Matt 4b9743a594 audit: 33-agent comprehensive audit + critical fixes ...

Full team audit run, all reports verbatim in docs/AUDIT-2026-05-12.md
(5900+ lines, 30+ critical findings). Already-fixed this commit:
- permission-overrides PUT: self-target block + RolePermissions allow-list + cross-tenant guard
- /api/auth/resolve-identifier: rate-limit + synthetic miss-email kill enumeration
- admin email-change: rotates account.accountId + revokes sessions
- middleware: token-gated email confirm/cancel routes whitelisted
- NAV_CATALOG: 10 dead-link sweeps to existing /admin/<x> targets

Feature work landing same commit: optional username sign-in
(migration 0054), per-user permission overrides (0055) with three-state
matrix tabbed inside UserForm, user disable button, role + outcome +
stage label normalisation across the platform, admin email-change
with auto-notification template.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-12 16:52:35 +02:00

..

bulk-archive-wizard.tsx

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00

bulk-hard-delete-dialog.tsx

fix(audit): permission UI gates + preflight leak (R2-H6/H7/H8/H9 + R2-M9)

2026-05-06 22:15:01 +02:00

client-card.tsx

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

client-columns.tsx

audit: 33-agent comprehensive audit + critical fixes

2026-05-12 16:52:35 +02:00

client-companies-tab.tsx

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

client-detail-header.tsx

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

client-detail.tsx

feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

2026-05-07 20:59:28 +02:00

client-files-tab.tsx

Initial commit: Port Nimara CRM (Layers 0-4)

2026-03-26 11:52:51 +01:00

client-filters.tsx

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

client-form.tsx

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00

client-interests-tab.tsx

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

client-list.tsx

feat: round 2 — stage prompts, berth header, EOI inline edit, measurement units

2026-05-12 15:28:22 +02:00

client-pipeline-summary.tsx

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

client-reservations-tab.tsx

fix(audit): replace 'coming soon' tab stubs (H7 + R2-M5)

2026-05-06 22:21:23 +02:00

client-tabs.tsx

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

client-yachts-tab.tsx

fix(audit): backlog sweep — partial archived indexes, custom-fields per-entity gate, polish

2026-05-07 21:45:42 +02:00

contacts-editor.tsx

fix(audit-tier-2): error-surface hygiene — toastError + CodedError sweep

2026-05-05 20:18:05 +02:00

dedup-suggestion-panel.tsx

chore(style): codebase em-dash sweep + minor layout polish

2026-05-04 22:57:01 +02:00

gdpr-export-button.tsx

feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

2026-05-07 20:59:28 +02:00

hard-delete-dialog.tsx

fix(audit): MEDIUMs sweep — mobile More-sheet, portal profile, inline override, dialog UX, ext-EOI gate

2026-05-06 22:38:59 +02:00

pipeline-constants.ts

refactor(sales): consolidate pipeline stages + wire EOI auto-advance

2026-05-01 23:33:53 +02:00

portal-invite-button.tsx

feat(interests): EOI/contract/reservation tabs + contact log + berth interest milestone + interest list overhaul

2026-05-07 20:59:28 +02:00

send-documents-dialog.tsx

feat(emails): sales send-out flows + brochures + email-from settings

2026-05-05 03:38:47 +02:00

smart-archive-dialog.tsx

feat(ui): broad consistency sweep — sources, dates, comboboxes, milestones

2026-05-12 14:50:58 +02:00

smart-restore-dialog.tsx

feat(client-archive): smart-restore wizard with auto/opt-in/locked sections

2026-05-06 19:26:28 +02:00