security hardening

services/staffNotifications.js

@@ -11,6 +11,7 @@
 const { mongoose } = require('../db-connection');
 const { CONFIG, parseThresholdString } = require('../config');
 const { increment } = require('./patternStore');
+const { enqueueSend } = require('./channelQueue');
 
 const Ticket = mongoose.model('Ticket');
 const StaffNotification = mongoose.model('StaffNotification');
@@ -39,7 +40,8 @@ async function notifyStaffOfReply(guild, ticket, message) {
 
   const jumpLink = `https://discord.com/channels/${guild.id}/${message.channel.id}/${message.id}`;
   const snippet = message.content?.slice(0, 300) || '(no text)';
-  await notifChannel.send(
+  await enqueueSend(
+    notifChannel,
     `New reply in **${message.channel.name}** from ${message.author.tag}:\n> ${snippet}\n[Jump to message](${jumpLink})`
   );
 
@@ -82,7 +84,7 @@ async function notifyAllStaffUnclaimed(client) {
   for (const ticket of unclaimedTickets) {
     const ageMs = now - new Date(ticket.createdAt).getTime();
     const ageHours = ageMs / (60 * 60 * 1000);
-    const alreadySent = ticket.unclaimedReminderssent || [];
+    const alreadySent = ticket.unclaimedRemindersSent || [];
 
     // Find thresholds crossed but not yet sent
     const crossedNew = sorted.filter(t => ageHours >= t && !alreadySent.includes(t));
@@ -100,7 +102,7 @@ async function notifyAllStaffUnclaimed(client) {
     for (const rec of staffRecords) {
       const chan = await guild.channels.fetch(rec.channelId).catch(() => null);
       if (chan) {
-        await chan.send(alertMsg).catch(e => console.error('Unclaimed notify send:', e));
+        await enqueueSend(chan, alertMsg).catch(e => console.error('Unclaimed notify send:', e));
         increment('staff_stale_pings', rec.userId, 'today');
         increment('staff_stale_pings', rec.userId, 'week');
       }
@@ -108,7 +110,7 @@ async function notifyAllStaffUnclaimed(client) {
 
     await Ticket.updateOne(
       { gmailThreadId: ticket.gmailThreadId },
-      { $addToSet: { unclaimedReminderssent: highest } }
+      { $addToSet: { unclaimedRemindersSent: highest } }
     );
   }
 }