Software Updates

Add employee invitation UI to dashboard

• Create InviteEmployeeModal component for dashboard
• Add /api/employees/invite endpoint to generate magic links
• Integrate invite button in Employees tab on /dashboard/employees
• Support single employee invitations with email, name, and role
• Display magic link for manual sharing if needed
• Copy to clipboard functionality for magic links

Add invitation quick start reference

Add employee invitation system with magic links

• Create invite-employee.ts script for instant employee onboarding
• Support single employee or batch invitations via JSON
• Generate secure magic links with 24-hour expiration
• Integrate with Magic Link email template
• Add comprehensive invitation system documentation
• Add EMAIL_TEMPLATES_GUIDE.md summarizing all 6 email templates

Upload logo to Supabase storage and update email templates

• Uploaded logo.png to Supabase 'logos' bucket
• Updated email template to use Supabase storage URL
• Added upload-logo.ts script for future logo updates
• Created LOGO_STORAGE.md documentation
• Email now serves logo from: https://figbtluokmdvavqgookg.supabase.co/storage/v1/object/public/logos/logo.png
• Added shell script for quick uploads (upload-logo-to-supabase.sh)

Update email template to match site branding

• Changed header to white background with actual logo.png image
• Replaced blue gradient with Maverick's flame orange (#ea580c)
• Updated all link colors to use brand flame color
• Matches site's fire + ice theme (flame-600 primary)
• Logo hosted at https://www.maverickheatingandair.com/logo.png
• Updated both HTML template and TypeScript version
• Correct contact info: (770) 579-9172 and maverickmechanical.hvac@gmail.com

Apply security hardening migrations to production database

• Fixed auth schema permissions (moved functions to public schema)
• Added table existence checks for non-existent tables
• Fixed SQL syntax errors and format() argument counts
• Added DROP POLICY IF EXISTS for idempotent migrations
• Successfully applied security_remediation and security_hardening migrations
• Deferred ServiceTitan RLS migration until tables are created
• All migrations now in sync with remote database

Security hardening: RLS for ServiceTitan tables, middleware API protection, input validation

• Add RLS policies for all ServiceTitan tables (20260103220000_servicetitan_rls.sql)
• customers, properties, assets, jobs_v2, job_tasks, job_notes
• dispatch_events, estimates_v2, estimate_options, estimate_items
• invoices_v2, invoice_items, payments_v2, maintenance_plans
• subscriptions, forms, form_responses, pricebook_items
• inventory_items, inventory_movements, communications
• Portal customers can only see their own records
• Role-based CRUD permissions (employee/manager/admin)
• Enhanced middleware.ts
• Protect /api/chat, /api/jobs, /api/contacts, /api/invoices, /api/time, /api/google
• Return JSON errors for API routes (401/403) instead of redirects
• Rate limiting on public portal endpoints
• Add user role to response headers
• Add input validation (src/lib/validation.ts)
• Zod schemas for portal login/register, chat messages, service requests
• Job creation/update schemas, pricebook items, time tracking
• Phone number normalization to E.164 format
• Add validateBody() helper to api-auth.ts
• Update security documentation
• RLS_AUTH_MATRIX.md with ServiceTitan table permissions
• API_SECURITY_CHECKLIST.md with middleware protection summary
• Fix Header.tsx aria-expanded accessibility issue

add implementation summary and next steps

security hardening, SEO optimization, and UX improvements

• Lock down RLS policies with role-scoped access control
• Created migration 20260103210000_security_hardening.sql
• RBAC helper functions: is_admin(), is_manager(), is_employee()
• Replace overly permissive 'FOR ALL TO authenticated' policies
• Portal customer isolation (read-only access to own data)
• Service role bypass for API routes
• Created lib/api-auth.ts with standardized utilities
• Rate limiting (configurable per endpoint)
• Standardized error/success response formats
• withAuth() wrapper for protected routes
• Input validation and sanitization helpers
• Structured API logging
• Created lib/rbac.ts with role-based access control
• Role hierarchy: employee → team_lead → admin → developer → owner
• Auth context functions for client & server
• Permission checking by module (dashboard, portal, etc.)
• Authorization error handling
• Created lib/portal-auth.tsx with enhanced session management
• usePortalAuth() hook with automatic session refresh
• Session expiry detection and redirect on timeout
• PortalGuard wrapper component
• PortalProvider context for portal pages
• Fallback to legacy table names (backwards compatible)
• Created app/sitemap.ts with dynamic sitemap generation
• Created app/robots.ts with proper crawl directives
• Added NEXT_PUBLIC_SITE_URL config
• GA4 tracking with pageview hook
• Created components/DataStates.tsx with reusable patterns
• Skeleton loaders: SkeletonCard, SkeletonTable, SkeletonList, SkeletonStats
• Empty states: EmptyJobs, EmptyInvoices, EmptyContacts, etc.
• Error states with retry functionality
• DataState wrapper for loading/error/empty patterns
• Created components/GoogleAnalytics.tsx
• Automatic pageview tracking on route changes
• Excludes development environment
• Environment-gated to production only
• Created docs/RLS_AUTH_MATRIX.md
• Complete role/table permission matrix
• API route authorization requirements
• Portal customer access restrictions
• Created docs/API_SECURITY_CHECKLIST.md
• Pre-deployment security gate checklist
• Input validation requirements
• Environment variable security guidelines
• External API key best practices
• src/app/layout.tsx: Added GoogleAnalytics component
• src/lib/config.ts: Added url property
• src/components/index.ts: Export new components
• NEXT_PUBLIC_GA_MEASUREMENT_ID=G-1TXWVKZX8E
• NEXT_PUBLIC_SITE_URL=https://maverickmechanical.us

Update Trustpilot logo to excellent badge with improved sizing

Fix Next.js build error: wrap useSearchParams in Suspense boundary

• Wrap ResetPasswordForm component in Suspense boundary
• Add loading fallback for better UX during page load
• Fixes prerendering error on /portal/reset-password

Fix remaining high-priority security and UX issues

• Fix aria-expanded attribute in Header mobile menu button (must be string not boolean)
• Fix chat dashboard currentUserId - now loads from authenticated employee profile
• Add admin authorization check to Square invoice sending endpoint
• Chat dashboard now properly identifies the sending employee
• Square invoices can only be sent by admin users (owner/developer/team_lead)

Major security remediation and footer update

• Add comprehensive RLS policies to prevent unauthorized data access
• Remove overly permissive 'FOR ALL TO authenticated' policies
• Add role-based access control (employees, admins, portal customers)
• Add authentication to all chat API endpoints
• Add admin authentication to /api/jobs/sync endpoint
• Create helper functions: is_employee(), is_admin_user(), is_portal_customer()
• Add verifyEmployeeAuth() and verifyAdminAuth() utilities
• Secure chat conversations, messages, and summary endpoints
• Ensure portal customers can only access their own data
• Add comprehensive SECURITY_REMEDIATION_ROADMAP.md
• Document all security fixes and remaining work
• Include P1 feature parity roadmap
• Add Trustpilot logo to footer with link to reviews page
• Fix footer accessibility (add title attribute)

Fix form accessibility bugs and remove time tracking from sidebar

• Add htmlFor and id attributes to all form inputs and labels for proper accessibility
• Fix textarea closing tag syntax in customer form
• Remove 'Time Tracking' and 'Time Approvals' sidebar buttons (now under Employees section)

implement customer portal with registration, login, and dashboard

• Add customer_portal_accounts table with RLS policies for customer data access
• Create registration flow that links existing customers or creates new leads
• Implement customer login with email/password and password reset
• Build customer dashboard with job history, upcoming appointments, estimates, invoices, and maintenance plans
• Update Header to show 'Customer Login' CTA instead of 'Call Now'
• Add portal pages: login, dashboard, password reset
• Create API routes for check-email, register-or-link, login, and forgot-password
• Add RLS policies allowing customers to view only their own data
• Include Supabase migration (20260103120000_customer_portal.sql) with helper functions

schedule page month calendar, employees page tabs, SQL migrations, and schema documentation

Add Google Calendar quick setup guide

Add Google Calendar sync and Twilio chat system

• Per-employee Google Calendar integration with OAuth
• One-way sync: Jobs → Google Calendar with change detection
• Twilio SMS/web chat with AI-powered conversation summaries
• Chat widget for customer website integration
• Agent chat dashboard with real-time updates
• OAuth flow with token auto-refresh
• Dedicated calendar creation per employee
• Smart sync with configurable time windows
• Event colors by job status
• Handles reassignments and cancellations
• Comprehensive audit logging
• Twilio SMS integration with webhooks
• OpenAI GPT-4 conversation summaries
• Customer matching by phone/email
• Real-time message delivery via Supabase Realtime
• Rate limiting and security validation
• google_calendar_connections, google_event_mappings tables
• chat_conversations, chat_messages, chat_participants tables
• RLS policies for security
• Helper functions for efficient queries

Add comprehensive changelog for January 2026 session

Add comprehensive development summary

Update dashboard logo to match home page header logo

Hide header on dashboard/login and standardize logo styling

• Hide main header on /dashboard and /login routes
• Remove link wrapper from login page logo
• Remove brightness-0 invert from footer logo for consistent coloring
• Dashboard sidebar logo already uses proper styling

Implement server-side auth login and resolve RLS infinite recursion

• Add API route for server-side authentication with cookie storage
• Update login page to use API route and set client session
• Fix RLS policies to use JWT metadata instead of table queries
• Configure Supabase client with PKCE flow for better security

Separate admin Supabase client to prevent service role key in browser

Employee login system with developer and owner accounts

Lazy Supabase client initialization for Vercel build

add employee login, time tracking, and contact sync

• Add employee authentication with Supabase
• Implement time tracking with clock in/out and approval workflow
• Add unified contact consolidation from Jobber and Airtable
• Create dashboard with role-based access control
• Add employee profiles with role-based permissions
• Implement contact sync service with phone/email matching
• Extend Jobber client with listClients and appointments
• Create Airtable client for contact fetching
• Add comprehensive RLS policies for security
• Seed script: admin user (rosserembrasil@gmail.com / 123456789)
• Overview page with stats and quick actions
• Time tracking with real-time clock in/out
• Time entry approvals for managers
• Unified contact directory with source badges
• Jobber/Airtable sync with history log
• Employee management for admins
• Protected dashboard routes with middleware
• Role-based access (owner, developer, team_lead, employee)
• Supabase RLS for row-level security
• Service role key support for backend operations

Replace 'tune-ups' with 'seasonal maintenance' on home page

Update branding: new logo, favicon, and slogan 'Where Comfort Begins with Integrity'

Update Tailwind config and global styles

Fix Tailwind CSS configuration for Vercel deployment

• Replace @theme directive with standard tailwind.config.ts
• Convert @import to @tailwind directives for better compatibility
• Add proper Tailwind config with custom flame and ice colors
• This fixes 404 errors on Vercel by ensuring CSS builds correctly

Initial commit: Complete Maverick Mechanical website implementation

• Contact info: Phone (770)579-9172, Email maverickmechanical.hvac@gmail.com
• Removed address, hours, and counties from all pages
• Service area: 14 cities in North Atlanta region
• About page: Complete team roster with experience levels
• Request Service: Call-only approach (no online form)
• Removed 'Safety first' gas leak warning
• Updated company experience to 30+ years
• Footer reorganized with Contact Us on far right
• Added actual logo to Header, Footer, and Home page
• All bugs fixed and build passes with no errors

Initial commit from Create Next App