180912ba9f
Final audit pass on feat/berth-recommender (3 parallel Opus agents) caught 5 critical and ~12 high-severity findings. All addressed in-branch; medium/low items deferred to docs/audit-final-deferred.md. Critical: - Add filesystem-backend PUT handler at /api/storage/[token] so presigned uploads stop 405-ing in filesystem mode (every browser-driven berth-PDF + brochure upload was broken). Same token-verify + replay protection as GET, plus magic-byte gate when c=application/pdf. - Forward req.signal into streamExpensePdf so an aborted 1000-receipt export no longer keeps grinding for minutes. - Strengthen Content-Disposition filename sanitization: \s matches CR/LF which would let documentName forge headers; restrict to [\w. -]+ and add filename* RFC 5987 fallback. - Lock public berths feed behind an explicit slug allowlist instead of ?portSlug= enumeration. - Reject cross-port interest_berths upserts (defense-in-depth on top of the recommender SQL port filter). High: - Recommender: width-only feasibility now caps length via L/W ratio so a 200ft berth doesn't surface for a 30ft beam request; total_interest_count filters out junction rows whose interest is in another port. - Mooring normalization follow-up migration (0034) catches un-hyphenated padded forms (A01) the original 0024 WHERE missed. - Send-out rate limit moved AFTER validation and scoped per-(port, user) so typos don't burn a slot and a multi-port rep can't be DoS'd by another tenant. - Default-brochure path now blocks an archived row from sneaking through the partial unique index. - NocoDB import --update-snapshot honoured under --dry-run so reps can refresh the seed JSON without committing DB writes. - PDF export: orderBy desc(expenseDate); apply isNull(archivedAt) when expenseIds are passed (was bypassed); flag rate-unavailable rows with an amber footer instead of silently treating them as 1:1; skip the USD->EUR chain when source already matches target. - expense-form-dialog: revokeObjectURL captures the URL in the closure instead of revoking the still-displayed one; reset upload state on close. - scan/page: handleClearReceipt resets in-flight scan/upload mutations; Save disabled while upload pending. - updateExpense re-asserts receipt-or-acknowledgement at the merged row so PATCH can't slip past the create-time refine. Plus the in-progress receipt upload UI for the expense form dialog (receipt picker + "I have no receipt" checkbox + warning banner) and a noReceiptAcknowledged flag on ExpenseRow for edit-mode hydration. Includes the canonical plan doc (referenced in CLAUDE.md), the handoff prompt, and a deferred-findings index for follow-up issues. 1163/1163 vitest passing. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
252 lines
5.1 KiB
JSON
252 lines
5.1 KiB
JSON
{
|
|
"version": "7",
|
|
"dialect": "postgresql",
|
|
"entries": [
|
|
{
|
|
"idx": 0,
|
|
"version": "7",
|
|
"when": 1776185027494,
|
|
"tag": "0000_narrow_longshot",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 1,
|
|
"version": "7",
|
|
"when": 1776185487775,
|
|
"tag": "0001_soft_ender_wiggin",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 2,
|
|
"version": "7",
|
|
"when": 1776958500747,
|
|
"tag": "0002_groovy_excalibur",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 3,
|
|
"version": "7",
|
|
"when": 1776959610819,
|
|
"tag": "0003_opposite_lucky_pierre",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 4,
|
|
"version": "7",
|
|
"when": 1776959707066,
|
|
"tag": "0004_nasty_warstar",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 5,
|
|
"version": "7",
|
|
"when": 1776959832091,
|
|
"tag": "0005_stale_kronos",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 6,
|
|
"version": "7",
|
|
"when": 1776959911400,
|
|
"tag": "0006_great_pixie",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 7,
|
|
"version": "7",
|
|
"when": 1776959993173,
|
|
"tag": "0007_brainy_felicia_hardy",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 8,
|
|
"version": "7",
|
|
"when": 1777204563579,
|
|
"tag": "0008_loud_ikaris",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 9,
|
|
"version": "7",
|
|
"when": 1777210206070,
|
|
"tag": "0009_outgoing_rumiko_fujikawa",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 10,
|
|
"version": "7",
|
|
"when": 1777303428222,
|
|
"tag": "0010_brave_joshua_kane",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 11,
|
|
"version": "7",
|
|
"when": 1777307410311,
|
|
"tag": "0011_red_cargill",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 12,
|
|
"version": "7",
|
|
"when": 1777308900666,
|
|
"tag": "0012_large_zarda",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 13,
|
|
"version": "7",
|
|
"when": 1777334766194,
|
|
"tag": "0013_abnormal_thundra",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 14,
|
|
"version": "7",
|
|
"when": 1777379952283,
|
|
"tag": "0014_black_banshee",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 15,
|
|
"version": "7",
|
|
"when": 1777391373291,
|
|
"tag": "0015_i18n_columns",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 16,
|
|
"version": "7",
|
|
"when": 1777395538988,
|
|
"tag": "0016_magical_spyke",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 17,
|
|
"version": "7",
|
|
"when": 1777398450555,
|
|
"tag": "0017_tiny_mercury",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 18,
|
|
"version": "7",
|
|
"when": 1777399135032,
|
|
"tag": "0018_stormy_spencer_smythe",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 19,
|
|
"version": "7",
|
|
"when": 1777671562738,
|
|
"tag": "0019_lazy_vampiro",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 20,
|
|
"version": "7",
|
|
"when": 1777811835982,
|
|
"tag": "0020_unusual_azazel",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 21,
|
|
"version": "7",
|
|
"when": 1777812671833,
|
|
"tag": "0021_magenta_madame_hydra",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 22,
|
|
"version": "7",
|
|
"when": 1777814682110,
|
|
"tag": "0022_medical_betty_brant",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 23,
|
|
"version": "7",
|
|
"when": 1777927586934,
|
|
"tag": "0023_omniscient_reaper",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 24,
|
|
"version": "7",
|
|
"when": 1777938954111,
|
|
"tag": "0024_normalize_mooring_numbers",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 25,
|
|
"version": "7",
|
|
"when": 1777939212954,
|
|
"tag": "0025_berth_pricing_columns",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 26,
|
|
"version": "7",
|
|
"when": 1777939906731,
|
|
"tag": "0026_client_contacts_one_primary_per_channel",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 27,
|
|
"version": "7",
|
|
"when": 1777939914252,
|
|
"tag": "0027_backfill_nationality_iso_from_phone",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 28,
|
|
"version": "7",
|
|
"when": 1777940421236,
|
|
"tag": "0028_interest_berths_junction",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 29,
|
|
"version": "7",
|
|
"when": 1777941465866,
|
|
"tag": "0029_puzzling_romulus",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 30,
|
|
"version": "7",
|
|
"when": 1777944021221,
|
|
"tag": "0030_berth_pdf_versions",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 31,
|
|
"version": "7",
|
|
"when": 1777944191753,
|
|
"tag": "0031_brochures_and_document_sends",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 32,
|
|
"version": "7",
|
|
"when": 1777946048910,
|
|
"tag": "0032_brochures_one_default_per_port_and_storage_fixes",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 33,
|
|
"version": "7",
|
|
"when": 1777948521076,
|
|
"tag": "0033_expense_no_receipt_acknowledged",
|
|
"breakpoints": true
|
|
},
|
|
{
|
|
"idx": 34,
|
|
"version": "7",
|
|
"when": 1778000000000,
|
|
"tag": "0034_normalize_mooring_numbers_broaden",
|
|
"breakpoints": true
|
|
}
|
|
]
|
|
}
|