Wave through the remaining audit-final-deferred items that aren't blocked
on the back-burnered Documenso work.
Multi-tenant isolation:
- Storage proxy ProxyTokenPayload gains optional `p` (port slug) claim;
verifier asserts `key.startsWith(${p}/)`. Defense-in-depth against a
buggy issuer in some future code path that mixes port scopes — every
storage key generated by generateStorageKey() already prefixes the
slug. document-sends opts in for 24h emailed download links; other
callers continue working unchanged via the optional field.
DB schema reconciliation:
- Migration 0047 rebuilds system_settings unique index with NULLS NOT
DISTINCT (Postgres 15+) so global settings (port_id IS NULL) are
uniquely keyed by `key` alone. Surfaced + dedupe'd 65 duplicate
(storage_backend, NULL) rows that had accumulated from race-prone
delete-then-insert patterns in ocr-config / settings / residential-
stages / ai-budget services. All four services converted to true
onConflictDoUpdate upserts so the race window is closed.
API uniformity:
- Response shape standardization: 16 routes converted from
`{ success: true }` to 204 No Content. CLAUDE.md documents the
convention (`{ data: <T> }` for content, 204 for empty mutations,
portal-auth retains `{ success: true }` for the frontend's auth chain).
- req.json() → parseBody() migration across 9 admin/CRM routes
(custom-fields, expenses/export ×3, currency convert,
search/recently-viewed, admin/duplicates, berths/pdf-{upload-url,
versions, parse-results}). Uniform 400 error shapes for
ZodError-flagged bodies.
Custom-fields merge tokens (shipped end-to-end):
- merge-fields.ts gains CUSTOM_MERGE_TOKEN_RE + helpers for the
`{{custom.<fieldName>}}` shape.
- document-templates validator accepts the dynamic shape alongside
the static catalog tokens.
- document-sends.service mergeCustomFieldValues resolver fetches
per-port custom_field_definitions for client/interest/berth contexts
and substitutes stored values keyed by `{{custom.fieldName}}`.
- custom-fields-manager amber banner updated to reflect that merge
tokens now expand (search index + entity-diff remain documented
design limitations).
/api/v1/files cross-entity filtering:
- Validator + listFiles + uploadFile accept companyId AND yachtId
alongside clientId. file-upload-zone propagates both.
- New CompanyFilesTab component mirrors ClientFilesTab; restored as a
visible Documents tab in company-tabs.tsx (was a hidden stub).
Inline TODOs:
- Reviewed remaining two TODOs (per-user reminder schedule, import
worker handlers). Both are placeholders for future feature surfaces,
not bugs — per-port digest works for every customer; nothing
currently enqueues import jobs (verified). Annotated in BACKLOG.
BACKLOG.md updated to reflect what landed and what's still pending
(Documenso-related items still bundled with the back-burnered phases).
Tests: 1185/1185 vitest, tsc clean.
108 lines
3.2 KiB
TypeScript
108 lines
3.2 KiB
TypeScript
import { and, eq, isNull } from 'drizzle-orm';
|
|
|
|
import { db } from '@/lib/db';
|
|
import { systemSettings } from '@/lib/db/schema';
|
|
import { createAuditLog, type AuditMeta } from '@/lib/audit';
|
|
import { NotFoundError } from '@/lib/errors';
|
|
import { emitToRoom } from '@/lib/socket/server';
|
|
|
|
export async function listSettings(portId: string) {
|
|
// Get port-specific settings
|
|
const portSettings = await db
|
|
.select()
|
|
.from(systemSettings)
|
|
.where(eq(systemSettings.portId, portId))
|
|
.orderBy(systemSettings.key);
|
|
|
|
// Get global settings (portId is null)
|
|
const globalSettings = await db
|
|
.select()
|
|
.from(systemSettings)
|
|
.where(isNull(systemSettings.portId))
|
|
.orderBy(systemSettings.key);
|
|
|
|
return { portSettings, globalSettings };
|
|
}
|
|
|
|
export async function getSetting(key: string, portId: string) {
|
|
// Try port-specific first, fall back to global
|
|
const setting = await db.query.systemSettings.findFirst({
|
|
where: and(eq(systemSettings.key, key), eq(systemSettings.portId, portId)),
|
|
});
|
|
if (setting) return setting;
|
|
|
|
const global = await db.query.systemSettings.findFirst({
|
|
where: and(eq(systemSettings.key, key), isNull(systemSettings.portId)),
|
|
});
|
|
return global ?? null;
|
|
}
|
|
|
|
export async function upsertSetting(key: string, value: unknown, portId: string, meta: AuditMeta) {
|
|
// Read existing first for the audit-log diff (before/after). The actual
|
|
// write goes through onConflictDoUpdate so two concurrent calls can't
|
|
// both observe `existing=null` and both INSERT — the (key, port_id)
|
|
// unique index now treats NULLs as equal (migration 0047).
|
|
const existing = await db.query.systemSettings.findFirst({
|
|
where: and(eq(systemSettings.key, key), eq(systemSettings.portId, portId)),
|
|
});
|
|
|
|
await db
|
|
.insert(systemSettings)
|
|
.values({
|
|
key,
|
|
value: value as Record<string, unknown>,
|
|
portId,
|
|
updatedBy: meta.userId,
|
|
})
|
|
.onConflictDoUpdate({
|
|
target: [systemSettings.key, systemSettings.portId],
|
|
set: {
|
|
value: value as Record<string, unknown>,
|
|
updatedBy: meta.userId,
|
|
updatedAt: new Date(),
|
|
},
|
|
});
|
|
|
|
void createAuditLog({
|
|
userId: meta.userId,
|
|
portId,
|
|
action: existing ? 'update' : 'create',
|
|
entityType: 'setting',
|
|
entityId: key,
|
|
oldValue: existing ? { value: existing.value } : undefined,
|
|
newValue: { value },
|
|
ipAddress: meta.ipAddress,
|
|
userAgent: meta.userAgent,
|
|
});
|
|
|
|
emitToRoom(`port:${portId}`, 'system:alert', {
|
|
alertType: 'setting:updated',
|
|
message: `Setting "${key}" updated`,
|
|
severity: 'info',
|
|
});
|
|
|
|
return { key, value, portId };
|
|
}
|
|
|
|
export async function deleteSetting(key: string, portId: string, meta: AuditMeta) {
|
|
const existing = await db.query.systemSettings.findFirst({
|
|
where: and(eq(systemSettings.key, key), eq(systemSettings.portId, portId)),
|
|
});
|
|
if (!existing) throw new NotFoundError('Setting');
|
|
|
|
await db
|
|
.delete(systemSettings)
|
|
.where(and(eq(systemSettings.key, key), eq(systemSettings.portId, portId)));
|
|
|
|
void createAuditLog({
|
|
userId: meta.userId,
|
|
portId,
|
|
action: 'delete',
|
|
entityType: 'setting',
|
|
entityId: key,
|
|
oldValue: { value: existing.value },
|
|
ipAddress: meta.ipAddress,
|
|
userAgent: meta.userAgent,
|
|
});
|
|
}
|