Matt cf8bbf3018 fix(documents): defense-in-depth port_id scope + invisible chevron a11y ...

- renameFolder/moveFolder UPDATE and deleteFolderSoftRescue DELETE now
  carry an explicit port_id predicate so the write is bounded to the
  same tenancy the pre-fetch verified, defending against future
  refactors that drop or reorder the ownership check.
- FolderRow's collapsed-children chevron is `invisible` for layout
  purposes, but it was still in the tab order with a misleading
  Expand/Collapse aria-label. Add aria-hidden + tabIndex=-1 when no
  children so keyboard users skip it.

Surfaced by post-implementation review (subagent code-review pass).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-10 16:50:02 +02:00

..

analytics

feat(analytics): Umami integration with per-port admin settings

2026-05-04 22:53:06 +02:00

api

fix(types): unblock catch-all routes under stricter Next 15.5 typing + Phase 2B deps

2026-05-08 17:07:07 +02:00

auth

fix(auth): forward in checks through better-auth Proxy

2026-05-09 04:09:17 +02:00

constants

fix(audit-tier-6): validation, perms, ops/infra, per-port webhook secret

2026-05-05 21:03:31 +02:00

db

feat(perms): add documents.manage_folders permission

2026-05-09 19:23:22 +02:00

dedup

feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

2026-05-07 20:59:28 +02:00

email

feat: autonomous backlog push — admin UX overhaul + storage parity + residential parity + Documenso Phase 1

2026-05-07 21:02:12 +02:00

i18n

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

minio

fix(build): make auth + storage modules side-effect-free at import

2026-05-08 15:38:04 +02:00

ocr

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

pdf

feat(currency): sweep remaining concat call sites to formatCurrency

2026-05-09 18:35:34 +02:00

portal

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

queue

feat(branding): wire per-port branding through every transactional email + auth shell (R2-H15)

2026-05-07 00:00:45 +02:00

services

fix(documents): defense-in-depth port_id scope + invisible chevron a11y

2026-05-10 16:50:02 +02:00

socket

fix(audit-integrations): SMTP/PG/Socket.IO timeouts, prompt injection, secret-at-rest

2026-05-05 21:31:50 +02:00

storage

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

templates

fix(audit): non-Documenso backlog sweep — port-binding, NULLS NOT DISTINCT, custom merge tokens, company docs

2026-05-08 02:20:27 +02:00

utils

feat(currency): centralise money formatting + curated currency picker

2026-05-09 04:24:46 +02:00

validators

feat(documents): wire folder sidebar + breadcrumb + In-progress tab

2026-05-10 12:12:53 +02:00

audit.ts

feat(audit): comprehensive logging — auth events, severity, source, IP

2026-05-06 20:35:34 +02:00

constants.ts

feat(berths): NocoDB-aligned dropdown enums + dual-unit auto-fill

2026-05-09 04:10:24 +02:00

entity-diff.ts

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

env.ts

fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

2026-05-05 19:52:58 +02:00

error-classifier.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

error-codes.ts

fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep

2026-05-05 20:18:05 +02:00

errors.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

fetch-with-timeout.ts

fix(audit-tier-1): timeouts, lifecycle, per-port Documenso, FK constraints

2026-05-05 19:52:58 +02:00

form-factor.ts

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

logger.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

rate-limit.ts

fix(audit): security HIGHs — rate-limit hard-delete codes, collapse error msgs, doc bad-secret per-IP

2026-05-06 22:06:40 +02:00

redis.ts

fix(ops): /health DB+Redis checks, validated env.REDIS_URL across workers, error_events 90d retention

2026-05-06 14:59:07 +02:00

request-context.ts

feat(errors): platform-wide request ids + error codes + admin inspector

2026-05-05 14:12:59 +02:00

utils.ts

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

vocabularies.ts

feat(admin): vocabularies page for per-port pick lists

2026-05-09 18:36:53 +02:00