Port the logged-in-pages audit branch onto main, one fix at a time (PORT-001)

.env.example

@@ -93,6 +93,23 @@ TWILIO_ACCOUNT_SID=
 TWILIO_AUTH_TOKEN=
 TWILIO_PHONE_NUMBER=
 
+# Leave this UNSET everywhere except a local machine.
+#
+# Every Twilio-facing webhook (Guardian inbound SMS/voice/WhatsApp, screening,
+# voicemail status, escalation TwiML, and the Contact Center's voice and SMS
+# callbacks) is on the middleware PUBLIC allowlist: the caller is Twilio, not a
+# signed-in person, so the request signature is the only thing standing between
+# those endpoints and anyone at all. lib/server/twilio-ingress.ts therefore
+# verifies on every request, in every environment, and refuses with 503 when
+# TWILIO_AUTH_TOKEN is absent and it cannot verify at all.
+#
+# Setting this to 1 turns that refusal into an acceptance — but only while
+# TWILIO_AUTH_TOKEN is unset; it cannot switch off a check that can actually
+# run. It exists so local work and the test suite can post unsigned callbacks.
+# In a deployment it means unauthenticated writes to the guardian tables and
+# outbound SMS and voice at your expense.
+ALLOW_UNSIGNED_TWILIO_WEBHOOKS=
+
 # ---- Google OAuth (Sign-in + Calendar sync) ----
 # Create credentials at https://console.cloud.google.com/apis/credentials
 # Authorised redirect URIs: https://your-project-ref.supabase.co/auth/v1/callback
@@ -306,3 +323,47 @@ APNS_ENVIRONMENT=production
 # Capacitor native shells load this hosted URL (defaults to production). Point at
 # a LAN dev server (e.g. http://192.168.1.20:3000) for on-device development.
 CAP_SERVER_URL=https://www.bubaly.com
+
+# ---- Contact Center: inbound family email ----
+# Shared secret the inbound-parse provider presents when it POSTs a message to
+# /api/contact-center/email. Send it in the `x-inbound-secret` header; a `?key=`
+# query parameter is accepted only for providers that cannot set headers, and a
+# secret in a URL lands in proxy and CDN logs (MAIN-F-E06). Unset, the route
+# refuses every message. Setup and MX routing:
+#   docs/runbooks/family-contact-center-routing.md
+# CONTACT_CENTER_INBOUND_SECRET=
+
+# ---- Feedback board -> GitHub issues (optional) ----
+# Mirrors ideas and bugs to a GitHub repository. A no-op unless BOTH a token and
+# an "owner/repo" resolve. Token: GITHUB_TOKEN, else GITHUB_FEEDBACK_TOKEN.
+# Repository: GITHUB_FEEDBACK_REPO, else GITHUB_REPO. Use a fine-grained token
+# limited to Issues on that one repository.
+# GITHUB_FEEDBACK_TOKEN=
+# GITHUB_FEEDBACK_REPO=owner/repo
+# GITHUB_TOKEN=
+# GITHUB_REPO=owner/repo
+
+# ---- X (Twitter) posting from the social studio (optional) ----
+# OAuth 2.0 client from the X developer portal. Both are required, AND
+# SYNC_TOKEN_KEY must be a 32-byte key (64 hex characters or 44 base64), or the
+# X connection reports "setup required" instead of starting.
+# X_CLIENT_ID=
+# X_CLIENT_SECRET=
+
+# ---- Apple Calendar (iCloud CalDAV) sync — off by default ----
+# The provider stays dark until APPLE_SYNC_ENABLED is exactly "true" (an owner
+# decision). APPLE_CALDAV_BASE_URL overrides the CalDAV host and defaults to
+# https://caldav.icloud.com; only change it to point at a test server.
+# APPLE_SYNC_ENABLED=true
+# APPLE_CALDAV_BASE_URL=https://caldav.icloud.com
+
+# ---- Set by the build or the test harness: do not set these by hand ----
+# BUBALY_BUILD_REVISION is written by next.config.mjs from VERCEL_GIT_COMMIT_SHA
+# and served by /api/build-info. NEXT_PUBLIC_BUILD_ID is an optional label the
+# display error screen shows when no commit SHA is available.
+# AI_PROVIDER_STUB_DIR selects a scripted-AI fixture directory for e2e runs; it
+# is honoured only under tests/, and the stub never runs on a Vercel production
+# deployment (VERCEL_ENV=production).
+# BUBALY_BUILD_REVISION=
+# NEXT_PUBLIC_BUILD_ID=
+# AI_PROVIDER_STUB_DIR=tests/ai-eval/scripts

.eslintrc.json

@@ -2,7 +2,7 @@
   "extends": "next/core-web-vitals",
   "ignorePatterns": ["mobile/**", "supabase/**", "node_modules/**", ".next/**"],
   "rules": {
-    "jsx-a11y/label-has-associated-control": ["warn", { "depth": 3 }],
+    "jsx-a11y/label-has-associated-control": ["error", { "assert": "either", "depth": 4 }],
     "jsx-a11y/click-events-have-key-events": "warn",
     "jsx-a11y/no-static-element-interactions": "warn"
   }

.github/workflows/ci.yml

@@ -144,6 +144,14 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # The web app's audit runs at `moderate` (above). The Expo app had none at
+      # all (MAIN-F-C10). It runs at `high` for now: on 2026-09-27 the lockfile
+      # carried 14 moderate advisories, all transitive through @expo/config and
+      # @expo/config-plugins, whose fix is a breaking Expo upgrade. None high or
+      # critical, so this passes today and stops anything worse arriving.
+      - name: Dependency audit (production dependencies)
+        run: npm audit --omit=dev --audit-level=high
+
       - name: Typecheck
         run: npm run typecheck
 
@@ -234,6 +242,21 @@ jobs:
       - name: ON CONFLICT targets are inferable
         run: node scripts/check-conflict-targets.mjs
 
+      # `plpgsql-bodies-resolve-check.sql` resolves every plpgsql body against
+      # the real catalogue, which needs plpgsql_check. The image does not ship
+      # it, and WITHOUT THIS STEP that probe skips — which is how the class it
+      # catches stayed invisible in the first place. The package is installed
+      # into the running service container; run-probes.sh fails any skip unless
+      # PROBES_ALLOW_SKIP=1 is set, so if this step ever stops working the suite says
+      # so instead of quietly running one probe fewer.
+      - name: Install plpgsql_check into the database container
+        run: |
+          docker exec ${{ job.services.postgres.id }} bash -c '
+            apt-get update -qq
+            apt-get install -y --no-install-recommends postgresql-16-plpgsql-check
+          '
+          psql -Atc "select 1 from pg_available_extensions where name = 'plpgsql_check'" | grep -q 1
+
       # Each probe asserts with RAISE EXCEPTION under ON_ERROR_STOP=1. Covers
       # both directions of the 0118 failure: another family reading your rows,
       # and your own family losing access to them.

app/(app)/admin/actions.ts

@@ -508,8 +508,16 @@ export async function adminDeleteDocumentAction(documentId: string, _storagePath
   if (docError) return actionFailure(docError, t('actions.couldNotLoadThatDocument'));
   if (!doc) return { ok: false, error: t('actions.documentNotFound') };
 
-  const { error: storageError } = await supabase.storage.from('documents').remove([doc.storage_path]);
+  // SEC-015: a refused delete and an absent object are both `error: null,
+  // data: []`, so the returned list is what says the object is gone.
+  const { data: removed, error: storageError } = await supabase.storage.from('documents').remove([doc.storage_path]);
   if (storageError) return actionFailure(storageError, t('actions.couldNotRemoveTheDocument'));
+  if (!removed?.some((object) => object.name === doc.storage_path)) {
+    const listed = await supabase.storage.from('documents').list(doc.storage_path.slice(0, doc.storage_path.lastIndexOf('/')), { search: doc.storage_path.slice(doc.storage_path.lastIndexOf('/') + 1), limit: 100 });
+    if (listed.data?.some((object) => object.name === doc.storage_path.slice(doc.storage_path.lastIndexOf('/') + 1))) {
+      return { ok: false, error: t('actions.couldNotRemoveTheDocument') };
+    }
+  }
 
   const { data: deleted, error } = await supabase
     .from('documents').delete().eq('id', documentId).select('id').maybeSingle();

app/(app)/admin/ai-activity/page.tsx

@@ -98,9 +98,9 @@ export default async function AdminAIActivityPage({ searchParams }: Params) {
       </div>
 
       <div className="grid gap-3 sm:grid-cols-3">
-        <SummaryTile label={`Failed · last ${SUMMARY_WINDOW_HOURS}h`} value={summary.failed} tone={summary.failed > 0 ? 'danger' : 'neutral'} />
-        <SummaryTile label={`In flight · last ${SUMMARY_WINDOW_HOURS}h`} value={summary.inFlight} tone="brand" />
-        <SummaryTile label={`Total · last ${SUMMARY_WINDOW_HOURS}h`} value={summary.total} tone="neutral" />
+        <SummaryTile label={t('adminAiActivity.failedLastHours', { hours: SUMMARY_WINDOW_HOURS })} value={summary.failed} tone={summary.failed > 0 ? 'danger' : 'neutral'} />
+        <SummaryTile label={t('adminAiActivity.inFlightLastHours', { hours: SUMMARY_WINDOW_HOURS })} value={summary.inFlight} tone="brand" />
+        <SummaryTile label={t('adminAiActivity.totalLastHours', { hours: SUMMARY_WINDOW_HOURS })} value={summary.total} tone="neutral" />
       </div>
 
       <SignalPrecisionCard result={precision} retryHref="/admin/ai-activity" allFamilies />