Commit History
-
fix(clients): resolve file import dialog error and SSE 401
CognxSafeTrackFile import (Bug 1): - CrmAIAssistant had its own <input type="file"> that called onFileUpload onChange, which then called .click() on #crm-file-upload — a second programmatic file dialog triggered from an onChange handler. Chrome 126+ blocks this as it lacks a direct "user activation". - Fix: replace the embedded <input> with <label htmlFor="crm-file-upload"> so the click routes directly to FileImporter's input. Remove the now-unused onFileUpload prop entirely. SSE 401 (Bug 2): - EventSource (browser API) cannot send custom headers — the JWT token never reached the server, causing a 401 on every SSE connection. - Fix: pass the token as ?token= query param in the EventSource URL (MainLayout + CrmConversationalDashboard). - Backend: verifyJwt now injects the query param token into the Authorization header before calling jwtVerify(), so no route changes are needed.87dcd87
-
feat: agentic platform — text-to-sql, pedagogy advisor, security hardening & performance
CognxSafeTrack +1: Claude Sonnet 4.6- Analytics: POST /v1/analytics/query — natural language → GPT-4o-mini → SELECT → results (Text-to-SQL) - Analytics UI: example chips, SQL results table, 'Voir SQL' toggle - Billing: role guard on change_organization_mode (ADMIN+ only) - Nav: /ai-setup accessible to all org members (not just super admin) - Scheduler: startPedagogyAdvisor() — Wednesday 08:30 UTC cron, at-risk nudges (5 languages) + email report - S1 security: organizationId always from JWT for non-super-admin (never from header) - A6: InboundHandler passes user.language to Whisper transcription (Wolof hint: 'fr') - A2: Redis 6h cache for personalized lessons keyed by (trackDayId, activity, language) - P1: sendLessonDay() parallelized from 4 sequential DB queries to 2 (user+trackDay batch, userProgress parallel) - D2: Redis 30s dedup lock on exercise submission to prevent double-submit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>5b8761d -
feat: Claude Sonnet 4.6 provider + Stripe billing automation
CognxSafeTrack +1: Claude Sonnet 4.6AI: - packages/ai-sdk: ClaudeProvider implements LLMProvider via tool_use structured outputs + zod-to-json-schema - Claude registered at priority 120 (TEXT only), supersedes Gemini for feedback/lessons/chat — -40% cost, better French - ANTHROPIC_API_KEY added to API and worker env validation Stripe: - apps/api/src/routes/stripe.ts: POST /v1/stripe/webhook handles checkout.session.completed, subscription.updated/deleted, invoice.payment_failed/succeeded - Schema: stripeCustomerId + stripeSubscriptionId added to Organization - tenant.ts: 402 gate for isHardStopped orgs (x-api-key calls always pass) - ClientsManagementView: SUSPENDU badge on hard-stopped orgs - STRIPE_SECRET_KEY + STRIPE_WEBHOOK_SECRET added to config Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>4a0c3ba -
feat(billing): implement full wallet/ledger system with hard-stop enforcement
CognxSafeTrack +1: Claude Sonnet 4.6- Add walletBalance + isHardStopped to Organization schema; WalletTransaction ledger model with full audit trail - wallet.ts (worker): debitWallet (atomic $transaction), creditWallet (with AuditLog), checkWalletBalance (Redis 30s cache), alert queuing (low/critical/exhausted/restored) - wallet.ts (api): creditWallet for admin top-up with cache invalidation - usage-tracker.ts: debitWallet integrated into trackAiUsage, trackAudioUsage, trackWhatsAppSent; BYOK orgs skipped - BroadcastHandler + CampaignHandler: bulk debit after send (BROADCAST_PER_USER per recipient) - requireCredits.ts: migrated from aiCreditsUsed/Limit to walletBalance/isHardStopped; shares Redis cache key with worker - whatsapp-logic.ts: replaced assertCredits/CreditExhaustedError with checkWalletBalance/WalletExhaustedError - ai.ts: added requireCredits preHandler to all 11 AI routes (was 4) - billing.ts: /admin/allocate now calls creditWallet(); new GET /wallet route (balance + 20 last txns) - BillingPage: wallet card…0fd3320 -
feat(billing): enforce AI credit limits across all surfaces
CognxSafeTrack +1: Claude Sonnet 4.6- credit-guard.ts (worker): assertCredits() blocks AI when creditsUsed >= creditsLimit; Redis cache 60s prevents DB hit on every message - whatsapp-logic.ts: credit guard injected before handler chain; RECHARGE keyword bypasses the guard so users can always request a payment link - CommandHandler: new RECHARGE keyword sends payment URL or contact message - i18n: credit_exhausted + recharge_link + recharge_contact in 5 languages - requireCredits middleware (api): 402 on personalize-lesson, tts, generate-feedback, crm/generate-campaign - billing route: POST /v1/billing/admin/allocate (SUPER_ADMIN only) supports set/add actions + optional usage reset + Redis cache invalidation - ClientsManagementView: "Crédits IA" button (SUPER_ADMIN only) per org opens allocation modal with set/add/reset controls - BillingPage: red exhaustion banner when creditsUsed >= creditsLimit Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>6484585
-
feat: backlog P0→P3 — toast system, payments, tenant isolation, feedback handler, i18n parity
CognxSafeTrack +1: Claude Sonnet 4.6P0 — Critical fixes - Fix generate-feedback job silently dropped: register FeedbackHandler in worker index.ts - Wire FeedbackHandler: AI feedback, Day 11 TeamMember extraction, atomicity enforced P0 — Toast system (replace all alert()) - Add useToast hook + ToastContext + Toaster component - Replace every alert() across admin pages with toast.success/error/warning/info - Migrate all raw fetch() in pages to api.upload() / api.get() / api.post() P1 — Type safety - CrmAIAssistant: icon prop any → React.ElementType - useAudioRecorder: add onError callback instead of alert() - api.ts: add upload() method for multipart FormData P1 — Payment gateway - Add payment-gateway.ts: Orange Money + Wave initiation and webhook parsing - Rewrite payments.ts routes: initiate, status, webhook handlers with auto-enrollment on SUCCESS P1 — AI regression tests - Add apps/api/test/regression/ai-gold-standards.test.ts (12 tests, 5 suites) P2 — Visual recruitment (Day 11) - FeedbackHandler extracts TeamMem…6dd9bad -
fix(auth): validateApiKey accepts Bearer pattern used by worker
CognxSafeTrack +1: Claude Sonnet 4.6The worker's api-client.ts sends Authorization: Bearer ADMIN_API_KEY, not x-api-key. Without this fix all worker→API internal calls would get 401 after the preHandler security chain was wired. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>c5813d5
-
feat: implement whatsapp templates management with security hardening, audit logs, and crm integration
CognxSafeTrack0f2f80a -
chore: stabilization, audit fixes and project synchronization
CognxSafeTrack7b0c22b
-
fix: security hardening, log all silent catch blocks, remove prisma cast
CognxSafeTrack +1: Claude Sonnet 4.6Security: - whatsapp.ts: remove WHATSAPP_VERIFY_TOKEN hardcoded fallback — return 500 if env var is missing instead of silently accepting a public default - rateLimit.ts: key by req.ip (not spoofable x-organization-id header) Code quality — 7 empty catch blocks now log with context: - NudgeHandler, AdminHandler (+ missing logger import), EnrollHandler (x2), MediaHandler (x2), organization.ts invalidateOrgCache - admin.ts: remove (prisma as any).normalizationRule — model is in schema, cast was unnecessary Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>aa4f69f
-
chore: finalize Sprint P2 & P3 optimizations, baseline prisma migrations, and update technical audit docs
CognxSafeTrackcfbb685
-
fix: replace non-existent RateLimitReplyContext with inline type
CognxSafeTrack979cb50 -
fix: add explicit types to rateLimit errorResponseBuilder parameters
CognxSafeTrackbb62bf7 -
fix: add 'as any' casts to resolve TS2769 plugin registration errors (cors, rate-limit, bullboard)
CognxSafeTrack255a85a -
fix: restore logger compatibility and fix major TS errors in services
CognxSafeTrack38df3bf -
fix: rename rate-limit middleware to rateLimit to help IDE resolution
CognxSafeTrack303f611 -
fix: finalize API index imports and cleanup types
CognxSafeTrackde7231f -
fix: resolve IDE errors and missing middleware in API index
CognxSafeTrack6f87c06
-
feat: B2B SaaS Multi-tenant architecture & Tech Debt Resolution
CognxSafeTracke289c5c