Prior session delivered a read-only money-path audit of Virtual Restyle (live, virtualrestyle.com, Stripe LIVE, Supabase uyloerfniphfxjvnuwmn) with 5 ranked findings and NO fixes. This session Sondra said "fix everything now" and (after I flagged the watermark as a bigger/riskier change) confirmed "nobody is using this app yet, go fix everything" + "commit the changes to git." All 5 fixed, verified live, committed + pushed.
20260710120000_audit_fixes_lock_infra_rpcs_clawback_ratecap.sql (applied live + saved to repo): REVOKE EXECUTE ... FROM PUBLIC, anon, authenticated; GRANT ... TO service_role on read_email_batch / enqueue_email / delete_email (auth-email pgmq queue holding magic-link/reset tokens) + update_user_plan (had no auth.uid() guard). Root cause was grant drift — a later CREATE OR REPLACE had re-opened EXECUTE to PUBLIC despite an original revoke. Verified live has_function_privilege('authenticated'|'anon',…)=false on all four; spend_generation/toggle_tester_mode correctly left executable (self-auth.uid()-guarded).clawback_credits(p_session_id) RPC (service_role, idempotent on new credit_grants.clawed_back_at, floors balance at 0) + stripe-webhook/index.ts now handles charge.refunded / charge.dispute.created (maps payment_intent → checkout session(s) → clawback). ALSO updated the live Stripe endpoint we_1TpYjMRvzUwDwHkjMj3mofpi enabled_events (was checkout.session.completed only) to add the two events via STRIPE_API_KEY_MAIN — otherwise the handler would never fire (recurring gap).bump_daily_generation(p_user_id, p_cap default 100) (auth.uid-guarded, counts every generation, NEVER refunded) + new daily_gen_counter table; wired into stage-room + edit-room after the spend so the structure-check refund-abuse loop is bounded.supabase/functions/_shared/watermark.ts (burnWatermark) composites the "Virtually Staged" pill into free stagings using ImageScript (deno.land/x/imagescript@1.3.0). Font-free: pill pre-rendered once with Pillow, embedded as base64 overlay PNG, decoded+resized+composited at runtime scaled to client geometry (fontSize=width0.028, pad=0.6fs). Called in stage-room + edit-room when spend.watermark === true. Client double-burn REMOVED from DownloadWithPresets.tsx (always download as-is), Gallery.tsx (dropped burn in processImageForTier + its import), ComplianceKit.tsx (imageToBlob(stagedUrl, cleanAllowed) so free=don't re-burn, paid=add label). Burn unit-tested locally with Deno on a sample image (pill+text composited, rest untouched); tsc --noEmit clean.3769532 (8 files) to AmplifAI-Your-Business/testvirtualrestyle branch relaunch-v2. Staged ONLY the 8 audit-fix files; pre-existing uncommitted 07-07 support-area work left untouched (see Deferred).reference/fable-mode-money-path-audit.md (new checklist item #15 "over-granted infra RPCs leaking auth tokens" + a VR Findings Log entry) and Sondra Brain/wiki/memory/open-questions.md (VR entry, all 5 marked shipped).c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Virtual Restyle\app\supabase\migrations\20260710120000_audit_fixes_lock_infra_rpcs_clawback_ratecap.sql — the whole DB fix (revokes + clawback + daily cap).c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Virtual Restyle\app\supabase\functions\_shared\watermark.ts — server-side watermark util.c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Virtual Restyle\app\supabase\functions\stripe-webhook\index.ts / stage-room\index.ts / edit-room\index.ts — the wired edge functions.c:\Users\srver\AIOS-Workspace\aios-starter-kit\reference\fable-mode-money-path-audit.md — the audit standard (checklist #15 is new; log SHIPPED fixes here).c:\Users\srver\AIOS-Workspace\aios-starter-kit\Sondra Brain\wiki\memory\open-questions.md — VR entry near top with the residual live-mode proofs.relaunch-v2 in PROJECTS\Virtual Restyle\app (committed + pushed; pre-existing uncommitted files remain in working tree — see Deferred)mcp__supabase__execute_sql on uyloerfniphfxjvnuwmn: select proname, has_function_privilege('authenticated', p.oid,'EXECUTE') from pg_proc p join pg_namespace n on n.oid=p.pronamespace where n.nspname='public' and proname in ('update_user_plan','read_email_batch','enqueue_email','delete_email','clawback_credits','bump_daily_generation'); → the first four false, clawback_credits false-for-authenticated, bump_daily_generation true-for-authenticated.curl -sX POST https://uyloerfniphfxjvnuwmn.supabase.co/functions/v1/stripe-webhook → 400 (Missing signature); curl -sX OPTIONS .../stage-room -H "Origin: https://virtualrestyle.com" → 200; same for edit-room → 200 (confirms ImageScript dep loads).curl -s https://api.stripe.com/v1/webhook_endpoints/we_1TpYjMRvzUwDwHkjpjU3bffO — wrong id; correct VR id is we_1TpYjMRvzUwDwHkjMj3mofpi, must list checkout.session.completed,charge.refunded,charge.dispute.created....\scratchpad\burn_test.ts (Deno) against a Pillow-generated sample; re-run only if changing watermark.ts.PROJECTS\Virtual Restyle\app — src/pages/Admin.tsx, supabase/functions/admin/, supabase/migrations/20260707120000_support_tickets.sql, and edits to src/App.tsx / src/pages/Auth.tsx / src/pages/Feedback.tsx / src/pages/Index.tsx. NOT mine; deployed-but-uncommitted. Sondra's call whether to commit them.clawback_credits fire end-to-end (wiring verified, not fire-tested).Virtual Restyle money-path work is complete and committed; nothing pending on it. Next likely action is a fresh, unrelated task (or, if Sondra asks, commit the leftover 07-07 support-area files on relaunch-v2).
Generated for the CEO Dashboard · source: PROJECTS/Virtual Restyle/handoffs/money-path-audit-fixes-2026-07-10.md 🤍