Optimize/landing

.gitignore

@@ -91,3 +91,6 @@ distapps/bot/.env
 .env
 apps/codebility/public/assets/onboardingvideos/*.mp4
 .planning/
+.cursor/
+docs/agents
+skills-lock.json

CLAUDE.md

@@ -199,4 +199,18 @@ All database migrations are located in `apps/codebility/supabase/migrations/`
 
 **Legacy Migrations:**
 The `migration-scripts/` folder in the root contains deprecated migration tools and scripts.
-Do not add new migrations there. See `migration-scripts/DEPRECATION_NOTICE.md` for details.
+Do not add new migrations there. See `migration-scripts/DEPRECATION_NOTICE.md` for details.
+
+## Agent skills
+
+### Issue tracker
+
+Issues and specs live in GitHub Issues for `CodebilityDev/codebility-plus`. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Five canonical triage roles mapped to GitHub label strings. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context layout: root `CONTEXT.md` and `docs/adr/`. See `docs/agents/domain.md`.

apps/codebility/__tests__/hooks/useLeaderboard.test.ts

@@ -1,5 +1,5 @@
 import { renderHook, waitFor } from "@testing-library/react";
-import { useLeaderboard } from "@/hooks/useLeaderboard";
+import { useLeaderboard } from "@/hooks/leaderboard/useLeaderboard";
 
 // Mock the API calls
 global.fetch = jest.fn();

apps/codebility/app/home/account-settings/action.ts → apps/codebility/actions/account-settings/actions.ts

@@ -2,6 +2,7 @@
 
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { revalidatePath } from "next/cache";
+import { requireUser } from "@/lib/server/auth-guard";
 
 export const updatePassword = async (formData: FormData) => {
     const email = formData.get("email") as string;
@@ -112,7 +113,12 @@ export const getUsernameData = async (userId: string) => {
 };
 
 // Update username
-export const updateUsername = async (userId: string, newUsername: string) => {
+export const updateUsername = async (newUsername: string) => {
+    // Identity from the session. This previously took a `userId` parameter and
+    // wrote to that row unchecked, so any caller could rename another user.
+    const { user } = await requireUser();
+    const userId = user.id;
+
     const supabase = await createClientServerComponent();
 
     // 1. Validate username format

apps/codebility/app/home/admin-controls/appointments/actions.ts → apps/codebility/actions/admin/appointments.ts

@@ -3,7 +3,7 @@
 // Import your actual server utility file relative to the utils folder mapping
 import { createClientServerComponent } from "@/utils/supabase/server"; 
 import { revalidatePath } from "next/cache";
-import { appointmentStatusSchema } from "./types";
+import { appointmentStatusSchema } from "@/app/home/admin-controls/appointments/types";
 
 /**
  * Server Action to securely update the status text field of a client appointment.

apps/codebility/app/home/admin-controls/client-tracker/actions.ts → apps/codebility/actions/admin/client-tracker.ts

@@ -2,7 +2,7 @@
 
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { revalidatePath } from "next/cache";
-import { getCurrentWeekStart } from "./utils";
+import { getCurrentWeekStart } from "@/app/home/admin-controls/client-tracker/utils";
 
 export interface ClientOutreach {
   id: string;
@@ -206,8 +206,7 @@ export async function getAdminOutreachHistory(
 
     let query = supabase
       .from('client_outreach')
-      .select('*')
-      .eq('admin_id', adminId)
+      .select('id, admin_id, client_name, client_email, client_company, job_link, outreach_date, notes, conversation_image, week_start, created_at')
       .order('outreach_date', { ascending: false });
 
     if (weekStart) {

apps/codebility/app/home/admin-controls/ticket-support/actions.ts → apps/codebility/actions/admin/ticket-support.ts

@@ -2,7 +2,8 @@
 
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { revalidatePath } from "next/cache";
-import type { TicketSupport, TicketStatus, TicketPriority } from "./types";
+import { requireRole } from "@/lib/server/auth-guard";
+import type { TicketSupport, TicketStatus, TicketPriority } from "@/app/home/admin-controls/ticket-support/types";
 
 export async function getTickets(): Promise<TicketSupport[]> {
   const supabase = await createClientServerComponent();
@@ -69,6 +70,10 @@ export async function updateTicketStatus(
   ticketId: string,
   status: TicketStatus
 ) {
+  // Ticket administration is gated by the `applicants` permission, matching the
+  // route permission middleware applies to /home/admin-controls.
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   const { data, error, count } = await supabase
@@ -97,6 +102,8 @@ export async function updateTicketPriority(
   ticketId: string,
   priority: TicketPriority
 ) {
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   const { data, error } = await supabase
@@ -125,6 +132,8 @@ export async function updateTicketAssignment(
   ticketId: string,
   assignedToId: string | null
 ) {
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   const { data, error } = await supabase
@@ -150,6 +159,8 @@ export async function updateTicketAssignment(
 }
 
 export async function deleteTicket(ticketId: string) {
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   // First verify the ticket exists
@@ -182,6 +193,8 @@ export async function deleteTicket(ticketId: string) {
 }
 
 export async function archiveTicket(ticketId: string) {
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   const { data, error } = await supabase
@@ -202,6 +215,8 @@ export async function archiveTicket(ticketId: string) {
 }
 
 export async function unarchiveTicket(ticketId: string) {
+  await requireRole("applicants");
+
   const supabase = await createClientServerComponent();
 
   const { data, error } = await supabase

apps/codebility/app/applicant/onboarding/_service/action.ts → apps/codebility/actions/applicant-onboarding/actions.ts

@@ -2,14 +2,42 @@
 
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { revalidatePath } from "next/cache";
+import { requireUser } from "@/lib/server/auth-guard";
+
+/**
+ * Onboarding progress is self-service, so a write is only allowed against the
+ * signed-in user's own `applicant` row.
+ *
+ * These actions used to take `applicantId` and write to it unchecked, so any
+ * caller could mark another applicant's videos complete or overwrite their quiz
+ * and commitment results.
+ */
+async function assertOwnApplicant(
+  supabase: Awaited<ReturnType<typeof createClientServerComponent>>,
+  applicantId: string,
+) {
+  const { user } = await requireUser();
+
+  const { data } = await supabase
+    .from("applicant")
+    .select("codev_id")
+    .eq("id", applicantId)
+    .maybeSingle();
+
+  if (!data || data.codev_id !== user.id) {
+    throw new Error("Forbidden");
+  }
+}
 
 export async function getOnboardingProgress(applicantId: string) {
   try {
     const supabase = await createClientServerComponent();
 
+    await assertOwnApplicant(supabase, applicantId);
+
     const { data, error } = await supabase
       .from("onboarding_videos")
-      .select("*")
+      .select("id, applicant_id, video_number, completed, completed_at")
       .eq("applicant_id", applicantId)
       .order("video_number", { ascending: true });
 
@@ -56,10 +84,12 @@ export async function updateVideoProgress({
   try {
     const supabase = await createClientServerComponent();
 
+    await assertOwnApplicant(supabase, applicantId);
+
     // Check if record exists
     const { data: existingRecord } = await supabase
       .from("onboarding_videos")
-      .select("*")
+      .select("id")
       .eq("applicant_id", applicantId)
       .eq("video_number", videoNumber)
       .single();
@@ -119,6 +149,8 @@ export async function saveQuizProgress({
   try {
     const supabase = await createClientServerComponent();
 
+    await assertOwnApplicant(supabase, applicantId);
+
     const { error } = await supabase
       .from("applicant")
       .update({
@@ -159,6 +191,8 @@ export async function saveQuizAndCommitment({
   try {
     const supabase = await createClientServerComponent();
 
+    await assertOwnApplicant(supabase, applicantId);
+
     const { error } = await supabase
       .from("applicant")
       .update({
@@ -185,6 +219,20 @@ export async function saveQuizAndCommitment({
 
 export async function completeOnboarding(codevId: string, newStatus: string = "waitlist") {
   try {
+    // Self only, and the status is constrained: the parameter used to accept any
+    // string, so a caller could set their own application_status to "passed"
+    // and skip the pipeline.
+    const { user } = await requireUser();
+
+    if (user.id !== codevId) {
+      throw new Error("Forbidden");
+    }
+
+    const ALLOWED_STATUSES = ["onboarding", "waitlist"];
+    if (!ALLOWED_STATUSES.includes(newStatus)) {
+      throw new Error("Forbidden");
+    }
+
     const supabase = await createClientServerComponent();
 
     // Update codev status to waitlist (or specified status)

apps/codebility/app/applicant/waiting/_service/action.ts → apps/codebility/actions/applicant-waiting/actions.ts

@@ -1,9 +1,28 @@
-
 "use server";
 
 
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { revalidatePath } from "next/cache";
+import { requireUser } from "@/lib/server/auth-guard";
+
+/**
+ * Applicant pipeline actions are self-service: an applicant moves their own
+ * record through testing/onboarding/waitlist.
+ *
+ * `codevId` used to be trusted from the caller, so any caller could set another
+ * user's `application_status` (e.g. push themselves or someone else to
+ * "waitlist"). The codev row written is now always the signed-in user; the
+ * caller's `codevId` argument must match it.
+ */
+async function requireSelfCodev(codevId: string): Promise<string> {
+    const { user } = await requireUser();
+
+    if (user.id !== codevId) {
+        throw new Error("Forbidden");
+    }
+
+    return user.id;
+}
 
 
 export async function applicantTakeTest({
@@ -14,6 +33,7 @@ export async function applicantTakeTest({
     codevId: string;
 }) {
     try {
+        const selfCodevId = await requireSelfCodev(codevId);
         const supabase = await createClientServerComponent();
 
         const { data, error } = await supabase
@@ -36,7 +56,7 @@ export async function applicantTakeTest({
                 application_status: "testing",
                 updated_at: new Date(),
             })
-            .eq("id", codevId);
+            .eq("id", selfCodevId);
 
         if (codevError) {
             console.error("Error updating codev test:", codevError);
@@ -49,12 +69,34 @@ export async function applicantTakeTest({
     }
 }
 
+/**
+ * Confirms an `applicant` row belongs to the signed-in user before it is
+ * written. `applicantId` arrives from the client, so without this any caller
+ * could edit another applicant's fork URL or join flags.
+ */
+async function assertOwnApplicant(
+    supabase: Awaited<ReturnType<typeof createClientServerComponent>>,
+    applicantId: string,
+    codevId: string,
+) {
+    const { data } = await supabase
+        .from("applicant")
+        .select("codev_id")
+        .eq("id", applicantId)
+        .maybeSingle();
+
+    if (!data || data.codev_id !== codevId) {
+        throw new Error("Forbidden");
+    }
+}
+
 export async function applicantMoveToOnboard({
     codevId,
 }: {
     codevId: string;
 }) {
     try {
+        const selfCodevId = await requireSelfCodev(codevId);
         const supabase = await createClientServerComponent();
 
         const { data: codevData, error: codevError } = await supabase
@@ -63,7 +105,7 @@ export async function applicantMoveToOnboard({
                 application_status: "onboarding",
                 updated_at: new Date(),
             })
-            .eq("id", codevId);
+            .eq("id", selfCodevId);
 
         if (codevError) {
             console.error("Error updating codev test:", codevError);
@@ -84,8 +126,11 @@ export async function applicantSubmitTest({
     forkUrl: string;
 }) {
     try {
+        const { user } = await requireUser();
         const supabase = await createClientServerComponent();
 
+        await assertOwnApplicant(supabase, applicantId, user.id);
+
         const { data, error } = await supabase
             .from("applicant")
             .update({
@@ -113,8 +158,11 @@ export async function applicantUpdateTestSubmission({
     forkUrl: string;
 }) {
     try {
+        const { user } = await requireUser();
         const supabase = await createClientServerComponent();
 
+        await assertOwnApplicant(supabase, applicantId, user.id);
+
         const { data, error } = await supabase
             .from("applicant")
             .update({
@@ -144,8 +192,11 @@ export async function applicantUpdateJoinedStatus({
     joinedMessenger?: boolean;
 }) {
     try {
+        const { user } = await requireUser();
         const supabase = await createClientServerComponent();
 
+        await assertOwnApplicant(supabase, applicantId, user.id);
+
         const updateData: any = {
             updated_at: new Date(),
         };

apps/codebility/app/home/applicants/_service/action.ts → apps/codebility/actions/applicants/applicant.ts

@@ -2,7 +2,7 @@
 
 
 import { revalidatePath } from "next/cache";
-import { NewApplicantType } from "./types";
+import { NewApplicantType } from "@/types/applicants";
 import { createAdminClient } from "@/utils/supabase/admin";
 import { createClientServerComponent } from "@/utils/supabase/server";
 import { invalidateCache } from "@/lib/server/redis-cache";