Repository navigation
Repair client portal file access, billing truth, projects and message recovery - #196
Merged
Merged
Conversation
…e actions Add scoped invoice details/downloads, billing review safeguards, canonical activity, legacy project links and scoped details, idempotent message retries, sign-out and session protections. Validation: 39 targeted tests, TypeScript, lint; documented production data and browser verification blockers.
Use authorized canonical and legacy project scopes; omit hidden, draft and foreign resource events. Surface activity errors honestly and document build/verification results. Validation: 40 targeted tests; final typecheck and lint.
masilo-dev
marked this pull request as ready for review
October 9, 2026 10:09
|
Kilo Code Review could not run — your account is out of credits. Add credits or switch to a free model to enable reviews on this change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The client portal could show an overdue invoice as caught up, fail authenticated file previews, omit legacy client projects, and lose message drafts after uncertain sends. This change adds guarded original-file resolution, invoice details/PDF downloads with recorded payment configuration and reconciliation warnings, consistent overview/activity, scoped project details, retry-safe messaging, visible logout and stronger session validation. Hidden, draft and other-client resources are excluded from activity.
Validation: 40 targeted portal/API/session/security tests passed; TypeScript passed; lint reports zero errors and two existing native-image warnings. Optimized production build completed, including 422 static pages and post-build typecheck. The final activity-sharing refinement was separately typechecked and regression-tested; repeat the optimized build on the final commit in CI. Broader suite: 1,398 passed, four failures in unrelated CRM/Supabase configuration and bulk-email static contracts, documented in the audit.
Production blockers: both signed contracts have null PDF URLs and authentic storage files remain unverified; E2E-LIVE-1787911897 contains test-harness evidence, overdue status, paid amount 1,150 and balance 0 with pending confirmation and no payment configuration; no canonical project link was found for this client. No records were deleted/reclassified, no signed content changed, and no real payment or client message was sent.
Live sign-in remains blocked after a declined secure credential request and automatic review rejection of its retry. Chromium download is denied by the network allowlist, so responsive screenshots and fixture UI execution remain unverified. The repeatable synthetic-only UI script is included. No screenshots or successful live behavior are fabricated.
See audit and exact resolution/release steps. No database migration. These portal changes are prepared in code, not deployed. Keep this draft until staging/live verification and data blockers are resolved.