Files
pn-new-crm/src/components/admin/brochures-admin-panel.tsx
Matt Ciaccio ade4c9e77d fix(audit-v2): platform-wide post-merge hardening across 5 domains
Five-domain audit (security, routes, DB, integrations, UI/UX) ran after
the cf37d09 merge. Critical + high-impact items landed here; deferred
medium/low items indexed in docs/audit-final-deferred.md (now organised
into a "Audit-final v2" section).

Security:
- Storage proxy tokens now bind to op (`'get'` vs `'put'`). A long-lived
  download URL minted by `presignDownload` for an emailed brochure can no
  longer be replayed against the proxy PUT to overwrite the original
  storage object. `verifyProxyToken` requires `expectedOp` and rejects
  mismatches; legacy tokens missing `op` fail-closed. Regression tests
  added.
- Markdown email merge values are now markdown-escaped (`[`, `]`, `(`,
  `)`, `*`, `_`, `\`, backticks, braces) before substitution into the
  rep-authored body. A malicious value like `[click here](https://evil)`
  stored in `client.fullName` no longer survives `escapeHtml` to render
  as a real `<a href>` in the outbound email. Phishing-via-merge-field
  closed; regression tests added.
- Middleware now performs an Origin/Referer check on
  POST/PUT/PATCH/DELETE to `/api/v1/**`. Defense-in-depth on top of
  better-auth's SameSite=Lax cookie. Webhooks/public/auth/portal routes
  exempt as they don't carry the session cookie.

Routes:
- Template management routes were calling `withPermission('documents',
  'manage', ...)` — but `documents` doesn't have a `manage` action. The
  registry has `document_templates.manage`. Every non-superadmin was
  getting 403'd on the seven template endpoints. Fixed across the
  /admin/templates surface.
- Custom-fields permission resource is hardcoded to `clients` regardless
  of which entity (yacht/company/etc.) the values belong to. Documented
  as deferred (requires per-entity routes).

DB:
- documentSends: every parent FK (client_id, interest_id, berth_id,
  brochure_id, brochure_version_id) now uses ON DELETE SET NULL so the
  audit trail outlasts hard-deletes. The denormalized columns
  (recipient_email, document_kind, body_markdown, from_address) were
  added precisely for this. Migration 0035.
- Polymorphic discriminators on yachts.current_owner_type and
  invoices.billing_entity_type now have CHECK constraints — typos like
  `'clients'` vs `'client'` were silently inserting unreachable rows
  before. Migration 0036.

Integrations:
- Email attachment resolution (`src/lib/email/index.ts`) was importing
  MinIO directly instead of `getStorageBackend()`. Filesystem-backend
  deployments would have broken every email-with-attachment send. Now
  routes through the pluggable abstraction per CLAUDE.md.
- Documenso DOCUMENT_OPENED webhook filter relaxed: v2 may omit
  `readStatus` or send lowercase, so an event that was the SIGNAL of an
  open was being silently dropped. Now treats any recipient on a
  DOCUMENT_OPENED event as opened.

UI/UX:
- Expense detail used to render `receiptFileIds` as opaque UUID badges —
  reps couldn't view the receipt they uploaded. Now renders an image
  thumbnail (via `/api/v1/files/[id]/preview`) plus a Download link for
  PDFs. Closed the "where's my receipt?" loop in the expense flow.
- Expense detail Edit + Archive buttons now `<PermissionGate>` and the
  archive mutation surfaces success/error toasts instead of silent 403s.
- Brochures admin: setDefault/archive/create mutations now have onError
  toasts (only onSuccess existed before).
- Removed broken bulk-upload link in scan/page (route doesn't exist;
  used a raw `<a>` triggering a full reload to a 404).

Test status: 1168/1168 vitest passing. tsc clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 05:51:39 +02:00

350 lines
11 KiB
TypeScript

'use client';
/**
* Brochures admin panel (Phase 7 §5.8).
*
* Lists every brochure for the port (including archived). Lets a
* `manage_settings` admin:
* - Create new brochures.
* - Upload a new version (direct-to-storage presigned PUT, see §11.1).
* - Mark default / archive.
*/
import { useState } from 'react';
import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
import { Archive, FileText, Loader2, Plus, Star, Upload } from 'lucide-react';
import { toast } from 'sonner';
import { Button } from '@/components/ui/button';
import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card';
import {
Dialog,
DialogContent,
DialogDescription,
DialogFooter,
DialogHeader,
DialogTitle,
} from '@/components/ui/dialog';
import { Input } from '@/components/ui/input';
import { Label } from '@/components/ui/label';
import { Textarea } from '@/components/ui/textarea';
import { Switch } from '@/components/ui/switch';
import { apiFetch } from '@/lib/api/client';
interface BrochureRow {
id: string;
label: string;
description: string | null;
isDefault: boolean;
archivedAt: string | null;
versionCount: number;
currentVersion: {
id: string;
fileName: string;
fileSizeBytes: number;
uploadedAt: string;
} | null;
}
interface BrochuresResponse {
data: BrochureRow[];
}
interface UploadGrantResponse {
data: { storageKey: string; uploadUrl: string; method: 'PUT'; maxBytes: number };
}
export function BrochuresAdminPanel() {
const queryClient = useQueryClient();
const [createOpen, setCreateOpen] = useState(false);
const brochuresQuery = useQuery<BrochuresResponse>({
queryKey: ['brochures', 'admin'],
queryFn: () => apiFetch('/api/v1/admin/brochures'),
});
const rows = brochuresQuery.data?.data ?? [];
return (
<div className="space-y-4">
<div className="flex justify-end">
<Button onClick={() => setCreateOpen(true)}>
<Plus className="mr-2 h-4 w-4" /> New brochure
</Button>
</div>
{brochuresQuery.isLoading && (
<div className="flex items-center gap-2 text-sm text-muted-foreground">
<Loader2 className="h-4 w-4 animate-spin" /> Loading
</div>
)}
{!brochuresQuery.isLoading && rows.length === 0 && (
<Card>
<CardContent className="py-8 text-center text-sm text-muted-foreground">
No brochures yet. Click &ldquo;New brochure&rdquo; to add one.
</CardContent>
</Card>
)}
<div className="space-y-3">
{rows.map((b) => (
<BrochureCard
key={b.id}
brochure={b}
onChange={() => {
void queryClient.invalidateQueries({ queryKey: ['brochures', 'admin'] });
void queryClient.invalidateQueries({ queryKey: ['brochures', 'list'] });
}}
/>
))}
</div>
<CreateBrochureDialog
open={createOpen}
onOpenChange={setCreateOpen}
onCreated={() => {
void queryClient.invalidateQueries({ queryKey: ['brochures', 'admin'] });
}}
/>
</div>
);
}
function BrochureCard({ brochure, onChange }: { brochure: BrochureRow; onChange: () => void }) {
const [uploading, setUploading] = useState(false);
const setDefaultMutation = useMutation({
mutationFn: () =>
apiFetch(`/api/v1/admin/brochures/${brochure.id}`, {
method: 'PATCH',
body: { isDefault: true },
}),
onSuccess: () => {
toast.success('Default brochure updated');
onChange();
},
onError: (e) =>
toast.error(e instanceof Error ? e.message : 'Could not update default brochure'),
});
const archiveMutation = useMutation({
mutationFn: () => apiFetch(`/api/v1/admin/brochures/${brochure.id}`, { method: 'DELETE' }),
onSuccess: () => {
toast.success('Brochure archived');
onChange();
},
onError: (e) => toast.error(e instanceof Error ? e.message : 'Archive failed'),
});
async function handleUpload(file: File) {
setUploading(true);
try {
const grant: UploadGrantResponse = await apiFetch(
`/api/v1/admin/brochures/${brochure.id}/versions`,
);
if (file.size > grant.data.maxBytes) {
throw new Error(
`File is too large. Max is ${(grant.data.maxBytes / 1024 / 1024).toFixed(0)}MB.`,
);
}
// Direct-to-storage PUT (§11.1).
const putRes = await fetch(grant.data.uploadUrl, {
method: 'PUT',
body: file,
headers: { 'Content-Type': 'application/pdf' },
});
if (!putRes.ok) throw new Error(`Upload failed: ${putRes.status}`);
const sha = await sha256Hex(file);
await apiFetch(`/api/v1/admin/brochures/${brochure.id}/versions`, {
method: 'POST',
body: {
storageKey: grant.data.storageKey,
fileName: file.name,
fileSizeBytes: file.size,
contentSha256: sha,
},
});
toast.success('New version uploaded');
onChange();
} catch (err) {
toast.error(err instanceof Error ? err.message : 'Upload failed');
} finally {
setUploading(false);
}
}
return (
<Card className={brochure.archivedAt ? 'opacity-60' : ''}>
<CardHeader>
<CardTitle className="flex items-center justify-between text-base">
<span className="flex items-center gap-2">
<FileText className="h-4 w-4" /> {brochure.label}
{brochure.isDefault && (
<span className="flex items-center gap-1 rounded bg-primary/10 px-2 py-0.5 text-xs text-primary">
<Star className="h-3 w-3" /> default
</span>
)}
{brochure.archivedAt && (
<span className="rounded bg-muted px-2 py-0.5 text-xs text-muted-foreground">
archived
</span>
)}
</span>
<span className="text-xs text-muted-foreground">{brochure.versionCount} versions</span>
</CardTitle>
</CardHeader>
<CardContent className="space-y-2">
{brochure.description && (
<p className="text-sm text-muted-foreground">{brochure.description}</p>
)}
{brochure.currentVersion && (
<p className="text-xs text-muted-foreground">
Latest: {brochure.currentVersion.fileName} (
{(brochure.currentVersion.fileSizeBytes / 1024 / 1024).toFixed(2)} MB,{' '}
{new Date(brochure.currentVersion.uploadedAt).toLocaleDateString()})
</p>
)}
<div className="flex gap-2 pt-2">
{!brochure.archivedAt && (
<>
<label className="cursor-pointer">
<input
type="file"
accept="application/pdf"
className="hidden"
onChange={(e) => {
const file = e.target.files?.[0];
if (file) void handleUpload(file);
e.target.value = '';
}}
/>
<Button asChild variant="outline" size="sm" disabled={uploading}>
<span>
{uploading ? (
<Loader2 className="mr-2 h-3 w-3 animate-spin" />
) : (
<Upload className="mr-2 h-3 w-3" />
)}
Upload version
</span>
</Button>
</label>
{!brochure.isDefault && (
<Button
variant="outline"
size="sm"
onClick={() => setDefaultMutation.mutate()}
disabled={setDefaultMutation.isPending}
>
<Star className="mr-2 h-3 w-3" /> Mark default
</Button>
)}
<Button
variant="outline"
size="sm"
onClick={() => archiveMutation.mutate()}
disabled={archiveMutation.isPending}
>
<Archive className="mr-2 h-3 w-3" /> Archive
</Button>
</>
)}
</div>
</CardContent>
</Card>
);
}
function CreateBrochureDialog({
open,
onOpenChange,
onCreated,
}: {
open: boolean;
onOpenChange: (o: boolean) => void;
onCreated: () => void;
}) {
const [label, setLabel] = useState('');
const [description, setDescription] = useState('');
const [isDefault, setIsDefault] = useState(false);
const createMutation = useMutation({
mutationFn: () =>
apiFetch('/api/v1/admin/brochures', {
method: 'POST',
body: {
label,
description: description || null,
isDefault,
},
}),
onSuccess: () => {
toast.success('Brochure created. Upload a version next.');
setLabel('');
setDescription('');
setIsDefault(false);
onCreated();
onOpenChange(false);
},
onError: (e) => toast.error(e instanceof Error ? e.message : 'Could not create brochure'),
});
return (
<Dialog open={open} onOpenChange={onOpenChange}>
<DialogContent>
<DialogHeader>
<DialogTitle>New brochure</DialogTitle>
<DialogDescription>
Create the brochure container, then upload a PDF version on the card that appears.
</DialogDescription>
</DialogHeader>
<div className="space-y-3">
<div className="space-y-1">
<Label htmlFor="b-label">Label</Label>
<Input
id="b-label"
value={label}
onChange={(e) => setLabel(e.target.value)}
placeholder="General overview"
/>
</div>
<div className="space-y-1">
<Label htmlFor="b-desc">Description (optional)</Label>
<Textarea
id="b-desc"
rows={2}
value={description}
onChange={(e) => setDescription(e.target.value)}
/>
</div>
<div className="flex items-center justify-between">
<Label htmlFor="b-def">Set as default</Label>
<Switch id="b-def" checked={isDefault} onCheckedChange={setIsDefault} />
</div>
</div>
<DialogFooter>
<Button variant="outline" onClick={() => onOpenChange(false)}>
Cancel
</Button>
<Button
disabled={!label.trim() || createMutation.isPending}
onClick={() => createMutation.mutate()}
>
{createMutation.isPending && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
Create
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
);
}
async function sha256Hex(file: File): Promise<string> {
const buf = await file.arrayBuffer();
const hash = await crypto.subtle.digest('SHA-256', buf);
return Array.from(new Uint8Array(hash))
.map((b) => b.toString(16).padStart(2, '0'))
.join('');
}