autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260725172633_harden_message_search_and_photo_pagination.sql

@@ -0,0 +1,256 @@
+-- Keep short searches fast: one- and two-character terms still match phone
+-- numbers, client names, company names, and employee names, but do not scan
+-- every message body. PostgreSQL trigram indexes are effective from three
+-- characters onward.
+
+create index if not exists "message_company_client_photo_created_id_idx"
+on "public"."message" (
+  "company_id",
+  "client_number",
+  "created_at" desc,
+  "id" desc
+)
+where "image" is not null;
+
+create or replace function "public"."get_message_threads_page"(
+  "p_company_id" uuid,
+  "p_limit" integer default 101,
+  "p_before_created_at" timestamp with time zone default null,
+  "p_before_message_id" uuid default null,
+  "p_search" text default null,
+  "p_user_numbers" text[] default null,
+  "p_unread_only" boolean default false,
+  "p_blocked_only" boolean default false
+)
+returns table (
+  "latest_message_id" uuid,
+  "client_id" uuid,
+  "client_name" text,
+  "client_or_lead" text,
+  "employee_name" text,
+  "employee_or_subcontractor" text,
+  "is_do_not_service" boolean,
+  "is_do_not_sms" boolean,
+  "is_do_not_marketing_sms" boolean,
+  "is_blocked" boolean,
+  "client_number" text,
+  "user_number" text,
+  "latest_message" text,
+  "last_active" timestamp with time zone,
+  "unread_count" bigint,
+  "search_match_content" text,
+  "search_match_created_at" timestamp with time zone
+)
+language sql
+stable
+security invoker
+set search_path = "public", "pg_temp"
+as $$
+  with search_params as (
+    select
+      nullif(btrim("p_search"), '') as search_term,
+      case
+        when nullif(btrim("p_search"), '') is null then null
+        else
+          '%' ||
+          replace(
+            replace(
+              replace(lower(btrim("p_search")), '\', '\\'),
+              '%',
+              '\%'
+            ),
+            '_',
+            '\_'
+          ) ||
+          '%'
+      end as search_pattern,
+      regexp_replace(coalesce("p_search", ''), '[^0-9]', '', 'g')
+        as search_digits
+  ),
+  latest_messages as materialized (
+    select distinct on (message_row."client_number")
+      message_row."id" as latest_message_id,
+      message_row."client_id",
+      message_row."client_number",
+      message_row."user_number",
+      message_row."content" as latest_message,
+      message_row."created_at" as last_active
+    from "public"."message" message_row
+    where
+      message_row."company_id" = "p_company_id"
+      and message_row."bulk" is not true
+    order by
+      message_row."client_number",
+      message_row."created_at" desc,
+      message_row."id" desc
+  ),
+  content_matches as materialized (
+    select distinct on (matched_message."client_number")
+      matched_message."client_number",
+      matched_message."content" as search_match_content,
+      matched_message."created_at" as search_match_created_at
+    from "public"."message" matched_message
+    cross join search_params search
+    where
+      search.search_term is not null
+      and char_length(search.search_term) >= 3
+      and matched_message."company_id" = "p_company_id"
+      and lower(matched_message."content")
+        like search.search_pattern escape '\'
+    order by
+      matched_message."client_number",
+      matched_message."created_at" desc,
+      matched_message."id" desc
+  ),
+  unread_counts as materialized (
+    select
+      unread_message."client_number",
+      count(*)::bigint as unread_count
+    from "public"."message" unread_message
+    where
+      unread_message."company_id" = "p_company_id"
+      and unread_message."inbound" is true
+      and unread_message."read" is false
+    group by unread_message."client_number"
+  ),
+  eligible_threads as (
+    select
+      latest.latest_message_id,
+      latest."client_id",
+      latest."client_number",
+      latest."user_number",
+      latest.latest_message,
+      latest.last_active,
+      blocked."phone_number" is not null as is_blocked,
+      coalesce(unread.unread_count, 0) as unread_count,
+      content_match.search_match_content,
+      content_match.search_match_created_at
+    from latest_messages latest
+    cross join search_params search
+    left join content_matches content_match
+      on content_match."client_number" = latest."client_number"
+    left join unread_counts unread
+      on unread."client_number" = latest."client_number"
+    left join "public"."blocked_number" blocked
+      on blocked."company_id" = "p_company_id"
+      and blocked."phone_number" = latest."client_number"
+    where
+      (
+        "p_user_numbers" is null
+        or cardinality("p_user_numbers") = 0
+        or latest."user_number" = any("p_user_numbers")
+      )
+      and (blocked."phone_number" is not null) = "p_blocked_only"
+      and (
+        not "p_unread_only"
+        or coalesce(unread.unread_count, 0) > 0
+      )
+      and (
+        "p_before_created_at" is null
+        or "p_before_message_id" is null
+        or (latest.last_active, latest.latest_message_id)
+          < ("p_before_created_at", "p_before_message_id")
+      )
+      and (
+        search.search_term is null
+        or content_match.search_match_content is not null
+        or lower(latest."client_number")
+          like search.search_pattern escape '\'
+        or (
+          search.search_digits <> ''
+          and latest."client_number" like search.search_digits || '%'
+        )
+        or exists (
+          select 1
+          from "public"."client" search_client
+          where
+            search_client."id" = latest."client_id"
+            and search_client."company_id" = "p_company_id"
+            and (
+              lower(
+                btrim(
+                  concat_ws(
+                    ' ',
+                    search_client."first_name",
+                    search_client."last_name"
+                  )
+                )
+              ) like search.search_pattern escape '\'
+              or lower(coalesce(search_client."client_company_name", ''))
+                like search.search_pattern escape '\'
+            )
+        )
+        or exists (
+          select 1
+          from "public"."user" search_employee
+          where
+            search_employee."company_id" = "p_company_id"
+            and search_employee."phone_number" = latest."client_number"
+            and lower(
+              btrim(
+                concat_ws(
+                  ' ',
+                  search_employee."first_name",
+                  search_employee."last_name"
+                )
+              )
+            ) like search.search_pattern escape '\'
+        )
+      )
+  ),
+  limited_threads as materialized (
+    select eligible.*
+    from eligible_threads eligible
+    order by
+      eligible.last_active desc,
+      eligible.latest_message_id desc
+    limit least(greatest("p_limit", 1), 101)
+  )
+  select
+    thread.latest_message_id,
+    thread."client_id",
+    coalesce(
+      nullif(
+        btrim(concat_ws(' ', client_row."first_name", client_row."last_name")),
+        ''
+      ),
+      client_row."client_company_name"
+    ) as client_name,
+    client_row."client_or_lead"::text as client_or_lead,
+    employee.employee_name,
+    employee.employee_or_subcontractor,
+    client_row."is_do_not_service",
+    client_row."is_do_not_sms",
+    client_row."is_do_not_marketing_sms",
+    thread.is_blocked,
+    thread."client_number",
+    thread."user_number",
+    thread.latest_message,
+    thread.last_active,
+    thread.unread_count,
+    thread.search_match_content,
+    thread.search_match_created_at
+  from limited_threads thread
+  left join "public"."client" client_row
+    on client_row."id" = thread."client_id"
+    and client_row."company_id" = "p_company_id"
+  left join lateral (
+    select
+      btrim(
+        concat_ws(' ', employee_row."first_name", employee_row."last_name")
+      ) as employee_name,
+      case
+        when employee_row."subcontractor" then 'subcontractor'
+        else 'employee'
+      end as employee_or_subcontractor
+    from "public"."user" employee_row
+    where
+      employee_row."company_id" = "p_company_id"
+      and employee_row."phone_number" = thread."client_number"
+    order by employee_row."created_at" desc
+    limit 1
+  ) employee on true
+  order by
+    thread.last_active desc,
+    thread.latest_message_id desc;
+$$;

package/dist/dist/migrations/20260725172634_fix_message_thread_line_filter.sql

@@ -0,0 +1,250 @@
+-- Apply the phone-line filter when selecting each thread's latest message,
+-- not after. Filtering on the globally latest row dropped any conversation
+-- whose most recent activity happened on a non-selected line, even when the
+-- conversation had messages on the selected lines. With the filter inside
+-- latest_messages, a line-filtered page lists every conversation with
+-- activity on the selected lines, previewing its latest message on those
+-- lines, and the cursor stays consistent with the rows being paged.
+
+create or replace function "public"."get_message_threads_page"(
+  "p_company_id" uuid,
+  "p_limit" integer default 101,
+  "p_before_created_at" timestamp with time zone default null,
+  "p_before_message_id" uuid default null,
+  "p_search" text default null,
+  "p_user_numbers" text[] default null,
+  "p_unread_only" boolean default false,
+  "p_blocked_only" boolean default false
+)
+returns table (
+  "latest_message_id" uuid,
+  "client_id" uuid,
+  "client_name" text,
+  "client_or_lead" text,
+  "employee_name" text,
+  "employee_or_subcontractor" text,
+  "is_do_not_service" boolean,
+  "is_do_not_sms" boolean,
+  "is_do_not_marketing_sms" boolean,
+  "is_blocked" boolean,
+  "client_number" text,
+  "user_number" text,
+  "latest_message" text,
+  "last_active" timestamp with time zone,
+  "unread_count" bigint,
+  "search_match_content" text,
+  "search_match_created_at" timestamp with time zone
+)
+language sql
+stable
+security invoker
+set search_path = "public", "pg_temp"
+as $$
+  with search_params as (
+    select
+      nullif(btrim("p_search"), '') as search_term,
+      case
+        when nullif(btrim("p_search"), '') is null then null
+        else
+          '%' ||
+          replace(
+            replace(
+              replace(lower(btrim("p_search")), '\', '\\'),
+              '%',
+              '\%'
+            ),
+            '_',
+            '\_'
+          ) ||
+          '%'
+      end as search_pattern,
+      regexp_replace(coalesce("p_search", ''), '[^0-9]', '', 'g')
+        as search_digits
+  ),
+  latest_messages as materialized (
+    select distinct on (message_row."client_number")
+      message_row."id" as latest_message_id,
+      message_row."client_id",
+      message_row."client_number",
+      message_row."user_number",
+      message_row."content" as latest_message,
+      message_row."created_at" as last_active
+    from "public"."message" message_row
+    where
+      message_row."company_id" = "p_company_id"
+      and message_row."bulk" is not true
+      and (
+        "p_user_numbers" is null
+        or cardinality("p_user_numbers") = 0
+        or message_row."user_number" = any("p_user_numbers")
+      )
+    order by
+      message_row."client_number",
+      message_row."created_at" desc,
+      message_row."id" desc
+  ),
+  content_matches as materialized (
+    select distinct on (matched_message."client_number")
+      matched_message."client_number",
+      matched_message."content" as search_match_content,
+      matched_message."created_at" as search_match_created_at
+    from "public"."message" matched_message
+    cross join search_params search
+    where
+      search.search_term is not null
+      and char_length(search.search_term) >= 3
+      and matched_message."company_id" = "p_company_id"
+      and lower(matched_message."content")
+        like search.search_pattern escape '\'
+    order by
+      matched_message."client_number",
+      matched_message."created_at" desc,
+      matched_message."id" desc
+  ),
+  unread_counts as materialized (
+    select
+      unread_message."client_number",
+      count(*)::bigint as unread_count
+    from "public"."message" unread_message
+    where
+      unread_message."company_id" = "p_company_id"
+      and unread_message."inbound" is true
+      and unread_message."read" is false
+    group by unread_message."client_number"
+  ),
+  eligible_threads as (
+    select
+      latest.latest_message_id,
+      latest."client_id",
+      latest."client_number",
+      latest."user_number",
+      latest.latest_message,
+      latest.last_active,
+      blocked."phone_number" is not null as is_blocked,
+      coalesce(unread.unread_count, 0) as unread_count,
+      content_match.search_match_content,
+      content_match.search_match_created_at
+    from latest_messages latest
+    cross join search_params search
+    left join content_matches content_match
+      on content_match."client_number" = latest."client_number"
+    left join unread_counts unread
+      on unread."client_number" = latest."client_number"
+    left join "public"."blocked_number" blocked
+      on blocked."company_id" = "p_company_id"
+      and blocked."phone_number" = latest."client_number"
+    where
+      (blocked."phone_number" is not null) = "p_blocked_only"
+      and (
+        not "p_unread_only"
+        or coalesce(unread.unread_count, 0) > 0
+      )
+      and (
+        "p_before_created_at" is null
+        or "p_before_message_id" is null
+        or (latest.last_active, latest.latest_message_id)
+          < ("p_before_created_at", "p_before_message_id")
+      )
+      and (
+        search.search_term is null
+        or content_match.search_match_content is not null
+        or lower(latest."client_number")
+          like search.search_pattern escape '\'
+        or (
+          search.search_digits <> ''
+          and latest."client_number" like search.search_digits || '%'
+        )
+        or exists (
+          select 1
+          from "public"."client" search_client
+          where
+            search_client."id" = latest."client_id"
+            and search_client."company_id" = "p_company_id"
+            and (
+              lower(
+                btrim(
+                  concat_ws(
+                    ' ',
+                    search_client."first_name",
+                    search_client."last_name"
+                  )
+                )
+              ) like search.search_pattern escape '\'
+              or lower(coalesce(search_client."client_company_name", ''))
+                like search.search_pattern escape '\'
+            )
+        )
+        or exists (
+          select 1
+          from "public"."user" search_employee
+          where
+            search_employee."company_id" = "p_company_id"
+            and search_employee."phone_number" = latest."client_number"
+            and lower(
+              btrim(
+                concat_ws(
+                  ' ',
+                  search_employee."first_name",
+                  search_employee."last_name"
+                )
+              )
+            ) like search.search_pattern escape '\'
+        )
+      )
+  ),
+  limited_threads as materialized (
+    select eligible.*
+    from eligible_threads eligible
+    order by
+      eligible.last_active desc,
+      eligible.latest_message_id desc
+    limit least(greatest("p_limit", 1), 101)
+  )
+  select
+    thread.latest_message_id,
+    thread."client_id",
+    coalesce(
+      nullif(
+        btrim(concat_ws(' ', client_row."first_name", client_row."last_name")),
+        ''
+      ),
+      client_row."client_company_name"
+    ) as client_name,
+    client_row."client_or_lead"::text as client_or_lead,
+    employee.employee_name,
+    employee.employee_or_subcontractor,
+    client_row."is_do_not_service",
+    client_row."is_do_not_sms",
+    client_row."is_do_not_marketing_sms",
+    thread.is_blocked,
+    thread."client_number",
+    thread."user_number",
+    thread.latest_message,
+    thread.last_active,
+    thread.unread_count,
+    thread.search_match_content,
+    thread.search_match_created_at
+  from limited_threads thread
+  left join "public"."client" client_row
+    on client_row."id" = thread."client_id"
+    and client_row."company_id" = "p_company_id"
+  left join lateral (
+    select
+      btrim(
+        concat_ws(' ', employee_row."first_name", employee_row."last_name")
+      ) as employee_name,
+      case
+        when employee_row."subcontractor" then 'subcontractor'
+        else 'employee'
+      end as employee_or_subcontractor
+    from "public"."user" employee_row
+    where
+      employee_row."company_id" = "p_company_id"
+      and employee_row."phone_number" = thread."client_number"
+    order by employee_row."created_at" desc
+    limit 1
+  ) employee on true
+  order by
+    thread.last_active desc,
+    thread.latest_message_id desc;
+$$;

package/dist/dist/migrations/20260725174948_google_lsa_attach_bing_exclusivity_guard.sql

@@ -0,0 +1,23 @@
+-- Reciprocal half of the Google LSA <-> Bing Ads lead-source exclusivity
+-- attach (bing-ads-integration review finding, same shape as the Facebook
+-- Ads <-> LSA attach in 20260724230721 and its facebook-ads-integration
+-- counterpart). The Bing branch attaches its guard to settings_google_lsa
+-- only when this table already exists; when this branch lands second, nothing
+-- installs the guard and an LSA assignment can take a source Bing Ads already
+-- owns. Attaching here at migration time closes that ordering gap: whichever
+-- branch is applied second performs the attach.
+--
+-- The guard function ships in the bing-ads-integration branch; when this
+-- branch is applied first the block is a no-op and the Bing migrations attach
+-- the trigger themselves.
+
+do $$
+begin
+    if to_regprocedure('public.prevent_other_ads_source_conflicts_with_bing_ads()') is not null then
+        execute 'create or replace trigger "prevent_google_lsa_source_conflicts_with_bing_ads_trigger" '
+            || 'before insert or update of "source_id" on "public"."settings_google_lsa" '
+            || 'for each row '
+            || 'execute function "public"."prevent_other_ads_source_conflicts_with_bing_ads"()';
+    end if;
+end
+$$;

package/dist/dist/migrations/20260725200430_client_portal_settings.sql

@@ -0,0 +1,41 @@
+create table if not exists "public"."settings_client_portal" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "updated_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "is_enabled" boolean not null default false,
+    -- Human-friendly per-company portal URL segment, e.g. /portal/<slug>.
+    -- Same pattern as settings_review.unique_url_slug.
+    "unique_url_slug" "text" not null,
+    -- Tips and partial payments deliberately have no portal-specific flags:
+    -- tips follow settings_payment.allow_tips and partial payments are
+    -- controlled per-invoice on the public invoice page.
+    "enable_booking" boolean not null default true,
+    "welcome_message" "text",
+    constraint "settings_client_portal_pkey" primary key ("id"),
+    constraint "settings_client_portal_company_id_key" unique ("company_id"),
+    constraint "settings_client_portal_unique_url_slug_key" unique ("unique_url_slug")
+);
+
+alter table "public"."settings_client_portal" owner to "postgres";
+
+alter table only "public"."settings_client_portal"
+    add constraint "settings_client_portal_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+create or replace function "public"."set_settings_client_portal_updated_at"()
+returns "trigger"
+language "plpgsql"
+as $$
+begin
+    new."updated_at" = "now"();
+    return new;
+end;
+$$;
+
+alter function "public"."set_settings_client_portal_updated_at"() owner to "postgres";
+
+create or replace trigger "set_settings_client_portal_updated_at_trigger"
+before update on "public"."settings_client_portal"
+for each row
+execute function "public"."set_settings_client_portal_updated_at"();

package/dist/dist/migrations/20260725200431_client_portal_settings_rls.sql

@@ -0,0 +1,21 @@
+-- settings_client_portal follows the standard settings-table pattern:
+-- owner/admin can CRUD their company row, all other company staff read-only.
+-- Anonymous end-customers never read this table directly; the portal resolves
+-- slugs through service-role API routes.
+
+alter table "public"."settings_client_portal" enable row level security;
+
+grant all on table "public"."settings_client_portal" to "authenticated";
+grant all on table "public"."settings_client_portal" to "service_role";
+
+create policy "Enable CRUD for owner and admin with matching company_id"
+on "public"."settings_client_portal"
+to "authenticated"
+using ((((coalesce(("public"."get_my_claim"('autopilot_role'::"text"))::"text", ''::"text") = '"owner"'::"text") or (coalesce(("public"."get_my_claim"('autopilot_role'::"text"))::"text", ''::"text") = '"admin"'::"text")) and ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")))
+with check ((((coalesce(("public"."get_my_claim"('autopilot_role'::"text"))::"text", ''::"text") = '"owner"'::"text") or (coalesce(("public"."get_my_claim"('autopilot_role'::"text"))::"text", ''::"text") = '"admin"'::"text")) and ((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id")));
+
+create policy "Read-only for matching companyId"
+on "public"."settings_client_portal"
+for select
+to "authenticated"
+using (((nullif(trim(both '"'::"text" from ("public"."get_my_claim"('autopilot_company_id'::"text"))::"text"), ''::"text"))::"uuid" = "company_id"));

package/dist/dist/migrations/20260725200433_client_portal_auth_tables.sql

@@ -0,0 +1,81 @@
+-- Passwordless auth for the end-customer client portal.
+-- portal_login_token: short-lived email/SMS login codes + magic-link tokens.
+-- portal_session: server-side sessions referenced by an HTTP-only cookie.
+-- Both tables store only SHA-256 hashes of secrets, never the raw values.
+
+create table if not exists "public"."portal_login_token" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "client_id" "uuid" not null,
+    -- hash of the long random magic-link token
+    "token_hash" "text" not null,
+    -- hash of the 6-digit code sent alongside the link
+    "code_hash" "text" not null,
+    "contact_method" "text" not null,
+    "sent_to" "text" not null,
+    -- hashed requester IP for per-IP rate limiting (independent of client_id),
+    -- blunting SMS-pump / toll-fraud abuse where an attacker requests codes
+    -- for many different clients of one business. Hashed, never the raw IP.
+    "request_ip_hash" "text",
+    "expires_at" timestamp with time zone not null,
+    "used_at" timestamp with time zone,
+    "attempt_count" integer not null default 0,
+    constraint "portal_login_token_pkey" primary key ("id"),
+    constraint "portal_login_token_token_hash_key" unique ("token_hash"),
+    constraint "portal_login_token_contact_method_check"
+        check ("contact_method" in ('email', 'sms'))
+);
+
+alter table "public"."portal_login_token" owner to "postgres";
+
+alter table only "public"."portal_login_token"
+    add constraint "portal_login_token_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."portal_login_token"
+    add constraint "portal_login_token_client_id_fkey"
+    foreign key ("client_id") references "public"."client"("id") on delete cascade;
+
+create index if not exists "portal_login_token_client_id_idx"
+    on "public"."portal_login_token" using "btree" ("client_id");
+
+-- backs the per-IP login rate-limit count
+create index if not exists "portal_login_token_ip_hash_created_idx"
+    on "public"."portal_login_token" using "btree" ("request_ip_hash", "created_at");
+
+-- Backs the per-company login rate-limit count
+-- (countRecentLoginTokensForCompany), which filters company_id + created_at on
+-- every unauthenticated /api/portal/request-login call. Without this the count
+-- degrades to a sequential scan as the token table grows.
+create index if not exists "portal_login_token_company_id_created_at_idx"
+    on "public"."portal_login_token" using "btree" ("company_id", "created_at");
+
+create table if not exists "public"."portal_session" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "client_id" "uuid" not null,
+    "token_hash" "text" not null,
+    "expires_at" timestamp with time zone not null,
+    "last_seen_at" timestamp with time zone default "now"() not null,
+    "revoked_at" timestamp with time zone,
+    -- true when a business owner/admin is viewing the portal as this client;
+    -- preview sessions cannot pay, approve, or submit anything
+    "is_preview" boolean not null default false,
+    constraint "portal_session_pkey" primary key ("id"),
+    constraint "portal_session_token_hash_key" unique ("token_hash")
+);
+
+alter table "public"."portal_session" owner to "postgres";
+
+alter table only "public"."portal_session"
+    add constraint "portal_session_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."portal_session"
+    add constraint "portal_session_client_id_fkey"
+    foreign key ("client_id") references "public"."client"("id") on delete cascade;
+
+create index if not exists "portal_session_client_id_idx"
+    on "public"."portal_session" using "btree" ("client_id");