Matt 4b9743a594 audit: 33-agent comprehensive audit + critical fixes ...

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-12 16:52:35 +02:00

..

analytics

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

api

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

auth

fix(auth): forward in checks through better-auth Proxy

2026-05-09 04:09:17 +02:00

constants

fix(audit-tier-6): validation, perms, ops/infra, per-port webhook secret

2026-05-05 21:03:31 +02:00

db

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

dedup

feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

2026-05-07 20:59:28 +02:00

email

feat(admin+search): user-mgmt polish, role labels, search keyword index

2026-05-12 16:14:12 +02:00

i18n

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

minio

fix(build): make auth + storage modules side-effect-free at import

2026-05-08 15:38:04 +02:00

ocr

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

pdf

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

portal

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

queue

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

services

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

socket

fix(audit-integrations): SMTP/PG/Socket.IO timeouts, prompt injection, secret-at-rest

2026-05-05 21:31:50 +02:00

storage

fix(integration): webhook v2 events, storage migrate, test theatre

2026-05-11 14:02:26 +02:00

templates

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

utils

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

validators

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

audit.ts

feat(audit): comprehensive logging — auth events, severity, source, IP

2026-05-06 20:35:34 +02:00

constants.ts

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

entity-diff.ts

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

env.ts

fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

2026-05-05 19:52:58 +02:00

error-classifier.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

error-codes.ts

fix(documents): idempotency, perf, contract pipeline, observability

2026-05-11 13:56:46 +02:00

errors.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

fetch-with-timeout.ts

fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

2026-05-05 19:52:58 +02:00

form-factor.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

logger.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

rate-limit.ts

fix(audit): security HIGHs — rate-limit hard-delete codes, collapse error msgs, doc bad-secret per-IP

2026-05-06 22:06:40 +02:00

redis.ts

fix(ops): /health DB+Redis checks, validated env.REDIS_URL across workers, error_events 90d retention

2026-05-06 14:59:07 +02:00

request-context.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

utils.ts

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

vocabularies.ts

feat(admin): vocabularies page for per-port pick lists

2026-05-09 18:36:53 +02:00