Working through the audit-v2 deferred backlog. Each round was tested
(typecheck + 1168/1168 vitest) before moving on.
Round 1 — DB performance + AI cost visibility:
- Add missing FK indexes Postgres doesn't auto-create on
berth_reservations.{interest_id, contract_file_id},
documents.{file_id, signed_file_id}, document_events.signer_id,
document_templates.source_file_id, form_submissions.{form_template_id,
client_id}, document_sends.{brochure_id, brochure_version_id,
sent_by_user_id}. Without these, RESTRICT-checks on parent delete +
reverse-lookups walk the child tables fully. Migration 0037.
- AI worker now writes one ai_usage_ledger row per OpenAI call so admins
can audit spend per port/user/feature and future per-port budgets have
history to read from. Failure to write is logged-not-thrown so the
user-facing email draft is unaffected.
Round 2 — Boot-time + transport hardening:
- S3 backend verifies the bucket exists at startup (or auto-creates
when MINIO_AUTO_CREATE_BUCKET=true). A typo'd bucket name now
surfaces with a clear boot error instead of a vague Minio error
inside the first user-facing request.
- Documenso v1 placeFields: 3-attempt exponential-backoff retry on 5xx
+ network errors, fail-fast on 4xx. Stops one transient flake from
leaving a document with a partial field set.
- FilesystemBackend logs a structured warn-once at boot when the dev
HMAC fallback is in effect, so two processes started with different
BETTER_AUTH_SECRET values are observable (random 401s on file
downloads otherwise).
- Logger redact paths extended to cover *.headers.{authorization,
cookie}, *.config.headers.authorization, encrypted-credential blobs
(secretKeyEncrypted, smtpPassEncrypted, etc.), the Documenso
X-Documenso-Secret header, and 2-level nested forms.
Round 3 — UI feedback + permission gates:
- Storage admin migrate dialog: success toast with row count + error
toast on both dryRun and migrate mutations.
- Invoice detail Send + Record-payment buttons wrapped in
PermissionGate (invoices.send / invoices.record_payment); both
mutations now toast on success/error.
- Admin user list Edit button wrapped in PermissionGate(admin.manage_users).
- Scan-receipt page surfaces an amber warning when OCR fails so reps
know they can fill the form manually instead of staring at a stalled
spinner; the editable form now also opens on scanMutation.isError
/ uploadedFile, not only on success.
- Email threads list now renders skeleton rows during load + shared
EmptyState for the empty case (was a single "Loading…" line).
Round 4 — Service / route correctness:
- documentSends.sent_by_user_id was a free-text NOT NULL column with no
FK. Now nullable + FK to user(id) ON DELETE SET NULL so the audit row
survives a user being hard-deleted. Migration 0038 with a defensive
null-out for any orphan ids before attaching the constraint.
- Saved-views route: documented why withAuth alone is correct (the
service strictly filters by (portId, userId) — owner-only by design).
- Public-interests audit log: replaced "userId: null as unknown as
string" cast with userId: null; AuditLogParams already accepts null
for system-generated events.
- EOI in-app PDF fill: extracted setBerthRange() that, when the
AcroForm field is missing AND the context has a non-empty range
string, logs a structured warn so the deployment gap (live Documenso
template needs the field) is observable instead of silently dropping
the multi-berth range.
Test status: 1168/1168 vitest. tsc clean. Two new migrations
(0037/0038) need pnpm db:push (or migration apply) on the dev DB.
Deferred-doc updated with the remaining open items (bigger refactors).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
134 lines
4.9 KiB
TypeScript
134 lines
4.9 KiB
TypeScript
import { promises as fs } from 'node:fs';
|
|
import path from 'node:path';
|
|
|
|
import { PDFDocument } from 'pdf-lib';
|
|
|
|
import type { EoiContext } from '@/lib/services/eoi-context';
|
|
import { logger } from '@/lib/logger';
|
|
|
|
/**
|
|
* Source PDF for the in-app EOI pathway. Must contain AcroForm fields whose
|
|
* names match the Documenso template's `formValues` keys exactly:
|
|
*
|
|
* Text: Name, Email, Address, Yacht Name, Length, Width, Draft,
|
|
* Berth Number
|
|
* Checkbox: Lease_10, Purchase
|
|
*
|
|
* See assets/eoi-template/README.md for full details and the field mapping
|
|
* doc at docs/eoi-documenso-field-mapping.md for the canonical list.
|
|
*/
|
|
const DEFAULT_EOI_TEMPLATE_PATH = path.join(process.cwd(), 'assets', 'eoi-template.pdf');
|
|
|
|
function eoiTemplatePath(): string {
|
|
return process.env.EOI_TEMPLATE_PDF_PATH ?? DEFAULT_EOI_TEMPLATE_PATH;
|
|
}
|
|
|
|
export async function loadEoiTemplatePdf(): Promise<Uint8Array> {
|
|
const filePath = eoiTemplatePath();
|
|
try {
|
|
return await fs.readFile(filePath);
|
|
} catch (err) {
|
|
throw new Error(
|
|
`EOI source PDF not found at ${filePath}. Drop the same PDF used by the Documenso template (with AcroForm fields: Name, Email, Address, Yacht Name, Length, Width, Draft, Berth Number, Lease_10, Purchase) at this path, or override via EOI_TEMPLATE_PDF_PATH. Original error: ${(err as Error).message}`,
|
|
);
|
|
}
|
|
}
|
|
|
|
function formatAddress(address: EoiContext['client']['address']): string {
|
|
if (!address) return '';
|
|
return [address.street, address.city, address.country].filter(Boolean).join(', ');
|
|
}
|
|
|
|
function setText(form: ReturnType<PDFDocument['getForm']>, name: string, value: string): void {
|
|
try {
|
|
form.getTextField(name).setText(value);
|
|
} catch {
|
|
// Field absent or wrong type - skip silently so a slightly different PDF
|
|
// template still produces output. Missing field issues surface in QA, not
|
|
// at runtime as a 500.
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Special-cased setter for the multi-berth `Berth Range` field. When the
|
|
* caller has a non-empty range and the AcroForm field is missing, we log
|
|
* a warning so the deployment gap is observable (the in-app pathway is
|
|
* intentionally tolerant of older PDF templates, but ops needs to know
|
|
* when ranges are silently dropped — otherwise a customer's multi-berth
|
|
* EOI ships with only the primary mooring visible).
|
|
*/
|
|
function setBerthRange(form: ReturnType<PDFDocument['getForm']>, value: string): void {
|
|
try {
|
|
form.getTextField('Berth Range').setText(value);
|
|
} catch {
|
|
if (value && value.trim().length > 0) {
|
|
logger.warn(
|
|
{ berthRange: value },
|
|
'EOI in-app PDF template is missing the "Berth Range" AcroForm field — ' +
|
|
'multi-berth bundle range string was dropped. Update the source template.',
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
function setCheckbox(
|
|
form: ReturnType<PDFDocument['getForm']>,
|
|
name: string,
|
|
checked: boolean,
|
|
): void {
|
|
try {
|
|
const cb = form.getCheckBox(name);
|
|
if (checked) cb.check();
|
|
else cb.uncheck();
|
|
} catch {
|
|
// See comment in setText.
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Fills the AcroForm fields of the EOI source PDF with values drawn from
|
|
* EoiContext. Field names mirror the Documenso template `formValues` keys so
|
|
* a single source PDF can serve both pathways.
|
|
*
|
|
* The form is left interactive (not flattened) so a recipient can still tweak
|
|
* fields if needed before signing.
|
|
*/
|
|
export async function fillEoiFormFields(
|
|
pdfBytes: Uint8Array,
|
|
context: EoiContext,
|
|
): Promise<Uint8Array> {
|
|
const doc = await PDFDocument.load(pdfBytes);
|
|
const form = doc.getForm();
|
|
|
|
setText(form, 'Name', context.client.fullName);
|
|
setText(form, 'Email', context.client.primaryEmail ?? '');
|
|
setText(form, 'Address', formatAddress(context.client.address));
|
|
// Yacht + berth (EOI Section 3) are optional - leave the AcroForm fields
|
|
// blank when the interest hasn't been linked to either.
|
|
setText(form, 'Yacht Name', context.yacht?.name ?? '');
|
|
setText(form, 'Length', context.yacht?.lengthFt ?? '');
|
|
setText(form, 'Width', context.yacht?.widthFt ?? '');
|
|
setText(form, 'Draft', context.yacht?.draftFt ?? '');
|
|
setText(form, 'Berth Number', context.berth?.mooringNumber ?? '');
|
|
// Multi-berth EOI: compact range string from the interest's EOI bundle.
|
|
// The AcroForm field may be absent on an older template revision —
|
|
// when the context HAS a non-empty range string but the field is
|
|
// missing we surface a structured warning so the deployment gap is
|
|
// observable (the CRM dataset has multi-berth bundles but the live
|
|
// PDF template needs the field added before they render correctly).
|
|
setBerthRange(form, context.eoiBerthRange);
|
|
|
|
setCheckbox(form, 'Purchase', true);
|
|
setCheckbox(form, 'Lease_10', false);
|
|
|
|
return doc.save();
|
|
}
|
|
|
|
/**
|
|
* Convenience: loads the source PDF from disk and returns the filled bytes.
|
|
*/
|
|
export async function generateEoiPdfFromTemplate(context: EoiContext): Promise<Uint8Array> {
|
|
const bytes = await loadEoiTemplatePdf();
|
|
return fillEoiFormFields(bytes, context);
|
|
}
|