Arnas Donauskas 55da996e52 perf(db,webhook): backend follow-ups from the multi-user review ... PR A of the post-review fix series. Addresses the two must-fix backend findings (flow-media account scoping; webhook contact lookup at scale) plus the two should-fix composite-index additions, all in one migration + two TS files. Migration 020 (`supabase/migrations/020_account_sharing_followups.sql`) - Composite partial index `idx_automations_account_active_trigger` on `automations(account_id, trigger_type) WHERE is_active`. The 006-era partial index was account-blind so the planner had to post-filter by account_id on every webhook dispatch. With 100+ admins in a shared account the post-filter step shows up in query plans; this index answers all three predicates from one lookup. - Same shape for flows: `idx_flows_account_active` on `flows(account_id) WHERE status='active'` — paired to the `findEntryFlow` query in the runner. - `flow-media` storage RLS rewritten to allow uploads / updates / deletes by any member of the account whose folder name matches `account-<account_id>/...`. Legacy `<auth.uid()>/...` paths remain writable by the original uploader so files uploaded pre-020 don't break. Reads stay public (the bucket was already public so Meta can fetch URLs without creds). Webhook contact lookup (`src/app/api/whatsapp/webhook/route.ts`) - The PR-8 conversion swapped `eq('user_id', userId)` for `eq('account_id', accountId)` but kept "pull every row, filter in JS" semantics. That was fine when account = one user but scales linearly with the team size × per-user contact count. - Now pre-filters in SQL by the phone's last-8-digit suffix (mirroring `phonesMatch`'s trunk-prefix tolerance). The trailing-suffix `like` can't use a B-tree index, but the account_id filter on top of `idx_contacts_account` keeps the scan to a small account-scoped subset. Re-applies the strict `phonesMatch` check in JS on the candidate set for correctness — typically 0-2 rows, basically free. Flow-media upload path (`src/components/flows/forms/node-config-form.tsx`) - Resolves the caller's `profile.account_id` before upload and pathes the file under `account-<account_id>/...` to match the new 020 RLS policy. Legacy `<user_id>/...` paths keep working via the back-compat clause in the policy. Verification - `npm run lint` → 0 errors (same 19 pre-existing warnings) - `npm run typecheck` → clean - `npm test` → 366/366 pass - `npm run build` → succeeds Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-31 19:18:58 +03:00
..
route.ts	perf(db,webhook): backend follow-ups from the multi-user review	2026-05-31 19:18:58 +03:00