Five-domain audit (security, routes, DB, integrations, UI/UX) ran after
the cf37d09 merge. Critical + high-impact items landed here; deferred
medium/low items indexed in docs/audit-final-deferred.md (now organised
into a "Audit-final v2" section).
Security:
- Storage proxy tokens now bind to op (`'get'` vs `'put'`). A long-lived
download URL minted by `presignDownload` for an emailed brochure can no
longer be replayed against the proxy PUT to overwrite the original
storage object. `verifyProxyToken` requires `expectedOp` and rejects
mismatches; legacy tokens missing `op` fail-closed. Regression tests
added.
- Markdown email merge values are now markdown-escaped (`[`, `]`, `(`,
`)`, `*`, `_`, `\`, backticks, braces) before substitution into the
rep-authored body. A malicious value like `[click here](https://evil)`
stored in `client.fullName` no longer survives `escapeHtml` to render
as a real `<a href>` in the outbound email. Phishing-via-merge-field
closed; regression tests added.
- Middleware now performs an Origin/Referer check on
POST/PUT/PATCH/DELETE to `/api/v1/**`. Defense-in-depth on top of
better-auth's SameSite=Lax cookie. Webhooks/public/auth/portal routes
exempt as they don't carry the session cookie.
Routes:
- Template management routes were calling `withPermission('documents',
'manage', ...)` — but `documents` doesn't have a `manage` action. The
registry has `document_templates.manage`. Every non-superadmin was
getting 403'd on the seven template endpoints. Fixed across the
/admin/templates surface.
- Custom-fields permission resource is hardcoded to `clients` regardless
of which entity (yacht/company/etc.) the values belong to. Documented
as deferred (requires per-entity routes).
DB:
- documentSends: every parent FK (client_id, interest_id, berth_id,
brochure_id, brochure_version_id) now uses ON DELETE SET NULL so the
audit trail outlasts hard-deletes. The denormalized columns
(recipient_email, document_kind, body_markdown, from_address) were
added precisely for this. Migration 0035.
- Polymorphic discriminators on yachts.current_owner_type and
invoices.billing_entity_type now have CHECK constraints — typos like
`'clients'` vs `'client'` were silently inserting unreachable rows
before. Migration 0036.
Integrations:
- Email attachment resolution (`src/lib/email/index.ts`) was importing
MinIO directly instead of `getStorageBackend()`. Filesystem-backend
deployments would have broken every email-with-attachment send. Now
routes through the pluggable abstraction per CLAUDE.md.
- Documenso DOCUMENT_OPENED webhook filter relaxed: v2 may omit
`readStatus` or send lowercase, so an event that was the SIGNAL of an
open was being silently dropped. Now treats any recipient on a
DOCUMENT_OPENED event as opened.
UI/UX:
- Expense detail used to render `receiptFileIds` as opaque UUID badges —
reps couldn't view the receipt they uploaded. Now renders an image
thumbnail (via `/api/v1/files/[id]/preview`) plus a Download link for
PDFs. Closed the "where's my receipt?" loop in the expense flow.
- Expense detail Edit + Archive buttons now `<PermissionGate>` and the
archive mutation surfaces success/error toasts instead of silent 403s.
- Brochures admin: setDefault/archive/create mutations now have onError
toasts (only onSuccess existed before).
- Removed broken bulk-upload link in scan/page (route doesn't exist;
used a raw `<a>` triggering a full reload to a 404).
Test status: 1168/1168 vitest passing. tsc clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
350 lines
11 KiB
TypeScript
350 lines
11 KiB
TypeScript
'use client';
|
|
|
|
/**
|
|
* Brochures admin panel (Phase 7 §5.8).
|
|
*
|
|
* Lists every brochure for the port (including archived). Lets a
|
|
* `manage_settings` admin:
|
|
* - Create new brochures.
|
|
* - Upload a new version (direct-to-storage presigned PUT, see §11.1).
|
|
* - Mark default / archive.
|
|
*/
|
|
import { useState } from 'react';
|
|
import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
|
|
import { Archive, FileText, Loader2, Plus, Star, Upload } from 'lucide-react';
|
|
import { toast } from 'sonner';
|
|
|
|
import { Button } from '@/components/ui/button';
|
|
import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
} from '@/components/ui/dialog';
|
|
import { Input } from '@/components/ui/input';
|
|
import { Label } from '@/components/ui/label';
|
|
import { Textarea } from '@/components/ui/textarea';
|
|
import { Switch } from '@/components/ui/switch';
|
|
import { apiFetch } from '@/lib/api/client';
|
|
|
|
interface BrochureRow {
|
|
id: string;
|
|
label: string;
|
|
description: string | null;
|
|
isDefault: boolean;
|
|
archivedAt: string | null;
|
|
versionCount: number;
|
|
currentVersion: {
|
|
id: string;
|
|
fileName: string;
|
|
fileSizeBytes: number;
|
|
uploadedAt: string;
|
|
} | null;
|
|
}
|
|
|
|
interface BrochuresResponse {
|
|
data: BrochureRow[];
|
|
}
|
|
|
|
interface UploadGrantResponse {
|
|
data: { storageKey: string; uploadUrl: string; method: 'PUT'; maxBytes: number };
|
|
}
|
|
|
|
export function BrochuresAdminPanel() {
|
|
const queryClient = useQueryClient();
|
|
const [createOpen, setCreateOpen] = useState(false);
|
|
|
|
const brochuresQuery = useQuery<BrochuresResponse>({
|
|
queryKey: ['brochures', 'admin'],
|
|
queryFn: () => apiFetch('/api/v1/admin/brochures'),
|
|
});
|
|
|
|
const rows = brochuresQuery.data?.data ?? [];
|
|
|
|
return (
|
|
<div className="space-y-4">
|
|
<div className="flex justify-end">
|
|
<Button onClick={() => setCreateOpen(true)}>
|
|
<Plus className="mr-2 h-4 w-4" /> New brochure
|
|
</Button>
|
|
</div>
|
|
|
|
{brochuresQuery.isLoading && (
|
|
<div className="flex items-center gap-2 text-sm text-muted-foreground">
|
|
<Loader2 className="h-4 w-4 animate-spin" /> Loading…
|
|
</div>
|
|
)}
|
|
|
|
{!brochuresQuery.isLoading && rows.length === 0 && (
|
|
<Card>
|
|
<CardContent className="py-8 text-center text-sm text-muted-foreground">
|
|
No brochures yet. Click “New brochure” to add one.
|
|
</CardContent>
|
|
</Card>
|
|
)}
|
|
|
|
<div className="space-y-3">
|
|
{rows.map((b) => (
|
|
<BrochureCard
|
|
key={b.id}
|
|
brochure={b}
|
|
onChange={() => {
|
|
void queryClient.invalidateQueries({ queryKey: ['brochures', 'admin'] });
|
|
void queryClient.invalidateQueries({ queryKey: ['brochures', 'list'] });
|
|
}}
|
|
/>
|
|
))}
|
|
</div>
|
|
|
|
<CreateBrochureDialog
|
|
open={createOpen}
|
|
onOpenChange={setCreateOpen}
|
|
onCreated={() => {
|
|
void queryClient.invalidateQueries({ queryKey: ['brochures', 'admin'] });
|
|
}}
|
|
/>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
function BrochureCard({ brochure, onChange }: { brochure: BrochureRow; onChange: () => void }) {
|
|
const [uploading, setUploading] = useState(false);
|
|
|
|
const setDefaultMutation = useMutation({
|
|
mutationFn: () =>
|
|
apiFetch(`/api/v1/admin/brochures/${brochure.id}`, {
|
|
method: 'PATCH',
|
|
body: { isDefault: true },
|
|
}),
|
|
onSuccess: () => {
|
|
toast.success('Default brochure updated');
|
|
onChange();
|
|
},
|
|
onError: (e) =>
|
|
toast.error(e instanceof Error ? e.message : 'Could not update default brochure'),
|
|
});
|
|
|
|
const archiveMutation = useMutation({
|
|
mutationFn: () => apiFetch(`/api/v1/admin/brochures/${brochure.id}`, { method: 'DELETE' }),
|
|
onSuccess: () => {
|
|
toast.success('Brochure archived');
|
|
onChange();
|
|
},
|
|
onError: (e) => toast.error(e instanceof Error ? e.message : 'Archive failed'),
|
|
});
|
|
|
|
async function handleUpload(file: File) {
|
|
setUploading(true);
|
|
try {
|
|
const grant: UploadGrantResponse = await apiFetch(
|
|
`/api/v1/admin/brochures/${brochure.id}/versions`,
|
|
);
|
|
if (file.size > grant.data.maxBytes) {
|
|
throw new Error(
|
|
`File is too large. Max is ${(grant.data.maxBytes / 1024 / 1024).toFixed(0)}MB.`,
|
|
);
|
|
}
|
|
// Direct-to-storage PUT (§11.1).
|
|
const putRes = await fetch(grant.data.uploadUrl, {
|
|
method: 'PUT',
|
|
body: file,
|
|
headers: { 'Content-Type': 'application/pdf' },
|
|
});
|
|
if (!putRes.ok) throw new Error(`Upload failed: ${putRes.status}`);
|
|
|
|
const sha = await sha256Hex(file);
|
|
await apiFetch(`/api/v1/admin/brochures/${brochure.id}/versions`, {
|
|
method: 'POST',
|
|
body: {
|
|
storageKey: grant.data.storageKey,
|
|
fileName: file.name,
|
|
fileSizeBytes: file.size,
|
|
contentSha256: sha,
|
|
},
|
|
});
|
|
toast.success('New version uploaded');
|
|
onChange();
|
|
} catch (err) {
|
|
toast.error(err instanceof Error ? err.message : 'Upload failed');
|
|
} finally {
|
|
setUploading(false);
|
|
}
|
|
}
|
|
|
|
return (
|
|
<Card className={brochure.archivedAt ? 'opacity-60' : ''}>
|
|
<CardHeader>
|
|
<CardTitle className="flex items-center justify-between text-base">
|
|
<span className="flex items-center gap-2">
|
|
<FileText className="h-4 w-4" /> {brochure.label}
|
|
{brochure.isDefault && (
|
|
<span className="flex items-center gap-1 rounded bg-primary/10 px-2 py-0.5 text-xs text-primary">
|
|
<Star className="h-3 w-3" /> default
|
|
</span>
|
|
)}
|
|
{brochure.archivedAt && (
|
|
<span className="rounded bg-muted px-2 py-0.5 text-xs text-muted-foreground">
|
|
archived
|
|
</span>
|
|
)}
|
|
</span>
|
|
<span className="text-xs text-muted-foreground">{brochure.versionCount} versions</span>
|
|
</CardTitle>
|
|
</CardHeader>
|
|
<CardContent className="space-y-2">
|
|
{brochure.description && (
|
|
<p className="text-sm text-muted-foreground">{brochure.description}</p>
|
|
)}
|
|
{brochure.currentVersion && (
|
|
<p className="text-xs text-muted-foreground">
|
|
Latest: {brochure.currentVersion.fileName} (
|
|
{(brochure.currentVersion.fileSizeBytes / 1024 / 1024).toFixed(2)} MB,{' '}
|
|
{new Date(brochure.currentVersion.uploadedAt).toLocaleDateString()})
|
|
</p>
|
|
)}
|
|
<div className="flex gap-2 pt-2">
|
|
{!brochure.archivedAt && (
|
|
<>
|
|
<label className="cursor-pointer">
|
|
<input
|
|
type="file"
|
|
accept="application/pdf"
|
|
className="hidden"
|
|
onChange={(e) => {
|
|
const file = e.target.files?.[0];
|
|
if (file) void handleUpload(file);
|
|
e.target.value = '';
|
|
}}
|
|
/>
|
|
<Button asChild variant="outline" size="sm" disabled={uploading}>
|
|
<span>
|
|
{uploading ? (
|
|
<Loader2 className="mr-2 h-3 w-3 animate-spin" />
|
|
) : (
|
|
<Upload className="mr-2 h-3 w-3" />
|
|
)}
|
|
Upload version
|
|
</span>
|
|
</Button>
|
|
</label>
|
|
{!brochure.isDefault && (
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
onClick={() => setDefaultMutation.mutate()}
|
|
disabled={setDefaultMutation.isPending}
|
|
>
|
|
<Star className="mr-2 h-3 w-3" /> Mark default
|
|
</Button>
|
|
)}
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
onClick={() => archiveMutation.mutate()}
|
|
disabled={archiveMutation.isPending}
|
|
>
|
|
<Archive className="mr-2 h-3 w-3" /> Archive
|
|
</Button>
|
|
</>
|
|
)}
|
|
</div>
|
|
</CardContent>
|
|
</Card>
|
|
);
|
|
}
|
|
|
|
function CreateBrochureDialog({
|
|
open,
|
|
onOpenChange,
|
|
onCreated,
|
|
}: {
|
|
open: boolean;
|
|
onOpenChange: (o: boolean) => void;
|
|
onCreated: () => void;
|
|
}) {
|
|
const [label, setLabel] = useState('');
|
|
const [description, setDescription] = useState('');
|
|
const [isDefault, setIsDefault] = useState(false);
|
|
|
|
const createMutation = useMutation({
|
|
mutationFn: () =>
|
|
apiFetch('/api/v1/admin/brochures', {
|
|
method: 'POST',
|
|
body: {
|
|
label,
|
|
description: description || null,
|
|
isDefault,
|
|
},
|
|
}),
|
|
onSuccess: () => {
|
|
toast.success('Brochure created. Upload a version next.');
|
|
setLabel('');
|
|
setDescription('');
|
|
setIsDefault(false);
|
|
onCreated();
|
|
onOpenChange(false);
|
|
},
|
|
onError: (e) => toast.error(e instanceof Error ? e.message : 'Could not create brochure'),
|
|
});
|
|
|
|
return (
|
|
<Dialog open={open} onOpenChange={onOpenChange}>
|
|
<DialogContent>
|
|
<DialogHeader>
|
|
<DialogTitle>New brochure</DialogTitle>
|
|
<DialogDescription>
|
|
Create the brochure container, then upload a PDF version on the card that appears.
|
|
</DialogDescription>
|
|
</DialogHeader>
|
|
<div className="space-y-3">
|
|
<div className="space-y-1">
|
|
<Label htmlFor="b-label">Label</Label>
|
|
<Input
|
|
id="b-label"
|
|
value={label}
|
|
onChange={(e) => setLabel(e.target.value)}
|
|
placeholder="General overview"
|
|
/>
|
|
</div>
|
|
<div className="space-y-1">
|
|
<Label htmlFor="b-desc">Description (optional)</Label>
|
|
<Textarea
|
|
id="b-desc"
|
|
rows={2}
|
|
value={description}
|
|
onChange={(e) => setDescription(e.target.value)}
|
|
/>
|
|
</div>
|
|
<div className="flex items-center justify-between">
|
|
<Label htmlFor="b-def">Set as default</Label>
|
|
<Switch id="b-def" checked={isDefault} onCheckedChange={setIsDefault} />
|
|
</div>
|
|
</div>
|
|
<DialogFooter>
|
|
<Button variant="outline" onClick={() => onOpenChange(false)}>
|
|
Cancel
|
|
</Button>
|
|
<Button
|
|
disabled={!label.trim() || createMutation.isPending}
|
|
onClick={() => createMutation.mutate()}
|
|
>
|
|
{createMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
|
|
Create
|
|
</Button>
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
);
|
|
}
|
|
|
|
async function sha256Hex(file: File): Promise<string> {
|
|
const buf = await file.arrayBuffer();
|
|
const hash = await crypto.subtle.digest('SHA-256', buf);
|
|
return Array.from(new Uint8Array(hash))
|
|
.map((b) => b.toString(16).padStart(2, '0'))
|
|
.join('');
|
|
}
|