0.25.0",
|
|
"eslint": "^9.0.0",
|
|
"eslint-config-next": "15.2.9",
|
|
"eslint-config-prettier": "^9.1.0",
|
|
"husky": "^9.1.0",
|
|
"lint-staged": "^15.2.0",
|
|
"postcss": "^8.4.0",
|
|
"prettier": "^3.4.0",
|
|
"react-grab": "^0.1.32",
|
|
"tailwindcss": "^3.4.0",
|
|
"tsx": "^4.19.0",
|
|
"typescript": "^5.7.0",
|
|
"vitest": "^4.1.0"
|
|
}
|
|
}
|