Matt 4b9743a594 audit: 33-agent comprehensive audit + critical fixes ...

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-12 16:52:35 +02:00

..

ai-budget

feat(ai): per-port token budgets + usage ledger for AI features

2026-04-28 19:53:09 +02:00

alerts/run-engine

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

audit

fix(audit): H2 audit-view dedupe, M3/M4 honest labels, M10 documenso DLQ alert

2026-05-06 22:31:52 +02:00

backup

feat: autonomous backlog push — admin UX overhaul + storage parity + residential parity + Documenso Phase 1

2026-05-07 21:02:12 +02:00

brochures

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

connections

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

custom-fields

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

dashboard-stats

feat(admin): inquiry inbox, send log, email-template overrides, reports dashboard, recommender keys, role-editor coverage; replace placeholder pages

2026-05-06 14:58:17 +02:00

documenso/health

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

document-sends

feat(admin): inquiry inbox, send log, email-template overrides, reports dashboard, recommender keys, role-editor coverage; replace placeholder pages

2026-05-06 14:58:17 +02:00

duplicates

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

email/sales-config

fix(audit): post-review hardening across phases 0-7

2026-05-05 04:07:03 +02:00

email-templates

feat(admin): inquiry inbox, send log, email-template overrides, reports dashboard, recommender keys, role-editor coverage; replace placeholder pages

2026-05-06 14:58:17 +02:00

error-events

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

errors

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

form-templates

feat(platform): residential module + admin UI + reliability fixes

2026-04-27 21:54:32 +02:00

health

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

invitations

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

ocr-settings

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

ports

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

queues

fix(audit-tier-2-routes): manual NextResponse.json error sweep + admin form banners

2026-05-05 20:36:59 +02:00

roles

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

settings

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

storage

feat: autonomous backlog push — admin UX overhaul + storage parity + residential parity + Documenso Phase 1

2026-05-07 21:02:12 +02:00

templates

fix(audit-v2): platform-wide post-merge hardening across 5 domains

2026-05-05 05:51:39 +02:00

umami/test

feat(analytics): Umami integration with per-port admin settings

2026-05-04 22:53:06 +02:00

users

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

webhooks

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

website-submissions

feat(inquiries): triage workflow on the inbox (R2-M2)

2026-05-06 23:48:59 +02:00