Close the security and privacy gaps from the app review (batch 2)

[EmotiveImpact]

Before: signing out in one tab left other tabs acting as the old account, and a sign-out the server refused cleared nothing. A session rejected at start-up looked like an outage with no way to sign out, and there was no way to change a password or sign out other devices. Anyone who joined a commune later could read former members' email addresses. One member could fill another's notices by reporting and withdrawing a payment thousands of times. Invitation emails led with a commune name anyone could choose and never said who sent them, so a commune called "Bank: card locked, call 020 7946 0000" produced exactly that subject from Commune's address. The design prototypes, with local file paths and a home network address, were served on the app's domain, and missing files came back as the app page.

After: each of those is closed, with a test that fails on the old code. Sign-out clears every tab whatever the server says, and each tab refuses to act for an account other than the one it shows. Settings has Change password and Sign out everywhere else. Invitation emails name the inviter, quote the commune, refuse names carrying contact details, and stop at addresses that bounced or complained.

This is batch 2 of the app review fixes and is built on #24 (batch 1), so review that first; the diff here shows only this batch.

What changed, by finding

Finding	Change
22, 43, 44	Each tab remembers the account it shows and names it on every request, and the hosted client and the local API refuse to act for anyone else, for reads and writes alike. A tab whose account signed out or changed elsewhere clears itself and says whether its last change was saved, and a sign-in, including the return from Google, reaches the other tabs once. Sign-out clears the tab, its stored settings and the other tabs first; if the server does not confirm it, the sign-in page says so and offers a retry. A session refused at start-up counts as signed out, and the connection screen has Sign out. Storage calls no longer throw when the store is full.
23	Settings gains Change password and Sign out everywhere else. Both keep this device signed in and end the account's other sessions; a device that already has Commune open keeps working until its access token expires (up to 15 minutes on Neon), and the wording says so. A wrong current password meets the sign-in limit. The reset page takes its token out of the address bar and keeps it for this tab until the reset works. The Neon console part of this finding is yours (below).
24	Subject "{Inviter} invited you to join “{Commune}” on Commune", a report link that names the invitation by id, 500 invitation emails a day overall and 5 a day from accounts under a day old. Migration 0033 refuses new names and renames with links, email addresses or phone numbers: 9 or more digits joined by any spaces, punctuation or symbols, so "020/7946/0000" is caught, while commas, semicolons and ampersands still part two numbers, so "Ski trip 2025/2026" and "Rooms 10 & 11, 2025/26" are fine. The worker applies the same rule before emailing and refuses an invitation whose commune or inviter name breaks it, which covers names from before 0033. A signed Resend webhook records bounces and complaints; invitations to those addresses are refused and reminders skip them like an opt-out.
25	Migration 0031 keeps a former member's name and leaves out their email, in the snapshot and in the invitation list. An accepted invitation shows its address only while the person who accepted it is still a member; Members names it from the new accepted_by or says "Former member".
26	Migration 0032 updates an unread notice in place when the same person repeats the same change, for expenses, payment reports and pledges alike, sends the latest 100 notices (unread first), and allows ten payment reports per share a day.
36	The prototypes moved to apps/web/reference, which the dev server still serves and builds leave out. A test keeps public/ to the app's own files.
57	Missing files under /assets/ return not found, and fingerprinted files are cached for a year.
66	Migration 0034: pgcrypto and pg_trgm functions are closed to clients, and a warning says so if the role applying it does not own them (see Releasing); another admin confirms contributions to an admin's own pledge (Funds says so); activity keeps up to 50 voids and corrections from the last 90 days however busy the commune is, with receipt reversals in a reserve of their own so they cannot push a void out; the worker trims email bodies and invitation email rows after 30 days and answers a dispatch the same way whether or not an email went. grants.sql checks every function's search path and grants. The auth SDK's stored copy of the session is removed after each request, and the Neon Auth console settings Commune expects are in docs/AUTH-SETTINGS.md.

Releasing

Nothing hosted was touched. Migrations 0031 to 0034 are local only and follow 0030. When releasing, apply them in order, refresh the Data API schema cache, deploy the client, then deploy the reminder worker with RESEND_WEBHOOK_SECRET set and the webhook added in Resend, as infra/neon/README.md describes. An older open tab still offers Record contribution on an admin's own pledge and shows the refusal until it reloads.

If applying 0034 prints "Clients can still run these extension functions in public", the role applying it does not own them, which happens when a role that is not a superuser installed the extensions. The rest of 0034 still applies, but only the functions' owner can close them, so the release notes ask Neon support to run the revokes and then tests/grants.sql again. Until then a PostgREST-style Data API can call eight of them, none of which reads Commune's data.

Needs the owner

• Check the Neon Auth settings in docs/AUTH-SETTINGS.md on production, including ending other sessions after a password reset (finding 23), the 15-minute token lifetime and any session cookie cache, and run its two-browser check on a preview branch.
• Decide how long notices, activity and old invitations are kept (finding 42). Only email bodies and delivery rows are trimmed so far.
• If 0034 prints the extension warning when you release it, ask Neon support for the revokes the release notes list.
• A reminder dispatch still takes slightly longer when an email is sent than when it is skipped, so timing could hint at an opt-out. Closing that fully means sending from a queue; say if you want it.

How it was checked

On the final branch:

• 20 SQL test files on fresh databases, plus the lock order test.
• 15 local API suites on a disposable database and port, including a new one for changing a password and signing out other sessions.
• 382 web tests in 36 files, including the hosted client's mapping of the new auth calls against the real SDK and two tabs signing in and out.
• The reminder worker's unit tests and 4 database suites (integration, invitations, webhooks, monthly limits), with no real email sent.
• Typechecks for the web app, local API and worker, and a production build.

In a browser: an admin's own pledge with and without a second admin, a rename carrying a phone number refused and a year range accepted, and signing out in one tab clearing another.

How

Each database change is a SECURITY DEFINER function or a patch made with pg_get_functiondef and replace(), which stops if the patch no longer matches. Every migration starts with BEGIN; and has one COMMIT;. The webhook verifies Resend's Svix signature with a five-minute tolerance and a 256 KB limit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01A6P7aTcMBccooYYr4xYnVS

---

Generated by Claude Code

[EmotiveImpact]

The Vercel preview for commune-web shows Error here, as it has on every branch since 6 October. It is the project or account issue explained on #24 (app review finding 45), not this diff: the production build of this branch passes locally (vite build on 999154f). It needs someone with the Vercel login to read a failed deployment's log.

---

Generated by Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T02:01:22.361679Z	999154f	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.