feat(migrations): add migration to drop share links version tables and type

This migration removes the "_share_links_v_version_permissions" and "_share_links_v" tables along with the associated enum type. It also includes a down migration to recreate these structures if needed, ensuring database integrity and allowing for rollback if necessary.

Author: kriss145

AGENTS.md

@@ -8,7 +8,7 @@ Operational guide for AI agents working in this repository.
 
 - Write everything in English: code, comments, variable names, documentation.
 - Check `.ai/specs/` before coding any non-trivial feature.
-- Skills are installed in `.claude/skills/` (Claude Code) and `.agents/skills/` (Codex) — do not edit them directly.
+- Skills are installed in `.claude/skills/` (Claude Code) and `.agents/skills/` (Codex). `.agents/skills/` is the local source of truth — edit a skill **only** there, then run `ags push-skill` to propagate it to the source repo (it also syncs the `.claude/skills/` copy). See Installing skills.
 - Prefer minimal, focused changes. Do not refactor code outside the task scope.
 - Run `yarn build` after every implementation to catch type errors.
 - Comment and naming conventions are defined in the `code-style` skill. Load it before writing or reviewing TypeScript.
@@ -52,6 +52,16 @@ npx skills add <source-path-or-url> -a claude-code -a codex --copy
 
 This installs into `.claude/skills/` (Claude Code) and `.agents/skills/` (Codex). A `skills-lock.json` file tracks the source and version of each installed skill.
 
+### Editing skills
+
+`.agents/skills/` is the local source of truth. Edit a skill **only** there, then push it upstream:
+
+```bash
+ags push-skill   # reads .agents/skills, pushes to the source repo, then syncs .claude/skills
+```
+
+Do not edit `.claude/skills/` by hand — it is a derived copy that `ags push-skill` overwrites from `.agents/skills/`. Likewise do not hand-edit the source repo; let `ags push-skill` write it.
+
 ### Available skills
 
 | Skill | When to load |

next.config.ts

@@ -9,8 +9,23 @@ const withNextIntl = createNextIntlPlugin('./src/i18n/request.ts')
 const __filename = fileURLToPath(import.meta.url)
 const dirname = path.dirname(__filename)
 
+// Sent on every response. CSP is intentionally limited to `frame-ancestors`
+// (clickjacking) — a script/style CSP would break the Payload admin's inline
+// assets and needs per-route nonces before it can be tightened.
+const securityHeaders = [
+  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
+  { key: 'X-Content-Type-Options', value: 'nosniff' },
+  { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
+  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+  { key: 'Content-Security-Policy', value: "frame-ancestors 'self'" },
+]
+
 const nextConfig: NextConfig = {
   // output: 'standalone',
+  async headers() {
+    return [{ source: '/:path*', headers: securityHeaders }]
+  },
   images: {
     localPatterns: [
       {

src/collections/clients/index.ts

@@ -1,5 +1,6 @@
 import type { CollectionConfig } from 'payload'
 import { isAdmin, adminOrSelf, isAdminField } from '../../access'
+import { validatePassword } from '../../lib/validate-password'
 
 export const Clients: CollectionConfig = {
   slug: 'clients',
@@ -24,6 +25,11 @@ export const Clients: CollectionConfig = {
     delete: isAdmin,
     admin: () => false,
   },
+  hooks: {
+    beforeValidate: [validatePassword],
+  },
+  // Audit trail for client account and trainer-note changes.
+  versions: true,
   fields: [
     {
       name: 'name',

src/collections/plans/index.ts

@@ -14,6 +14,8 @@ export const Plans: CollectionConfig = {
     update: isAdmin,
     delete: isAdmin,
   },
+  // Keep an audit trail of every change (no drafts — publish workflow unchanged).
+  versions: true,
   fields: [
     {
       name: 'client',

src/collections/users/index.ts

@@ -1,4 +1,5 @@
 import type { CollectionConfig } from 'payload'
+import { validatePassword } from '../../lib/validate-password'
 
 export const Users: CollectionConfig = {
   slug: 'users',
@@ -14,6 +15,9 @@ export const Users: CollectionConfig = {
       sameSite: 'Lax',
     },
   },
+  hooks: {
+    beforeValidate: [validatePassword],
+  },
   fields: [],
   versions: false,
 }

src/lib/validate-password.ts

@@ -0,0 +1,22 @@
+import type { CollectionBeforeValidateHook } from 'payload'
+import { APIError } from 'payload'
+
+// NIST SP 800-63B: favour length over composition rules. 15+ characters.
+const MIN_PASSWORD_LENGTH = 15
+
+/**
+ * `beforeValidate` hook for auth collections. Enforces a minimum password
+ * length. Payload exposes the plaintext password on `data.password` during
+ * create and password changes; it is absent on ordinary updates, so this is a
+ * no-op then.
+ */
+export const validatePassword: CollectionBeforeValidateHook = async ({ data }) => {
+  const password = (data as { password?: unknown } | undefined)?.password
+  if (typeof password !== 'string' || password.length === 0) return data
+
+  if (password.length < MIN_PASSWORD_LENGTH) {
+    throw new APIError(`Password must be at least ${MIN_PASSWORD_LENGTH} characters long.`, 400)
+  }
+
+  return data
+}