From ab7735d6fc9d5abc5213792badbf0eda6534575d Mon Sep 17 00:00:00 2001
From: bot-hermes <bot-hermes@buzzbee.dev>
Date: Thu, 6 Aug 2026 13:56:22 +0000
Subject: [PATCH 1/2] fix(graph): filter soft-deleted projects in getGraphData

projectIds query omitted isNull(projects.deletedAt), unlike the sibling
projectRows query, so sections of soft-deleted projects were loaded as
orphan nodes via inArray(sections.projectId, projectIds).
---
 apps/web/lib/graph-service.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/web/lib/graph-service.ts b/apps/web/lib/graph-service.ts
index dac144a..648f010 100644
--- a/apps/web/lib/graph-service.ts
+++ b/apps/web/lib/graph-service.ts
@@ -60,7 +60,7 @@ export async function getGraphData(domainId: string): Promise<GraphData> {
   }
 
   // Fetch all entities in this domain
-  const projectIds = (await db.select({ id: projects.id }).from(projects).where(eq(projects.domainId, domainId))).map(p => p.id);
+  const projectIds = (await db.select({ id: projects.id }).from(projects).where(and(eq(projects.domainId, domainId), isNull(projects.deletedAt)))).map(p => p.id);
   const [noteRows, taskRows, habitRows, projectRows, sectionRows, tagRows, domainRows] = await Promise.all([
     db.select({ id: notes.id, title: notes.title }).from(notes).where(and(eq(notes.domainId, domainId), isNull(notes.deletedAt))),
     db.select({ id: tasks.id, title: tasks.title, projectId: tasks.projectId }).from(tasks).where(and(eq(tasks.domainId, domainId), isNull(tasks.deletedAt))),

From ca7a0d7ff780628fe852867e36482916be416809 Mon Sep 17 00:00:00 2001
From: bot-hermes <bot-hermes@buzzbee.dev>
Date: Thu, 6 Aug 2026 13:56:29 +0000
Subject: [PATCH 2/2] fix(reports): honor passed token in report-service
 generate* helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The generateWeeklySummary/generateProjectHealth/generateHabitAnalysis/
generateTimeAudit helpers all had "const pb = token ? createAdminClient()
: createAdminClient();" — both branches return the admin client, so a
passed user token was silently discarded and every caller got admin-level
access. Use createPocketBaseClient(token) when a token is provided,
matching the sibling project-service.ts / note-service.ts pattern.
---
 apps/web/lib/services/report-service.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/apps/web/lib/services/report-service.ts b/apps/web/lib/services/report-service.ts
index 807044f..14be7d4 100644
--- a/apps/web/lib/services/report-service.ts
+++ b/apps/web/lib/services/report-service.ts
@@ -1,4 +1,4 @@
-import { createAdminClient } from '../pocketbase';
+import { createAdminClient, createPocketBaseClient } from '../pocketbase';
 import type {
   Task,
   Habit,
@@ -46,7 +46,7 @@ export async function generateWeeklySummary(
   streaks: Array<{ name: string; streak: number }>;
   byDomain: Record<string, { tasks: number; habits: number }>;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   // Tasks completed this week
   const taskResults = await pb.collection('tasks').getFullList({
@@ -112,7 +112,7 @@ export async function generateProjectHealth(
   milestoneStatus: Record<string, number>;
   completionRate: number;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const taskResults = await pb.collection('tasks').getFullList({
     filter: `project_id = "${projectId}"`,
@@ -169,7 +169,7 @@ export async function generateHabitAnalysis(
   }>;
   atRiskHabits: string[];
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const startDate = new Date();
   startDate.setDate(startDate.getDate() - days);
@@ -225,7 +225,7 @@ export async function generateTimeAudit(
   byProject: Record<string, number>;
   byTag: Record<string, number>;
 }> {
-  const pb = token ? createAdminClient() : createAdminClient();
+  const pb = token ? createPocketBaseClient(token) : createAdminClient();
 
   const entryResults = await pb.collection('time_entries').getFullList({
     filter: `started_at >= "${startDate}" && started_at <= "${endDate}"`,