autopilot-core-sandbox 0.0.1

package/dist/dist/migrations/20260725200434_client_portal_auth_rls.sql

@@ -0,0 +1,18 @@
+-- portal_login_token and portal_session hold end-customer auth secrets and
+-- are accessed exclusively through server-side (service-role) portal API
+-- routes. No app role should ever read or write them directly — same
+-- lockdown pattern as settings_ai_voice_assistant.
+
+alter table "public"."portal_login_token" enable row level security;
+
+revoke all on table "public"."portal_login_token" from "authenticated";
+revoke all on table "public"."portal_login_token" from "anon";
+
+grant all on table "public"."portal_login_token" to "service_role";
+
+alter table "public"."portal_session" enable row level security;
+
+revoke all on table "public"."portal_session" from "authenticated";
+revoke all on table "public"."portal_session" from "anon";
+
+grant all on table "public"."portal_session" to "service_role";

package/dist/dist/migrations/20260725200435_portal_claim_login_attempt.sql

@@ -0,0 +1,36 @@
+-- Atomic attempt-claim for portal login-code verification. A single UPDATE
+-- statement takes a row lock, so concurrent verify-login calls serialize and
+-- the attempt cap holds under parallelism — closing the check-then-act race
+-- that otherwise made the 6-digit code brute-forceable.
+--
+-- Returns the token row (including code_hash for comparison) only when an
+-- attempt was successfully claimed (still under the cap, unused, unexpired);
+-- returns no rows otherwise. Service-role only, matching the portal tables.
+
+create or replace function "public"."portal_claim_login_attempt"(
+  "p_token_id" "uuid",
+  "p_max_attempts" integer
+)
+returns setof "public"."portal_login_token"
+language "sql"
+as $$
+  update "public"."portal_login_token"
+  set "attempt_count" = "attempt_count" + 1
+  where "id" = "p_token_id"
+    and "attempt_count" < "p_max_attempts"
+    and "used_at" is null
+    and "expires_at" > "now"()
+  returning *;
+$$;
+
+alter function "public"."portal_claim_login_attempt"("uuid", integer)
+  owner to "postgres";
+
+revoke all on function "public"."portal_claim_login_attempt"("uuid", integer)
+  from "public";
+revoke all on function "public"."portal_claim_login_attempt"("uuid", integer)
+  from "anon";
+revoke all on function "public"."portal_claim_login_attempt"("uuid", integer)
+  from "authenticated";
+grant execute on function "public"."portal_claim_login_attempt"("uuid", integer)
+  to "service_role";

package/dist/dist/migrations/20260725200436_portal_appointment_request.sql

@@ -0,0 +1,39 @@
+-- Durable record of a customer's reschedule/cancel request made from the client
+-- portal. Previously these existed only as fire-and-forget owner notifications.
+-- This table also backs the server-side throttle: the API rejects a repeat
+-- request for the same job + type within a short window, so a click-happy
+-- customer (or a script holding a valid session) can't spam owner SMS/email/push.
+
+create table if not exists "public"."portal_appointment_request" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "company_id" "uuid" not null,
+    "client_id" "uuid" not null,
+    "job_id" "uuid" not null,
+    -- 'reschedule' | 'cancel'
+    "request_type" "text" not null,
+    "note" "text",
+    constraint "portal_appointment_request_pkey" primary key ("id"),
+    constraint "portal_appointment_request_request_type_check"
+        check ("request_type" in ('reschedule', 'cancel'))
+);
+
+alter table "public"."portal_appointment_request" owner to "postgres";
+
+alter table only "public"."portal_appointment_request"
+    add constraint "portal_appointment_request_company_id_fkey"
+    foreign key ("company_id") references "public"."company"("id") on delete cascade;
+
+alter table only "public"."portal_appointment_request"
+    add constraint "portal_appointment_request_client_id_fkey"
+    foreign key ("client_id") references "public"."client"("id") on delete cascade;
+
+alter table only "public"."portal_appointment_request"
+    add constraint "portal_appointment_request_job_id_fkey"
+    foreign key ("job_id") references "public"."job"("id") on delete cascade;
+
+-- backs the duplicate-request throttle lookup, which filters on
+-- job_id + request_type + created_at
+create index if not exists "portal_appointment_request_job_id_request_type_created_at_idx"
+    on "public"."portal_appointment_request" using "btree"
+    ("job_id", "request_type", "created_at");

package/dist/dist/migrations/20260725200437_portal_appointment_request_rls.sql

@@ -0,0 +1,10 @@
+-- portal_appointment_request is written and read exclusively through
+-- server-side (service-role) portal API routes. No app role should ever touch
+-- it directly -- same lockdown pattern as portal_login_token / portal_session.
+
+alter table "public"."portal_appointment_request" enable row level security;
+
+revoke all on table "public"."portal_appointment_request" from "authenticated";
+revoke all on table "public"."portal_appointment_request" from "anon";
+
+grant all on table "public"."portal_appointment_request" to "service_role";

package/dist/dist/migrations/20260725210000_google_reserve_integration.sql

@@ -0,0 +1,85 @@
+-- Reserve with Google (Actions Center "Appointments Redirect") integration.
+-- Autopilot is the Actions Center partner; enrolled companies are exported
+-- in daily merchant feeds and get a "Book Online" button on their Google
+-- Search/Maps listing that deep-links to their Autopilot booking form.
+-- Feeds, enrollment API, and conversion pings live in autopilot-web
+-- (src/app/utils/googleReserve/, /api/google-reserve/*).
+
+-- Per-company enrollment (self-serve toggle on Settings → Integrations),
+-- plus the merchant profile Google actually receives. The company's
+-- Autopilot profile (Company Settings) can legitimately differ from their
+-- Google Business Profile — different phone, different address, or no
+-- public address at all (service-area businesses). So the Google Reserve
+-- settings page collects the feed fields explicitly: pre-populated from
+-- the company profile, editable, snapshotted here on save. The daily
+-- feeds read these columns, falling back to the company profile only for
+-- fields never saved.
+--
+-- Service-area businesses (google_reserve_service_area): no street address
+-- is collected, and the entity feed sends latitude/longitude ONLY (the spec
+-- allows location without a postal address). Coordinates are geocoded from
+-- city/state/ZIP at save time.
+--
+-- google_reserve_excluded_item_ids: per-company choice of which Online
+-- Booking services are included in the Google services feed. Google's
+-- policy requires fed service names/prices to MATCH the booking page, so
+-- services can't be free-edited for Google — but the company chooses WHICH
+-- of their booking services appear. Exclusion list (rather than an
+-- inclusion flag on item): new booking services default to included,
+-- matching "your booking form is what Google gets" with opt-out, and
+-- everything Google Reserve stays on the settings_integration row.
+alter table "public"."settings_integration"
+    add column if not exists "google_reserve_enabled" boolean default false not null,
+    add column if not exists "google_reserve_enabled_at" timestamp with time zone,
+    add column if not exists "google_reserve_business_name" "text",
+    add column if not exists "google_reserve_phone" "text",
+    add column if not exists "google_reserve_website" "text",
+    add column if not exists "google_reserve_street_address" "text",
+    add column if not exists "google_reserve_city" "text",
+    add column if not exists "google_reserve_state" "text",
+    add column if not exists "google_reserve_zip" "text",
+    add column if not exists "google_reserve_service_area" boolean default false not null,
+    add column if not exists "google_reserve_latitude" double precision,
+    add column if not exists "google_reserve_longitude" double precision,
+    add column if not exists "google_reserve_excluded_item_ids" "uuid"[] default '{}'::"uuid"[] not null;
+
+-- Conversion attribution: Google appends ?rwg_token=… to every Book Online
+-- link it serves. The booking form stores it for 30 days and sends it with
+-- the booking; the job row keeps it so one Google referral reports at most
+-- one conversion ping (and for lead-source auditing).
+alter table "public"."job"
+    add column if not exists "rwg_token" "text";
+
+-- Dedupe lookup ("has this token already converted?"); partial — almost all
+-- jobs have no token.
+create index if not exists "job_rwg_token_idx"
+    on "public"."job" ("rwg_token")
+    where "rwg_token" is not null;
+
+-- Platform-level operational log: feed uploads (cron/manual), feed-bundle
+-- fetches, and conversion pings. No company_id — this is partner-level ops
+-- data (service_role only; see the rls migration). Google's launch review
+-- requires ≥3 conversion pings/week to the production endpoint, counted
+-- from this table.
+create table if not exists "public"."google_reserve_event" (
+    "id" "uuid" default "gen_random_uuid"() not null,
+    "created_at" timestamp with time zone default "now"() not null,
+    "kind" "text" not null,
+    "environment" "text",
+    "ok" boolean not null,
+    "summary" "text" not null,
+    constraint "google_reserve_event_pkey" primary key ("id"),
+    constraint "google_reserve_event_kind_check" check (
+        "kind" in ('upload', 'feed_fetch', 'conversion')
+    ),
+    constraint "google_reserve_event_environment_check" check (
+        "environment" is null or "environment" in ('sandbox', 'production')
+    )
+);
+
+alter table "public"."google_reserve_event" owner to "postgres";
+
+-- Recent-activity reads and the conversions-per-week count both filter by
+-- kind ordered by recency.
+create index if not exists "google_reserve_event_kind_created_at_idx"
+    on "public"."google_reserve_event" ("kind", "created_at" desc);

package/dist/dist/migrations/20260725210001_google_reserve_integration_rls.sql

@@ -0,0 +1,10 @@
+-- RLS for google_reserve_event.
+-- Platform-level operational log (no company_id): only autopilot-web's
+-- service-role client (supabaseAdmin) writes and reads it — feed uploads,
+-- feed fetches, conversion pings. No authenticated or anon access: company
+-- users never see partner-level ops data, so there are no policies and no
+-- grants beyond service_role (default-deny stops everyone else).
+
+alter table "public"."google_reserve_event" enable row level security;
+
+grant all on table "public"."google_reserve_event" to "service_role";

package/dist/dist/migrations/20260725220000_add_analytics_query_indexes.sql

@@ -0,0 +1,47 @@
+-- Range and history lookups used by the analytics dashboard.
+create index if not exists idx_job_schedule_company_active_start
+  on public.job_schedule (company_id, start_time, job_id)
+  where status <> 'Canceled';
+
+create index if not exists idx_job_schedule_company_active_id
+  on public.job_schedule (company_id, id)
+  include (job_id, start_time)
+  where status <> 'Canceled';
+
+create index if not exists idx_job_schedule_company_completed_end
+  on public.job_schedule (company_id, end_time, job_id)
+  where status = 'Completed';
+
+create index if not exists idx_job_schedule_job_id
+  on public.job_schedule (job_id);
+
+-- Financial child rows are fetched by batches of job IDs.
+create index if not exists idx_job_item_job_id
+  on public.job_item (job_id)
+  where job_id is not null;
+
+create index if not exists idx_job_discount_job_id
+  on public.job_discount (job_id)
+  where job_id is not null;
+
+create index if not exists idx_job_tag_link_job_tag
+  on public.job_tag_link (job_id, job_tag_id);
+
+-- Cash-basis analytics filter payments by company and payment date.
+create index if not exists idx_payment_company_payment_date
+  on public.payment (company_id, payment_date, id)
+  include (amount_base, amount_tip);
+
+-- Sales includes only standalone invoices in the selected creation range.
+create index if not exists idx_invoice_company_created_standalone
+  on public.invoice (company_id, created_at, id)
+  where job_id is null;
+
+-- Exact New Clients and New Leads counts use these partial range indexes.
+create index if not exists idx_client_company_became_client
+  on public.client (company_id, date_became_client)
+  where client_or_lead = 'client';
+
+create index if not exists idx_client_company_created_lead
+  on public.client (company_id, created_at)
+  where client_or_lead = 'lead';