Matt 4b9743a594 audit: 33-agent comprehensive audit + critical fixes ...

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-12 16:52:35 +02:00

..

ai-usage.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

berths.ts

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00

brochures.ts

fix(audit-v3): platform-wide deferred-list cleanup (rounds 1-4)

2026-05-05 12:49:53 +02:00

clients.ts

fix(audit): backlog sweep — partial archived indexes, custom-fields per-entity gate, polish

2026-05-07 21:45:42 +02:00

companies.ts

fix(notes): add company_notes.updated_at, drop createdAt substitution

2026-05-09 04:14:29 +02:00

crm-invites.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

documents.ts

feat(db): tighten chk_system_folder_shape, add recommender FK + composite indexes

2026-05-11 13:47:52 +02:00

email.ts

chore: prettier format pass on branch files

2026-05-11 13:01:47 +02:00

financial.ts

feat(expenses+interests): trip/event grouping (lightweight)

2026-05-05 13:46:54 +02:00

gdpr.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

index.ts

feat(emails): sales send-out flows + brochures + email-from settings

2026-05-05 03:38:47 +02:00

insights.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

interests.ts

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00

migration.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

operations.ts

feat: autonomous backlog push — admin UX overhaul + storage parity + residential parity + Documenso Phase 1

2026-05-07 21:02:12 +02:00

portal.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

ports.ts

chore: prettier format pass on branch files

2026-05-11 13:01:47 +02:00

relations.ts

fix(documents): wire folder Drizzle .references() + relations

2026-05-09 19:17:58 +02:00

reservations.ts

feat(expenses+interests): trip/event grouping (lightweight)

2026-05-05 13:46:54 +02:00

residential.ts

fix(audit): backlog sweep — partial archived indexes, custom-fields per-entity gate, polish

2026-05-07 21:45:42 +02:00

system.ts

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

users.ts

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

website-submissions.ts

feat(inquiries): triage workflow on the inbox (R2-M2)

2026-05-06 23:48:59 +02:00

yachts.ts

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00