Repair JackerBox security, rentals and Stripe flow

.env.example

@@ -1,72 +1,43 @@
-# Environment variables declared in this file are automatically made available to Prisma.
-# See the documentation for more detail: https://pris.ly/d/prisma-schema#accessing-environment-variables-from-the-schema
-
-# Prisma supports the native connection string format for PostgreSQL, MySQL, SQLite, SQL Server, MongoDB and CockroachDB.
-# See the documentation for all the connection string options: https://pris.ly/d/connection-strings
-
-# Database configuration
-# For local development, use direct connection
-DATABASE_URL="postgresql://username:password@host:port/database?sslmode=require"
-DIRECT_DATABASE_URL="postgresql://username:password@host:port/database?sslmode=require"
-# For local development, you can keep the SQLite connection as a fallback
-# DATABASE_URL="file:./dev.db"
-
-# NextAuth.js
+# JackerBox local configuration TEMPLATE. No real credentials belong in Git.
+# Add real values only to your local .env (ignored) or to your hosting provider's secrets.
+DATABASE_URL=
+DIRECT_DATABASE_URL=
+# Non-secret safety guard for the read-only preview verification script
+JACKERBOX_SUPABASE_PROJECT_REF=
 NEXTAUTH_URL=http://localhost:3000
-NEXTAUTH_SECRET=your-nextauth-secret
-
-# OAuth Providers (add your own credentials when setting up)
-GOOGLE_CLIENT_ID="your-google-client-id"
-GOOGLE_CLIENT_SECRET="your-google-client-secret"
-APPLE_CLIENT_ID=""
-APPLE_CLIENT_SECRET=""
-
-# Stripe (Payment Processing)
-# Using test keys for development
-STRIPE_SECRET_KEY=your-stripe-secret-key
-STRIPE_PUBLISHABLE_KEY=your-stripe-publishable-key
-NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=your-stripe-publishable-key
-
-STRIPE_WEBHOOK_SECRET=your-stripe-webhook-secret
-STRIPE_IDENTITY_WEBHOOK_SECRET=your-stripe-identity-webhook-secret
-STRIPE_ACCOUNT_COUNTRY=US
-
-# Cloudinary (Image Upload)
-NEXT_PUBLIC_CLOUDINARY_CLOUD_NAME="your-cloudinary-cloud-name"
-CLOUDINARY_API_KEY="your-cloudinary-api-key"
-CLOUDINARY_API_SECRET="your-cloudinary-api-secret"
-CLOUDINARY_URL="cloudinary://your-api-key:your-api-secret@your-cloud-name"
-
-# AWS (for S3 and Rekognition)
-AWS_REGION="your-aws-region"
-AWS_ACCESS_KEY_ID="your-aws-access-key-id"
-AWS_SECRET_ACCESS_KEY="your-aws-secret-access-key"
-AWS_S3_BUCKET_NAME="your-s3-bucket-name"
-
-# Twilio (SMS Verification)
-TWILIO_ACCOUNT_SID=""
-TWILIO_AUTH_TOKEN=""
-TWILIO_PHONE_NUMBER=""
-
-# Email (optional)
-EMAIL_FROM=noreply@example.com
-EMAIL_SERVER=smtp://username:password@smtp.example.com:587
-
-# Firebase (for phone verification)
-NEXT_PUBLIC_FIREBASE_API_KEY="your-firebase-api-key"
-NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN="your-firebase-auth-domain"
-NEXT_PUBLIC_FIREBASE_PROJECT_ID="your-firebase-project-id"
-NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET="your-firebase-storage-bucket"
-NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID="your-firebase-messaging-sender-id"
-NEXT_PUBLIC_FIREBASE_APP_ID="your-firebase-app-id"
-
-APPLE_TEAM_ID=2PF2FNX9X6
-APPLE_CLIENT_ID=com.jackerbox
-APPLE_KEY_ID=HX8H87KYWG
-APPLE_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----
-MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgjlLbtFOdb20cmqfL
-ESK0IB01iRrNDEZnY2meztsOENugCgYIKoZIzj0DAQehRANCAAQWADQcTbwAEUEi
-9u3THkeByaDPIGVq7Nvi9oA1KY9dbn/p64K1R+fdD6CaM5J6m9fJpUQ3zoYKGHYp
-c7mRl5ps
------END PRIVATE KEY-----
-# Add other environment variables as needed 
+NEXTAUTH_SECRET=
+# Required for distributed signup rate limiting (set as Netlify secrets)
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+APPLE_CLIENT_ID=
+APPLE_CLIENT_SECRET=
+STRIPE_SECRET_KEY=
+STRIPE_PUBLISHABLE_KEY=
+NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_IDENTITY_WEBHOOK_SECRET=
+STRIPE_ACCOUNT_COUNTRY=
+NEXT_PUBLIC_CLOUDINARY_CLOUD_NAME=
+CLOUDINARY_API_KEY=
+CLOUDINARY_API_SECRET=
+CLOUDINARY_URL=
+AWS_REGION=
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_S3_BUCKET_NAME=
+TWILIO_ACCOUNT_SID=
+TWILIO_AUTH_TOKEN=
+TWILIO_PHONE_NUMBER=
+EMAIL_FROM=
+EMAIL_SERVER=
+NEXT_PUBLIC_FIREBASE_API_KEY=
+NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
+NEXT_PUBLIC_FIREBASE_PROJECT_ID=
+NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
+NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
+NEXT_PUBLIC_FIREBASE_APP_ID=
+APPLE_TEAM_ID=
+APPLE_KEY_ID=
+APPLE_PRIVATE_KEY=

.github/workflows/jackerbox-repair.yml

@@ -0,0 +1,96 @@
+name: JackerBox repair checks
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  security-and-unit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+      - name: Generate Prisma client
+        run: npx prisma generate
+      - name: Verify security repair regression tests
+        run: npx jest tests/unit/security-guardrails.test.ts tests/unit/rental-pricing.test.ts tests/unit/test-verification-guard.test.ts tests/unit/uuid-compatibility.test.ts tests/unit/migration-history.test.ts tests/unit/stripe-workflow.test.ts tests/unit/staging-preview.test.ts --runInBand
+      - name: Verify non-production staging isolation guard
+        run: node --test tests/unit/staging-env-guard.test.mjs
+      - name: TypeScript diagnostics (release gate)
+        run: npx tsc --noEmit
+      - name: Production Webpack build (release gate)
+        run: npm run build
+        env:
+          NEXT_TELEMETRY_DISABLED: '1'
+      - name: Dependency audit with zero-vulnerability threshold
+        if: always()
+        run: npm audit --omit=dev --audit-level=moderate
+
+  migrate-fresh-postgres:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_USER: jackerbox
+          POSTGRES_PASSWORD: isolated_test_password
+          POSTGRES_DB: jackerbox_migrations
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U jackerbox -d jackerbox_migrations"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 12
+    env:
+      DATABASE_URL: postgresql://jackerbox:isolated_test_password@localhost:5432/jackerbox_migrations?schema=public
+      DIRECT_DATABASE_URL: postgresql://jackerbox:isolated_test_password@localhost:5432/jackerbox_migrations?schema=public
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - name: Reproducible dependency install
+        run: npm ci --legacy-peer-deps
+      - name: Validate schema formatting and generate client
+        run: |
+          npx prisma validate
+          npx prisma generate
+      - name: Apply historical migrations and seed legacy financial/message records
+        run: |
+          mv prisma/migrations/20261010130000_reconcile_legacy_schema /tmp/jackerbox_reconcile_migration
+          npx prisma migrate deploy
+          psql "postgresql://jackerbox:isolated_test_password@localhost:5432/jackerbox_migrations" -v ON_ERROR_STOP=1 -f tests/fixtures/legacy-schema-before.sql
+          mv /tmp/jackerbox_reconcile_migration prisma/migrations/20261010130000_reconcile_legacy_schema
+      - name: Apply safe reconciliation migration and verify surviving data
+        run: |
+          npx prisma migrate deploy
+          psql "postgresql://jackerbox:isolated_test_password@localhost:5432/jackerbox_migrations" -v ON_ERROR_STOP=1 -f tests/fixtures/legacy-schema-after.sql
+      - name: Verify migration status
+        run: npx prisma migrate status
+      - name: Verify migrations can be reapplied idempotently
+        run: npx prisma migrate deploy
+      - name: Review SQL needed to reconcile model drift (do not execute)
+        run: npx prisma migrate diff --from-url "$DIRECT_DATABASE_URL" --to-schema-datamodel prisma/schema.prisma --script
+      - name: Validate intentional legacy-data retention only
+        run: |
+          npx prisma migrate diff --from-url "$DIRECT_DATABASE_URL" --to-schema-datamodel prisma/schema.prisma --script > /tmp/jackerbox-schema-drift.sql
+          node scripts/validate-legacy-schema-drift.mjs /tmp/jackerbox-schema-drift.sql
+      - name: Verify retention allowlist rejects unexpected schema changes
+        run: node --test tests/unit/legacy-schema-drift.test.mjs
+      - name: Production type checks
+        run: npx tsc --noEmit

REPAIR-VERIFICATION.md

@@ -0,0 +1,23 @@
+# JackerBox Repair Verification
+
+This branch is **not** a production release. It removes exposed configuration from the latest tree, closes unauthenticated debug and test routes, secures checkout and changes the rental state machine.
+
+## Release prerequisites
+
+1. **Rotate exposed credentials immediately**: all database URLs/passwords, NextAuth secret, Redis/Upstash, Stripe, AWS, Google OAuth, Apple, Resend and Cloudinary values discovered in historical env files. Removing files from Git does not revoke the credentials. Review Git history and provider audit logs separately.
+2. Review Netlify environment variable names and update values in Netlify. No tokens should be pasted into GitHub issues, PRs or chat.
+3. Next.js is upgraded to 15.5.27 and React to 19.0.6. The manifest and lockfile were regenerated together. Confirm `npm ci` succeeds before releasing.
+4. Run `npm ci --legacy-peer-deps`, `npm run test:unit -- --runInBand`, `npx tsc --noEmit`, and a full Next.js build in a test environment with dummy/non-production keys. Existing type and ESLint errors are **not** considered resolved by this security patch.
+5. Exercise the end-to-end renter/owner Stripe **test-mode** flow: create equipment -> book -> pay -> webhook -> PAID -> ACTIVE -> COMPLETED -> admin payout -> admin deposit refund. Test overlaps, abandoned pending holds, duplicate Stripe webhooks and payout retries.
+6. Publish only after successful checks and owner approval. Confirm `jackerbox.app` serves Next.js routes, not the former static placeholder.
+
+## Known limitations requiring follow-up
+
+- Old database records may use obsolete rental/payment states and need reconciliation before release.
+- Payout and deposit refund services now call Stripe with stable idempotency keys but are not validated against a connected Stripe test account.
+- Historical Git commits still contain secrets; rotation is required even after source cleanup.
+- Booking availability supports blackout dates and rental overlaps, but recurring availability schedules and calendar sync still need integrated test coverage.
+- Identity verification should be finalized using signed Stripe Identity webhooks and human review where appropriate.
+- An old client may still be looking for obsolete payment routes; run real browser checks on mobile and desktop.
+
+No production deployment or database migration is included in this repair branch.