Arnas Donauskas 4afa9bea32 fix(automations): scope meta-send contact lookup by user_id ... The engine runs with the service-role client (bypassing RLS) and the public POST /api/automations/engine endpoint accepts contact_id from the request body. Without a user_id filter on the contacts lookup, an authenticated user could fire their own automations against another tenant's contact UUID and send via their own WhatsApp config to that contact's phone. UUIDs are unguessable so practical risk is low, but this is cheap defense-in-depth. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-04-17 21:39:33 +03:00
..
app	fix(dashboard): open the clicked conversation when deep-linking from dashboard	2026-04-17 21:11:05 +03:00
components	Merge pull request #36 from ArnasDon/fix/inbox-unread-indicator	2026-04-17 21:23:22 +03:00
hooks	fix(inbox): reliable unread reset + sidebar green-dot indicator	2026-04-17 21:17:28 +03:00
lib	fix(automations): scope meta-send contact lookup by user_id	2026-04-17 21:39:33 +03:00
types	feat(automations): add 'First Message from Contact' trigger	2026-04-17 20:47:13 +03:00
middleware.ts	Initial scaffold: WhatsApp CRM with Next.js + Supabase	2026-04-16 18:17:31 +03:00