Fix revenue dashboard: tenant data leak, DB connection, money precision and timezone-aware months

[krowslyare]

Summary

The dashboard never reached the database (every request fell back to tenant-agnostic
mock data) and the Redis cache key ignored the tenant. Together this caused Sunset's
wrong March totals and Ocean seeing another company's numbers. One commit per bug.

Bugs fixed

#	Symptom	Root cause	Fix
1	All figures were mock values	DB pool misconfigured (undefined settings, sync pool on async engine, missing greenlet)	Fixed pool, initialized once at startup
2	Fake totals, incl. other tenants'	Silent fallback to a mock table keyed only by property	503 instead of fake data
3	Ocean "sometimes" saw Sunset's revenue	Cache key revenue:{property_id}; IDs repeat across tenants	Key scoped by tenant and period
4	Any tenant could read any property	No ownership check	Same 404 for foreign/unknown properties
5	Unknown users mapped to tenant-a	Default tenant fallback	Tenant from verified token, else 403
6	Totals "off by a few cents"	float in API + second rounding in browser	Decimal end-to-end, rounded once (half-up), string in API
7	March totals didn't match	Month bounds in UTC; a Paris check-in on 1 Mar 00:30 counted in Feb	Month filter in the property's timezone (2250.00/4 vs 1000.00/3)
8	Each client saw the other's property names	Hardcoded property list	Tenant-scoped /dashboard/properties; removed fake "12%" badge and unused header
9	"Monthly" dashboard had no month picker	—	Month selector + error/empty states

Testing

• Reproduced each symptom as both clients and checked against SQL ground truth.
• After the fix: curl checks per tenant (totals, 404/422/503), UI checked as both clients.
• Unit tests for rounding and timezone month bounds:
  cd backend && uv run --no-project --with pytest pytest -q -p no:cacheprovider
• Prettier skipped on touched frontend files (no repo config; it would rewrite whole files).
  Remaining lint errors already exist on main.

Out of scope (found, not fixed)

Hardcoded SECRET_KEY, candidate@ login without password check, RLS without
policies, frontend session lost on reload.

How I used AI

Claude Code explored the code, reproduced bugs, implemented each fix and ran adversarial
reviews. I directed the plan, made the key decisions (money as decimal string, 404 vs 403,
month selector) and verified each fix with SQL, curl and the UI.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sentry]

Bug: String replacement in database_pool.py fails to handle postgres:// URLs, causing async engine creation to fail and permanently disabling the database session factory.
_{Severity: MEDIUM}

Suggested Fix

Normalize database URLs using URL parsing (e.g. urllib.parse or sqlalchemy.engine.make_url) or handle prefixes like postgres:// and postgresql:// explicitly before passing the URL with dialect postgresql+asyncpg:// to create_async_engine.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: backend/app/core/database_pool.py#L17-L19

Potential issue: Database pool initialization relies on replacing `postgresql://` with
`postgresql+asyncpg://`. If `settings.database_url` uses the legacy `postgres://`
dialect prefix or an empty/malformed URL, the string replacement does not occur, leaving
the URI unchanged. Passing an unsupported scheme to `create_async_engine()` raises an
exception that is swallowed by a generic catch block, leaving `session_factory` as
`None` for the application lifecycle and causing subsequent database-dependent requests
to fail with 503 errors.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[krowslyare]

Good catch, fixed in 80e26e2: the URL is now parsed with make_url and the asyncpg driver is set explicitly, so postgres://, postgresql:// and postgresql+psycopg2:// all work.