feat: import row validation + KB/process per-item ACLs

Continuing the audit backlog and finishing the permissions UI.

Import validation (recurring audit finding):
- Added importMembersSchema / importPaymentsCsvSchema. importMembers
  and importPaymentsCsv now validate per row (a single bad row no
  longer rejects the whole file), lowercase emails, normalize dates
  through flexibleDateTime(), enforce tier/platform enums and
  positive finite amounts, and return a `skipped` count instead of
  silently dropping invalid rows.

Permissions UI completion:
- OpsAclEditor is now wired into the KB/process viewer modal
  (admin/board), with entity type derived from the `process` tag.
  Per-item Ops access control now covers secrets + KB + processes,
  matching "all ops facilities stuff".

Left as-is with rationale in HANDOFF: /ops + /import denial paths
(unreachable behind the layout gate or already a clear non-leaking
denial); members-row make-area-lead shortcut (Customize -> Area
leads fully covers assignment); types/database.ts + docs regen
(pure hygiene, zero runtime/security impact, still tracked).

271/271 tests pass. Build clean. No migration this pass.

lib/actions/imports.ts

@@ -4,18 +4,9 @@ import { revalidatePath } from 'next/cache'
 import { createClient } from '@/lib/supabase/server'
 import { requireMemberWithRole } from '@/lib/auth-helpers'
 import { ADMIN_ROLES } from '@/lib/permissions'
+import { importMembersSchema } from '@/lib/validations'
 
-export async function importMembers(
-  rows: Array<{
-    display_name: string
-    email: string
-    phone?: string
-    tier?: string
-    joined_at?: string
-    last_paid_at?: string
-    has_card_access?: boolean
-  }>,
-) {
+export async function importMembers(rows: unknown) {
   if (!Array.isArray(rows) || rows.length === 0) {
     return { error: 'No rows to import' }
   }
@@ -25,33 +16,39 @@ export async function importMembers(
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
-  const inserts = rows
-    .filter(r => typeof r.display_name === 'string' && typeof r.email === 'string')
-    .map(r => ({
+  // Validate per row so one bad row does not reject the whole file; the
+  // schema lowercases email and normalizes dates via flexibleDateTime.
+  const rowSchema = importMembersSchema.element
+  const valid: Array<Record<string, unknown>> = []
+  let skipped = 0
+  for (const raw of rows) {
+    const r = rowSchema.safeParse(raw)
+    if (!r.success) { skipped++; continue }
+    valid.push({
       space_id: member.space_id,
-      display_name: r.display_name,
-      email: r.email,
-      phone: r.phone ?? null,
-      tier: r.tier ?? 'basic',
+      display_name: r.data.display_name,
+      email: r.data.email,
+      phone: r.data.phone ?? null,
+      tier: r.data.tier ?? 'basic',
       role: 'member',
       status: 'current',
       approved: true,
-      joined_at: r.joined_at ?? new Date().toISOString(),
-      last_paid_at: r.last_paid_at ?? null,
-      has_card_access: r.has_card_access ?? false,
-    }))
+      joined_at: r.data.joined_at ?? new Date().toISOString(),
+      last_paid_at: r.data.last_paid_at ?? null,
+      has_card_access: r.data.has_card_access ?? false,
+    })
+  }
 
-  if (inserts.length === 0) {
-    return { error: 'No valid rows to import' }
+  if (valid.length === 0) {
+    return { error: `No valid rows to import (${skipped} skipped: bad email, name, tier, or date).` }
   }
 
-  // Upsert by (space_id, email) to dedupe re-imports.
   const { data, error } = await supabase
     .from('space_members')
-    .upsert(inserts, { onConflict: 'space_id,email', ignoreDuplicates: false })
+    .upsert(valid, { onConflict: 'space_id,email', ignoreDuplicates: false })
     .select()
 
   if (error) return { error: error.message }
   revalidatePath('/members')
-  return { data, count: data.length }
+  return { data, count: data.length, skipped }
 }

lib/actions/payments.ts

@@ -11,6 +11,7 @@ import { TREASURER_ROLES } from '@/lib/permissions'
 import {
   logCashPaymentSchema,
   linkPaymentSchema,
+  importPaymentsCsvSchema,
 } from '@/lib/validations'
 import type { Enums } from '@/types/database'
 
@@ -114,36 +115,38 @@ export async function linkPaymentToMember(paymentId: string, memberId: string) {
   return { success: true as const }
 }
 
-export async function importPaymentsCsv(
-  rows: Array<{
-    platform: string
-    amount: number
-    from_identifier: string
-    from_note?: string
-    transaction_date: string
-  }>,
-) {
+export async function importPaymentsCsv(rows: unknown) {
+  if (!Array.isArray(rows) || rows.length === 0) {
+    return { error: 'No rows to import' }
+  }
+
   const supabase = await createClient()
   const auth = await requireMemberWithRole(supabase, TREASURER_ROLES, 'Treasurer access required')
   if (!auth.ok) return { error: auth.error }
   const { member } = auth
 
-  const validPlatforms: PaymentPlatform[] = ['paypal', 'zeffy', 'venmo', 'cash']
-
-  const inserts = rows
-    .filter(r => validPlatforms.includes(r.platform as PaymentPlatform))
-    .map(r => ({
+  // Per-row validation: platform enum, positive finite amount, normalized
+  // transaction_date. Invalid rows are skipped and counted, not silently
+  // dropped without feedback.
+  const rowSchema = importPaymentsCsvSchema.element
+  const inserts: Array<Record<string, unknown>> = []
+  let skipped = 0
+  for (const raw of rows) {
+    const r = rowSchema.safeParse(raw)
+    if (!r.success) { skipped++; continue }
+    inserts.push({
       space_id: member.space_id,
-      platform: r.platform as PaymentPlatform,
-      amount: r.amount,
-      from_identifier: r.from_identifier,
-      from_note: r.from_note ?? null,
+      platform: r.data.platform as PaymentPlatform,
+      amount: r.data.amount,
+      from_identifier: r.data.from_identifier,
+      from_note: r.data.from_note ?? null,
       link_status: 'unlinked' as const,
-      transaction_date: r.transaction_date,
-    }))
+      transaction_date: r.data.transaction_date ?? new Date().toISOString(),
+    })
+  }
 
   if (inserts.length === 0) {
-    return { error: 'No valid rows to import' }
+    return { error: `No valid rows to import (${skipped} skipped: bad platform, amount, or date).` }
   }
 
   const { data, error } = await supabase.from('payments').insert(inserts).select()
@@ -151,5 +154,5 @@ export async function importPaymentsCsv(
 
   revalidatePath('/payments')
   revalidatePath('/dashboard')
-  return { data, count: data.length }
+  return { data, count: data.length, skipped }
 }

lib/validations.ts

@@ -522,6 +522,32 @@ export const assignAreaLeadSchema = z.object({
   member_id: z.string().uuid('Invalid member ID'),
 })
 
+// ─── Bulk import ─────────────────────────────────────────────────────────────
+
+const importEmail = z.string().email('Invalid email').max(200).transform(s => s.trim().toLowerCase())
+
+export const importMembersSchema = z.array(
+  z.object({
+    display_name: z.string().min(1, 'Name required').max(100),
+    email: importEmail,
+    phone: z.string().max(20).optional().nullable(),
+    tier: z.enum(['plus', 'basic', 'associate']).optional(),
+    joined_at: flexibleDateTime().optional(),
+    last_paid_at: flexibleDateTime().optional(),
+    has_card_access: z.boolean().optional(),
+  }),
+).max(5000)
+
+export const importPaymentsCsvSchema = z.array(
+  z.object({
+    platform: z.enum(['paypal', 'zeffy', 'venmo', 'cash']),
+    amount: z.number().finite().positive('Amount must be positive').max(10_000_000),
+    from_identifier: z.string().min(1, 'Payer required').max(200),
+    from_note: z.string().max(500).optional().nullable(),
+    transaction_date: flexibleDateTime().optional(),
+  }),
+).max(10000)
+
 // ─── Generic ID schemas ──────────────────────────────────────────────────────
 
 export const uuidSchema = z.string().uuid('Invalid ID format')