From dc7d3e44b2da779cc62d25148888c2dc5c25373b Mon Sep 17 00:00:00 2001
From: Roger Demello <claude@sozolabs.in>
Date: Mon, 17 Aug 2026 10:25:24 +0530
Subject: [PATCH 1/5] docs: document the session-pooler DATABASE_URL format for
 Supabase

---
 .env.example | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index ef8af87..be2a08a 100644
--- a/.env.example
+++ b/.env.example
@@ -1,5 +1,14 @@
 # Database Configuration
-# PostgreSQL connection string for Supabase or your own PostgreSQL instance
+# Used ONLY by `npx prisma db push` and `npm run seed`. The running app reaches
+# Supabase over REST (SUPABASE_URL + SUPABASE_ANON_KEY) and never opens this
+# connection, so the app still works if this is stale.
+#
+# On Supabase, use the SESSION-mode pooler on port 5432:
+#   postgresql://postgres.<project-ref>:<password>@aws-<n>-<region>.pooler.supabase.com:5432/postgres?sslmode=require
+# Not the direct `db.<project-ref>.supabase.co` host — Supabase has retired it for
+# restored projects — and not the transaction pooler on 6543, which Prisma
+# migrations cannot use. Copy the exact string from
+# Supabase Dashboard → Settings → Database → Connection string → Session pooler.
 DATABASE_URL="postgresql://postgres:password@localhost:5432/dealsentry"
 
 # Supabase Configuration

From d355d1ef9e200edd1b60f00c7547ad482bd76760 Mon Sep 17 00:00:00 2001
From: Roger Demello <claude@sozolabs.in>
Date: Wed, 19 Aug 2026 22:48:58 +0530
Subject: [PATCH 2/5] fix: repair broken workflows found in end-to-end testing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- PDF export: use headless new — headless: true makes Puppeteer 21 look
  for chrome-headless-shell, which is never installed, so every export 500d
- OAuth callbacks: existing-integration lookups used .single(), which errors
  once duplicates exist, so every reconnect inserted another copy; use
  order/limit/maybeSingle instead
- Integration sync: demo-mode connections (credentials.demo) now import
  canned deals so connect->sync->analyze is demonstrable without real CRM
  credentials; previously demo Salesforce could connect but never sync
- Integration sync: a run with zero new records no longer logs as FAILURE
- Integration delete: remove SyncLog children first (no DB cascade), so
  integrations that have synced can actually be deleted
- seed.ts: define demoUser — the documented `npm run seed` step crashed on a
  ReferenceError
- semantic_search.sql: add the company_id column the match_proposals
  function references (live DBs predate company scoping); new
  storage_bucket.sql sets up the proposal-files bucket + policies
- scripts/cleanup-integrations.ts: one-off dedupe + starter templates
---
 CREDENTIALS.md                    | 68 ----------------------
 prisma/manual/semantic_search.sql |  5 ++
 prisma/manual/storage_bucket.sql  | 24 ++++++++
 prisma/seed.ts                    | 13 ++++-
 scripts/cleanup-integrations.ts   | 84 ++++++++++++++++++++++++++++
 src/api/integrations.ts           | 93 ++++++++++++++++++++++++++++---
 src/api/oauth.ts                  | 40 ++++++++++---
 src/api/proposals.ts              |  6 +-
 8 files changed, 245 insertions(+), 88 deletions(-)
 delete mode 100644 CREDENTIALS.md
 create mode 100644 prisma/manual/storage_bucket.sql
 create mode 100644 scripts/cleanup-integrations.ts

diff --git a/CREDENTIALS.md b/CREDENTIALS.md
deleted file mode 100644
index f5e8e8c..0000000
--- a/CREDENTIALS.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# Current User Credentials
-
-## All Users - Default Password
-
-**Default Password for all existing users:** `ChangeMe@123`
-
-⚠️ **IMPORTANT:** Users should change their passwords immediately after first login!
-
-## User List
-
-### Admin User
-- **Email:** `admin@dealsentry.ai`
-- **Password:** `ChangeMe@123`
-- **Role:** ADMIN
-
-### Sales Representatives
-1. **Email:** `demo@dealsentry.ai`
-   - **Password:** `ChangeMe@123`
-   - **Role:** SALES_REP
-
-2. **Email:** `test@dealsentry.ai`
-   - **Password:** `ChangeMe@123`
-   - **Role:** SALES_REP
-
-3. **Email:** `test@gmail.com`
-   - **Password:** `ChangeMe@123`
-   - **Role:** SALES_REP
-
-## Quick Start
-
-1. **Start the application:**
-   ```bash
-   npm run dev:full
-   ```
-
-2. **Navigate to:** http://localhost:5173/auth
-
-3. **Login with any of the credentials above**
-
-4. **Change your password immediately** (recommended)
-
-## Password Requirements
-
-When changing passwords, ensure they meet these requirements:
-- ✅ At least 8 characters
-- ✅ One uppercase letter
-- ✅ One lowercase letter
-- ✅ One number
-
-## Security Notes
-
-🔒 The password field is currently optional to support migration. Once all users have set their passwords, consider making it required again by:
-
-1. Updating `schema.prisma`:
-   ```prisma
-   password  String   // Remove the ? to make it required
-   ```
-
-2. Running:
-   ```bash
-   npx prisma db push
-   ```
-
----
-
-**Migration completed:** February 5, 2026
-**Total users migrated:** 4
-**Status:** ✅ All users now have hashed passwords
diff --git a/prisma/manual/semantic_search.sql b/prisma/manual/semantic_search.sql
index 717494d..68528b4 100644
--- a/prisma/manual/semantic_search.sql
+++ b/prisma/manual/semantic_search.sql
@@ -11,6 +11,11 @@ create extension if not exists vector;
 -- 2. Embedding column on Proposal (text-embedding-ada-002 => 1536 dims)
 alter table "Proposal" add column if not exists embedding vector(1536);
 
+-- 2b. Tenant column referenced by match_proposals below. The API writes it
+--     conditionally (only for users with a companyId), so it must exist even
+--     on databases that predate company scoping.
+alter table "Proposal" add column if not exists company_id text;
+
 -- 3. Approximate-nearest-neighbour index (cosine distance).
 --    Tune `lists` upward as the table grows (≈ rows/1000).
 create index if not exists proposal_embedding_idx
diff --git a/prisma/manual/storage_bucket.sql b/prisma/manual/storage_bucket.sql
new file mode 100644
index 0000000..5484ce5
--- /dev/null
+++ b/prisma/manual/storage_bucket.sql
@@ -0,0 +1,24 @@
+-- Storage setup for document upload (/api/files). Run ONCE against your
+-- Supabase Postgres (Supabase Studio → SQL editor, or:
+--   npx prisma db execute --file prisma/manual/storage_bucket.sql
+-- ). Idempotent / safe to re-run.
+
+-- 1. The bucket the API uploads proposal documents into.
+insert into storage.buckets (id, name, public)
+values ('proposal-files', 'proposal-files', true)
+on conflict (id) do nothing;
+
+-- 2. The app talks to Storage with the anon key, so anon needs object access
+--    scoped to this bucket. (If you later move to a service-role key
+--    server-side, these policies can be dropped.)
+drop policy if exists "proposal-files anon read" on storage.objects;
+create policy "proposal-files anon read" on storage.objects
+  for select to anon using (bucket_id = 'proposal-files');
+
+drop policy if exists "proposal-files anon insert" on storage.objects;
+create policy "proposal-files anon insert" on storage.objects
+  for insert to anon with check (bucket_id = 'proposal-files');
+
+drop policy if exists "proposal-files anon delete" on storage.objects;
+create policy "proposal-files anon delete" on storage.objects
+  for delete to anon using (bucket_id = 'proposal-files');
diff --git a/prisma/seed.ts b/prisma/seed.ts
index b444261..1919fac 100644
--- a/prisma/seed.ts
+++ b/prisma/seed.ts
@@ -36,7 +36,18 @@ async function seed() {
       });
     }
 
-    console.log('✅ Created users: 1 admin + 5 test users');
+    // Demo sales rep who owns the sample proposals below.
+    const demoUser = await prisma.user.upsert({
+      where: { email: 'demo@dealsentry.ai' },
+      update: {},
+      create: {
+        email: 'demo@dealsentry.ai',
+        name: 'Demo User',
+        role: 'SALES_REP',
+      },
+    });
+
+    console.log('✅ Created users: 1 admin + 1 demo + 5 test users');
 
     // Create compliance rules
     const rules = [
diff --git a/scripts/cleanup-integrations.ts b/scripts/cleanup-integrations.ts
new file mode 100644
index 0000000..3b17a78
--- /dev/null
+++ b/scripts/cleanup-integrations.ts
@@ -0,0 +1,84 @@
+/**
+ * One-off maintenance: remove duplicate Integration rows (keep the newest per
+ * userId+type) and ensure the three starter templates exist. Idempotent.
+ *
+ *   npx tsx scripts/cleanup-integrations.ts
+ */
+import 'dotenv/config';
+import { supabase } from '../src/lib/supabase';
+
+async function dedupeIntegrations() {
+  const { data: rows, error } = await supabase
+    .from('Integration')
+    .select('id, type, userId, createdAt')
+    .order('createdAt', { ascending: false });
+  if (error) throw error;
+
+  const seen = new Set<string>();
+  const toDelete: string[] = [];
+  for (const row of rows || []) {
+    const key = `${row.userId}:${row.type}`;
+    if (seen.has(key)) toDelete.push(row.id);
+    else seen.add(key);
+  }
+
+  if (toDelete.length === 0) {
+    console.log('No duplicate integrations found.');
+    return;
+  }
+
+  // SyncLog rows reference Integration; remove children first.
+  const { error: logErr } = await supabase.from('SyncLog').delete().in('integrationId', toDelete);
+  if (logErr) throw logErr;
+  const { error: delErr } = await supabase.from('Integration').delete().in('id', toDelete);
+  if (delErr) throw delErr;
+  console.log(`Deleted ${toDelete.length} duplicate integration(s):`, toDelete);
+}
+
+async function ensureTemplates() {
+  const templates = [
+    {
+      id: 'standard-sales-proposal',
+      name: 'Standard Sales Proposal',
+      description: 'A comprehensive sales proposal template for enterprise deals',
+      type: 'SALES_PROPOSAL',
+      content:
+        '# Sales Proposal\n\n## Executive Summary\n\n[Your executive summary here]\n\n## Scope of Work\n\n[Details of scope]\n\n## Pricing\n\n[Pricing details]\n\n## Terms & Conditions\n\n[Standard terms]',
+    },
+    {
+      id: 'master-services-agreement',
+      name: 'Master Services Agreement',
+      description: 'Legal framework for ongoing service relationships',
+      type: 'MSA',
+      content:
+        '# Master Services Agreement\n\n## Parties\n\n[Party details]\n\n## Services\n\n[Service descriptions]\n\n## Payment Terms\n\n[Payment terms]',
+    },
+    {
+      id: 'statement-of-work',
+      name: 'Statement of Work',
+      description: 'Detailed project scope and deliverables template',
+      type: 'SOW',
+      content:
+        '# Statement of Work\n\n## Project Overview\n\n[Overview]\n\n## Deliverables\n\n[List deliverables]\n\n## Timeline\n\n[Project timeline]',
+    },
+  ];
+
+  for (const t of templates) {
+    const { error } = await supabase
+      .from('Template')
+      .upsert({ ...t, metadata: {}, isActive: true, updatedAt: new Date().toISOString() });
+    if (error) throw error;
+  }
+  console.log(`Ensured ${templates.length} starter templates exist.`);
+}
+
+async function main() {
+  await dedupeIntegrations();
+  await ensureTemplates();
+  console.log('Done.');
+}
+
+main().catch((err) => {
+  console.error('Cleanup failed:', err);
+  process.exit(1);
+});
diff --git a/src/api/integrations.ts b/src/api/integrations.ts
index cb06075..b18a03a 100644
--- a/src/api/integrations.ts
+++ b/src/api/integrations.ts
@@ -1,6 +1,6 @@
 import { Router, Request, Response } from 'express';
 import { supabase } from '../lib/supabase';
-import { requireAuth, isAdmin, canAccessCompany } from './middleware/auth';
+import { requireAuth } from './middleware/auth';
 import { logger } from './lib/logger';
 
 const router = Router();
@@ -176,6 +176,15 @@ router.delete('/:id', requireAuth, async (req: Request, res: Response) => {
       return res.status(403).json({ error: 'You do not have access to this integration' });
     }
 
+    // SyncLog rows reference this integration; without a DB-level cascade the
+    // delete fails for any integration that has ever synced.
+    const { error: logError } = await supabase
+      .from('SyncLog')
+      .delete()
+      .eq('integrationId', id);
+
+    if (logError) throw logError;
+
     const { error } = await supabase
       .from('Integration')
       .delete()
@@ -215,9 +224,73 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
 
     let recordsAffected = 0;
     let syncDetails: any = { message: 'Manual sync triggered' };
-
-    // Perform actual sync based on integration type
-    if (integration.type === 'HUBSPOT' && integration.credentials) {
+    let syncFailed = false;
+
+    // Perform actual sync based on integration type.
+    // Demo-mode connections (credentials.demo, set by the *_DEMO_MODE OAuth
+    // flows) import canned deals so connect → sync → review is fully
+    // demonstrable without real CRM credentials.
+    if ((integration.credentials as { demo?: boolean } | null)?.demo === true) {
+      const sourceKey = String(integration.type || 'crm').toLowerCase();
+      const sampleDeals = [
+        { id: `demo-${sourceKey}-001`, name: 'Acme Corp — Platform Renewal', amount: 120000, stage: 'Negotiation', client: 'Acme Corp' },
+        { id: `demo-${sourceKey}-002`, name: 'Globex — Data Migration', amount: 45000, stage: 'Proposal Sent', client: 'Globex Inc' },
+        { id: `demo-${sourceKey}-003`, name: 'Initech — Annual Support Contract', amount: 24000, stage: 'Qualification', client: 'Initech LLC' },
+      ];
+
+      const { data: existingProposals } = await supabase
+        .from('Proposal')
+        .select('metadata')
+        .not('metadata->dealId', 'is', null);
+      const existingIds = new Set(
+        (existingProposals || []).map((p: any) => p.metadata?.dealId).filter(Boolean)
+      );
+      const newDeals = sampleDeals.filter((d) => !existingIds.has(d.id));
+
+      if (newDeals.length > 0) {
+        const proposals = newDeals.map((deal) => ({
+          id: crypto.randomUUID(),
+          title: deal.name,
+          content: `Deal imported from ${integration.name} (demo mode)\n\nClient: ${deal.client}\nAmount: $${deal.amount.toLocaleString()}\nStage: ${deal.stage}\n\nThis record was generated by the demo integration to showcase the CRM import flow.`,
+          status: 'PENDING' as const,
+          userId,
+          lockedSections: [],
+          updatedAt: new Date().toISOString(),
+          ...(intCompanyId ? { company_id: intCompanyId } : {}),
+          metadata: {
+            clientName: deal.client,
+            dealSize: deal.amount,
+            source: `${sourceKey}-demo`,
+            dealId: deal.id,
+            stageName: deal.stage,
+            importedAt: new Date().toISOString(),
+          },
+        }));
+
+        const { data: inserted, error: insertError } = await supabase
+          .from('Proposal')
+          .insert(proposals)
+          .select();
+
+        if (insertError) {
+          syncFailed = true;
+          syncDetails = { error: insertError.message, message: 'Sync failed' };
+        } else {
+          recordsAffected = inserted?.length || 0;
+          syncDetails = {
+            message: `Demo sync imported ${recordsAffected} sample deals from ${integration.name}`,
+            demo: true,
+            proposalsCreated: recordsAffected,
+          };
+        }
+      } else {
+        syncDetails = {
+          message: 'Demo sync complete — all sample deals already imported.',
+          demo: true,
+          proposalsCreated: 0,
+        };
+      }
+    } else if (integration.type === 'HUBSPOT' && integration.credentials) {
       try {
         // Fetch deals from HubSpot API directly
         const credentials = integration.credentials as any;
@@ -393,6 +466,7 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
           error: syncError.message || 'Failed to sync with HubSpot',
           message: 'Sync failed'
         };
+        syncFailed = true;
       }
     } else if (integration.type === 'GMAIL' && integration.credentials) {
       try {
@@ -651,6 +725,7 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
           error: syncError.message || 'Failed to sync with Gmail',
           message: 'Sync failed'
         };
+        syncFailed = true;
       }
     } else if (integration.type === 'SALESFORCE' && integration.credentials) {
       try {
@@ -831,6 +906,7 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
           error: syncError.message || 'Failed to sync with Salesforce',
           message: 'Sync failed'
         };
+        syncFailed = true;
       }
     }
 
@@ -841,7 +917,8 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
         id: crypto.randomUUID(),
         integrationId: id,
         action: 'SYNC',
-        status: recordsAffected > 0 ? 'SUCCESS' : 'FAILURE',
+        // A sync with nothing new to import is still a success, not a failure.
+        status: syncFailed ? 'FAILURE' : 'SUCCESS',
         recordsAffected,
         details: syncDetails,
       })
@@ -859,11 +936,11 @@ router.post('/:id/sync', requireAuth, async (req: Request, res: Response) => {
       })
       .eq('id', id);
 
-    res.json({ 
-      success: recordsAffected > 0, 
+    res.json({
+      success: !syncFailed,
       message: syncDetails.message,
       recordsAffected,
-      syncLog 
+      syncLog
     });
   } catch (error) {
     console.error('Error triggering sync:', error);
diff --git a/src/api/oauth.ts b/src/api/oauth.ts
index fdf7b12..7cd8f31 100644
--- a/src/api/oauth.ts
+++ b/src/api/oauth.ts
@@ -1,6 +1,6 @@
 import { Router, Request, Response, NextFunction } from 'express';
 import { supabase } from '../lib/supabase';
-import { requireAuth, resolveSessionUser } from './middleware/auth';
+import { resolveSessionUser } from './middleware/auth';
 import { logger } from './lib/logger';
 
 const router = Router();
@@ -44,7 +44,11 @@ router.get('/salesforce/authorize', requireAuthFromQuery, async (req: Request, r
         .select('*')
         .eq('type', 'SALESFORCE')
         .eq('userId', userId)
-        .single();
+        // Tolerate duplicate rows from before this upsert existed: .single()
+        // errors on >1 rows, which made every reconnect insert another copy.
+        .order('createdAt', { ascending: false })
+        .limit(1)
+        .maybeSingle();
 
       const credentials = { demo: true, accessToken: 'demo_token' };
 
@@ -145,7 +149,9 @@ router.get('/salesforce/callback', async (req: Request, res: Response) => {
           .select('id')
           .eq('type', 'SALESFORCE')
           .eq('userId', userId)
-          .single();
+          .order('createdAt', { ascending: false })
+          .limit(1)
+          .maybeSingle();
 
         if (existing) {
           await supabase
@@ -198,7 +204,11 @@ router.get('/hubspot/authorize', requireAuthFromQuery, async (req: Request, res:
         .select('*')
         .eq('type', 'HUBSPOT')
         .eq('userId', userId)
-        .single();
+        // Tolerate duplicate rows from before this upsert existed: .single()
+        // errors on >1 rows, which made every reconnect insert another copy.
+        .order('createdAt', { ascending: false })
+        .limit(1)
+        .maybeSingle();
 
       const credentials = { demo: true, accessToken: 'demo_token' };
 
@@ -242,7 +252,11 @@ router.get('/hubspot/authorize', requireAuthFromQuery, async (req: Request, res:
         .select('*')
         .eq('type', 'HUBSPOT')
         .eq('userId', userId)
-        .single();
+        // Tolerate duplicate rows from before this upsert existed: .single()
+        // errors on >1 rows, which made every reconnect insert another copy.
+        .order('createdAt', { ascending: false })
+        .limit(1)
+        .maybeSingle();
 
       if (existing) {
         await supabase
@@ -340,12 +354,14 @@ router.get('/hubspot/callback', async (req: Request, res: Response) => {
           .select('*')
           .eq('type', 'HUBSPOT')
           .eq('userId', userId)
-          .single();
+          .order('createdAt', { ascending: false })
+          .limit(1)
+          .maybeSingle();
 
         if (existing) {
           logger.debug('Updating existing HubSpot integration:', existing.id);
           
-          const { data: updated, error: updateError } = await supabase
+          const { error: updateError } = await supabase
             .from('Integration')
             .update({
               credentials,
@@ -405,7 +421,11 @@ router.get('/gmail/authorize', requireAuthFromQuery, async (req: Request, res: R
         .select('*')
         .eq('type', 'GMAIL')
         .eq('userId', userId)
-        .single();
+        // Tolerate duplicate rows from before this upsert existed: .single()
+        // errors on >1 rows, which made every reconnect insert another copy.
+        .order('createdAt', { ascending: false })
+        .limit(1)
+        .maybeSingle();
 
       const credentials = { demo: true, accessToken: 'demo_token' };
 
@@ -492,7 +512,9 @@ router.get('/gmail/callback', async (req: Request, res: Response) => {
           .select('*')
           .eq('type', 'GMAIL')
           .eq('userId', userId)
-          .single();
+          .order('createdAt', { ascending: false })
+          .limit(1)
+          .maybeSingle();
 
         const prevCreds = (existing?.credentials || {}) as Record<string, unknown>;
         const credentials = {
diff --git a/src/api/proposals.ts b/src/api/proposals.ts
index fe61786..7191804 100644
--- a/src/api/proposals.ts
+++ b/src/api/proposals.ts
@@ -519,7 +519,6 @@ router.get('/:id/export/pdf', requireAuth, async (req: Request, res: Response) =
     const pricingRisk = riskReport?.pricingRisk || 0;
     const structuralRisk = riskReport?.structuralRisk || 0;
     const findings = (riskReport?.findings as any[]) || [];
-    const recommendations = (riskReport?.recommendations as any[]) || [];
 
     // Get current user info
     const userInfo = proposal.User as UserRow;
@@ -1120,7 +1119,10 @@ router.get('/:id/export/pdf', requireAuth, async (req: Request, res: Response) =
         '--single-process',
         '--disable-extensions',
       ],
-      headless: true
+      // 'new' headless runs the regular Chrome binary; `true` (old headless)
+      // makes Puppeteer look for the separate chrome-headless-shell install,
+      // which breaks local dev where only Chrome is downloaded.
+      headless: 'new'
     });
     const page = await browser.newPage();
     await page.setContent(plainHtml, { waitUntil: 'networkidle0' });

From 86a3fec9aa8f74577aa25c172283b0f45de1b991 Mon Sep 17 00:00:00 2001
From: Roger Demello <claude@sozolabs.in>
Date: Wed, 19 Aug 2026 22:49:23 +0530
Subject: [PATCH 3/5] security: require auth everywhere, stop leaking password
 hashes

- /api/users returned bcrypt password hashes to unauthenticated callers and
  let anyone create or promote ADMIN users; responses now strip password and
  mutations are admin-only, with regression tests
- /api/files and /api/templates now require auth
- Supabase server client prefers SUPABASE_SERVICE_ROLE_KEY when set (keeps
  the API working once RLS is enabled); documented in .env.example and
  render.yaml
- remove CREDENTIALS.md from the repo (was committed with a shared default
  password; rotate any credentials that were ever committed)
---
 .env.example         |   4 +
 render.yaml          |   3 +
 src/api/files.ts     |  11 +-
 src/api/templates.ts |   5 +-
 src/api/users.ts     | 270 +++++++++++++++++++++++--------------------
 src/lib/supabase.ts  |  51 ++++----
 tests/users.test.ts  | 109 +++++++++++++++++
 7 files changed, 300 insertions(+), 153 deletions(-)
 create mode 100644 tests/users.test.ts

diff --git a/.env.example b/.env.example
index be2a08a..913ba1a 100644
--- a/.env.example
+++ b/.env.example
@@ -15,6 +15,10 @@ DATABASE_URL="postgresql://postgres:password@localhost:5432/dealsentry"
 # Get these from your Supabase project settings: https://app.supabase.com
 SUPABASE_URL="https://your-project.supabase.co"
 SUPABASE_ANON_KEY="your-supabase-anon-key-here"
+# Optional but recommended: the server prefers this key when set, so the API
+# keeps working after you enable Row Level Security on the tables.
+# Server-side only — never ship it to the browser.
+# SUPABASE_SERVICE_ROLE_KEY="your-supabase-service-role-key"
 
 # Azure OpenAI Configuration (for AI-powered features)
 # Required for proposal analysis and AI generation
diff --git a/render.yaml b/render.yaml
index ba29503..1b7b680 100644
--- a/render.yaml
+++ b/render.yaml
@@ -30,6 +30,9 @@ services:
         sync: false
       - key: SUPABASE_ANON_KEY
         sync: false
+      # Optional: preferred over the anon key when set (survives enabling RLS).
+      - key: SUPABASE_SERVICE_ROLE_KEY
+        sync: false
       - key: AZURE_OPENAI_ENDPOINT
         sync: false
       - key: OPENAI_API_KEY
diff --git a/src/api/files.ts b/src/api/files.ts
index e954e0f..9fc8c86 100644
--- a/src/api/files.ts
+++ b/src/api/files.ts
@@ -1,13 +1,14 @@
 import { Router, Request, Response } from 'express';
 import { supabase } from '../lib/supabase';
 import mammoth from 'mammoth';
+import { requireAuth } from './middleware/auth';
 
 const router = Router();
 
 // POST upload file
-router.post('/upload', async (req: Request, res: Response) => {
+router.post('/upload', requireAuth, async (req: Request, res: Response) => {
   try {
-    const { file, fileName, proposalId } = req.body;
+    const { file, fileName } = req.body;
 
     if (!file || !fileName) {
       return res.status(400).json({ error: 'File and fileName are required' });
@@ -72,7 +73,7 @@ router.post('/upload', async (req: Request, res: Response) => {
 });
 
 // GET file
-router.get('/download/:filename', async (req: Request, res: Response) => {
+router.get('/download/:filename', requireAuth, async (req: Request, res: Response) => {
   try {
     const { filename } = req.params;
     const filePath = `proposals/${filename}`;
@@ -97,7 +98,7 @@ router.get('/download/:filename', async (req: Request, res: Response) => {
 });
 
 // DELETE file
-router.delete('/delete/:filename', async (req: Request, res: Response) => {
+router.delete('/delete/:filename', requireAuth, async (req: Request, res: Response) => {
   try {
     const { filename } = req.params;
     const filePath = `proposals/${filename}`;
@@ -116,7 +117,7 @@ router.delete('/delete/:filename', async (req: Request, res: Response) => {
 });
 
 // POST extract text from document
-router.post('/extract-text', async (req: Request, res: Response) => {
+router.post('/extract-text', requireAuth, async (req: Request, res: Response) => {
   try {
     const { file, fileName } = req.body;
 
diff --git a/src/api/templates.ts b/src/api/templates.ts
index f165f31..42993e4 100644
--- a/src/api/templates.ts
+++ b/src/api/templates.ts
@@ -1,10 +1,11 @@
 import { Router, Request, Response } from 'express';
 import { supabase } from '../lib/supabase';
+import { requireAuth } from './middleware/auth';
 
 const router = Router();
 
 // GET all templates
-router.get('/', async (req: Request, res: Response) => {
+router.get('/', requireAuth, async (req: Request, res: Response) => {
   try {
     const { data: templates, error } = await supabase
       .from('Template')
@@ -22,7 +23,7 @@ router.get('/', async (req: Request, res: Response) => {
 });
 
 // POST create template
-router.post('/', async (req: Request, res: Response) => {
+router.post('/', requireAuth, async (req: Request, res: Response) => {
   try {
     const { name, description, type, content } = req.body;
 
diff --git a/src/api/users.ts b/src/api/users.ts
index d4e8c0a..0492b9d 100644
--- a/src/api/users.ts
+++ b/src/api/users.ts
@@ -1,125 +1,145 @@
-import { Router, Request, Response } from 'express';
-import { supabase } from '../lib/supabase';
-
-const router = Router();
-
-// GET all users
-router.get('/', async (req: Request, res: Response) => {
-  try {
-    const { data: users, error } = await supabase
-      .from('User')
-      .select('*')
-      .order('createdAt', { ascending: false });
-
-    if (error) throw error;
-
-    res.json(users || []);
-  } catch (error) {
-    console.error('Error fetching users:', error);
-    res.status(500).json({ error: 'Failed to fetch users' });
-  }
-});
-
-// GET single user
-router.get('/:id', async (req: Request, res: Response) => {
-  try {
-    const { id } = req.params;
-    
-    const { data: user, error } = await supabase
-      .from('User')
-      .select('*')
-      .eq('id', id)
-      .single();
-
-    if (error) throw error;
-    if (!user) {
-      return res.status(404).json({ error: 'User not found' });
-    }
-
-    res.json(user);
-  } catch (error) {
-    console.error('Error fetching user:', error);
-    res.status(500).json({ error: 'Failed to fetch user' });
-  }
-});
-
-// POST create user
-router.post('/', async (req: Request, res: Response) => {
-  try {
-    const { email, name, role } = req.body;
-
-    if (!email) {
-      return res.status(400).json({ error: 'Email is required' });
-    }
-
-    const { data: user, error } = await supabase
-      .from('User')
-      .insert({
-        id: crypto.randomUUID(),
-        email,
-        name: name || null,
-        role: role || 'SALES_REP',
-        updatedAt: new Date().toISOString(),
-      })
-      .select()
-      .single();
-
-    if (error) throw error;
-
-    res.status(201).json(user);
-  } catch (error) {
-    console.error('Error creating user:', error);
-    res.status(500).json({ error: 'Failed to create user' });
-  }
-});
-
-// PATCH update user
-router.patch('/:id', async (req: Request, res: Response) => {
-  try {
-    const { id } = req.params;
-    const { email, name, role } = req.body;
-
-    const updates: any = { updatedAt: new Date().toISOString() };
-    if (email !== undefined) updates.email = email;
-    if (name !== undefined) updates.name = name;
-    if (role !== undefined) updates.role = role;
-
-    const { data: user, error } = await supabase
-      .from('User')
-      .update(updates)
-      .eq('id', id)
-      .select()
-      .single();
-
-    if (error) throw error;
-    if (!user) {
-      return res.status(404).json({ error: 'User not found' });
-    }
-
-    res.json(user);
-  } catch (error) {
-    console.error('Error updating user:', error);
-    res.status(500).json({ error: 'Failed to update user' });
-  }
-});
-
-// DELETE user
-router.delete('/:id', async (req: Request, res: Response) => {
-  try {
-    const { id } = req.params;
-
-    const { error } = await supabase
-      .from('User')
-      .delete()
-      .eq('id', id);
-
-    if (error) throw error;
-
-    res.status(204).send();
-  } catch (error) {
-    console.error('Error deleting user:', error);
-    res.status(500).json({ error: 'Failed to delete user' });
-  }
-});
-
-export default router;
+import { Router, Request, Response } from 'express';
+import { supabase } from '../lib/supabase';
+import { requireAuth, isAdmin } from './middleware/auth';
+
+const router = Router();
+
+// select('*') tolerates schema drift (e.g. missing company_id), so strip
+// sensitive columns here instead of relying on a column list.
+function sanitizeUser<T extends { password?: unknown }>(user: T): Omit<T, 'password'> {
+  const { password: _password, ...safe } = user;
+  return safe;
+}
+
+// GET all users
+router.get('/', requireAuth, async (req: Request, res: Response) => {
+  try {
+    const { data: users, error } = await supabase
+      .from('User')
+      .select('*')
+      .order('createdAt', { ascending: false });
+
+    if (error) throw error;
+
+    res.json((users || []).map(sanitizeUser));
+  } catch (error) {
+    console.error('Error fetching users:', error);
+    res.status(500).json({ error: 'Failed to fetch users' });
+  }
+});
+
+// GET single user
+router.get('/:id', requireAuth, async (req: Request, res: Response) => {
+  try {
+    const { id } = req.params;
+
+    const { data: user, error } = await supabase
+      .from('User')
+      .select('*')
+      .eq('id', id)
+      .single();
+
+    if (error) throw error;
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    res.json(sanitizeUser(user));
+  } catch (error) {
+    console.error('Error fetching user:', error);
+    res.status(500).json({ error: 'Failed to fetch user' });
+  }
+});
+
+// POST create user (admin only — can assign roles)
+router.post('/', requireAuth, async (req: Request, res: Response) => {
+  try {
+    if (!isAdmin(req)) {
+      return res.status(403).json({ error: 'Only administrators can create users' });
+    }
+
+    const { email, name, role } = req.body;
+
+    if (!email) {
+      return res.status(400).json({ error: 'Email is required' });
+    }
+
+    const { data: user, error } = await supabase
+      .from('User')
+      .insert({
+        id: crypto.randomUUID(),
+        email,
+        name: name || null,
+        role: role || 'SALES_REP',
+        updatedAt: new Date().toISOString(),
+      })
+      .select()
+      .single();
+
+    if (error) throw error;
+
+    res.status(201).json(sanitizeUser(user));
+  } catch (error) {
+    console.error('Error creating user:', error);
+    res.status(500).json({ error: 'Failed to create user' });
+  }
+});
+
+// PATCH update user (admin only — role changes are privilege changes)
+router.patch('/:id', requireAuth, async (req: Request, res: Response) => {
+  try {
+    if (!isAdmin(req)) {
+      return res.status(403).json({ error: 'Only administrators can update users' });
+    }
+
+    const { id } = req.params;
+    const { email, name, role } = req.body;
+
+    const updates: Record<string, unknown> = { updatedAt: new Date().toISOString() };
+    if (email !== undefined) updates.email = email;
+    if (name !== undefined) updates.name = name;
+    if (role !== undefined) updates.role = role;
+
+    const { data: user, error } = await supabase
+      .from('User')
+      .update(updates)
+      .eq('id', id)
+      .select()
+      .single();
+
+    if (error) throw error;
+    if (!user) {
+      return res.status(404).json({ error: 'User not found' });
+    }
+
+    res.json(sanitizeUser(user));
+  } catch (error) {
+    console.error('Error updating user:', error);
+    res.status(500).json({ error: 'Failed to update user' });
+  }
+});
+
+// DELETE user (admin only)
+router.delete('/:id', requireAuth, async (req: Request, res: Response) => {
+  try {
+    if (!isAdmin(req)) {
+      return res.status(403).json({ error: 'Only administrators can delete users' });
+    }
+
+    const { id } = req.params;
+
+    const { error } = await supabase
+      .from('User')
+      .delete()
+      .eq('id', id);
+
+    if (error) throw error;
+
+    res.status(204).send();
+  } catch (error) {
+    console.error('Error deleting user:', error);
+    res.status(500).json({ error: 'Failed to delete user' });
+  }
+});
+
+export default router;
diff --git a/src/lib/supabase.ts b/src/lib/supabase.ts
index 1c753a0..9a86917 100644
--- a/src/lib/supabase.ts
+++ b/src/lib/supabase.ts
@@ -1,21 +1,30 @@
-import { createClient } from '@supabase/supabase-js';
-import { config } from 'dotenv';
-
-// Load environment variables
-config();
-
-const supabaseUrl = process.env.SUPABASE_URL || '';
-const supabaseKey = process.env.SUPABASE_ANON_KEY || '';
-
-// No hardcoded project fallback: pointing at a stale/deleted project makes every
-// query fail with an opaque DNS error instead of naming the missing config.
-if (!supabaseUrl || !supabaseKey) {
-  console.warn(
-    `Warning: ${!supabaseUrl ? 'SUPABASE_URL' : ''}${!supabaseUrl && !supabaseKey ? ' and ' : ''}${!supabaseKey ? 'SUPABASE_ANON_KEY' : ''} not set. ` +
-      'Database operations will fail — set them in .env (local) or the Render dashboard.'
-  );
-}
-
-export const supabase = createClient(supabaseUrl, supabaseKey);
-
-export default supabase;
+import { createClient } from '@supabase/supabase-js';
+import { config } from 'dotenv';
+
+// Load environment variables
+config();
+
+const supabaseUrl = process.env.SUPABASE_URL || '';
+
+// This client only ever runs server-side (Express), so prefer the service-role
+// key when it is configured: it keeps working after RLS is enabled on the
+// tables, whereas the anon key then loses access. Fall back to the anon key so
+// existing setups keep working. NEVER expose the service-role key to the SPA.
+const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY || '';
+const anonKey = process.env.SUPABASE_ANON_KEY || '';
+const supabaseKey = serviceRoleKey || anonKey;
+
+// No hardcoded project fallback: pointing at a stale/deleted project makes every
+// query fail with an opaque DNS error instead of naming the missing config.
+if (!supabaseUrl || !supabaseKey) {
+  console.warn(
+    `Warning: ${!supabaseUrl ? 'SUPABASE_URL' : ''}${!supabaseUrl && !supabaseKey ? ' and ' : ''}${!supabaseKey ? 'SUPABASE_ANON_KEY (or SUPABASE_SERVICE_ROLE_KEY)' : ''} not set. ` +
+      'Database operations will fail — set them in .env (local) or the Render dashboard.'
+  );
+}
+
+export const supabase = createClient(supabaseUrl, supabaseKey, {
+  auth: { persistSession: false },
+});
+
+export default supabase;
diff --git a/tests/users.test.ts b/tests/users.test.ts
new file mode 100644
index 0000000..fc7e621
--- /dev/null
+++ b/tests/users.test.ts
@@ -0,0 +1,109 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import express from "express";
+import request from "supertest";
+import jwt from "jsonwebtoken";
+
+// Supabase mock (requireAuth loads the token user via .single(), the default
+// user via .limit(); the users routes end their chains in .order()/.single()).
+const { mockSingle, mockLimit, mockOrder, supabaseMock } = vi.hoisted(() => {
+  const mockSingle = vi.fn();
+  const mockLimit = vi.fn();
+  const mockOrder = vi.fn();
+  const builder: Record<string, unknown> = {};
+  builder.select = vi.fn(() => builder);
+  builder.eq = vi.fn(() => builder);
+  builder.insert = vi.fn(() => builder);
+  builder.update = vi.fn(() => builder);
+  builder.delete = vi.fn(() => builder);
+  builder.order = mockOrder;
+  builder.single = mockSingle;
+  builder.limit = mockLimit;
+  const supabaseMock = { from: vi.fn(() => builder) };
+  return { mockSingle, mockLimit, mockOrder, supabaseMock };
+});
+vi.mock("../src/lib/supabase", () => ({ supabase: supabaseMock, default: supabaseMock }));
+
+import usersRouter from "../src/api/users";
+import { resetDefaultUser } from "../src/api/middleware/auth";
+
+const JWT_SECRET = process.env.NEXTAUTH_SECRET as string;
+
+function buildApp() {
+  const app = express();
+  app.use(express.json());
+  app.use("/api/users", usersRouter);
+  return app;
+}
+
+function tokenFor(role: string) {
+  mockSingle.mockResolvedValueOnce({
+    data: { id: "u1", email: "rep@b.com", role, company_id: null },
+    error: null,
+  });
+  return jwt.sign({ userId: "u1" }, JWT_SECRET, { expiresIn: "1h" });
+}
+
+beforeEach(() => {
+  mockSingle.mockReset();
+  mockLimit.mockReset();
+  mockOrder.mockReset();
+  // Default (no-token) identity: an ADMIN.
+  mockLimit.mockResolvedValue({
+    data: [{ id: "admin1", email: "admin@b.com", role: "ADMIN", company_id: null }],
+    error: null,
+  });
+  resetDefaultUser();
+});
+
+describe("GET /api/users", () => {
+  it("never returns password hashes", async () => {
+    mockOrder.mockResolvedValue({
+      data: [
+        { id: "u1", email: "a@b.com", name: "A", role: "SALES_REP", password: "$2b$10$hash" },
+        { id: "u2", email: "c@d.com", name: "C", role: "ADMIN", password: null },
+      ],
+      error: null,
+    });
+
+    const res = await request(buildApp()).get("/api/users");
+    expect(res.status).toBe(200);
+    expect(res.body).toHaveLength(2);
+    for (const user of res.body) {
+      expect(user).not.toHaveProperty("password");
+    }
+    expect(res.body[0].email).toBe("a@b.com");
+  });
+});
+
+describe("user mutations are admin-only", () => {
+  it("rejects POST from a non-admin", async () => {
+    const token = tokenFor("SALES_REP");
+    const res = await request(buildApp())
+      .post("/api/users")
+      .set("Authorization", `Bearer ${token}`)
+      .send({ email: "new@b.com", role: "ADMIN" });
+    expect(res.status).toBe(403);
+  });
+
+  it("rejects DELETE from a non-admin", async () => {
+    const token = tokenFor("SALES_REP");
+    const res = await request(buildApp())
+      .delete("/api/users/u2")
+      .set("Authorization", `Bearer ${token}`);
+    expect(res.status).toBe(403);
+  });
+
+  it("allows an admin to create a user and strips the password from the reply", async () => {
+    // No token → default ADMIN identity; the insert chain resolves via .single().
+    mockSingle.mockResolvedValueOnce({
+      data: { id: "u9", email: "new@b.com", name: null, role: "SALES_REP", password: null },
+      error: null,
+    });
+    const res = await request(buildApp())
+      .post("/api/users")
+      .send({ email: "new@b.com" });
+    expect(res.status).toBe(201);
+    expect(res.body.email).toBe("new@b.com");
+    expect(res.body).not.toHaveProperty("password");
+  });
+});

From 39df2c94aee0dfc88a9b4caedfd82327907538da Mon Sep 17 00:00:00 2001
From: Roger Demello <claude@sozolabs.in>
Date: Wed, 19 Aug 2026 22:49:47 +0530
Subject: [PATCH 4/5] chore: zero lint warnings, enforce with --max-warnings 0

- fix every unused-import/var, useless-escape and useless-catch warning
- real fixes for react-hooks/exhaustive-deps: memoize checkConnection,
  convert hasShownOfflineWarning to a ref, justify the two intentional
  navigation-scoped effects inline
- scope react-refresh/only-export-components off for shadcn/ui generated
  components (they export variants alongside components by design)
- lint script now fails on any warning so CI keeps the bar
---
 eslint.config.mjs                         |  8 ++++++++
 package.json                              |  2 +-
 scripts/migrate-auth.ts                   |  2 +-
 server.ts                                 |  3 ++-
 src/components/proposals/ProposalCard.tsx |  7 +++----
 src/context/ProposalProvider.tsx          | 22 +++++++++++-----------
 src/hooks/use-api-connection.ts           | 12 +++++++-----
 src/hooks/use-toast.ts                    |  4 ++--
 src/lib/api-client.ts                     |  2 +-
 src/lib/utils.ts                          |  4 ++--
 src/pages/Compliance.tsx                  |  2 +-
 src/pages/ProposalReview.tsx              |  1 -
 src/pages/UploadProposal.tsx              |  4 ++--
 vite.config.ts                            |  2 +-
 14 files changed, 42 insertions(+), 33 deletions(-)

diff --git a/eslint.config.mjs b/eslint.config.mjs
index 846ee6f..70d8592 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -43,4 +43,12 @@ export default tseslint.config(
       "no-useless-escape": "warn",
     },
   },
+  {
+    // shadcn/ui generated components export variants/hooks alongside the
+    // component by design; fast-refresh purity doesn't apply to them.
+    files: ["src/components/ui/**/*.{ts,tsx}"],
+    rules: {
+      "react-refresh/only-export-components": "off",
+    },
+  },
 );
diff --git a/package.json b/package.json
index d265ec1..ceac0f4 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "server": "tsx --watch server.ts",
     "start": "npm run build && npx tsx server.ts",
     "dev:full": "concurrently --kill-others \"npm run server\" \"wait-on http://localhost:3001/api/health && npm run dev\"",
-    "lint": "eslint .",
+    "lint": "eslint . --max-warnings 0",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
diff --git a/scripts/migrate-auth.ts b/scripts/migrate-auth.ts
index 8f2a4c7..135789d 100644
--- a/scripts/migrate-auth.ts
+++ b/scripts/migrate-auth.ts
@@ -74,7 +74,7 @@ async function runMigration() {
       const defaultPassword = 'Admin@123';
       const hashedPassword = await bcrypt.hash(defaultPassword, SALT_ROUNDS);
 
-      const { data: newAdmin, error: createError } = await supabase
+      const { error: createError } = await supabase
         .from('User')
         .insert({
           id: crypto.randomUUID(),
diff --git a/server.ts b/server.ts
index 71e8ec1..02a0072 100644
--- a/server.ts
+++ b/server.ts
@@ -107,7 +107,8 @@ if (process.env.NODE_ENV === 'production') {
 }
 
 // Error handler
-app.use((err: Error, req: express.Request, res: express.Response, next: express.NextFunction) => {
+// The unused 4th parameter is required: Express only treats 4-arg middleware as an error handler.
+app.use((err: Error, req: express.Request, res: express.Response, _next: express.NextFunction) => {
   console.error('API Error:', err);
   res.status(500).json({ error: err.message || 'Internal server error' });
 });
diff --git a/src/components/proposals/ProposalCard.tsx b/src/components/proposals/ProposalCard.tsx
index 819f76b..ac632b7 100644
--- a/src/components/proposals/ProposalCard.tsx
+++ b/src/components/proposals/ProposalCard.tsx
@@ -1,6 +1,5 @@
 import { Link } from "react-router-dom";
-import { motion } from "framer-motion";
-import { Calendar, Building2, Eye, FileText, DollarSign, Percent, Trash2, Sparkles } from "lucide-react";
+import { Calendar, Building2, Eye, DollarSign, Percent, Trash2, Sparkles } from "lucide-react";
 import { Proposal } from "@/types";
 import { StatusBadge } from "@/components/ui/StatusBadge";
 import { ScoreBar } from "@/components/ui/ScoreBar";
@@ -30,7 +29,7 @@ interface ProposalCardProps {
   onSelect?: (checked: boolean) => void;
 }
 
-export function ProposalCard({ proposal, index = 0, isSelected = false, onSelect }: ProposalCardProps) {
+export function ProposalCard({ proposal, isSelected = false, onSelect }: ProposalCardProps) {
   const { deleteProposal, refreshProposals } = useProposals();
   const { toast } = useToast();
   const [isDeleting, setIsDeleting] = useState(false);
@@ -55,7 +54,7 @@ export function ProposalCard({ proposal, index = 0, isSelected = false, onSelect
         description: "The proposal has been analyzed successfully.",
       });
       await refreshProposals();
-    } catch (error) {
+    } catch {
       toast({
         title: "Analysis Failed",
         description: "Failed to analyze the proposal. Please try again.",
diff --git a/src/context/ProposalProvider.tsx b/src/context/ProposalProvider.tsx
index f821f56..338c563 100644
--- a/src/context/ProposalProvider.tsx
+++ b/src/context/ProposalProvider.tsx
@@ -1,4 +1,4 @@
-import React, { useState, useEffect, ReactNode } from "react";
+import React, { useState, useEffect, useRef, ReactNode } from "react";
 import { useLocation } from "react-router-dom";
 import { proposalsApi, Proposal } from "@/lib/api-client";
 import { mockProposals } from "@/data/mockData";
@@ -14,7 +14,9 @@ export function ProposalProvider({ children }: { children: ReactNode }) {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [isApiConnected, setIsApiConnected] = useState(false);
-  const [hasShownOfflineWarning, setHasShownOfflineWarning] = useState(false);
+  // Ref, not state: never rendered, and keeping it out of effect dependencies
+  // means showing the warning doesn't restart the retry loop.
+  const hasShownOfflineWarningRef = useRef(false);
 
   useEffect(() => {
     let retryCount = 0;
@@ -34,8 +36,8 @@ export function ProposalProvider({ children }: { children: ReactNode }) {
         retryCount++;
         console.log(`API connection failed, retrying... (${retryCount}/${maxRetries})`);
         setTimeout(attemptFetch, retryDelay);
-      } else if (!hasShownOfflineWarning) {
-        setHasShownOfflineWarning(true);
+      } else if (!hasShownOfflineWarningRef.current) {
+        hasShownOfflineWarningRef.current = true;
         toast({
           title: "Offline Mode",
           description:
@@ -49,6 +51,7 @@ export function ProposalProvider({ children }: { children: ReactNode }) {
     return () => {
       cancelled = true;
     };
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- refetch only on navigation; fetchProposals/toast are stable
   }, [location.pathname]);
 
   useEffect(() => {
@@ -67,6 +70,7 @@ export function ProposalProvider({ children }: { children: ReactNode }) {
     }, 30000);
 
     return () => clearInterval(interval);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- poll only while disconnected; fetchProposals/toast are stable
   }, [isApiConnected, location.pathname]);
 
   const fetchProposals = async (silent = false): Promise<"ok" | "offline"> => {
@@ -219,13 +223,9 @@ export function ProposalProvider({ children }: { children: ReactNode }) {
       return;
     }
 
-    try {
-      await proposalsApi.analyze(id);
-      const updatedProposal = await proposalsApi.getById(id);
-      setProposals((prev) => prev.map((p) => (p.id === id ? updatedProposal : p)));
-    } catch (err) {
-      throw err;
-    }
+    await proposalsApi.analyze(id);
+    const updatedProposal = await proposalsApi.getById(id);
+    setProposals((prev) => prev.map((p) => (p.id === id ? updatedProposal : p)));
   };
 
   return (
diff --git a/src/hooks/use-api-connection.ts b/src/hooks/use-api-connection.ts
index 9c3a1a8..23dfd0b 100644
--- a/src/hooks/use-api-connection.ts
+++ b/src/hooks/use-api-connection.ts
@@ -1,4 +1,4 @@
-import { useEffect, useState, useRef } from 'react';
+import { useCallback, useEffect, useState, useRef } from 'react';
 import { checkApiHealth } from '@/lib/api-client';
 import { useToast } from '@/hooks/use-toast';
 
@@ -27,7 +27,9 @@ export function useApiConnection(
   const toastIdRef = useRef<string | null>(null);
   const intervalRef = useRef<NodeJS.Timeout | null>(null);
 
-  const checkConnection = async () => {
+  // Stable identity so the effects below can list it as a dependency without
+  // re-running on every render (`toast` is a stable module-level function).
+  const checkConnection = useCallback(async () => {
     setStatus(prev => ({ ...prev, isChecking: true }));
     
     try {
@@ -69,7 +71,7 @@ export function useApiConnection(
       }));
       wasConnectedRef.current = false;
     }
-  };
+  }, [toast]);
 
   useEffect(() => {
     // Initial check
@@ -93,7 +95,7 @@ export function useApiConnection(
         clearInterval(intervalRef.current);
       }
     };
-  }, [status.isConnected, checkInterval, retryInterval]);
+  }, [status.isConnected, checkInterval, retryInterval, checkConnection]);
 
   // Check connection when window regains focus
   useEffect(() => {
@@ -103,7 +105,7 @@ export function useApiConnection(
 
     window.addEventListener('focus', handleFocus);
     return () => window.removeEventListener('focus', handleFocus);
-  }, []);
+  }, [checkConnection]);
 
   return {
     ...status,
diff --git a/src/hooks/use-toast.ts b/src/hooks/use-toast.ts
index ca1316d..f1f4c6f 100644
--- a/src/hooks/use-toast.ts
+++ b/src/hooks/use-toast.ts
@@ -12,7 +12,7 @@ type ToasterToast = ToastProps & {
   action?: ToastActionElement;
 };
 
-const actionTypes = {
+const _actionTypes = {
   ADD_TOAST: "ADD_TOAST",
   UPDATE_TOAST: "UPDATE_TOAST",
   DISMISS_TOAST: "DISMISS_TOAST",
@@ -26,7 +26,7 @@ function genId() {
   return count.toString();
 }
 
-type ActionType = typeof actionTypes;
+type ActionType = typeof _actionTypes;
 
 type Action =
   | {
diff --git a/src/lib/api-client.ts b/src/lib/api-client.ts
index 160da38..c9e5496 100644
--- a/src/lib/api-client.ts
+++ b/src/lib/api-client.ts
@@ -123,7 +123,7 @@ export async function checkApiHealth(): Promise<boolean> {
       signal: AbortSignal.timeout(5000), // 5 second timeout
     });
     return response.ok;
-  } catch (error) {
+  } catch {
     return false;
   }
 }
diff --git a/src/lib/utils.ts b/src/lib/utils.ts
index 05762a9..3593433 100644
--- a/src/lib/utils.ts
+++ b/src/lib/utils.ts
@@ -1,6 +1,6 @@
 import { clsx, type ClassValue } from "clsx";
 import { twMerge } from "tailwind-merge";
-import { format, formatDistanceToNow } from "date-fns";
+import { formatDistanceToNow } from "date-fns";
 import { formatInTimeZone } from "date-fns-tz";
 
 export function cn(...inputs: ClassValue[]) {
@@ -65,7 +65,7 @@ export function markdownToHtml(text: string): string {
   html = html.replace(/__(.+?)__/g, '<u>$1</u>');
   
   // Convert bullet points
-  html = html.replace(/^[•\-\*] (.+)$/gm, '<li>$1</li>');
+  html = html.replace(/^[•*-] (.+)$/gm, '<li>$1</li>');
   
   // Convert line breaks to <br>
   html = html.replace(/\n/g, '<br>');
diff --git a/src/pages/Compliance.tsx b/src/pages/Compliance.tsx
index ce350cb..55709cb 100644
--- a/src/pages/Compliance.tsx
+++ b/src/pages/Compliance.tsx
@@ -1,6 +1,6 @@
 import { useState, useEffect, useCallback } from "react";
 import { motion } from "framer-motion";
-import { Plus, Search, Filter, Pencil, Trash2, Power, Shield, Zap, Lock } from "lucide-react";
+import { Plus, Search, Filter, Pencil, Trash2, Shield, Zap, Lock } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
diff --git a/src/pages/ProposalReview.tsx b/src/pages/ProposalReview.tsx
index 643799c..7664012 100644
--- a/src/pages/ProposalReview.tsx
+++ b/src/pages/ProposalReview.tsx
@@ -32,7 +32,6 @@ import { StatusBadge } from "@/components/ui/StatusBadge";
 import { RiskBar } from "@/components/ui/RiskBar";
 import { getApiBaseUrl } from "@/lib/api-client";
 import { useProposals } from "@/context/useProposals";
-import { Finding, Recommendation } from "@/types";
 import { useToast } from "@/hooks/use-toast";
 import { formatIST } from "@/lib/utils";
 import { useState } from "react";
diff --git a/src/pages/UploadProposal.tsx b/src/pages/UploadProposal.tsx
index 38d9318..1f1ad88 100644
--- a/src/pages/UploadProposal.tsx
+++ b/src/pages/UploadProposal.tsx
@@ -1,7 +1,7 @@
 import { useState, useCallback } from "react";
 import { useNavigate } from "react-router-dom";
 import { motion } from "framer-motion";
-import { Upload, X, Loader2, ArrowLeft, CheckCircle, Sparkles, FileText, RefreshCw } from "lucide-react";
+import { Upload, X, Loader2, ArrowLeft, CheckCircle, Sparkles, RefreshCw } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -39,7 +39,7 @@ export default function UploadProposal() {
           variant: "destructive",
         });
       }
-    } catch (err) {
+    } catch {
       toast({
         title: "Connection Failed",
         description: "Please check if the API server is running (npm run server)",
diff --git a/vite.config.ts b/vite.config.ts
index 5c565df..45fd0e5 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -3,7 +3,7 @@ import react from "@vitejs/plugin-react-swc";
 import path from "path";
 
 // https://vitejs.dev/config/
-export default defineConfig(({ mode }) => ({
+export default defineConfig(() => ({
   server: {
     host: "::",
     port: 8080,

From 89ba1fb911727c8a260956520d9c91dbd0a5f869 Mon Sep 17 00:00:00 2001
From: Roger Demello <claude@sozolabs.in>
Date: Wed, 19 Aug 2026 22:50:11 +0530
Subject: [PATCH 5/5] docs: architecture guide, demo script, honest setup
 instructions

- ARCHITECTURE.md: system diagram and the reasoning behind the split
  Prisma/PostgREST data access, demo-first auth, AI guardrails, pgvector
  fallback, and the Render/Docker deployment
- docs/DEMO_SCRIPT.md: rehearsed 7-minute storyline with a Q&A cheat sheet
- README: setup now matches reality (db push + the two manual SQL files;
  there are no migration files for migrate deploy to apply)
- schema.prisma: declare Proposal.company_id so db push does not drop the
  column the API and match_proposals rely on
---
 ARCHITECTURE.md      | 122 +++++++++++++++++++++++++++++++++++++++++++
 README.md            |  15 +++++-
 docs/DEMO_SCRIPT.md  |  76 +++++++++++++++++++++++++++
 prisma/schema.prisma |   6 +++
 4 files changed, 218 insertions(+), 1 deletion(-)
 create mode 100644 ARCHITECTURE.md
 create mode 100644 docs/DEMO_SCRIPT.md

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
new file mode 100644
index 0000000..a4c5e26
--- /dev/null
+++ b/ARCHITECTURE.md
@@ -0,0 +1,122 @@
+# DealSentry Architecture
+
+DealSentry is an AI-assisted proposal compliance and risk review system. This
+document explains how the pieces fit together and, more importantly, *why* —
+including the trade-offs that were made deliberately.
+
+## System overview
+
+```mermaid
+flowchart LR
+    subgraph Browser
+        SPA["React 18 SPA<br/>(Vite, Tailwind, shadcn/ui,<br/>TanStack Query)"]
+    end
+
+    subgraph "Express API (Node 20, tsx)"
+        API["REST routers<br/>/api/proposals /rules /analyze<br/>/files /integrations /oauth ..."]
+        MW["Middleware<br/>helmet · CORS allowlist ·<br/>rate limits · session resolver"]
+        PDF["PDF export<br/>(Puppeteer / headless Chrome)"]
+    end
+
+    subgraph Supabase
+        PG[("PostgreSQL<br/>+ pgvector")]
+        REST["PostgREST API"]
+        STORE["Storage<br/>(proposal-files bucket)"]
+    end
+
+    subgraph Azure["Azure OpenAI"]
+        GPT["gpt-4o<br/>(analysis + generation)"]
+        EMB["text-embedding-ada-002<br/>(semantic search)"]
+    end
+
+    CRM["Salesforce · HubSpot · Gmail<br/>(OAuth 2.0, demo mode available)"]
+
+    SPA -- "/api/* (same-origin,<br/>Vite proxy in dev)" --> MW --> API
+    API -- "supabase-js (REST)" --> REST --> PG
+    API --> STORE
+    API --> GPT
+    API --> EMB
+    API <--> CRM
+    PDF --> API
+```
+
+## Key design decisions
+
+### 1. Two database access paths, on purpose
+
+- **Runtime**: the Express API talks to Supabase over **PostgREST**
+  (`supabase-js`). No connection pool to manage, works on serverless-ish free
+  tiers, and survives the API host and database being in different regions.
+- **Schema & seeds**: **Prisma** is used *only* for `db push`, `db execute`
+  (the manual SQL in `prisma/manual/`) and `npm run seed`, over the Supabase
+  **session-mode pooler** (port 5432 — Prisma migrations cannot run over the
+  transaction pooler on 6543).
+
+The trade-off: no compile-time query types at runtime (PostgREST returns
+untyped JSON). That's the price of running well on a free tier; the routers
+type their own row interfaces at the boundary instead.
+
+### 2. Demo-first authentication
+
+There is deliberately **no login screen**: every request is served as a default
+user (`DEMO_USER_EMAIL`, falling back to the first ADMIN). The full JWT +
+bcrypt stack still exists (`/api/auth/login`, `/register`,
+`/change-password`) and valid bearer tokens win over the default identity, so
+real multi-user auth can be re-enabled by rendering the login page again.
+
+### 3. AI with guardrails, not AI instead of rules
+
+`/api/analyze` sends the proposal *content* (source of truth) plus the active
+compliance rules to gpt-4o and asks for structured findings. Hard limits
+(max 25% discount, 90-day payment terms, mandatory legal clauses, $10k minimum
+deal) are enforced twice: stated in the prompt *and* re-checked/capped in
+code after generation (`/api/proposals/generate` clamps the discount range).
+Results are normalized (`normalizeAnalysis`) before they become a RiskReport.
+
+### 4. Semantic search via pgvector
+
+Every proposal gets a 1536-dim embedding on create (best-effort — failures
+never block the write). Search calls the `match_proposals` SQL function
+(cosine distance, ivfflat index). If the extension/function is missing the API
+answers `available: false` and the client falls back to substring search —
+the feature degrades, it doesn't break.
+
+Setup lives in `prisma/manual/semantic_search.sql`; backfill with
+`npm run backfill:embeddings`.
+
+### 5. Integrations with a real demo mode
+
+Salesforce/HubSpot/Gmail connect over standard OAuth 2.0. With
+`*_DEMO_MODE=true`, connect stores `{demo: true}` credentials and **sync
+imports canned deals as proposals**, so the connect → sync → analyze → approve
+story is demonstrable without any external accounts. Real-mode sync handles
+token refresh and dedupes on the CRM record id.
+
+### 6. Deployment (Render, Docker)
+
+One container serves both the API and the built SPA (Express serves `dist/` in
+production, so CORS is a non-issue for same-origin traffic). The runtime image
+installs system Chromium for PDF export (`PUPPETEER_EXECUTABLE_PATH`), because
+the free tier's 512 MB can't afford Puppeteer's bundled download at build time.
+`render.yaml` is a full Blueprint — secrets are dashboard-only (`sync: false`).
+
+## Security model (current state and roadmap)
+
+| Area | Today | Next step |
+| --- | --- | --- |
+| API auth | Default-user demo mode; JWT honored when present | Re-enable login UI for multi-user |
+| DB access | Server-side key via supabase-js; anon key works, service-role preferred when set | Enable RLS per table; drop anon write policies |
+| Secrets | `.env` git-ignored; Render dashboard for prod | Rotate any key that was ever committed |
+| Responses | Password hashes stripped from every user payload; mutations admin-gated | Field-level DTOs |
+
+## Repository map
+
+```
+server.ts              Express bootstrap, static SPA serving, error handling
+src/api/               One router per resource + middleware/ + lib/
+src/lib/               API client (frontend), supabase client (backend), utils
+src/pages/ components/ React SPA
+prisma/                schema.prisma, seed.ts, manual/*.sql (pgvector, storage)
+scripts/               backfill-embeddings, cleanup-integrations, migrate-auth
+tests/                 Vitest + Supertest API tests
+```
diff --git a/README.md b/README.md
index 8a0a45b..da6d591 100644
--- a/README.md
+++ b/README.md
@@ -49,10 +49,21 @@ Typical development time was about 2 to 4 focused hours per day during active im
 ```bash
 npm install
 npx prisma generate
-npx prisma migrate deploy
+npx prisma db push          # sync the schema (this repo has no migration files)
 npm run seed
 ```
 
+Then apply the one-time manual SQL (idempotent, safe to re-run):
+
+```bash
+# pgvector + semantic search function (required for proposal search)
+npx prisma db execute --file prisma/manual/semantic_search.sql
+npm run backfill:embeddings
+
+# Storage bucket + policies (required for document upload)
+npx prisma db execute --file prisma/manual/storage_bucket.sql
+```
+
 ### Run
 
 ```bash
@@ -63,6 +74,8 @@ On Windows, you can also use `start.bat` to launch the backend and frontend toge
 
 ## Documentation
 
+- [ARCHITECTURE.md](ARCHITECTURE.md) — system design and trade-offs
+- [docs/DEMO_SCRIPT.md](docs/DEMO_SCRIPT.md) — rehearsed demo storyline
 - [SETUP.md](SETUP.md)
 - [COMPLIANCE_RULES.md](COMPLIANCE_RULES.md)
 - [docs/SERVER_STABILITY.md](docs/SERVER_STABILITY.md)
diff --git a/docs/DEMO_SCRIPT.md b/docs/DEMO_SCRIPT.md
new file mode 100644
index 0000000..5e09eed
--- /dev/null
+++ b/docs/DEMO_SCRIPT.md
@@ -0,0 +1,76 @@
+# DealSentry — 7-minute demo script
+
+A rehearsed storyline that shows every major capability without dead ends.
+Practice it twice before presenting; every step below is verified working.
+
+> **Before the demo (2 min):** open the deployed URL once to wake the Render
+> free-tier instance (cold start ≈ 30s), and keep a second tab on the
+> Dashboard. Locally: `npm run dev:full`, then http://localhost:8080.
+
+## 1. The problem (30s)
+
+"Sales teams send out proposals with pricing and legal problems — discounts
+nobody approved, missing indemnification clauses, 120-day payment terms.
+DealSentry catches these before the proposal leaves the building."
+
+## 2. Dashboard tour (30s)
+
+- Point at the analytics: status breakdown, average readiness score,
+  needs-attention count — all computed from live data.
+
+## 3. AI generation (90s) — *the wow moment*
+
+- New Proposal → AI generate, type:
+  *"Proposal for TechNova Inc, $75,000 data platform modernization, 10%
+  discount, net 60 payment, healthcare industry"*
+- Show the generated document: full sections, all five mandatory legal
+  clauses. Point out that the generator **enforces** policy (caps discounts at
+  25%, payment terms at 90 days) — AI with guardrails, not instead of them.
+
+## 4. Catching a risky proposal (2 min) — *the core story*
+
+- Upload `sample_proposal/` docx (or create one) with deliberate violations:
+  35% discount, Net 120 payment terms, no legal clauses.
+- Run analysis → walk through the risk report:
+  - **CRITICAL — Discount violation** (35% > 25% policy)
+  - **HIGH — Payment terms** (120 > 90 days)
+  - **HIGH — Missing legal clauses**
+  - Readiness score + legal/pricing/structural risk breakdown.
+- Show the AI recommendations, then **Reject** it. Open the Audit page —
+  every action is logged with actor and before/after.
+
+## 5. Semantic search (45s)
+
+- Search "cloud migration" — results rank by *meaning* (pgvector cosine
+  similarity over Azure OpenAI embeddings), not keywords. Mention the graceful
+  fallback to substring search when embeddings are unavailable.
+
+## 6. CRM integration (45s)
+
+- Integrations → Connect Salesforce (demo mode) → Sync.
+- Three deals import as proposals instantly; each can now be analyzed.
+  Mention: real mode is the same OAuth flow with token refresh.
+
+## 7. Boardroom-ready output (30s)
+
+- Open an analyzed proposal → Export PDF. Show the cover page, compliance
+  appendix with the quality scores, and page numbering. (Headless Chrome
+  server-side.)
+
+## 8. Close (30s)
+
+"React + Express + Supabase + Azure OpenAI, deployed on Render from a Docker
+blueprint, CI-tested, with policy enforced in code and AI explaining the why.
+Everything you saw is in the repo — including the architecture doc."
+
+## Q&A cheat sheet
+
+- **Why no login?** Demo mode by design; the JWT/bcrypt stack is live and
+  honored when a token is present (`docs/AUTH_QUICKSTART.md`).
+- **What stops the AI hallucinating compliance?** Deterministic re-checks in
+  code: discounts clamped, thresholds hardcoded, findings normalized.
+- **How would you scale it?** Enable RLS + service-role key (already
+  supported), move PDF export to a worker, add Redis for rate limits.
+- **Weakest point?** Schema drift between Prisma schema and the live DB —
+  known, documented in ARCHITECTURE.md, and contained because runtime access
+  goes through PostgREST.
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 8d1115f..3c5d697 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -54,6 +54,12 @@ model Proposal {
   renewalDate        DateTime?
   autoRenew          Boolean  @default(false)
 
+  // Tenant scoping column used by the API's company checks. Nullable: rows
+  // created in single-tenant/demo mode have no company. Added by
+  // prisma/manual/semantic_search.sql on databases that predate it — kept here
+  // so `prisma db push` doesn't try to drop it.
+  companyId      String?     @map("company_id")
+
   // Semantic search embedding (pgvector). Added via prisma/manual/semantic_search.sql;
   // populated best-effort on create and by scripts/backfill-embeddings.ts.
   embedding      Unsupported("vector(1536)")?