fix production issues

apps/api/src/modules/admin/admin.presenter.test.ts

@@ -9,13 +9,26 @@ describe('admin.presenter', () => {
       role: 'SUPER_ADMIN',
       passwordHash: 'hash',
       totpSecret: 'secret',
+      passwordResetToken: 'reset-token',
+      passwordResetExpiresAt: new Date('2026-01-01T00:00:00.000Z'),
+      emailVerificationToken: 'verify-token',
     })
 
     expect(result).toEqual({ id: 'admin_1', email: 'admin@example.com', role: 'SUPER_ADMIN' })
   })
 
   it('wraps sessions without leaking credentials', () => {
-    expect(presentAdminSession({ id: 'admin_1', passwordHash: 'hash', totpSecret: 'secret' }, 'jwt-token')).toEqual({
+    expect(
+      presentAdminSession(
+        {
+          id: 'admin_1',
+          passwordHash: 'hash',
+          totpSecret: 'secret',
+          passwordResetToken: 'reset-token',
+        },
+        'jwt-token',
+      ),
+    ).toEqual({
       token: 'jwt-token',
       admin: { id: 'admin_1' },
     })

apps/api/src/modules/admin/admin.presenter.ts

@@ -1,5 +1,16 @@
+const ADMIN_SECRET_FIELDS = [
+  'passwordHash',
+  'totpSecret',
+  'passwordResetToken',
+  'passwordResetExpiresAt',
+  'emailVerificationToken',
+] as const
+
 export function presentAdminUser<T extends Record<string, any>>(admin: T) {
-  const { passwordHash, totpSecret, ...safe } = admin
+  const safe = { ...admin }
+  for (const field of ADMIN_SECRET_FIELDS) {
+    delete (safe as Record<string, unknown>)[field]
+  }
   return safe
 }
 

apps/api/src/modules/admin/admin.repo.edge.test.ts

@@ -63,10 +63,7 @@ describe('admin.repo edge queries', () => {
 
     expect(prisma.adminUser.findFirst).toHaveBeenCalledWith({
       where: {
-        OR: [
-          { passwordResetToken: hashPublicAccessToken('reset-token') },
-          { passwordResetToken: 'reset-token' },
-        ],
+        passwordResetToken: hashPublicAccessToken('reset-token'),
         passwordResetExpiresAt: { gt: new Date('2026-06-01T00:00:00.000Z') },
       },
     })

apps/api/src/modules/admin/admin.repo.ts

@@ -92,7 +92,7 @@ export function findAdminByResetToken(token: string) {
   const tokenHash = hashPublicAccessToken(token)
   return prisma.adminUser.findFirst({
     where: {
-      OR: [{ passwordResetToken: tokenHash }, { passwordResetToken: token }],
+      passwordResetToken: tokenHash,
       passwordResetExpiresAt: { gt: new Date() },
     },
   })
@@ -163,6 +163,13 @@ export async function applyCompanyUpdate(
   return prisma.$transaction(async (tx: any) => {
     if (body.company) {
       const companyData = { ...body.company }
+      if (typeof companyData.slug === 'string') {
+        companyData.slug = companyData.slug
+          .toLowerCase()
+          .replace(/[^a-z0-9]+/g, '-')
+          .replace(/^-+|-+$/g, '')
+          .slice(0, 50) || 'company'
+      }
       if (companyData.address && typeof companyData.address === 'object' && !Array.isArray(companyData.address)) {
         const baseAddress = current.address && typeof current.address === 'object' && !Array.isArray(current.address)
           ? current.address as Record<string, unknown>

apps/api/src/modules/admin/admin.schemas.ts

@@ -122,7 +122,13 @@ const nullableDate   = z.union([z.string().datetime(), z.string().regex(/^\d{4}-
 
 export const adminCompanyUpdateSchema = z.object({
   company: z.object({
-    name: z.string().min(1).optional(), slug: z.string().min(1).optional(),
+    name: z.string().min(1).optional(),
+    slug: z
+      .string()
+      .min(1)
+      .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, 'Slug must be lowercase alphanumeric with optional hyphens')
+      .max(50)
+      .optional(),
     email: z.string().email().optional(), phone: nullableString,
     status: z.enum(['PENDING', 'TRIALING', 'ACTIVE', 'PAST_DUE', 'SUSPENDED', 'CANCELLED']).optional(),
     subscriptionPaymentRef: nullableString,